Windows desktop app repeatedly fails with "timeout waiting for child process to exit" due to sandbox ACL failure in WindowsApps

What version of the Codex App are you using (From “About Codex” dialog)?

26.409.1734.0

What subscription do you have?

ChatGPT Plus

What platform is your computer?

Windows 11 Home China, version 10.0.26200, x64

What issue are you seeing?

The Codex Windows desktop app frequently fails even in a blank conversation with:

timeout waiting for child process to exit

This happens after repeated reconnect attempts, and sometimes only works after several retries.

I investigated locally and found that the failure appears to happen during Windows sandbox setup. Codex repeatedly tries to grant a read ACL / ACE to its install resources under:

C:\Program Files\WindowsApps\OpenAI.Codex_...\app\resources

The local sandbox log shows:

SetNamedSecurityInfoW failed: 5

and:

read ACL run had errors

This reproduces even in a blank conversation and also after rebooting the computer.

What steps can reproduce the bug?

1. Launch the Codex desktop app on Windows.
2. Start a blank conversation.
3. Send a simple message such as "你好".
4. The app shows repeated reconnect attempts.
5. It eventually reports: "timeout waiting for child process to exit".

This can also happen after restarting the computer.

<img width="1218" height="492" alt="Image" src="https://github.com/user-attachments/assets/6603100f-37ba-46f8-95a0-e2bfc53a7db3" />

What is the expected behavior?

Codex should respond normally in a blank conversation without reconnect loops, and sandbox initialization should not fail when starting the app or sending a simple message.

Additional information

Additional local findings:

The issue appears related to Windows sandbox initialization, not to any child process I manually started.

Relevant local files:
C:\Users\10793\.codex\.sandbox\setup_error.json
C:\Users\10793\.codex\.sandbox\sandbox.log

The setup error file contains:
{
"code": "helper_unknown_error",
"message": "read ACL run had errors"
}

Relevant sandbox log lines include:
granting read ACE to C:\Program Files\WindowsApps\OpenAI.Codex_...\app\resources for sandbox users
grant read ACE failed on C:\Program Files\WindowsApps\OpenAI.Codex_...\app\resources for sandbox_group: SetNamedSecurityInfoW failed: 5
read ACL run completed with errors
setup error: read ACL run had errors

Additional notes:

• The ACL write succeeds only when performed from a truly elevated PowerShell process.
• However, launching the Microsoft Store version of Codex "as administrator" does not appear to reliably make the actual sandbox helper run with the effective privilege needed for this ACL step.
• Codex requires sandbox mode, so disabling sandbox is not a usable workaround.