Sandboxed PowerShell commands intermittently fail on Windows with `windows sandbox: spawn setup refresh`

What version of the IDE extension are you using?

openai.chatgpt@26.527.31454

What subscription do you have?

ChatGPT Plus

Which IDE are you using?

VS Code 1.122.1

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Sandboxed shell commands frequently fail immediately on Windows before the command itself runs.

The repeated error is:

execution error: Io(Custom { kind: Other, error: "windows sandbox: spawn setup refresh" })

This happened with simple read-only PowerShell commands in a workspace on E:\..., including:

Get-ChildItem -Force

It also happened with search commands such as:

rg -n "score|评分|fallback|兜底|short|truncate|limit|85|90|75|rank|排序" -S .

In one session, both commands failed when run through the sandbox. Retrying Get-ChildItem -Force outside the sandbox with escalation succeeded immediately.

The same sandbox startup error also occurred when trying to query local tool versions:

code --version
code --list-extensions --show-versions

Both failed inside the sandbox with windows sandbox: spawn setup refresh, then succeeded when rerun outside the sandbox with approval.

This makes normal repo inspection unreliable because even basic read-only commands fail during sandbox setup.

What steps can reproduce the bug?

1. Use the Codex/OpenAI IDE extension in VS Code on Windows.
2. Open a workspace on a Windows drive, for example an E:\... repo.
3. Start a Codex session with filesystem sandboxing enabled, e.g. workspace-write.
4. Ask Codex to inspect the repo or run a simple read-only command.
5. Codex attempts a sandboxed PowerShell command such as:

Get-ChildItem -Force

1. The command fails immediately with:

execution error: Io(Custom { kind: Other, error: "windows sandbox: spawn setup refresh" })

1. Rerun the same command outside the sandbox with escalation/approval.
2. The command succeeds.

Expected behavior:

Sandboxed read-only PowerShell commands should run normally, or sandbox startup failures should provide a more actionable diagnostic.

Actual behavior:

The sandbox fails during startup/setup with windows sandbox: spawn setup refresh, blocking even basic read-only commands.

What is the expected behavior?

_No response_

Additional information

_No response_