node_repl sandbox initialization crashes after updating to the Codex Windows Store version (os error 740)
环境：
Codex 版本：通过 Microsoft Store 安装的 OpenAI.Codex_26.601.2237.0
Windows 版本：Windows 11
安装方式：从旧版 CLI 安装升级到 Microsoft Store 版
问题：
更新到 Store 版后，node_repl MCP 的 sandbox 初始化在每次 kernel 启动时崩溃：windows sandbox failed: spawn setup refresh
根因（已排查）：
node_repl.exe 在 %LOCALAPPDATA%\OpenAI\Codex\bin\34ab3e1324cc55b5\（旧 CLI 安装遗留）
Sandbox 初始化试图 spawn %LOCALAPPDATA%\OpenAI\Codex\bin\716dda49c14d31a0\codex-windows-sandbox-setup.exe
Store 容器对该路径的二进制无提权权限：os error 740（请求的操作需要提升权限）
主 Codex 进程的 setup_refresh 使用 WindowsApp 内建版本（C:\Program Files\WindowsApps\...\app\resources\codex-windows-sandbox-setup.exe）通过 payload 机制可以成功提权
但 node_repl kernel 没有这个 fallback，只有一个直接 spawn 路径，导致崩溃
影响：
Computer Use 插件不可用（依赖 nodeRepl.nativePipe.createConnection）
Chrome 插件的部分 node_repl 后端功能受限
内置浏览器也可能受影响
Sandbox 日志关键片段codex.exe setup refresh: spawning ...\bin\...\codex-windows-sandbox-setup.exe
codex.exe setup refresh: failed to spawn ... (os error 740)
已尝试的修复方法
修改 CODEX_CLI_PATH 指向 WindowsApp 版 codex.exe —— 主进程正常，node_repl 仍崩溃
在 node_repl 目录和 bin 目录补充 codex-windows-sandbox-setup.exe —— 无效（同一二进制在不同路径的 spawn 行为不同）
将 sandbox 从 elevated 改为 none 绕过（由于安全策略未实施）
清理 bin 目录旧版本文件 —— 无效，kernel 使用硬编码路径
建议修复
让 node_repl kernel 的 sandbox 初始化使用与主 Codex 进程相同的 setup_refresh payload 机制
或使用 WindowsApp 内建的 codex-windows-sandbox-setup.exe 路径作为默认 fallback
3 Comments
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
English translation:
Environment:
Codex version: OpenAI.Codex_26.601.2237.0 installed through the Microsoft Store
Windows version: Windows 11
Installation method: upgraded from an older CLI installation to the Microsoft Store version
Issue:
After updating to the Store version, node_repl MCP sandbox initialization crashes every time the kernel starts: windows sandbox failed: spawn setup refresh
Root cause (investigated):
node_repl.exe is located in %LOCALAPPDATA%\OpenAI\Codex\bin\34ab3e1324cc55b5\ (left over from the old CLI installation)
Sandbox initialization attempts to spawn %LOCALAPPDATA%\OpenAI\Codex\bin\716dda49c14d31a0\codex-windows-sandbox-setup.exe
The Store container does not have elevation permission for the binary at that path: os error 740 (the requested operation requires elevation)
The main Codex process's setup_refresh uses the WindowsApp built-in version (C:\Program Files\WindowsApps\...\app\resources\codex-windows-sandbox-setup.exe) and can successfully elevate through the payload mechanism
But the node_repl kernel does not have this fallback and has only a direct spawn path, causing the crash
Impact:
The Computer Use plugin is unavailable (depends on nodeRepl.nativePipe.createConnection)
Some node_repl backend functionality of the Chrome plugin is limited
The built-in browser may also be affected
Key sandbox log excerpt
codex.exe setup refresh: spawning ...\bin\...\codex-windows-sandbox-setup.execodex.exe setup refresh: failed to spawn ... (os error 740)
Attempted fixes
Changed CODEX_CLI_PATH to point to the WindowsApp version of codex.exe — the main process works normally, but node_repl still crashes
Added codex-windows-sandbox-setup.exe to the node_repl directory and bin directory — ineffective (spawn behavior differs for the same binary at different paths)
Changed the sandbox from elevated to none as a workaround (not implemented due to security policy)
Cleaned old-version files from the bin directory — ineffective; the kernel uses a hard-coded path
Suggested fix
Make node_repl kernel sandbox initialization use the same setup_refresh payload mechanism as the main Codex process
Or use the WindowsApp built-in codex-windows-sandbox-setup.exe path as the default fallback
<!-- codex-issue-translator -->
this is now fixed