Windows Codex Desktop: node_repl fails with “windows sandbox failed: spawn setup refresh”, breaking Chrome plugin and in-app Browser

Resolved 💬 11 comments Opened May 31, 2026 by pipeuyriverplate-hue Closed Jun 12, 2026

💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of the Codex App are you using (From “About Codex” dialog)?

26.521.10419

What subscription do you have?

ChatGPT Plus

What platform is your computer?

Windows 11

What issue are you seeing?

Codex Desktop on Windows cannot start node_repl, which breaks both browser automation paths:

The Google Chrome plugin cannot connect to Chrome.
The Codex in-app Browser cannot start.
Even a minimal node_repl call fails before executing any JavaScript.

Observed error:

node_repl kernel exited unexpectedly
node_repl diagnostics: {"kernel_status":"running","kernel_stderr_tail":"windows sandbox failed: spawn setup refresh","reason":"stdout_eof","stream_error":null}

I tested this after restarting Codex Desktop and after reinstalling/updating the Chrome plugin/extension.

Important: Chrome extension and native host appear healthy.

Local checks show:

Chrome is installed and running.
Codex Chrome Extension is installed and enabled.
Extension ID: hehggadaopoacecdllhhajmbjkdcmajg
Extension version detected: 1.1.5_0
Selected Chrome profile: Profile 1
Native messaging host registry key exists:

HKCU\Software\Google\Chrome\NativeMessagingHosts\com.openai.codexextension

Native host manifest path:

C:\Users\Usuario\AppData\Local\OpenAI\extension\com.openai.codexextension.json

Native host check reports correct: true.

Because a minimal node_repl call also fails, this does not appear to be a Chrome extension problem, a website problem, or a native messaging host registration problem. It appears to be a Codex Desktop Windows sandbox / node_repl startup failure.

What steps can reproduce the bug?

Open Codex Desktop on Windows.
Ensure Chrome is running and the Codex Chrome Extension is installed/enabled.
Try to use the Chrome plugin from Codex.
The plugin fails before it can list or control Chrome tabs.
Try to use the Codex in-app Browser.
The in-app Browser also fails before it can open a page.
Try a minimal node_repl call:

nodeRepl.write("ok")

The node_repl kernel exits immediately with:

node_repl kernel exited unexpectedly
node_repl diagnostics: {"kernel_status":"running","kernel_stderr_tail":"windows sandbox failed: spawn setup refresh","reason":"stdout_eof","stream_error":null}

Troubleshooting already attempted:

Restarted Codex Desktop.
Reinstalled the Chrome plugin from Codex.
Updated/reinstalled the Codex Chrome Extension.
Confirmed Chrome is running.
Opened Chrome with the selected profile.
Retried both Chrome plugin and in-app Browser.
Same error persists.

What is the expected behavior?

node_repl should start successfully.

The Codex Chrome plugin should be able to connect to the installed Codex Chrome Extension and list/control Chrome tabs.

The Codex in-app Browser should also start successfully and allow Codex to open and inspect pages.

If the Windows sandbox cannot start, Codex should show a clear actionable error or supported workaround instead of failing with “windows sandbox failed: spawn setup refresh”.

Additional information

This looks similar to several existing public reports:

Those reports also mention:

node_repl failing before executing minimal JavaScript.
Browser and Chrome plugin becoming unusable.
“windows sandbox failed: spawn setup refresh”.
Possible relationship to the Windows elevated sandbox path.
Some users reporting that changing Windows sandbox mode from “elevated” to “unelevated” may work around the problem.

Could the Codex Desktop / Windows sandbox team please confirm:

Whether this is a known Codex Desktop Windows regression.
Whether changing [windows] sandbox = "unelevated" is currently a supported workaround.
Whether there is a diagnostic bundle or log file I should attach.
Whether a Codex Desktop update is expected to fix this.

View original on GitHub ↗

11 Comments

github-actions[bot] contributor · 1 month ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

#24963
#25012
#25226
#25222
#24926

Powered by Codex Action

KaihanWCSE · 1 month ago

Had this exact issue. After hours of debugging, changing the sandbox from "elevated" to "unelevated" fixed it for me. But hopefully elevated sandbox will work again

tonykey910 · 1 month ago

Confirming that switching the Windows sandbox mode to unelevated fixed this for me.
I was hitting the exact same error on Codex Desktop for Windows — windows sandbox failed: spawn setup refresh — which broke node_repl and all in-app browser / Chrome plugin automation. Regular PowerShell commands worked fine; only the node_repl sandbox startup failed.
I confirmed my whole system was healthy first: virtualization enabled, Windows Sandbox feature enabled, AppXSvc/ClipSVC running, UAC on, Secondary Logon running, both CodexSandbox users present, Defender showing no blocks, and the Codex package status was OK. I also fully uninstalled/reinstalled (including the Beta build) and removed leftover app data — none of it helped, which pointed to the elevated sandbox spawn path itself (consistent with the os error 740 – requires elevation reported in #24926).
The fix that worked: adding this to ~/.codex/config.toml:
toml[windows]
sandbox = "unelevated"
After fully restarting Codex, node_repl starts correctly and the in-app browser works again.
One caveat worth flagging for the maintainers: there are reports that Codex regenerates config.toml on restart and can overwrite user settings, so it would be great to have official confirmation on whether unelevated is a supported workaround and whether it will persist. A fix for the default elevated path (or a clearer actionable error) would be ideal.
App version affected: 26.519.11010.0 (also reproduced on later builds per other reports).

jessygrizzle · 1 month ago

I am seeing the same failure on Windows with Codex Desktop 26.527.3686.0.

My issue was filed as #25439 and I am closing it as a duplicate of this one.

Additional confirmation from my machine:

Subscription: ChatGPT Pro
Codex Desktop package: OpenAI.Codex_26.527.3686.0_x64__2p2nqsd0c76g0
Chrome profile: Default
Codex Chrome Extension version: 1.1.5_0
Chrome extension is installed and enabled.
Native messaging manifest is valid and registered.
Manifest path: C:\Users\jessy\AppData\Local\OpenAI\extension\com.openai.codexextension.json
Registry key: HKCU\Software\Google\Chrome\NativeMessagingHosts\com.openai.codexextension
Native manifest check reports correct: true.

The live @chrome bridge still fails before reaching Chrome with:

node_repl kernel exited unexpectedly
node_repl diagnostics: {"kernel_pid":6996,"kernel_status":"running","kernel_stderr_tail":"windows sandbox failed: spawn setup refresh","reason":"stdout_eof","stream_error":null}

I reproduced after:

Removing and re-adding the Codex Chrome Extension.
Rebooting Windows.
Opening Chrome first, then Codex.
Retesting @chrome test Chrome connection.

This appears to be the same Windows sandbox / node_repl startup failure described here, rather than a Chrome extension or native host registration issue.

qcy007 · 1 month ago

Confirming that switching the Windows sandbox mode to unelevated fixed this for me. I was hitting the exact same error on Codex Desktop for Windows — windows sandbox failed: spawn setup refresh — which broke node_repl and all in-app browser / Chrome plugin automation. Regular PowerShell commands worked fine; only the node_repl sandbox startup failed. I confirmed my whole system was healthy first: virtualization enabled, Windows Sandbox feature enabled, AppXSvc/ClipSVC running, UAC on, Secondary Logon running, both CodexSandbox users present, Defender showing no blocks, and the Codex package status was OK. I also fully uninstalled/reinstalled (including the Beta build) and removed leftover app data — none of it helped, which pointed to the elevated sandbox spawn path itself (consistent with the os error 740 – requires elevation reported in #24926). The fix that worked: adding this to ~/.codex/config.toml: toml[windows] sandbox = "unelevated" After fully restarting Codex, node_repl starts correctly and the in-app browser works again. One caveat worth flagging for the maintainers: there are reports that Codex regenerates config.toml on restart and can overwrite user settings, so it would be great to have official confirmation on whether unelevated is a supported workaround and whether it will persist. A fix for the default elevated path (or a clearer actionable error) would be ideal. App version affected: 26.519.11010.0 (also reproduced on later builds per other reports).

thanks！your solution worked

Keesan12 · 1 month ago

The pattern here makes me think the product needs a clearer failure boundary between:

shell/tool execution still healthy
Node sandbox failed
browser features unavailable as a consequence

Right now users have to reverse-engineer that from symptoms, which is why people keep chasing Chrome, extension, and native-host setup when the real break is earlier.

The minimum useful behavior would be:

one explicit startup probe for node_repl on app launch
if that probe fails, mark browser lanes unavailable immediately
show the exact sandbox mode in the error and offer the known workaround inline
stop retrying browser actions behind the scenes once the same sandbox signature repeats

That would save a lot of wasted debugging time. The expensive part of bugs like this is not just that something is broken. It is that the UI makes three different layers look equally suspicious.

wikihua · 1 month ago

Confirming that switching the Windows sandbox mode to unelevated fixed this for me. I was hitting the exact same error on Codex Desktop for Windows — windows sandbox failed: spawn setup refresh — which broke node_repl and all in-app browser / Chrome plugin automation. Regular PowerShell commands worked fine; only the node_repl sandbox startup failed. I confirmed my whole system was healthy first: virtualization enabled, Windows Sandbox feature enabled, AppXSvc/ClipSVC running, UAC on, Secondary Logon running, both CodexSandbox users present, Defender showing no blocks, and the Codex package status was OK. I also fully uninstalled/reinstalled (including the Beta build) and removed leftover app data — none of it helped, which pointed to the elevated sandbox spawn path itself (consistent with the os error 740 – requires elevation reported in #24926). The fix that worked: adding this to ~/.codex/config.toml: toml[windows] sandbox = "unelevated" After fully restarting Codex, node_repl starts correctly and the in-app browser works again. One caveat worth flagging for the maintainers: there are reports that Codex regenerates config.toml on restart and can overwrite user settings, so it would be great to have official confirmation on whether unelevated is a supported workaround and whether it will persist. A fix for the default elevated path (or a clearer actionable error) would be ideal. App version affected: 26.519.11010.0 (also reproduced on later builds per other reports).

It worked! thanks a lot!

Cesar2592 · 1 month ago

I can confirm the same failure pattern on a current Windows Codex Desktop setup, with Chrome itself appearing healthy.

Sanitized environment:

OS: Windows 10 Home Single Language / x64
Codex Desktop app package observed in sandbox logs: OpenAI.Codex_26.602.4764.0_x64__2p2nqsd0c76g0
Codex app version exposed in generated node_repl env: 26.602.40724
Config has bundled plugins enabled: chrome@openai-bundled and browser@openai-bundled
[windows] sandbox = "elevated"
node_repl is generated with args = []

Impact:

Chrome plugin cannot list/read open tabs.
In-app Browser/Browser plugin path also fails because it depends on node_repl.
This is not specific to a target website; the failure happens before any page content can be read.

Chrome-specific checks:

Chrome is installed and running.
Codex Chrome Extension is installed and enabled in the selected Chrome profile.
Extension ID: hehggadaopoacecdllhhajmbjkdcmajg
Extension version detected: 1.1.5_0
Native messaging registry key exists under HKCU\Software\Google\Chrome\NativeMessagingHosts\com.openai.codexextension
Native host manifest exists and points to the bundled extension-host.exe.

Minimal failing test:

nodeRepl.write("ok")

Observed result:

node_repl kernel exited unexpectedly
node_repl diagnostics: {"kernel_status":"running","kernel_stderr_tail":"windows sandbox failed: spawn setup refresh","reason":"stdout_eof","stream_error":null}

Relevant sanitized sandbox-log pattern:

START: %LOCALAPPDATA%\OpenAI\Codex\bin\<node-hash>\node.exe --experimental-vm-modules %TEMP%\...\kernel.js ...
setup refresh: spawning %LOCALAPPDATA%\OpenAI\Codex\bin\<codex-hash>\codex-windows-sandbox-setup.exe (cwd=<workspace>, payload_len=3364)
setup refresh: failed to spawn %LOCALAPPDATA%\OpenAI\Codex\bin\<codex-hash>\codex-windows-sandbox-setup.exe: The requested operation requires elevation. (os error 740)

Important comparison from the same sandbox log: ordinary shell commands do successfully run setup refresh via the packaged WindowsApps resource path:

setup refresh: spawning C:\Program Files\WindowsApps\OpenAI.Codex_26.602.4764.0_x64__2p2nqsd0c76g0\app\resources\codex-windows-sandbox-setup.exe ...
setup refresh: processed write roots; errors=[]

Troubleshooting already attempted multiple times by the user:

Updated Codex.
Fully restarted Codex.
Restarted Windows.
Reinstalled/reloaded the Chrome plugin from the Codex UI.
Verified Chrome extension and native host setup.

The only workaround not yet tested in this setup is temporarily changing the Windows sandbox mode, for example from elevated to unelevated, if that is considered safe/supported. Could the team confirm whether sandbox = "unelevated" is an intended temporary workaround for this specific node_repl/Browser/Chrome failure path?

old4693000-byte · 1 month ago

I am seeing the same failure pattern on Windows Codex Desktop and filed a related report here: https://github.com/openai/codex/issues/27792

My case is specifically the Chrome plugin path:

Chrome plugin / Codex Chrome Extension installed and enabled
Chrome extension version: 1.1.5_0
Selected Chrome profile: Default
Native Messaging Host manifest and registry checks pass (correct: true)
Chrome itself is installed and running
@chrome fails before it can list or access current Chrome tabs

Observed error:

node_repl kernel exited unexpectedly
windows sandbox failed: runner error: CreateProcessAsUserW failed: 5

Additional local signal: running codex --version from the Codex workspace PowerShell also failed with Access denied, so this looks like the same Windows sandbox / Node helper startup path rather than a Chrome extension installation problem.

ax-openai · 1 month ago

Closing as a duplicate of #24963.

old4693000-byte · 1 month ago

I am seeing the same failure pattern on Windows Codex Desktop and filed a related report here: https://github.com/openai/codex/issues/27792

My case is specifically the Chrome plugin path:

Chrome plugin / Codex Chrome Extension installed and enabled
Chrome extension version: 1.1.5_0
Selected Chrome profile: Default
Native Messaging Host manifest and registry checks pass (correct: true)
Chrome itself is installed and running
@chrome fails before it can list or access current Chrome tabs

Observed error:

node_repl kernel exited unexpectedly
windows sandbox failed: runner error: CreateProcessAsUserW failed: 5