Windows Codex App WSL mode requires danger-full-access because sandbox blocks WSL access

What version of the Codex App are you using (From “About Codex” dialog)?

26.519.81530

What subscription do you have?

Plus

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Environment:

• Windows 11
• Codex App on Windows
• WSL 2 installed with 3 distros:
• Ubuntu-20.04 default
• Ubuntu-22.04
• Ubuntu-22.04-clone

Problem:
Codex App cannot run in WSL mode unless sandbox_mode = "danger-full-access". The user must disable command sandbox entirely to use WSL mode.

What steps can reproduce the bug?

Reproduction:

1. Set [windows] sandbox = "elevated"
2. Restart Codex App
3. In Codex shell, whoami returns ...\codexsandboxoffline
4. wsl -l shows no installed distributions

1. Set [windows] sandbox = "unelevated"
2. Restart Codex App
3. In Codex shell, whoami returns real user ...\<user_name>
4. HKCU\Software\Microsoft\Windows\CurrentVersion\Lxss contains distro entries
5. But wsl -l fails with:

Wsl/EnumerateDistros/Service/E_ACCESSDENIED

1. Only sandbox_mode = "danger-full-access" allows wsl -l and WSL agent to work.

What is the expected behavior?

Expected:
WSL agent mode should be able to access the current user's WSL distros without requiring danger-full-access.

Additional information

_No response_