Windows Sandbox makes PATH binaries appear missing

What version of the Codex App are you using (From “About Codex” dialog)?

26.609.41114

What subscription do you have?

Plus

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

When running Codex in a sandboxed shell on Windows, a binary can be present on PATH but appear as if it is not installed. The underlying problem is that the sandbox denies execution, but the visible error path makes it hard to discover that.

In my case, PATH included my Golang toolchain, where the binary existed under. PowerShell could identify the full path as an application using Get-Command <full path>. However, normal PATH resolution failed, when running Get-Command go.exe or go version. go / go.exe could not be found will be reported instead.

Running the binary by full path inside the sandbox gave the real clue. It failed with:

Program 'go.exe' failed to run: Access is denied

When rerun outside the sandbox, both direct execution and PATH resolution worked:

go version go1.26.4 windows/amd64

What steps can reproduce the bug?

Codex tries to run a program in the PATH variable.

What is the expected behavior?

If a binary is present on PATH but blocked by sandbox execution policy, Codex should surface that distinction clearly. For example:

go.exe was found on PATH at ...\go.exe, but the sandbox denied execution.
Try approving execution outside the sandbox or adjust sandbox permissions.

Additional information

Why this matters

This makes debugging toolchain availability confusing. A user may incorrectly conclude that Go is not installed or PATH is broken, when the actual issue is sandbox execution denial. The current behavior hides the important distinction between:

1. binary not present,
2. directory not on PATH,
3. binary present but inaccessible,
4. binary present but blocked by sandbox policy.

Suggested improvement

When command lookup fails inside the sandbox, Codex could optionally inspect PATH entries and detect matching executable names. If a matching executable exists but cannot be executed due to access denial, report that as a sandbox/permission issue instead of a missing command.