codex - 💡(How to fix) Fix Windows sandbox initialization fails with "setup refresh failed with status exit code: 1"

Bug Description Codex desktop app on Windows fails to initialize the sandbox component, causing intermittent command execution failures. The error message is:

windows sandbox: setup refresh failed with status exit code: 1 Steps to Reproduce

Open Codex desktop app on Windows Try to execute any shell command or use the js_repl tool Observe that commands fail with the sandbox initialization error Occasionally commands succeed, but failure rate is very high (~80-90%) Expected Behavior Shell commands and js_repl should execute reliably without sandbox initialization failures.

Actual Behavior

Shell commands fail with: Io(Custom { kind: Other, error: "windows sandbox: setup refresh failed with status exit code: 1" }) js_repl fails with: node_repl kernel exited unexpectedly ... windows sandbox failed: setup refresh failed with status exit code: 1 The error is intermittent - sometimes commands succeed, but most fail Environment

OS: Windows (Chinese edition) Codex Desktop App (latest version) Node.js installed at: D:\nodejs npm global prefix: D:\npm-global Workspace: D:\codex Config File (D:\codex-config\config.toml)

[sandbox] mode = "danger-full-access" sandbox.log Content

failed: SetNamedSecurityInfoW sandbox dir failed: 5 [2026-05-25 14:13:15.845 codex-windows-sandbox-setup.exe] setup error: helper_sandbox_lock_failed: lock sandbox bin dir C:\Users\Administrator.codex.sandbox-bin failed: SetNamedSecurityInfoW sandbox dir failed: 5 [2026-05-25 14:13:15.854 codex.exe] setup refresh: exited with status ExitStatus(ExitStatus(1)) Additional Context

Error code 5 in SetNamedSecurityInfoW is ERROR_ACCESS_DENIED Setting mode = "danger-full-access" in config.toml does not resolve the issue The sandbox setup binary (codex-windows-sandbox-setup.exe) appears to have permission issues accessing C:\Users\Administrator.codex.sandbox-bin This makes the Codex desktop app nearly unusable on Windows as most operations require shell execution Suggested Investigation

Check if codex-windows-sandbox-setup.exe has proper permissions to modify sandbox directories Investigate why SetNamedSecurityInfoW fails with access denied Consider providing a way to completely bypass sandbox setup on Windows The danger-full-access mode should ideally skip sandbox initialization entirely