codex - 💡(How to fix) Fix Windows sandbox setup helper triggers UAC installer detection (os error 740)

What happened?

On Windows, non-elevated sandboxed tool execution started failing before the command itself was launched. Even trivial commands such as rg --version or cmd /c ver failed with:

windows sandbox: spawn setup refresh

The sandbox log showed the underlying failure:

setup refresh: spawning C:\Users\vision\AppData\Local\Microsoft\WinGet\Links\codex-windows-sandbox-setup.exe (...)
setup refresh: failed to spawn C:\Users\vision\AppData\Local\Microsoft\WinGet\Links\codex-windows-sandbox-setup.exe: 请求的操作需要提升。 (os error 740)

os error 740 is Windows reporting that the requested operation requires elevation.

Environment

• OS: Windows 10.0.26200.8457
• Codex CLI: codex-cli 0.133.0
• Install source: WinGet package OpenAI.Codex 0.133.0
• Package release: rust-v0.133.0
• Config had [windows] sandbox = "elevated"

Reproduction

After installing/updating Codex 0.133.0 from WinGet, run any sandboxed command from Codex without require_escalated, for example:

rg --version
cmd /c ver

Expected: command runs in the Codex Windows sandbox.

Actual: command fails before launch with windows sandbox: spawn setup refresh.

Diagnosis

The target exists and is signed:

C:\Users\vision\AppData\Local\Microsoft\WinGet\Links\codex-windows-sandbox-setup.exe
  -> C:\Users\vision\AppData\Local\Microsoft\WinGet\Packages\OpenAI.Codex_Microsoft.Winget.Source_8wekyb3d8bbwe\codex-windows-sandbox-setup.exe

Authenticode signature verified as valid.

The failure appears to be caused by Windows UAC installer detection: the helper filename contains setup.exe, and the binary did not appear to have an embedded requestedExecutionLevel manifest. Windows therefore treated it as requiring elevation and CreateProcess returned error 740.

Workaround that confirmed the diagnosis

Embedding an asInvoker manifest into codex-windows-sandbox-setup.exe fixed the issue locally:

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

After embedding the manifest, the same non-elevated sandboxed commands succeeded:

cmd /c ver
rg --version

The sandbox log then showed successful setup refresh:

setup refresh: processed 3 write roots (read roots delegated); errors=[]
SUCCESS ... rg --version

Suggested fix

Please embed an explicit application manifest into codex-windows-sandbox-setup.exe, likely with:

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

Alternatively, rename the helper so it does not match Windows installer-detection heuristics, but an explicit manifest is probably safer.