Windows sandbox helper not found in Codex CLI 0.138.0; regression from 0.132.0

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #25876
• #26158

Powered by Codex Action

For me the Codex CLI exe is in the C:\Users\XXX\.codex\packages\standalone\releases\0.139.0-x86_64-pc-windows-msvc\bin\codex.exe and the result of any shell command is execution error: Io(Custom { kind: Other, error: "windows sandbox: orchestrator_helper_launch_failed: setup refresh failed to launch helper: helper=codex-windows-sandbox-setup.exe, cwd=C:\\XXXX
The sandbox setup is in the C:\Users\XXXX\.codex\packages\standalone\releases\0.139.0-x86_64-pc-windows-msvc\codex-resources so this looks like simple path issue.

Try 0.140
@valepakh

Same issue on 0.139.0 — still not fixed

Confirming this is still reproducible on Codex CLI 0.139.0 (Windows 11 Pro), so the regression carries over from 0.132.0 through 0.139.0.

In my case it surfaced through the Codex desktop App: it became very slow to start and kept failing. I spent about 3 hours troubleshooting — repeatedly restarting the App and re-checking my setup — before realizing the root cause was the Windows sandbox config compatibility. The error shown was Couldn't update Agent sandbox / Retry the update, and clicking Retry update never succeeded.

Switching the config from:

[windows]
sandbox = "elevated"

to:

[windows]
sandbox = "unelevated"

immediately resolved it and everything works normally again.

So unelevated is a working workaround, but elevated is still broken on 0.139.0. The 0.139.0 changelog doesn't mention any fix for this. Would really appreciate an official fix soon — the failure is silent enough that it cost real debugging time before the sandbox config turned out to be the culprit. Thanks!

---

0.139.0 上仍未修复

确认该问题在 Codex CLI 0.139.0(Windows 11 Pro)上依然复现,也就是说这个回归从 0.132.0 一直延续到了 0.139.0。

我这边是通过 Codex 桌面 App 暴露出来的:App 启动变得非常慢并不断失败。我花了大约 3 个小时排查 —— 反复重启 App、反复检查配置 —— 最后才发现根因是 Windows sandbox 配置的兼容性问题。界面报的错是 Couldn't update Agent sandbox / Retry the update,而点击 Retry update 从来没有成功过。

把配置从:

[windows]
sandbox = "elevated"

改成:

[windows]
sandbox = "unelevated"

之后立刻恢复正常,一切又能正常工作了。

所以 unelevated 是个可用的临时绕过方案,但 elevated 在 0.139.0 上仍然是坏的。0.139.0 的 changelog 也没提到任何相关修复。希望官方能尽快修复 —— 这个故障足够隐蔽,在最终定位到是 sandbox 配置之前,实实在在浪费了不少调试时间。谢谢!

@zouchenzhen
0.140, Try it.

0.140.0 result: launch issue fixed, but a new failure stage appears

Thanks @BaseBlank — I upgraded the CLI to 0.140.0 and tested the elevated sandbox directly with codex sandbox -c 'windows.sandbox="elevated"'. The failure changed form, which is actually useful signal:

• 0.139.0: orchestrator_helper_launch_failed: setup refresh failed to launch helper ... error=program not found (the helper couldn't be located/launched — the "path issue" @valepakh described).
• 0.140.0: windows sandbox failed: orchestrator_helper_incomplete: setup helper exited successfully before setup completed

So in 0.140.0 the helper is now found and launches successfully (the PathUri refactor seems to have fixed the path/launch problem), but the elevated sandbox still can't be established — it now fails at a later stage: the setup helper exits successfully before setup actually completes.

unelevated continues to work normally on 0.140.0.

Environment: Windows 11 Pro x64, Codex CLI installed via npm (@openai/codex).

So this is partial progress: the program not found launch failure is gone, but elevated provisioning is still broken — just at a different point now. Hope this helps narrow it down. 🙏

---

0.140.0 实测:launch 问题已修复,但暴露出新的失败阶段

谢谢 @BaseBlank —— 我把 CLI 升级到了 0.140.0,并用 codex sandbox -c 'windows.sandbox="elevated"' 直接测试了 elevated 沙箱。报错的形态变了,这其实是有用的信息:

• 0.139.0: orchestrator_helper_launch_failed: setup refresh failed to launch helper ... error=program not found(helper 找不到/无法启动 —— 正是 @valepakh 描述的"路径问题")。
• 0.140.0: windows sandbox failed: orchestrator_helper_incomplete: setup helper exited successfully before setup completed

所以在 0.140.0 里,helper 已经能被找到并成功启动了(看起来 PathUri 重构修好了路径/启动问题),但 elevated 沙箱仍然搭不起来 —— 现在卡在更靠后的阶段:setup helper 正常退出了,却在 setup 真正完成之前就退出了。

unelevated 在 0.140.0 上依然正常工作。

环境:Windows 11 Pro x64,Codex CLI 通过 npm(@openai/codex)安装。

总之是阶段性进展:program not found 这个 launch 失败已经消失,但 elevated 配置仍然是坏的 —— 只是卡点换了位置。希望这能帮助缩小排查范围。🙏

@zouchenzhen
I've noticed this issue as well, and I've already reported it.
Version 0.140 is currently generally functional. Although it fails testing, Codex is able to execute workflows during normal use.

https://github.com/openai/codex/issues/28457

Sigh, Sandbox has been having issues in the last few versions. We'll just have to make do for now and wait for a fix;
As far as I know, the last stable version was 0.132;
Alternatively, we could roll back to 0.132—there haven't been any useful new features lately anyway. Version 0.132 meets my daily needs just fine.

I am on v0.140.0, the error is still reproducible when the sandbox config is elevated.

Run this command: `node -e "console.log('test123')"`


• Ran node -e "console.log('test123')"
  └ execution error: Io(Custom { kind: Other, error: "windows sandbox: orchestrator_helper_launch_failed: setup refresh failed to launch helper: helper=codex-windows-sandbox-setup.exe, cwd=D:\\coding\\ABC, log=C:\\Users\\XXX\\.codex\\.sandbox\\sandbox.2026-06-16.log,
    error=program not found" })

@wanjuntham
https://github.com/openai/codex/issues/28457

I am still unable to setup admin sandbox in 0.140.0 version after installing it on Windows using the installation script:

powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"

#28680

You guys can give it a try.
https://github.com/openai/codex/issues/29089#issuecomment-4765718971

You guys can give it a try. #29089 (comment)

This didn't work for me.

However, I found https://github.com/openai/codex/issues/23194#issuecomment-4692509619. And miraculously, it works!

What I did was:

1. Navigate to C:\Users\XXX\.codex\packages\standalone\current\codex-resources, copy codex-command-runner.exe and codex-windows-sandbox-setup.exe.
2. Paste them to C:\Users\XXX\.codex\packages\standalone\current\bin.

Windows CLI sandbox helper symlink workaround

Quick start powershell command

New-Item -ItemType SymbolicLink -Path "$env:LOCALAPPDATA\Programs\OpenAI\Codex\bin\codex-resources" -Target "$HOME\.codex\packages\standalone\current\codex-resources"

Scope

This workaround applies to the standalone Codex CLI for Windows when its sandbox helper exists in the installed package but the CLI cannot locate it. It does not apply to the Codex app installed from the Microsoft Store, which has its own installation and resource paths.

The observed failure looked like this:

windows sandbox: orchestrator_helper_launch_failed:
setup refresh failed to launch helper:
helper=codex-windows-sandbox-setup.exe
error=program not found

Cause

In the affected standalone package layout, the CLI entry point is under:

%USERPROFILE%\.codex\packages\standalone\current\bin\codex.exe

The Windows sandbox resources are under:

%USERPROFILE%\.codex\packages\standalone\current\codex-resources\

The CLI probes for codex-windows-sandbox-setup.exe next to codex.exe, under a codex-resources directory next to codex.exe, and finally through PATH. With the layout above, the actual resource directory is one level above bin, so none of those probes finds it.

Workaround

Open an elevated PowerShell session and create a directory symbolic link from the CLI bin directory to the package resource directory:

New-Item -ItemType SymbolicLink -Path "$env:LOCALAPPDATA\Programs\OpenAI\Codex\bin\codex-resources" -Target "$HOME\.codex\packages\standalone\current\codex-resources"

Verify the link

Get-Item "$env:LOCALAPPDATA\Programs\OpenAI\Codex\bin\codex-resources" |
    Select-Object FullName, LinkType, Target

Expected properties:

LinkType: SymbolicLink
Target: %USERPROFILE%\.codex\packages\standalone\current\codex-resources

After creating the link, retry a normal Codex tool command without bypassing the sandbox. A working offline sandbox runs under an identity such as CodexSandboxOffline and does not have administrator privileges. An online sandbox may use the corresponding online sandbox identity.

Update behavior

The visible CLI bin directory is a junction into the currently selected standalone release. A CLI update can point current at a new release whose bin directory does not contain this symbolic link. If the same helper error returns after an update, inspect the new package layout and recreate the link only if the mismatch still exists.

This is a packaging-layout workaround. The long-term correction is for the CLI helper resolver or standalone package layout to agree on the location of codex-resources.

Remove the workaround

Before removing anything, verify that the path is still a symbolic link:

$link = Get-Item -Force "$env:LOCALAPPDATA\Programs\OpenAI\Codex\bin\codex-resources"
if ($link.LinkType -eq "SymbolicLink") {
    Remove-Item -LiteralPath $link.FullName
} else {
    throw "Refusing to remove a path that is not a symbolic link."
}

Removing the symbolic link does not remove the target codex-resources directory.

How to solve

This is not a complex environment issue. It occurs because Codex assumes a Linux-style relationship between the executable and resource directories while the standalone Windows installation uses a different package layout. As a result, the helper lookup overlooks the actual Windows resource path. The simplicity of the root cause makes it surprising that the Windows installation layout was overlooked.

I have this issue on codex-cli 0.144.3