Codex Extension for VS Code: Windows sandbox runner fails before PowerShell starts with CreateProcessAsUserW failed: 1920

What version of Codex is running?

Codex Extension for VS Code build observed locally:

openai.chatgpt-26.623.31921-win32-x64

Related Codex Desktop package on the same machine:

OpenAI.Codex_26.623.4041.0_x64__2p2nqsd0c76g0

What platform is your computer?

Windows, PowerShell shell.

What issue are you seeing?

The Codex Extension for VS Code is hitting the same Windows sandbox command-runner failure pattern seen in Codex Desktop/CLI issue #20570, but this report is specifically for CEV / Codex Extension in VS Code.

CEV fails before PowerShell can read files, with behaviour matching:

windows sandbox: runner error: CreateProcessAsUserW failed: 1920

In the CEV conversation, the assistant reported:

The sandbox runner failed before PowerShell could read either file. I’m retrying the two reads with escalation because both files are outside the writable workspace and the runner error is environmental, not a content issue.

This blocks normal inspect-first repository work in VS Code, including reading project files before planning changes.

The same machine also reproduced the exact failure in Codex Desktop on 2026-06-26:

• Get-Content -Path C:\Users\arvid\Documents\Codex\AGENTS.md
• Get-Location
• Write-Output ok

All failed before PowerShell started with:

windows sandbox: runner error: CreateProcessAsUserW failed: 1920

Escalated / non-sandboxed execution succeeds for the same read-only commands.

What steps can reproduce the bug?

1. Open a project in VS Code.
2. Use Codex Extension in VS Code.
3. Ask CEV to inspect project files before planning.
4. CEV attempts normal sandboxed PowerShell reads.
5. The sandbox runner fails before PowerShell reads the files.
6. Retrying the same read-only inspection with escalated / non-sandboxed execution works.

Expected behaviour

CEV should be able to run normal read-only inspection commands in the workspace sandbox, especially for inspect-first workflows.

Actual behaviour

The sandbox command runner fails before PowerShell starts, so CEV cannot inspect files without escalation.

Workaround

Temporarily retry necessary read-only inspection commands with escalated / non-sandboxed access when the CreateProcessAsUserW failed: 1920 sandbox runner error appears.

This is only a workaround. It is not a safe long-term fix because CEV should be able to perform ordinary read-only inspection in the workspace sandbox.

Related issues

• Related exact Codex Desktop/CLI tracker: #20570
• This issue is intended to track the same failure pattern as it affects Codex Extension for VS Code / CEV specifically.

Additional context

I searched for CEV-specific duplicates before filing using terms including:

• CreateProcessAsUserW failed: 1920 + VS Code
• CreateProcessAsUserW failed: 1920 + CEV
• sandbox runner + VS Code + PowerShell
• CreateProcessAsUserW + extension
• Codex Extension + sandbox

I did not find an existing CEV-specific issue.