Windows CLI install misses sandbox helper/command runner placement, causing CreateProcessWithLogonW failed: 2

Open 💬 2 comments Opened Jul 1, 2026 by cosmoarcanex

💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of Codex CLI is running?

Codex (v0.142.5)

What subscription do you have?

custom OpenAI-compatible API endpoint(this issue occurs before any model request is made)

Which model were you using?

_No response_

What platform is your computer?

Microsoft Windows NT 10.0.19045.0 x64

What terminal emulator and version are you using (if applicable)?

Windows Terminal ( pwsh 7.6.3)

Codex doctor report

{
  "schemaVersion": 1,
  "generatedAt": "1782931758s since unix epoch",
  "overallStatus": "ok",
  "codexVersion": "0.142.5",
  "checks": {
    "app_server.status": {
      "id": "app_server.status",
      "category": "app-server",
      "status": "ok",
      "summary": "background server is not running",
      "details": {
        "control socket": "C:\\Users\\Ta1z\\.codex\\app-server-control\\app-server-control.sock",
        "daemon state dir": "C:\\Users\\Ta1z\\.codex\\app-server-daemon",
        "mode": "ephemeral",
        "pid file": "C:\\Users\\Ta1z\\.codex\\app-server-daemon\\app-server.pid (missing)",
        "settings": "C:\\Users\\Ta1z\\.codex\\app-server-daemon\\settings.json (missing)",
        "status": "not running",
        "update-loop pid file": "C:\\Users\\Ta1z\\.codex\\app-server-daemon\\app-server-updater.pid (missing)"
      },
      "remediation": null,
      "durationMs": 0
    },
    "auth.credentials": {
      "id": "auth.credentials",
      "category": "auth",
      "status": "ok",
      "summary": "auth is provided by the active model provider",
      "details": {
        "auth file": "C:\\Users\\Ta1z\\.codex\\auth.json",
        "auth storage mode": "File",
        "model provider requires OpenAI auth": "false",
        "provider auth env var": "ATRAIN_API_KEY (present)"
      },
      "remediation": null,
      "durationMs": 0
    },
    "config.load": {
      "id": "config.load",
      "category": "config",
      "status": "ok",
      "summary": "config loaded",
      "details": {
        "CODEX_HOME": "C:\\Users\\Ta1z\\.codex",
        "config.toml": "C:\\Users\\Ta1z\\.codex\\config.toml",
        "config.toml parse": "ok",
        "cwd": "C:\\Users\\Ta1z",
        "enabled feature flags": "<redacted>",
        "feature flag overrides": "none",
        "feature flags enabled": "33",
        "log dir": "C:\\Users\\Ta1z\\.codex\\log",
        "mcp servers": "0",
        "model": "gpt-5.5",
        "model provider": "ATRAIN",
        "sqlite home": "C:\\Users\\Ta1z\\.codex"
      },
      "remediation": null,
      "durationMs": 0
    },
    "git.environment": {
      "id": "git.environment",
      "category": "git",
      "status": "ok",
      "summary": "git version 2.49.0.windows.1",
      "details": {
        "PATH git #1": "C:\\Program Files\\Git\\cmd\\git.exe",
        "PATH git entries": "1",
        "git build options": "git version 2.49.0.windows.1; cpu: x86_64; built from commit: cca1f38702730b35f52c29efd62864b85e85ddcc; sizeof-long: 4; sizeof-size_t: 8; shell-path: D:/git-sdk-64-build-installers/usr/bin/sh; feature: fsmonitor--daemon; libcurl: 8.12.1; OpenSSL: OpenSSL 3.2.4 11 Feb 2025; zlib: 1.3.1",
        "git exec path": "C:/Program Files/Git/mingw64/libexec/git-core",
        "git version": "git version 2.49.0.windows.1",
        "repo detected": "false",
        "selected git": "C:\\Program Files\\Git\\cmd\\git.exe"
      },
      "remediation": null,
      "durationMs": 125
    },
    "installation": {
      "id": "installation",
      "category": "install",
      "status": "ok",
      "summary": "installation looks consistent",
      "details": {
        "PATH codex #1": "C:\\Users\\Ta1z\\AppData\\Local\\Programs\\OpenAI\\Codex\\bin\\codex.exe",
        "current executable": "C:\\Users\\Ta1z\\AppData\\Local\\Programs\\OpenAI\\Codex\\bin\\codex.exe",
        "install context": "standalone (windows, package C:\\Users\\Ta1z\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc, bin C:\\Users\\Ta1z\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\bin, resources C:\\Users\\Ta1z\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\codex-resources, path C:\\Users\\Ta1z\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\codex-path)",
        "managed by bun": "false",
        "managed by npm": "false",
        "managed package root": "not set"
      },
      "remediation": null,
      "durationMs": 70
    },
    "mcp.config": {
      "id": "mcp.config",
      "category": "mcp",
      "status": "ok",
      "summary": "no MCP servers configured",
      "details": {},
      "remediation": null,
      "durationMs": 0
    },
    "network.env": {
      "id": "network.env",
      "category": "network",
      "status": "ok",
      "summary": "network-related environment looks readable",
      "details": {
        "proxy env vars": "none"
      },
      "remediation": null,
      "durationMs": 0
    },
    "network.provider_reachability": {
      "id": "network.provider_reachability",
      "category": "reachability",
      "status": "ok",
      "summary": "active provider endpoints are reachable over HTTP",
      "details": {
        "ATRAIN API base URL": "https://api.a-train.top/v1 reachable (HTTP 404)",
        "ATRAIN API route probe": "https://api.a-train.top/v1/<redacted> route exists (HTTP 401)",
        "reachability mode": "provider auth"
      },
      "remediation": null,
      "durationMs": 3216
    },
    "network.websocket_reachability": {
      "id": "network.websocket_reachability",
      "category": "websocket",
      "status": "ok",
      "summary": "Responses WebSocket is not enabled for the active provider",
      "details": {
        "model provider": "ATRAIN",
        "provider name": "ATRAIN",
        "proxy env vars": "none",
        "supports websockets": "false",
        "wire API": "responses"
      },
      "remediation": null,
      "durationMs": 0
    },
    "runtime.provenance": {
      "id": "runtime.provenance",
      "category": "runtime",
      "status": "ok",
      "summary": "running standalone on windows-x86_64",
      "details": {
        "commit": "unknown",
        "current executable": "C:\\Users\\Ta1z\\AppData\\Local\\Programs\\OpenAI\\Codex\\bin\\codex.exe",
        "install method": "standalone (windows, package C:\\Users\\Ta1z\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc, bin C:\\Users\\Ta1z\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\bin, resources C:\\Users\\Ta1z\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\codex-resources, path C:\\Users\\Ta1z\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\codex-path)",
        "platform": "windows-x86_64",
        "version": "0.142.5"
      },
      "remediation": null,
      "durationMs": 0
    },
    "runtime.search": {
      "id": "runtime.search",
      "category": "search",
      "status": "ok",
      "summary": "search is OK (bundled)",
      "details": {
        "search command": "C:\\Users\\Ta1z\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\codex-path\\rg.exe",
        "search command readiness": "file exists",
        "search provider": "bundled"
      },
      "remediation": null,
      "durationMs": 0
    },
    "sandbox.helpers": {
      "id": "sandbox.helpers",
      "category": "sandbox",
      "status": "ok",
      "summary": "sandbox configuration is readable",
      "details": {
        "approval policy": "OnRequest",
        "codex-linux-sandbox helper": "none",
        "execve wrapper helper": "none",
        "filesystem sandbox": "restricted",
        "network sandbox": "restricted"
      },
      "remediation": null,
      "durationMs": 0
    },
    "state.paths": {
      "id": "state.paths",
      "category": "state",
      "status": "ok",
      "summary": "state paths and databases are inspectable",
      "details": {
        "CODEX_HOME": "C:\\Users\\Ta1z\\.codex (dir)",
        "active rollout files": "31 files, 3787410 total bytes, 122174 average bytes",
        "archived rollout files": "0 files, 0 total bytes, 0 average bytes",
        "goals DB": "C:\\Users\\Ta1z\\.codex\\goals_1.sqlite (file)",
        "goals DB integrity": "ok",
        "log DB": "C:\\Users\\Ta1z\\.codex\\logs_2.sqlite (file)",
        "log DB integrity": "ok",
        "log dir": "C:\\Users\\Ta1z\\.codex\\log (missing)",
        "memories DB": "C:\\Users\\Ta1z\\.codex\\memories_1.sqlite (file)",
        "memories DB integrity": "ok",
        "sqlite home": "C:\\Users\\Ta1z\\.codex (dir)",
        "standalone release cache": "2 entries in C:\\Users\\Ta1z\\.codex\\packages\\standalone\\releases",
        "state DB": "C:\\Users\\Ta1z\\.codex\\state_5.sqlite (file)",
        "state DB integrity": "ok"
      },
      "remediation": null,
      "durationMs": 145
    },
    "state.rollout_db_parity": {
      "id": "state.rollout_db_parity",
      "category": "threads",
      "status": "ok",
      "summary": "rollout files and state DB thread inventory agree",
      "details": {
        "default model provider": "ATRAIN",
        "rollout DB active files": "31",
        "rollout DB active rows": "31",
        "rollout DB archive mismatches": "0",
        "rollout DB archived files": "0",
        "rollout DB archived rows": "0",
        "rollout DB duplicate DB paths": "0",
        "rollout DB duplicate rollout thread ids": "0",
        "rollout DB malformed file names": "0",
        "rollout DB missing active rows": "0",
        "rollout DB missing archived rows": "0",
        "rollout DB model providers": "ATRAIN=29, openai=2",
        "rollout DB rows": "31",
        "rollout DB scan cap reached": "false",
        "rollout DB scan errors": "0",
        "rollout DB sources": "cli=21, subagent:other=5, vscode=5",
        "rollout DB stale rows": "0"
      },
      "remediation": null,
      "durationMs": 59
    },
    "system.environment": {
      "id": "system.environment",
      "category": "system",
      "status": "ok",
      "summary": "OS language zh-CN",
      "details": {
        "EDITOR": "not set",
        "VISUAL": "not set",
        "os": "Windows 10.0.19045 (Windows 10 Pro) [64-bit]",
        "os language": "zh-CN",
        "os type": "Windows",
        "os version": "10.0.19045"
      },
      "remediation": null,
      "durationMs": 0
    },
    "terminal.env": {
      "id": "terminal.env",
      "category": "terminal",
      "status": "ok",
      "summary": "terminal metadata was detected",
      "details": {
        "WT_SESSION": "present",
        "color output": "enabled",
        "console input code page": "936",
        "console output code page": "936",
        "stderr console mode": "0x00000007 (VT processing: true)",
        "stderr is terminal": "true",
        "stdin is terminal": "true",
        "stdout console mode": "0x00000007 (VT processing: true)",
        "stdout is terminal": "true",
        "terminal": "Windows Terminal",
        "terminal size": "210x46"
      },
      "remediation": null,
      "durationMs": 0
    },
    "terminal.title": {
      "id": "terminal.title",
      "category": "title",
      "status": "ok",
      "summary": "terminal title default",
      "details": {
        "terminal title activity": "true",
        "terminal title items": "activity, project-name",
        "terminal title project source": "cwd",
        "terminal title project value": "Ta1z",
        "terminal title source": "default"
      },
      "remediation": null,
      "durationMs": 0
    },
    "updates.status": {
      "id": "updates.status",
      "category": "updates",
      "status": "ok",
      "summary": "update configuration is locally consistent",
      "details": {
        "cached latest version": "0.142.5",
        "check for update on startup": "true",
        "dismissed version": "0.142.5",
        "last checked at": "2026-07-01T06:07:23.579707200Z",
        "latest version": "0.142.5",
        "latest version status": "current version is not older",
        "update action": "standalone installer",
        "version cache": "C:\\Users\\Ta1z\\.codex\\version.json"
      },
      "remediation": null,
      "durationMs": 745
    }
  }
}

What issue are you seeing?

### What happened?

After installing/updating Codex CLI on Windows using the official installer:

```powershell
powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"

Codex CLI started successfully, but any sandboxed command failed.

Initial error:

windows sandbox: orchestrator_helper_launch_failed:
setup refresh failed to launch helper:
helper=codex-windows-sandbox-setup.exe
error=program not found

After manually copying codex-windows-sandbox-setup.exe into the Codex bin directory, the error changed to:

windows sandbox: CreateProcessWithLogonW failed: 2

The sandbox log then showed:

helper copy failed for command-runner:
helper not found next to current executable or under codex-resources:
C:\Users\<user>\AppData\Local\Programs\OpenAI\Codex\bin\codex.exe;
falling back to legacy path codex-command-runner.exe

.codex\.sandbox-bin was empty.

### Environment

OS: Windows
Shell: PowerShell 7.6.3
Codex CLI: codex-cli 0.142.5
Codex path:

C:\Users\<user>\AppData\Local\Programs\OpenAI\Codex\bin\codex.exe

PowerShell path after cleanup:

C:\Program Files\PowerShell\7\pwsh.exe

### Relevant files found

The required files existed in the standalone release package:

C:\Users\<user>\.codex\packages\standalone\releases\0.142.5-x86_64-pc-windows-msvc\codex-resources\codex-windows-sandbox-setup.exe
C:\Users\<user>\.codex\packages\standalone\releases\0.142.5-x86_64-pc-windows-msvc\codex-resources\codex-command-runner.exe

But they were not available where the running Codex binary expected them.

### Workaround

Manually copying these files fixed sandboxed command execution:

$release = "$env:USERPROFILE\.codex\packages\standalone\releases\0.142.5-x86_64-pc-windows-msvc"
$codexBin = Split-Path (Get-Command codex).Source
$sandboxBin = "$env:USERPROFILE\.codex\.sandbox-bin"

New-Item -ItemType Directory -Force $sandboxBin | Out-Null

Copy-Item "$release\codex-resources\codex-windows-sandbox-setup.exe" "$codexBin\codex-windows-sandbox-setup.exe" -Force
Copy-Item "$release\codex-resources\codex-windows-sandbox-setup.exe" "$sandboxBin\codex-windows-sandbox-setup.exe" -Force

Copy-Item "$release\codex-resources\codex-command-runner.exe" "$codexBin\codex-command-runner.exe" -Force
Copy-Item "$release\codex-resources\codex-command-runner.exe" "$sandboxBin\codex-command-runner.exe" -Force
Copy-Item "$release\codex-resources\codex-command-runner.exe" "$sandboxBin\codex-command-runner-0.142.5.exe" -Force

After this, sandboxed commands such as Get-Location succeeded.

What steps can reproduce the bug?

Send texts such as "Output the current directory" or "Create a folder in this directory" to Codex. When he needs to use the sandbox to use some commands, this issue occurs.

What is the expected behavior?

The official Windows installer should place or expose codex-windows-sandbox-setup.exe and codex-command-runner.exe in the paths expected by codex.exe, or the CLI should resolve them from the standalone
release package correctly.

Additional information

The CLI launches, but sandboxed tool execution fails because the sandbox setup helper and command runner are not found from the installed runtime location.

View original on GitHub ↗

2 Comments

github-actions[bot] contributor · 1 month ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

#30829
#30732
#30047

Powered by Codex Action

mchampanis · 1 month ago

Environment

Codex CLI 0.142.5, standalone Windows installer (not npm)
Windows 11 Pro 10.0.26200
Package layout: %USERPROFILE%\.codex\packages\standalone\releases\0.142.5-x86_64-pc-windows-msvc\
Sandbox previously worked on 0.142.2; broke after the self-update to 0.142.5

Symptom

Every sandboxed exec fails:

ERROR codex_core::exec: exec error: windows sandbox: orchestrator_helper_launch_failed:
setup refresh failed to launch helper: helper=codex-windows-sandbox-setup.exe,
cwd=..., log=C:\Users....codex.sandbox\sandbox.2026-07-02.log, error=program not found

Analysis

The helpers are present in the package, just not where the launcher looks. The release ships:

releases/0.142.5-x86_64-pc-windows-msvc/
  bin/codex.exe                                  <- only this dir is on PATH (via installer shim)
  codex-resources/codex-windows-sandbox-setup.exe
  codex-resources/codex-command-runner.exe

codex-package.json declares "resourcesDir": "codex-resources", but the spawn logic doesn't use it.

I isolated the two lookups by experiment:

codex-windows-sandbox-setup.exe is spawned by bare name and resolved via the invoking

user's PATH. Adding codex-resources to PATH fixes this first failure.

With only that PATH fix, the run then fails with CreateProcessWithLogonW failed: 2:

codex-command-runner.exe is resolved relative to codex.exe when creating the process
as the sandbox logon user (which doesn't see the invoking user's PATH). It must
physically sit next to codex.exe.

Workaround

copy codex-resources\codex-windows-sandbox-setup.exe bin
copy codex-resources\codex-command-runner.exe bin\

Sandboxed execs then succeed. The copies live inside the release directory, so every
self-update reintroduces the breakage.

Expected

The launcher should resolve both helpers from the resourcesDir declared in the
package manifest, for both the user-context spawn and the sandbox-user spawn.