Windows sandbox runner fails to start with 0xc0000022 / pipe-in timeout

Title: Windows sandbox runner fails to start with 0xc0000022 / pipe-in timeout

Summary

On Windows, Codex commands executed through the sandbox fail because codex-command-runner-0.130.0-alpha.5.exe cannot start correctly. Windows shows an Application Error dialog with 0xc0000022, and Codex reports a pipe-in timeout.

Environment

• OS: Windows 11 (personal PC)
• Codex CLI: codex-cli 0.130.0
• Codex desktop app package: OpenAI.Codex_26.506.3741.0_x64__2p2nqsd0c76g0
• Failing runner: C:\Users\Rowan Weber\.codex\.sandbox-bin\codex-command-runner-0.130.0-alpha.5.exe
• Install path for CLI shim: C:\Users\Rowan Weber\AppData\Roaming\npm\codex.ps1

Reproduction

From Codex / sandboxed terminal execution, run:

codex --version

Or directly:

codex sandbox windows -- codex --version

Actual result

Codex reports:

windows sandbox failed: timed out after 15000ms connecting runner pipe-in

Windows shows an Application Error popup:

codex-command-runner-0.130.0-alpha.5.exe - Application Error
The application was unable to start correctly (0xc0000022). Click OK to close the application.

Windows Event Log records:

ProviderName: Application Popup
Event ID: 26
Message: Application popup: codex-command-runner-0.130.0-alpha.5.exe - Application Error : The application was unable to start correctly (0xc0000022).

Expected result

The Windows sandbox runner should start and connect back to the pipe, allowing sandboxed commands to execute.

Troubleshooting already performed

• Restarted Codex desktop app.
• Reinstalled Codex.
• Ran Codex as Administrator.
• Confirmed no visible security software / Windows Defender protection history block.
• Verified codex-cli 0.130.0 is latest from npm (@openai/codex reports 0.130.0).
• Verified the runner binary has a valid Authenticode signature.
• Verified the runner can start outside the sandbox: running it directly returns Error: runner: no pipe-in provided, rather than a Windows loader error.
• Checked AppLocker and Code Integrity logs; no obvious block was recorded.
• Checked sandbox users:
• CodexSandboxOffline exists, enabled, and logs on successfully.
• CodexSandboxOnline exists and is enabled.
• Both are members of CodexSandboxUsers.
• Rebuilt sandbox directories by renaming:
• .codex\.sandbox
• .codex\.sandbox-bin
• .codex\.sandbox-secrets
• After rebuild, .sandbox-bin was recreated empty while Codex logged helper copy: using in-memory cache, causing a temporary CreateProcessWithLogonW failed: 2; manually copying the runner back restored the original 0xc0000022 failure.
• Investigated ACLs:
• Initially .codex / .sandbox-bin inherited a Deny ACE for a Codex capability SID from .codex\cap_sid.
• Removed/rebuilt .codex and .sandbox-bin ACLs so CodexSandboxUsers had ReadAndExecute and no Deny ACE remained on those directories.
• The failure persisted, so the Deny ACE does not appear to be the only cause.

Notes

The failure seems specific to starting codex-command-runner-0.130.0-alpha.5.exe under the Windows sandbox restricted/logon context. The same binary is valid and starts outside the sandbox.