Windows sandbox initialization fails with "setup refresh failed with status exit code: 1"

Bug Description
Codex desktop app on Windows fails to initialize the sandbox component, causing intermittent command execution failures. The error message is:

windows sandbox: setup refresh failed with status exit code: 1
Steps to Reproduce

Open Codex desktop app on Windows
Try to execute any shell command or use the js_repl tool
Observe that commands fail with the sandbox initialization error
Occasionally commands succeed, but failure rate is very high (~80-90%)
Expected Behavior
Shell commands and js_repl should execute reliably without sandbox initialization failures.

Actual Behavior

Shell commands fail with: Io(Custom { kind: Other, error: "windows sandbox: setup refresh failed with status exit code: 1" })
js_repl fails with: node_repl kernel exited unexpectedly ... windows sandbox failed: setup refresh failed with status exit code: 1
The error is intermittent - sometimes commands succeed, but most fail
Environment

OS: Windows (Chinese edition)
Codex Desktop App (latest version)
Node.js installed at: D:\nodejs
npm global prefix: D:\npm-global
Workspace: D:\codex
Config File (D:\codex-config\config.toml)

[sandbox]
mode = "danger-full-access"
sandbox.log Content

failed: SetNamedSecurityInfoW sandbox dir failed: 5
[2026-05-25 14:13:15.845 codex-windows-sandbox-setup.exe] setup error: helper_sandbox_lock_failed: lock sandbox bin dir C:\Users\Administrator\.codex\.sandbox-bin failed: SetNamedSecurityInfoW sandbox dir failed: 5
[2026-05-25 14:13:15.854 codex.exe] setup refresh: exited with status ExitStatus(ExitStatus(1))
Additional Context

Error code 5 in SetNamedSecurityInfoW is ERROR_ACCESS_DENIED
Setting mode = "danger-full-access" in config.toml does not resolve the issue
The sandbox setup binary (codex-windows-sandbox-setup.exe) appears to have permission issues accessing C:\Users\Administrator\.codex\.sandbox-bin
This makes the Codex desktop app nearly unusable on Windows as most operations require shell execution
Suggested Investigation

Check if codex-windows-sandbox-setup.exe has proper permissions to modify sandbox directories
Investigate why SetNamedSecurityInfoW fails with access denied
Consider providing a way to completely bypass sandbox setup on Windows
The danger-full-access mode should ideally skip sandbox initialization entirely