›_ Codex Issues
Codex Issues / #29881

[Windows] Switching App Agent Environment WSL → Native initializes the sandbox and fixes both App and CLI

Open 💬 0 comments Opened Jun 24, 2026 by kiti1924

What version of the Codex App are you using?

Version 26.616.81150
Released 2026/06/24

What version of Codex CLI are you using?

codex-cli 0.142.0

The CLI was installed globally through npm.

What subscription do you have?

ChatGPT Plus

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64
Windows 11
Japanese locale

What issue are you seeing?

The Windows Native sandbox was initially unusable in both the Codex App and Codex CLI.

Commands executed by the Codex App repeatedly failed because the Windows sandbox could not start.

The same failure could be reproduced directly from Codex CLI in PowerShell.

Elevated sandbox test

$cmd = "$env:WINDIR\System32\cmd.exe"

codex -c 'windows.sandbox="elevated"' sandbox windows `
    $cmd /c echo CODEX_ELEVATED_OK

Result:

windows sandbox failed: runner error: CreateProcessAsUserW failed: 2

Unelevated sandbox test

codex -c 'windows.sandbox="unelevated"' sandbox windows `
    $cmd /c echo CODEX_UNELEVATED_OK

Result:

windows sandbox failed: CreateProcessAsUserW failed: 2

The target executable existed and worked normally outside the Codex sandbox:

Test-Path "$env:WINDIR\System32\cmd.exe"
# True

& "$env:WINDIR\System32\cmd.exe" /c echo DIRECT_CMD_OK
# DIRECT_CMD_OK

codex doctor reported that the following components were healthy:

  • CLI installation
  • Bundled runtime
  • State databases
  • Authentication
  • Connectivity

Recovery procedure that fixed both the App and CLI

I performed the following steps in the Codex App:

  1. Opened Settings.
  2. Changed Agent Environment from Windows Native to WSL.
  3. Changed Agent Environment back from WSL to Windows Native.
  4. After switching back, the App displayed the Windows sandbox creation/setup flow.
  5. Completed the sandbox setup.

After completing the App-triggered setup:

  • sandboxed commands in the Codex App stopped failing;
  • the same Codex CLI sandbox commands that had previously returned CreateProcessAsUserW failed: 2 started working;
  • no Codex App or CLI reinstall was performed;
  • no CLI downgrade was performed;
  • no CLI configuration change was required;
  • .codex was not deleted or renamed;
  • session history was not deleted;
  • sandbox directories were not manually reset.

This suggests that the Codex App and CLI use the same underlying Windows sandbox configuration or shared sandbox state.

Changing the Agent Environment in the App appears to have initialized or repaired that shared state.

Steps to reproduce

The exact cause of the initial incomplete state is unknown, but the observed sequence was:

  1. Start Codex App with Windows Native selected.
  1. Attempt to execute an agent command that uses the Windows sandbox.
  1. Observe a Windows sandbox failure.
  1. Run a direct sandbox test from Codex CLI.
  1. Observe:

``text
CreateProcessAsUserW failed: 2
``

  1. In Codex App, change Agent Environment from Windows Native to WSL.
  1. Change Agent Environment back from WSL to Windows Native.
  1. Observe that the Windows sandbox creation/setup flow now appears.
  1. Complete the setup.
  1. Retry commands in the Codex App.
  1. Retry the direct sandbox tests in Codex CLI.
  1. Observe that both the App and CLI now work.

Expected behavior

When either Codex App or Codex CLI attempts to use the Windows sandbox, Codex should check whether the sandbox is fully initialized and ready.

If the Windows sandbox is missing, incomplete, or uninitialized, Codex should automatically display or run the required setup flow before attempting sandboxed process execution.

The user should not need to switch the Codex App Agent Environment to WSL and back to initialize a sandbox that is also used by Codex CLI.

Actual behavior

Both Codex App and Codex CLI attempted to use an apparently uninitialized or incomplete Windows sandbox and failed with process-creation errors.

Neither the App nor CLI initially detected the missing setup condition.

The setup flow appeared only after changing the Codex App Agent Environment from Windows Native to WSL and then back to Windows Native.

Completing that App-triggered setup repaired sandbox execution in both the App and CLI.

Additional information

This appears to involve Windows sandbox state shared by Codex App and Codex CLI.

There may be two related problems:

  1. The shared Windows sandbox was missing or incompletely initialized.
  2. Its readiness state was cached or incorrectly considered valid by both the App and CLI.

Changing the Agent Environment in the App may invalidate or refresh that state and trigger the previously omitted Windows Native sandbox setup.

Possibly related issues:

  • #23894 — WSL app-server remains active after switching back to Windows and breaks Windows sandbox setup
  • #28982 — Windows App native sandbox setup helper failure

This case differs because switching from WSL back to Windows Native repaired both the App and CLI by triggering a sandbox setup flow that had not appeared previously.

View original on GitHub ↗