Windows Desktop node_repl fails with sandbox setup refresh / os error 740

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #25366
• #25362
• #24926
• #24755
• #25226

Powered by Codex Action

Additional reproduction on a newer Codex Desktop build.

Environment:

• Windows 11 Pro, x64
• Codex Desktop package: OpenAI.Codex_26.602.4764.0_x64__2p2nqsd0c76g0
• Config:

```toml
sandbox_mode = "workspace-write"

[windows]
sandbox = "elevated"
```

• Codex launched as Administrator during the final tests.

Observed behavior:

• Shell sandbox initially failed with CreateProcessAsUserW failed: 1312 when not elevated.
• After launching Codex as Administrator, a minimal shell command succeeded:

``powershell
Get-Date
``

• node_repl still failed even after Administrator launch and a fresh isolated thread.

Minimal failing test:

nodeRepl.write('ok')

node_repl result:

node_repl kernel exited unexpectedly
windows sandbox failed: spawn setup refresh

Relevant sandbox log pattern:

START: C:\Users\<USER>\AppData\Local\OpenAI\Codex\bin\5b9024f90663758b\node.exe --experimental-vm-modules ...\kernel.js
setup refresh: spawning C:\Users\<USER>\AppData\Local\OpenAI\Codex\bin\fb2111b91430cb17\codex-windows-sandbox-setup.exe
setup refresh: failed to spawn ...\codex-windows-sandbox-setup.exe: 请求的操作需要提升。 (os error 740)

Troubleshooting already attempted:

• Restarted Codex
• Rebooted Windows
• Windows app Repair
• Windows app Reset
• Uninstalled/reinstalled Codex
• Renamed local runtime/sandbox cache directories before reinstall
• Launched Codex as Administrator
• Created a fresh isolated Codex thread and retested
• Ran js_reset; node_repl still failed

Current state:

• Shell sandbox works when Codex is launched as Administrator.
• node_repl MCP/runtime still fails with windows sandbox failed: spawn setup refresh / os error 740.

This appears consistent with the existing report: normal shell execution can use the WindowsApps helper successfully, while node_repl uses the AppData helper path and fails during sandbox setup refresh.

Adding a confirmed workaround data point from Codex Desktop on Windows, plus a pasteable prompt other affected users can give to Codex.

Environment / symptom:

• Windows Codex Desktop package observed in logs: OpenAI.Codex_26.602.4764.0_x64__2p2nqsd0c76g0
• User config still had:

``toml
[windows]
sandbox = "elevated"
``

• node_repl, in-app Browser, and the Chrome extension backend all failed before any JS/browser automation code ran.

Minimal failure:

nodeRepl.write('ping')

Result:

node_repl kernel exited unexpectedly
node_repl diagnostics: {"kernel_status":"running","kernel_stderr_tail":"windows sandbox failed: spawn setup refresh","reason":"stdout_eof","stream_error":null}

The concrete sandbox log failure was the AppData helper path:

setup refresh: failed to spawn C:\Users\<USER>\AppData\Local\OpenAI\Codex\bin\<hash>\codex-windows-sandbox-setup.exe: The requested operation requires elevation. (os error 740)

Workaround tested:
Added per-user AppCompat RUNASINVOKER entries under:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

for:

%LOCALAPPDATA%\OpenAI\Codex\bin\<hash>\codex-windows-sandbox-setup.exe = RUNASINVOKER
%LOCALAPPDATA%\OpenAI\Codex\bin\codex-windows-sandbox-setup.exe = RUNASINVOKER

After that, without changing [windows] sandbox = "elevated":

• nodeRepl.write('node_repl ok') succeeded
• in-app Browser loaded and verified https://example.com/
• Chrome extension backend connected with browserId: "extension", saw existing Chrome tabs, opened a Chrome-controlled tab, and verified https://example.com/

Caveats:

• This is a persistent per-user Windows compatibility override, so users should explicitly approve it before Codex applies it.
• The override is keyed by exact executable path. If an update changes the helper hash/path, the entry may need to be added for the new helper path.
• This is not a product fix. It seems to support the existing theory that the helper should have an explicit asInvoker manifest or the setup-refresh path should avoid spawning a helper that Windows treats as elevation-required.
• I would still avoid no-sandbox as a workaround.

Pasteable prompt for affected users:

I’m on Windows Codex Desktop and `node_repl` / Browser / Chrome control fails with `windows sandbox failed: spawn setup refresh`. Diagnose and fix only if the evidence matches. Do not inspect cookies, local storage, passwords, or private browser profile data.

1. Check `C:\Users\<me>\.codex\config.toml` for `[windows] sandbox = "elevated"`.
2. Search `C:\Users\<me>\.codex\.sandbox\*.log` for `setup refresh: failed to spawn`, `codex-windows-sandbox-setup.exe`, and `os error 740`.
3. Find `codex-windows-sandbox-setup.exe` under `%LOCALAPPDATA%\OpenAI\Codex\bin`.
4. If and only if the logs show the AppData `codex-windows-sandbox-setup.exe` path failing with `os error 740`, explain the security tradeoff of adding a per-user `HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers` `RUNASINVOKER` entry for the exact failing helper path(s), then ask me for explicit approval before changing the registry.
5. After approval, add `RUNASINVOKER` for the exact failing helper path(s), then verify with a minimal `nodeRepl.write('node_repl ok')` test and a Browser/Chrome smoke test against `https://example.com/`.
6. Do not switch to `no-sandbox`.

I’m seeing a related Windows Computer Use failure on Codex Desktop as well.

Environment:

• Codex Desktop: 26.602.4764.0
• Bundled Computer Use plugin: 26.602.40724
• Windows user profile: C:\Users\Administrator

Initial failure:

• Computer Use failed with:

windows sandbox failed: spawn setup refresh
stdout_eof

• Sandbox log showed os error 740 while spawning:

C:\Users\Administrator\AppData\Local\OpenAI\Codex\bin\fb2111b91430cb17\codex-windows-sandbox-setup.exe

Workaround applied:

• Added AppCompatFlags RUNASINVOKER for the setup helper path above.
• After that, os error 740 disappeared.
• Sandbox setup now completes successfully:

setup refresh: processed 1 write roots (read roots delegated); errors=[]
setup binary completed

Remaining failure:

• Computer Use still fails with:

Computer Use native pipe path is unavailable

• Desktop logs show:

computer-use notify config ensure finished platform=win32 reason=missing-helper-path status=skipped
computer-use native pipe startup failed errorMessage="Windows Computer Use helper paths are unavailable"
computer_use_native_pipe_thread_config_skipped platform=win32 reason=not-ready

Additional check:

• The plugin cache originally only had:

C:\Users\Administrator\.codex\plugins\cache\openai-bundled\computer-use\26.602.40724

• I created a junction:

C:\Users\Administrator\.codex\plugins\cache\openai-bundled\computer-use\latest -> 26.602.40724

• This helper now exists through latest:

C:\Users\Administrator\.codex\plugins\cache\openai-bundled\computer-use\latest\node_modules\@oai\sky\bin\windows\codex-computer-use.exe

• But after restarting Codex, the desktop app still reports missing-helper-path and does not start the Computer Use native pipe.

So RUNASINVOKER fixes the 740 part, but the app still cannot resolve/start the Computer Use helper paths afterward.

this is now fixed