Windows Desktop: elevated sandbox blocks node_repl; unelevated fixes bridge but Computer Use pipe missing

Summary

Codex Desktop on Windows had a node_repl / plugin bridge failure where nodeRepl.write('ok') failed before executing. The root symptom was the sandbox setup helper being spawned from the bridge path and failing with os error 740.

Changing the Windows sandbox setting from elevated to unelevated recovered node_repl and Chrome/browser control, but Computer Use remains unavailable because its native pipe is not created. Settings now reports Browser/Computer Use plugin availability inconsistently with the runtime state.

Feedback ID already submitted from Codex Desktop:

019e9343-cf10-7dd1-9de9-c2e24bd3636a

Environment

• OS: Windows
• Codex Desktop package observed: OpenAI.Codex_26.602.9276.0_x64__2p2nqsd0c76g0
• Codex CLI/app-server path observed under the user-local Codex install
• Plugin set involved:
• node_repl
• browser
• chrome
• computer-use

Original Minimal Reproduction

Run:

nodeRepl.write('ok')

Observed:

node_repl kernel exited unexpectedly
windows sandbox failed: spawn setup refresh

Relevant sandbox log pattern:

setup refresh: spawning C:\Users\<user>\AppData\Local\OpenAI\Codex\bin\<hash>\codex-windows-sandbox-setup.exe
setup refresh: failed to spawn C:\Users\<user>\AppData\Local\OpenAI\Codex\bin\<hash>\codex-windows-sandbox-setup.exe: The requested operation requires elevation. (os error 740)

This reproduced after:

• Codex Desktop uninstall/reinstall.
• Chrome plugin removal/reinstall.
• Renaming local Codex runtime folders.
• Full Codex process shutdown and relaunch.
• Launching Codex as administrator.
• Running the sandbox setup EXE once with UAC.
• Resetting generated sandbox folders and accepting the in-app sandbox update.

Profiler environment variables requested by support were checked and were not present:

COR_ENABLE_PROFILING
COR_PROFILER
COR_PROFILER_PATH
COR_PROFILER_PATH_32
COR_PROFILER_PATH_64
CORECLR_ENABLE_PROFILING
CORECLR_PROFILER
CORECLR_PROFILER_PATH

Partial Fix Found

The bridge recovered after changing:

[windows]
sandbox = "elevated"

to:

[windows]
sandbox = "unelevated"

Then fully closing Codex, stopping remaining Codex processes, reopening Codex, and retesting.

Confirmed after the change:

nodeRepl.write('ok') => ok

Chrome extension/browser runtime also became available.

Remaining Failure

Computer Use is still unavailable.

Runtime check from node_repl after the partial fix:

{
  "nodeRepl": "ok",
  "extensionBrowser": true,
  "inAppBrowser": true,
  "computerUse": "unavailable",
  "computerUseError": "Computer Use native pipe is unavailable: Error: failed to connect native pipe: The system cannot find the file specified. (os error 2)"
}

Observed local process/pipe state:

• No codex-computer-use.exe process is running.
• No codex-computer-use-* named pipe exists.
• Browser-related Codex pipes do exist.

Settings UI after this state:

Settings > Computer use: Computer Use plugins unavailable
Settings > Browser: In-app browser plugin unavailable

However, local config still shows the relevant plugins enabled:

[plugins."computer-use@openai-bundled"]
enabled = true

[plugins."browser@openai-bundled"]
enabled = true

[plugins."chrome@openai-bundled"]
enabled = true

Plugin cache folders are also still present:

C:\Users\<user>\.codex\plugins\cache\openai-bundled\browser
C:\Users\<user>\.codex\plugins\cache\openai-bundled\chrome
C:\Users\<user>\.codex\plugins\cache\openai-bundled\computer-use

Expected Behavior

• node_repl should execute simple scripts without requiring an elevation-dependent sandbox setup spawn from the user-local bridge path.
• Browser/Chrome and Computer Use plugin availability in Settings should match runtime availability.
• Computer Use should start/register its native helper and named pipe when enabled and installed.

Actual Behavior

• With windows.sandbox = "elevated", node_repl fails with sandbox setup os error 740.
• With windows.sandbox = "unelevated", node_repl and Chrome/browser recover, but Computer Use remains unavailable because the native pipe does not exist.
• Settings reports Browser/Computer Use plugin unavailability even though local config and plugin cache are present, and browser runtime is available from node_repl.

Evidence Package

A local evidence package was created containing:

• sanitized runtime bridge report
• partial fix instructions
• original repair/reset scripts used during troubleshooting
• isolated Chrome CDP test script

The issue body above contains the essential evidence because GitHub issue attachment upload is not available through the connector used to create this issue.