Windows app sandbox helpers are packaged under resources but launcher searches app/PATH

What happened?

On the Windows Codex app, sandboxed commands started failing before the requested command ran. The initial failure was that the sandbox setup helper could not be launched:

windows sandbox: orchestrator_helper_launch_failed: setup refresh failed to launch helper: helper=codex-windows-sandbox-setup.exe, cwd=C:\Program Files\WindowsApps\OpenAI.Codex_26.623.9142.0_x64__2p2nqsd0c76g0\app, log=%USERPROFILE%\.codex\.sandbox\sandbox.2026-06-30.log, error=program not found

The helper binary exists, but under app\resources rather than directly under app or a directory on PATH:

C:\Program Files\WindowsApps\OpenAI.Codex_26.623.9142.0_x64__2p2nqsd0c76g0\app\resources\codex-windows-sandbox-setup.exe

After copying codex-windows-sandbox-setup.exe to the active Codex user bin directory on PATH, setup completed, but the next sandbox run failed with:

windows sandbox: CreateProcessWithLogonW failed: 2

The sandbox log then showed the command runner lookup falling back to the legacy name:

helper copy failed for command-runner: helper not found next to current executable or under codex-resources: %LOCALAPPDATA%\OpenAI\Codex\bin\<hash>\codex.exe; falling back to legacy path codex-command-runner.exe

codex-command-runner.exe also exists under app\resources, but was not discoverable from the active user bin/PATH location.

Expected behavior

Sandboxed commands should run without manually copying helper binaries. The launcher should either:

• look in app\resources for codex-windows-sandbox-setup.exe and codex-command-runner.exe, or
• package/copy those helpers next to the executable/path location where the launcher expects them.

Actual behavior

Any sandboxed command failed before execution because codex-windows-sandbox-setup.exe was not found. After manually making that helper discoverable, sandbox setup completed but command execution failed because codex-command-runner.exe was not found.

Workaround

Copying both helper binaries from app\resources into the active Codex user bin directory made sandboxed commands work again:

Copy-Item "<Codex WindowsApps package>\app\resources\codex-windows-sandbox-setup.exe" "<active %LOCALAPPDATA%\OpenAI\Codex\bin\hash>\codex-windows-sandbox-setup.exe" -Force
Copy-Item "<Codex WindowsApps package>\app\resources\codex-command-runner.exe" "<active %LOCALAPPDATA%\OpenAI\Codex\bin\hash>\codex-command-runner.exe" -Force

After this, simple sandboxed commands such as Get-Location and git status --short ran successfully.

Environment

• OS: Windows native Codex app
• Codex app package observed: OpenAI.Codex_26.623.9142.0_x64__2p2nqsd0c76g0
• Sandbox mode: workspace-write, Windows native sandbox
• Date observed: 2026-06-30

Notes

This looks like a packaging or helper lookup path regression: the required helper binaries are present in the app package, but the runtime lookup path does not include their packaged location.