Windows Codex app: Browser/node_repl bridge fails with sandbox elevation error

Resolved 💬 4 comments Opened May 28, 2026 by edseljohn1music-create Closed Jun 12, 2026

💡 Likely answer: A maintainer (iceweasel-oai, contributor) responded on this thread — see the highlighted reply below.

What version of the Codex App are you using (From “About Codex” dialog)?

codex 26.519.81530

What subscription do you have?

codex plus

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Codex Windows app 26.519.81530
Browser / node_repl bridge fails before browser opens.
mcp__node_repl__.js returns:
windows sandbox failed: spawn setup refresh

Sandbox log shows:
setup refresh failed to spawn codex-windows-sandbox-setup.exe:
The requested operation requires elevation. (os error 740)

Manual node_repl.exe --disable-sandbox diagnostic can run JS successfully,
but Codex regenerates .codex/config.toml with args = [] on restart.

What steps can reproduce the bug?

Open Codex Windows app.
Start a chat and ask Codex to perform any task that requires the Browser plugin, for example: "test the browser" or "open example.com in the browser".
Codex attempts to use mcp__node_repl__.js to initialize the browser runtime.
The bridge fails before any browser page opens.

I also reproduced the lower-level bridge issue by calling mcp__node_repl__.js with a trivial script, not involving any website:

nodeRepl.write(JSON.stringify({ ok: true }, null, 2));

That also fails with the same sandbox error.

What is the expected behavior?

The Browser plugin should initialize successfully, open or connect to the in-app browser, and allow Codex to inspect pages such as https://example.com.

actual behavior:
The browser never opens/connects. mcp__node_repl__.js exits immediately with:

node_repl kernel exited unexpectedly
windows sandbox failed: spawn setup refresh
reason: stdout_eof

The sandbox log shows the underlying Windows error:

setup refresh: failed to spawn codex-windows-sandbox-setup.exe:
The requested operation requires elevation. (os error 740)

Additional information

A manual diagnostic using node_repl.exe --disable-sandbox can run JavaScript successfully, so the issue appears specific to the sandbox setup path. However, Codex regenerates .codex/config.toml with args = [] on restart, so the workaround cannot be persisted from user config.

Additional data point: installed Chrome headless works on the same machine. A separate smoke check using local Chrome loaded an HTML page, rendered the title, ran JavaScript, and exited cleanly. So this does not appear to be a general Chrome/browser rendering problem.

The failure appears specific to the Codex in-app browser backend / node_repl bridge startup path.

View original on GitHub ↗

4 Comments

jt523 · 2 months ago

Additional reproduction after reinstall:

Codex Desktop package: OpenAI.Codex_26.527.3686.0_x64__2p2nqsd0c76g0
CLI: codex-cli 0.135.0-alpha.1
Platform: Microsoft Windows NT 10.0.26200.0, AMD64
codex doctor --summary reports 17 ok | 1 idle | 0 warn | 0 fail
Fully reinstalling Codex Desktop did not resolve the issue.

Minimal elevated sandbox test still fails before command execution:

codex sandbox cmd.exe /c echo CODEX_SANDBOX_TEST

Observed:

windows sandbox failed: spawn setup refresh

The sandbox log shows the underlying error:

setup refresh: failed to spawn codex-windows-sandbox-setup.exe:
The requested operation requires elevation. (os error 740)

A single-command unelevated test succeeds:

codex -c 'windows.sandbox="unelevated"' sandbox cmd.exe /c echo CODEX_UNELEVATED_SANDBOX_TEST_OK

Observed:

CODEX_UNELEVATED_SANDBOX_TEST_OK

node_repl also fails with the same spawn setup refresh error, preventing Chrome and browser automation from starting. This appears to remain an elevated sandbox startup-path issue in Desktop package 26.527.3686.0.

edseljohn1music-create · 2 months ago

I ran the sandbox checks from a normal Windows PowerShell outside Codex Desktop.

Note: codex hit PowerShell execution policy because it resolves to codex.ps1, so I used codex.cmd.

Version:

codex.cmd --version
codex-cli 0.130.0

Results:

codex.cmd sandbox windows cmd.exe /c echo CODEX_SANDBOX_TEST
CODEX_SANDBOX_TEST

codex.cmd -c "windows.sandbox=""unelevated""" sandbox windows cmd.exe /c echo CODEX_UNELEVATED_SANDBOX_TEST_OK
CODEX_UNELEVATED_SANDBOX_TEST_OK

Also:

codex.cmd doctor --summary

does not appear to be supported by this CLI version; it returns:
unexpected argument '--summary' found

So the standalone npm CLI sandbox works for me. The failure still appears specific to Codex Desktop’s Browser/node_repl bridge startup path, not the basic codex.cmd sandbox windows ... command.

edseljohn1music-create · 2 months ago

Follow-up as of June 8: this still reproduces for me in Codex Desktop.

The in-app Browser/node_repl path still fails before browser startup with:

node_repl kernel exited unexpectedly
windows sandbox failed: spawn setup refresh
reason: stdout_eof

Additional distinction: standalone CLI sandbox commands from normal PowerShell work for me:

codex.cmd --version
codex-cli 0.130.0

codex.cmd sandbox windows cmd.exe /c echo CODEX_SANDBOX_TEST
CODEX_SANDBOX_TEST

codex.cmd -c "windows.sandbox=""unelevated""" sandbox windows cmd.exe /c echo CODEX_UNELEVATED_SANDBOX_TEST_OK
CODEX_UNELEVATED_SANDBOX_TEST_OK

So the Windows sandbox can work from the standalone CLI path. The remaining failure appears specific to Codex Desktop’s generated Browser/node_repl bridge startup path.

Is there any supported Desktop setting or generated config path that can force the node_repl/browser bridge to use the working sandbox mode?

iceweasel-oai contributor · 2 months ago

this is now fixed