codex - 💡(How to fix) Fix Windows elevated sandbox fails with “spawn setup refresh” after Codex CLI update; unelevated sandbox works

codex2026-05-22 16:26:15

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

Error Message

return a clear actionable setup/configuration error explaining what Windows setting or permission needs to be repaired.

Root Cause

This appears specific to elevated Windows sandbox execution, not the project workspace, because I reproduced it from a clean scratch directory outside my project.

Fix Action

Fix / Workaround

Current workaround: codex -c windows.sandbox="unelevated" --sandbox workspace-write --ask-for-approval untrusted

I have not used dangerous/no-sandbox mode. I have not changed global Codex config. I am avoiding broad changes and only using the unelevated workaround temporarily for narrow, explicitly authorized tasks.

Code Example

{
  "schemaVersion": 1,
  "generatedAt": "1779466710s since unix epoch",
  "overallStatus": "ok",
  "codexVersion": "0.133.0",
  "checks": {
    "app_server.status": {
      "id": "app_server.status",
      "category": "app-server",
      "status": "ok",
      "summary": "background server is not running",
      "details": {
        "control socket": "C:\\Users\\<USERNAME>\\.codex\\app-server-control\\app-server-control.sock",
        "daemon state dir": "C:\\Users\\<USERNAME>\\.codex\\app-server-daemon",
        "mode": "ephemeral",
        "pid file": "C:\\Users\\<USERNAME>\\.codex\\app-server-daemon\\app-server.pid (missing)",
        "settings": "C:\\Users\\<USERNAME>\\.codex\\app-server-daemon\\settings.json (missing)",
        "status": "not running",
        "update-loop pid file": "C:\\Users\\<USERNAME>\\.codex\\app-server-daemon\\app-server-updater.pid (missing)"
      },
      "remediation": null,
      "durationMs": 0
    },
    "auth.credentials": {
      "id": "auth.credentials",
      "category": "auth",
      "status": "ok",
      "summary": "auth is configured",
      "details": {
        "auth file": "C:\\Users\\<USERNAME>\\.codex\\auth.json",
        "auth storage mode": "File",
        "stored API key": "false",
        "stored ChatGPT tokens": "true",
        "stored agent identity": "false",
        "stored auth mode": "chatgpt"
      },
      "remediation": null,
      "durationMs": 0
    },
    "config.load": {
      "id": "config.load",
      "category": "config",
      "status": "ok",
      "summary": "config loaded",
      "details": {
        "CODEX_HOME": "C:\\Users\\<USERNAME>\\.codex",
        "config.toml": "C:\\Users\\<USERNAME>\\.codex\\config.toml",
        "config.toml parse": "ok",
        "cwd": "C:\\Users\\<USERNAME>",
        "enabled feature flags": "shell_tool, shell_snapshot, terminal_resize_reflow, sqlite, hooks, enable_request_compression, multi_agent, apps, tool_suggest, plugins, plugin_hooks, in_app_browser, browser_use, browser_use_external, computer_use, plugin_sharing, image_generation, skill_mcp_dependency_install, steer, guardian_approval, goals, collaboration_modes, tool_call_mcp_elicitation, personality, fast_mode, tui_app_server, workspace_dependencies",
        "feature flag overrides": "none",
        "feature flags enabled": "27",
        "log dir": "C:\\Users\\<USERNAME>\\.codex\\log",
        "mcp servers": "0",
        "model": "gpt-5.4",
        "model provider": "openai",
        "sqlite home": "C:\\Users\\<USERNAME>\\.codex"
      },
      "remediation": null,
      "durationMs": 0
    },
    "installation": {
      "id": "installation",
      "category": "install",
      "status": "ok",
      "summary": "installation looks consistent",
      "details": {
        "PATH codex #1": "C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\codex",
        "PATH codex #2": "C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\codex.cmd",
        "PATH codex entries": "2",
        "current executable": "C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\bin\\codex.exe",
        "install context": "npm (package C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc, bin C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\bin, resources C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex-resources, path C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex-path)",
        "managed by bun": "false",
        "managed by npm": "true",
        "managed package root": "C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex",
        "npm update target": "C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex"
      },
      "remediation": null,
      "durationMs": 196
    },
    "mcp.config": {
      "id": "mcp.config",
      "category": "mcp",
      "status": "ok",
      "summary": "no MCP servers configured",
      "details": {},
      "remediation": null,
      "durationMs": 0
    },
    "network.env": {
      "id": "network.env",
      "category": "network",
      "status": "ok",
      "summary": "network-related environment looks readable",
      "details": {
        "proxy env vars": "none"
      },
      "remediation": null,
      "durationMs": 0
    },
    "network.provider_reachability": {
      "id": "network.provider_reachability",
      "category": "reachability",
      "status": "ok",
      "summary": "active provider endpoints are reachable over HTTP",
      "details": {
        "ChatGPT base URL": "https://chatgpt.com/backend-api/ reachable (HTTP 403)",
        "reachability mode": "ChatGPT auth"
      },
      "remediation": null,
      "durationMs": 107
    },
    "network.websocket_reachability": {
      "id": "network.websocket_reachability",
      "category": "websocket",
      "status": "ok",
      "summary": "Responses WebSocket handshake succeeded",
      "details": {
        "DNS": "2 IPv4, 2 IPv6, first IPv6",
        "auth mode": "chatgpt",
        "connect timeout": "15000 ms",
        "endpoint": "wss://chatgpt.com/backend-api/<redacted>",
        "handshake result": "HTTP 101 Switching Protocols",
        "model provider": "openai",
        "models etag present": "true",
        "provider name": "OpenAI",
        "proxy env vars": "none",
        "reasoning header": "false",
        "server model present": "false",
        "supports websockets": "true",
        "wire API": "responses"
      },
      "remediation": null,
      "durationMs": 914
    },
    "runtime.provenance": {
      "id": "runtime.provenance",
      "category": "runtime",
      "status": "ok",
      "summary": "running npm on windows-x86_64",
      "details": {
        "commit": "unknown",
        "current executable": "C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\bin\\codex.exe",
        "install method": "npm (package C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc, bin C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\bin, resources C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex-resources, path C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex-path)",
        "platform": "windows-x86_64",
        "version": "0.133.0"
      },
      "remediation": null,
      "durationMs": 0
    },
    "runtime.search": {
      "id": "runtime.search",
      "category": "search",
      "status": "ok",
      "summary": "search is OK (bundled)",
      "details": {
        "search command": "C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex-path\\rg.exe",
        "search command readiness": "file exists",
        "search provider": "bundled"
      },
      "remediation": null,
      "durationMs": 0
    },
    "sandbox.helpers": {
      "id": "sandbox.helpers",
      "category": "sandbox",
      "status": "ok",
      "summary": "sandbox configuration is readable",
      "details": {
        "approval policy": "OnRequest",
        "codex-linux-sandbox helper": "none",
        "execve wrapper helper": "none",
        "filesystem sandbox": "restricted",
        "network sandbox": "restricted"
      },
      "remediation": null,
      "durationMs": 0
    },
    "state.paths": {
      "id": "state.paths",
      "category": "state",
      "status": "ok",
      "summary": "state paths and databases are inspectable",
      "details": {
        "CODEX_HOME": "C:\\Users\\<USERNAME>\\.codex (dir)",
        "active rollout files": "305 files, 43287081 total bytes, 141924 average bytes",
        "archived rollout files": "0 files, 0 total bytes, 0 average bytes",
        "goals DB": "C:\\Users\\<USERNAME>\\.codex\\goals_1.sqlite (file)",
        "goals DB integrity": "ok",
        "log DB": "C:\\Users\\<USERNAME>\\.codex\\logs_2.sqlite (file)",
        "log DB integrity": "ok",
        "log dir": "C:\\Users\\<USERNAME>\\.codex\\log (dir)",
        "sqlite home": "C:\\Users\\<USERNAME>\\.codex (dir)",
        "state DB": "C:\\Users\\<USERNAME>\\.codex\\state_5.sqlite (file)",
        "state DB integrity": "ok"
      },
      "remediation": null,
      "durationMs": 5751
    },
    "terminal.env": {
      "id": "terminal.env",
      "category": "terminal",
      "status": "ok",
      "summary": "terminal metadata was detected",
      "details": {
        "color output": "enabled",
        "stderr is terminal": "true",
        "stdin is terminal": "true",
        "stdout is terminal": "true",
        "terminal": "unknown",
        "terminal size": "120x30"
      },
      "remediation": null,
      "durationMs": 0
    },
    "updates.status": {
      "id": "updates.status",
      "category": "updates",
      "status": "ok",
      "summary": "update configuration is locally consistent",
      "details": {
        "cached latest version": "0.133.0",
        "check for update on startup": "true",
        "last checked at": "2026-05-22T01:37:07.004640500Z",
        "latest version": "0.133.0",
        "latest version status": "current version is not older",
        "npm update target": "C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex",
        "update action": "npm install -g @openai/codex",
        "version cache": "C:\\Users\\<USERNAME>\\.codex\\version.json"
      },
      "remediation": null,
      "durationMs": 765
    }
  }
}

RAW_BUFFERClick to expand / collapse

What version of Codex CLI is running?

codex -- version 0.133.0

What subscription do you have?

ChatGPT Plus account using Codex CLI

Which model were you using?

gpt-5.4

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What terminal emulator and version are you using (if applicable)?

Windows PowerShell launched from taskbar shortcut. No terminal multiplexer in use.

Codex doctor report

{
  "schemaVersion": 1,
  "generatedAt": "1779466710s since unix epoch",
  "overallStatus": "ok",
  "codexVersion": "0.133.0",
  "checks": {
    "app_server.status": {
      "id": "app_server.status",
      "category": "app-server",
      "status": "ok",
      "summary": "background server is not running",
      "details": {
        "control socket": "C:\\Users\\<USERNAME>\\.codex\\app-server-control\\app-server-control.sock",
        "daemon state dir": "C:\\Users\\<USERNAME>\\.codex\\app-server-daemon",
        "mode": "ephemeral",
        "pid file": "C:\\Users\\<USERNAME>\\.codex\\app-server-daemon\\app-server.pid (missing)",
        "settings": "C:\\Users\\<USERNAME>\\.codex\\app-server-daemon\\settings.json (missing)",
        "status": "not running",
        "update-loop pid file": "C:\\Users\\<USERNAME>\\.codex\\app-server-daemon\\app-server-updater.pid (missing)"
      },
      "remediation": null,
      "durationMs": 0
    },
    "auth.credentials": {
      "id": "auth.credentials",
      "category": "auth",
      "status": "ok",
      "summary": "auth is configured",
      "details": {
        "auth file": "C:\\Users\\<USERNAME>\\.codex\\auth.json",
        "auth storage mode": "File",
        "stored API key": "false",
        "stored ChatGPT tokens": "true",
        "stored agent identity": "false",
        "stored auth mode": "chatgpt"
      },
      "remediation": null,
      "durationMs": 0
    },
    "config.load": {
      "id": "config.load",
      "category": "config",
      "status": "ok",
      "summary": "config loaded",
      "details": {
        "CODEX_HOME": "C:\\Users\\<USERNAME>\\.codex",
        "config.toml": "C:\\Users\\<USERNAME>\\.codex\\config.toml",
        "config.toml parse": "ok",
        "cwd": "C:\\Users\\<USERNAME>",
        "enabled feature flags": "shell_tool, shell_snapshot, terminal_resize_reflow, sqlite, hooks, enable_request_compression, multi_agent, apps, tool_suggest, plugins, plugin_hooks, in_app_browser, browser_use, browser_use_external, computer_use, plugin_sharing, image_generation, skill_mcp_dependency_install, steer, guardian_approval, goals, collaboration_modes, tool_call_mcp_elicitation, personality, fast_mode, tui_app_server, workspace_dependencies",
        "feature flag overrides": "none",
        "feature flags enabled": "27",
        "log dir": "C:\\Users\\<USERNAME>\\.codex\\log",
        "mcp servers": "0",
        "model": "gpt-5.4",
        "model provider": "openai",
        "sqlite home": "C:\\Users\\<USERNAME>\\.codex"
      },
      "remediation": null,
      "durationMs": 0
    },
    "installation": {
      "id": "installation",
      "category": "install",
      "status": "ok",
      "summary": "installation looks consistent",
      "details": {
        "PATH codex #1": "C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\codex",
        "PATH codex #2": "C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\codex.cmd",
        "PATH codex entries": "2",
        "current executable": "C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\bin\\codex.exe",
        "install context": "npm (package C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc, bin C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\bin, resources C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex-resources, path C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex-path)",
        "managed by bun": "false",
        "managed by npm": "true",
        "managed package root": "C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex",
        "npm update target": "C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex"
      },
      "remediation": null,
      "durationMs": 196
    },
    "mcp.config": {
      "id": "mcp.config",
      "category": "mcp",
      "status": "ok",
      "summary": "no MCP servers configured",
      "details": {},
      "remediation": null,
      "durationMs": 0
    },
    "network.env": {
      "id": "network.env",
      "category": "network",
      "status": "ok",
      "summary": "network-related environment looks readable",
      "details": {
        "proxy env vars": "none"
      },
      "remediation": null,
      "durationMs": 0
    },
    "network.provider_reachability": {
      "id": "network.provider_reachability",
      "category": "reachability",
      "status": "ok",
      "summary": "active provider endpoints are reachable over HTTP",
      "details": {
        "ChatGPT base URL": "https://chatgpt.com/backend-api/ reachable (HTTP 403)",
        "reachability mode": "ChatGPT auth"
      },
      "remediation": null,
      "durationMs": 107
    },
    "network.websocket_reachability": {
      "id": "network.websocket_reachability",
      "category": "websocket",
      "status": "ok",
      "summary": "Responses WebSocket handshake succeeded",
      "details": {
        "DNS": "2 IPv4, 2 IPv6, first IPv6",
        "auth mode": "chatgpt",
        "connect timeout": "15000 ms",
        "endpoint": "wss://chatgpt.com/backend-api/<redacted>",
        "handshake result": "HTTP 101 Switching Protocols",
        "model provider": "openai",
        "models etag present": "true",
        "provider name": "OpenAI",
        "proxy env vars": "none",
        "reasoning header": "false",
        "server model present": "false",
        "supports websockets": "true",
        "wire API": "responses"
      },
      "remediation": null,
      "durationMs": 914
    },
    "runtime.provenance": {
      "id": "runtime.provenance",
      "category": "runtime",
      "status": "ok",
      "summary": "running npm on windows-x86_64",
      "details": {
        "commit": "unknown",
        "current executable": "C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\bin\\codex.exe",
        "install method": "npm (package C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc, bin C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\bin, resources C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex-resources, path C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex-path)",
        "platform": "windows-x86_64",
        "version": "0.133.0"
      },
      "remediation": null,
      "durationMs": 0
    },
    "runtime.search": {
      "id": "runtime.search",
      "category": "search",
      "status": "ok",
      "summary": "search is OK (bundled)",
      "details": {
        "search command": "C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex-path\\rg.exe",
        "search command readiness": "file exists",
        "search provider": "bundled"
      },
      "remediation": null,
      "durationMs": 0
    },
    "sandbox.helpers": {
      "id": "sandbox.helpers",
      "category": "sandbox",
      "status": "ok",
      "summary": "sandbox configuration is readable",
      "details": {
        "approval policy": "OnRequest",
        "codex-linux-sandbox helper": "none",
        "execve wrapper helper": "none",
        "filesystem sandbox": "restricted",
        "network sandbox": "restricted"
      },
      "remediation": null,
      "durationMs": 0
    },
    "state.paths": {
      "id": "state.paths",
      "category": "state",
      "status": "ok",
      "summary": "state paths and databases are inspectable",
      "details": {
        "CODEX_HOME": "C:\\Users\\<USERNAME>\\.codex (dir)",
        "active rollout files": "305 files, 43287081 total bytes, 141924 average bytes",
        "archived rollout files": "0 files, 0 total bytes, 0 average bytes",
        "goals DB": "C:\\Users\\<USERNAME>\\.codex\\goals_1.sqlite (file)",
        "goals DB integrity": "ok",
        "log DB": "C:\\Users\\<USERNAME>\\.codex\\logs_2.sqlite (file)",
        "log DB integrity": "ok",
        "log dir": "C:\\Users\\<USERNAME>\\.codex\\log (dir)",
        "sqlite home": "C:\\Users\\<USERNAME>\\.codex (dir)",
        "state DB": "C:\\Users\\<USERNAME>\\.codex\\state_5.sqlite (file)",
        "state DB integrity": "ok"
      },
      "remediation": null,
      "durationMs": 5751
    },
    "terminal.env": {
      "id": "terminal.env",
      "category": "terminal",
      "status": "ok",
      "summary": "terminal metadata was detected",
      "details": {
        "color output": "enabled",
        "stderr is terminal": "true",
        "stdin is terminal": "true",
        "stdout is terminal": "true",
        "terminal": "unknown",
        "terminal size": "120x30"
      },
      "remediation": null,
      "durationMs": 0
    },
    "updates.status": {
      "id": "updates.status",
      "category": "updates",
      "status": "ok",
      "summary": "update configuration is locally consistent",
      "details": {
        "cached latest version": "0.133.0",
        "check for update on startup": "true",
        "last checked at": "2026-05-22T01:37:07.004640500Z",
        "latest version": "0.133.0",
        "latest version status": "current version is not older",
        "npm update target": "C:\\Users\\<USERNAME>\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex",
        "update action": "npm install -g @openai/codex",
        "version cache": "C:\\Users\\<USERNAME>\\.codex\\version.json"
      },
      "remediation": null,
      "durationMs": 765
    }
  }
}

What issue are you seeing?

After accepting a Codex CLI update, the Windows elevated sandbox consistently fails before executing even a basic command.

The failure is:

windows sandbox failed: spawn setup refresh

This happens with Codex CLI 0.133.0 on Windows when running the elevated Windows sandbox. The same command using the unelevated Windows sandbox succeeds.

Codex doctor reports overallStatus: ok, including sandbox.helpers: ok and updates.status: current/latest version 0.133.0, so the installation and configuration appear healthy, but the elevated sandbox runtime path still fails.

This appears specific to elevated Windows sandbox execution, not the project workspace, because I reproduced it from a clean scratch directory outside my project.

What steps can reproduce the bug?

Open Windows PowerShell.
Create and enter a clean scratch directory outside any project workspace:

New-Item -ItemType Directory -Force D:\Codex_Sandbox_Diag | Out-Null Set-Location D:\Codex_Sandbox_Diag Get-Location

Confirm Codex is installed and check versions:

where.exe codex codex --version npm view @openai/codex version

Observed output:

C:\Users<USERNAME>\AppData\Roaming\npm\codex C:\Users<USERNAME>\AppData\Roaming\npm\codex.cmd

codex-cli 0.133.0

0.133.0

Run a basic command through the elevated Windows sandbox:

codex -c windows.sandbox="elevated" sandbox windows cmd /c echo CODEX_ELEVATED_SANDBOX_TEST_OK

Observed output:

windows sandbox failed: spawn setup refresh

Run the same basic command through the unelevated Windows sandbox:

codex -c windows.sandbox="unelevated" sandbox windows cmd /c echo CODEX_UNELEVATED_SANDBOX_TEST_OK

Observed output:

CODEX_UNELEVATED_SANDBOX_TEST_OK

Optional sanity check: run Codex doctor:

codex doctor --json

Observed summary:

overallStatus: ok
codexVersion: 0.133.0
sandbox.helpers: ok
updates.status: latest version 0.133.0 / current version is not older

Result: The elevated Windows sandbox fails before executing the command, while the unelevated Windows sandbox succeeds from the same clean scratch directory.

What is the expected behavior?

The elevated Windows sandbox should successfully execute the basic command and print:

CODEX_ELEVATED_SANDBOX_TEST_OK

Because the same command works in unelevated mode, I would expect elevated mode to either:

run the command successfully, or
return a clear actionable setup/configuration error explaining what Windows setting or permission needs to be repaired.

Instead, elevated mode fails before the command executes with:

windows sandbox failed: spawn setup refresh

Expected elevated command:

codex -c windows.sandbox="elevated" sandbox windows cmd /c echo CODEX_ELEVATED_SANDBOX_TEST_OK

Expected output:

CODEX_ELEVATED_SANDBOX_TEST_OK

Additional information

Additional notes:

This began after I accepted a Codex CLI update. I do not know whether the update caused the issue, but the timing is why I am reporting it as a possible regression.

The issue persists today with Codex CLI 0.133.0, which appears to be the latest available npm version.

Codex doctor reports overallStatus: ok. Relevant doctor checks include:

codexVersion: 0.133.0
config.load: ok
installation: ok
auth.credentials: ok
sandbox.helpers: ok
updates.status: ok / latest version 0.133.0 / current version is not older

The failure appears specific to elevated Windows sandbox execution:

Elevated sandbox fails in both my project workspace and a clean scratch directory.
Unelevated sandbox succeeds in both my project workspace and a clean scratch directory.
PowerShell and cmd both failed under elevated sandbox during earlier troubleshooting.
This does not appear to be caused by the project repo path.

Current workaround: codex -c windows.sandbox="unelevated" --sandbox workspace-write --ask-for-approval untrusted

Platform: Microsoft Windows NT 10.0.26200.0 x64

Terminal: Windows PowerShell launched from taskbar shortcut. No terminal multiplexer in use.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Data

Security

Network

Code

UI/UX

Text

System

Multimedia

Protocol

API

Engineering

codex - 💡(How to fix) Fix Windows elevated sandbox fails with “spawn setup refresh” after Codex CLI update; unelevated sandbox works

Recommended Tools

GitHub issue graph ai analysis

Error Message

Root Cause

Fix Action

Fix / Workaround

Code Example

What version of Codex CLI is running?

What subscription do you have?

Which model were you using?

What platform is your computer?

What terminal emulator and version are you using (if applicable)?

Codex doctor report

What issue are you seeing?

What steps can reproduce the bug?

What is the expected behavior?

Additional information

Still need to ship something?

TRENDING