Windows elevated sandbox setup fails resolving unqualified real username

Summary

Windows Codex Desktop elevated sandbox setup fails for a non-admin Windows user when UAC elevation uses a separate admin account. The helper appears to resolve %USERNAME% as an unqualified account name instead of using the real user's fully qualified account name or SID.

Environment

• Codex App: 26.608.1337.0
• Codex CLI: 0.138.0-alpha.7
• OS: Windows 11 Enterprise
• Normal user: domain-backed / Entra-backed non-admin Windows account
• Admin/UAC account: separate privileged account
• Config:

[windows]
sandbox = elevated

Error

helper_setup_marker_write_failed:
resolve real user SID for setup marker failed:
LookupAccountNameW failed for User.Name: 1332

Reproduction

1. Log into Windows as a non-admin domain-backed user whose username contains a dot, for example User.Name.
2. Configure Codex Desktop:

[windows]
sandbox = elevated

1. Start Codex normally.
2. Click retry/update sandbox.
3. Enter a separate admin account in the UAC prompt.
4. Sandbox setup fails with LookupAccountNameW failed for User.Name: 1332.

Expected behavior

The elevated sandbox helper should resolve the real non-admin user correctly and write the setup marker.

Actual behavior

The helper tries to resolve only the unqualified username:

User.Name

This fails from the elevated helper context. The same account is resolvable when qualified as:

DOMAIN\User.Name

Confirmed workaround

Launching Codex Desktop directly with %USERNAME% set to the fully qualified username fixes setup:

$env:USERNAME = 'DOMAIN\User.Name'
$env:USERDOMAIN = 'DOMAIN'

& 'C:\Program Files\WindowsApps\OpenAI.Codex_<version>_x64__2p2nqsd0c76g0\app\Codex.exe'

After launching this way, elevated sandbox setup succeeds and writes:

%USERPROFILE%\.codex\.sandbox\setup_marker.json

Launching via codex.exe app did not preserve the environment override because it activated the MSIX packaged app. Directly launching the packaged Codex.exe did preserve it.

Additional details

The same failure was reproduced from the bundled CLI with:

codex.exe sandbox -c 'windows.sandbox=elevated' powershell.exe -NoProfile -Command whoami

Using the unqualified username failed with error 1332. Setting %USERNAME% to DOMAIN\User.Name before launching made the elevated sandbox run successfully as the Codex sandbox user.

Suggested fix

Do not pass/resolve bare %USERNAME% for the real user in elevated sandbox setup. Prefer one of:

• fully qualified DOMAIN\USERNAME
• the current user's SID captured before elevation
• a Windows token/user API rather than environment variables

This seems related to other Windows sandbox issues where name-based resolution fails and SID-based resolution is more robust.