Windows Desktop: Computer Use native pipe missing after unelevated sandbox; bundled plugin reinstall fails with os error 6000

Windows Desktop: Computer Use remains unavailable after unelevated sandbox; native pipe missing and bundled plugin reinstall fails with os error 6000

Summary

On Windows Codex Desktop, Computer Use remains unavailable even after switching the Windows sandbox from elevated to unelevated and fully restarting Codex.

The current state matches the remaining failure described in #27278: browser-related pipes exist, but the Computer Use native helper/pipe is not created.

There is one additional local finding: the installed openai-bundled Computer Use plugin cache remains at 26.601.21317, while the current Codex App package contains a newer bundled Computer Use plugin 26.616.51431. Trying to install from the current App package bundled marketplace fails because the WindowsApps plugin source is EFS/Application Protected encrypted and cannot be copied by the CLI:

failed to copy plugin file: 无法加密指定的文件。 (os error 6000)

Environment

• OS: Windows 11, zh-CN
• Codex Desktop package: OpenAI.Codex_26.616.6631.0_x64__2p2nqsd0c76g0
• Codex CLI: codex-cli 0.136.0-alpha.2
• Install source shown by winget list: msstore
• winget upgrade --name Codex: no newer version available
• Config:

[windows]
sandbox = "unelevated"

[plugins."browser@openai-bundled"]
enabled = true

[plugins."chrome@openai-bundled"]
enabled = true

[plugins."computer-use@openai-bundled"]
enabled = true

Current plugin state

codex plugin list shows:

browser@openai-bundled       installed, enabled  26.601.21317
chrome@openai-bundled        installed, enabled  26.601.21317
computer-use@openai-bundled  installed, enabled  26.601.21317

Computer Use cache exists only at:

C:\Users\legion\.codex\plugins\cache\openai-bundled\computer-use\26.601.21317

The current Codex App package contains a newer Computer Use manifest:

D:\WindowsApps\OpenAI.Codex_26.616.6631.0_x64__2p2nqsd0c76g0\app\resources\plugins\openai-bundled\plugins\computer-use\.codex-plugin\plugin.json

with:

{
  "name": "computer-use",
  "version": "26.616.51431"
}

But cipher /c on the App package plugin source reports:

Listing D:\WindowsApps\OpenAI.Codex_26.616.6631.0_x64__2p2nqsd0c76g0\app\resources\plugins\openai-bundled\plugins\
New files added to this directory will be encrypted.

E computer-use
  Compatibility Level:
    Application Protected

Reproduction steps

1. Install and open Codex Desktop on Windows.
2. Enable browser@openai-bundled, chrome@openai-bundled, and computer-use@openai-bundled.
3. Set:

[windows]
sandbox = "unelevated"

1. Fully close and reopen Codex.
2. Start a new thread.
3. Ask Codex to use @Computer, for example:

使用 @Computer 打开记事本/列出窗口

Actual behavior

Codex does not get a real Computer Use runtime. It may fall back to ordinary shell/system commands and report something like:

本线程没有暴露 @Computer 所需的原生 node_repl js 工具，所以我用普通系统命令完成了启动和窗口枚举。

Runtime/process checks show:

No codex-computer-use.exe process is running.
No codex-computer-use-* named pipe exists.
Browser-related Codex pipes do exist.

Observed named pipes include only browser/Codex IPC entries, for example:

browser.a3ba19ec797144349ea5dbc1b742aca1.24655.23d6e2be089bed49.high.dpi1.5.pipe
codex-browser-use\0be74f5e-f1f3-40e7-8bd3-1370fc0f2685
codex-browser-use\66cf9ae3-b586-4f00-9589-5005b6121cc5
codex-browser-use-480aa0de-38a5-46a4-94aa-8fba8ce2ae44
codex-browser-use-b58d41b6-fa12-4fee-9611-fb1e368a2844
codex-ipc

The node_repl js execution tool is not exposed in the thread, so Computer Use cannot be initialized via its documented bootstrap path.

Expected behavior

Computer Use should start/register its native helper and named pipe when the plugin is installed and enabled. Asking @Computer to list windows or open Notepad should use the Computer Use runtime rather than falling back to ordinary shell commands.

Plugin availability shown in settings/config should match actual runtime availability.

Things already tried

• Changed:

[windows]
sandbox = "elevated"

to:

[windows]
sandbox = "unelevated"

• Fully restarted Codex Desktop.
• Started a new thread and retried @Computer.
• Verified unelevated sandbox works with a minimal command:

CODEX_UNELEVATED_SANDBOX_TEST_OK

• Verified elevated still fails:

windows sandbox failed: spawn setup refresh

• Tried the #25362 workaround by setting RUNASINVOKER under:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

for:

C:\Program Files\WindowsApps\OpenAI.Codex_26.616.6631.0_x64__2p2nqsd0c76g0\app\resources\codex-windows-sandbox-setup.exe

The registry value was written successfully, but elevated sandbox still failed and Computer Use still did not create a native pipe.

• Tried re-adding the currently configured computer-use@openai-bundled; it succeeds but remains at 26.601.21317.
• Tried pointing openai-bundled marketplace to the current App package bundled plugin source, then running:

codex plugin add computer-use@openai-bundled

This failed with:

Error: failed to copy plugin file: 无法加密指定的文件。 (os error 6000)

I restored the marketplace source back to:

C:\Users\legion\.codex\plugins\sources\openai-bundled-26.601.21317-20260613-170812

to avoid leaving the config in a broken state.

Related issues

• #27278: same remaining failure pattern after unelevated: Computer Use native pipe unavailable.
• #25362: RUNASINVOKER workaround for spawn setup refresh / os error 740. This workaround did not fix this current environment.
• #23884: mentions plugin repair while Codex Desktop was running hitting failed to copy plugin file: 无法加密指定的文件。 (os error 6000).

Impact

Computer Use is unusable on this machine even though the plugin is installed and enabled. Codex falls back to shell commands for desktop tasks, which is not equivalent to Computer Use and can cause false-positive reports that @Computer worked.