Windows CLI install misses sandbox helper/command runner placement, causing CreateProcessWithLogonW failed: 2
What version of Codex CLI is running?
Codex (v0.142.5)
What subscription do you have?
custom OpenAI-compatible API endpoint(this issue occurs before any model request is made)
Which model were you using?
_No response_
What platform is your computer?
Microsoft Windows NT 10.0.19045.0 x64
What terminal emulator and version are you using (if applicable)?
Windows Terminal ( pwsh 7.6.3)
Codex doctor report
{
"schemaVersion": 1,
"generatedAt": "1782931758s since unix epoch",
"overallStatus": "ok",
"codexVersion": "0.142.5",
"checks": {
"app_server.status": {
"id": "app_server.status",
"category": "app-server",
"status": "ok",
"summary": "background server is not running",
"details": {
"control socket": "C:\\Users\\Ta1z\\.codex\\app-server-control\\app-server-control.sock",
"daemon state dir": "C:\\Users\\Ta1z\\.codex\\app-server-daemon",
"mode": "ephemeral",
"pid file": "C:\\Users\\Ta1z\\.codex\\app-server-daemon\\app-server.pid (missing)",
"settings": "C:\\Users\\Ta1z\\.codex\\app-server-daemon\\settings.json (missing)",
"status": "not running",
"update-loop pid file": "C:\\Users\\Ta1z\\.codex\\app-server-daemon\\app-server-updater.pid (missing)"
},
"remediation": null,
"durationMs": 0
},
"auth.credentials": {
"id": "auth.credentials",
"category": "auth",
"status": "ok",
"summary": "auth is provided by the active model provider",
"details": {
"auth file": "C:\\Users\\Ta1z\\.codex\\auth.json",
"auth storage mode": "File",
"model provider requires OpenAI auth": "false",
"provider auth env var": "ATRAIN_API_KEY (present)"
},
"remediation": null,
"durationMs": 0
},
"config.load": {
"id": "config.load",
"category": "config",
"status": "ok",
"summary": "config loaded",
"details": {
"CODEX_HOME": "C:\\Users\\Ta1z\\.codex",
"config.toml": "C:\\Users\\Ta1z\\.codex\\config.toml",
"config.toml parse": "ok",
"cwd": "C:\\Users\\Ta1z",
"enabled feature flags": "<redacted>",
"feature flag overrides": "none",
"feature flags enabled": "33",
"log dir": "C:\\Users\\Ta1z\\.codex\\log",
"mcp servers": "0",
"model": "gpt-5.5",
"model provider": "ATRAIN",
"sqlite home": "C:\\Users\\Ta1z\\.codex"
},
"remediation": null,
"durationMs": 0
},
"git.environment": {
"id": "git.environment",
"category": "git",
"status": "ok",
"summary": "git version 2.49.0.windows.1",
"details": {
"PATH git #1": "C:\\Program Files\\Git\\cmd\\git.exe",
"PATH git entries": "1",
"git build options": "git version 2.49.0.windows.1; cpu: x86_64; built from commit: cca1f38702730b35f52c29efd62864b85e85ddcc; sizeof-long: 4; sizeof-size_t: 8; shell-path: D:/git-sdk-64-build-installers/usr/bin/sh; feature: fsmonitor--daemon; libcurl: 8.12.1; OpenSSL: OpenSSL 3.2.4 11 Feb 2025; zlib: 1.3.1",
"git exec path": "C:/Program Files/Git/mingw64/libexec/git-core",
"git version": "git version 2.49.0.windows.1",
"repo detected": "false",
"selected git": "C:\\Program Files\\Git\\cmd\\git.exe"
},
"remediation": null,
"durationMs": 125
},
"installation": {
"id": "installation",
"category": "install",
"status": "ok",
"summary": "installation looks consistent",
"details": {
"PATH codex #1": "C:\\Users\\Ta1z\\AppData\\Local\\Programs\\OpenAI\\Codex\\bin\\codex.exe",
"current executable": "C:\\Users\\Ta1z\\AppData\\Local\\Programs\\OpenAI\\Codex\\bin\\codex.exe",
"install context": "standalone (windows, package C:\\Users\\Ta1z\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc, bin C:\\Users\\Ta1z\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\bin, resources C:\\Users\\Ta1z\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\codex-resources, path C:\\Users\\Ta1z\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\codex-path)",
"managed by bun": "false",
"managed by npm": "false",
"managed package root": "not set"
},
"remediation": null,
"durationMs": 70
},
"mcp.config": {
"id": "mcp.config",
"category": "mcp",
"status": "ok",
"summary": "no MCP servers configured",
"details": {},
"remediation": null,
"durationMs": 0
},
"network.env": {
"id": "network.env",
"category": "network",
"status": "ok",
"summary": "network-related environment looks readable",
"details": {
"proxy env vars": "none"
},
"remediation": null,
"durationMs": 0
},
"network.provider_reachability": {
"id": "network.provider_reachability",
"category": "reachability",
"status": "ok",
"summary": "active provider endpoints are reachable over HTTP",
"details": {
"ATRAIN API base URL": "https://api.a-train.top/v1 reachable (HTTP 404)",
"ATRAIN API route probe": "https://api.a-train.top/v1/<redacted> route exists (HTTP 401)",
"reachability mode": "provider auth"
},
"remediation": null,
"durationMs": 3216
},
"network.websocket_reachability": {
"id": "network.websocket_reachability",
"category": "websocket",
"status": "ok",
"summary": "Responses WebSocket is not enabled for the active provider",
"details": {
"model provider": "ATRAIN",
"provider name": "ATRAIN",
"proxy env vars": "none",
"supports websockets": "false",
"wire API": "responses"
},
"remediation": null,
"durationMs": 0
},
"runtime.provenance": {
"id": "runtime.provenance",
"category": "runtime",
"status": "ok",
"summary": "running standalone on windows-x86_64",
"details": {
"commit": "unknown",
"current executable": "C:\\Users\\Ta1z\\AppData\\Local\\Programs\\OpenAI\\Codex\\bin\\codex.exe",
"install method": "standalone (windows, package C:\\Users\\Ta1z\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc, bin C:\\Users\\Ta1z\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\bin, resources C:\\Users\\Ta1z\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\codex-resources, path C:\\Users\\Ta1z\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\codex-path)",
"platform": "windows-x86_64",
"version": "0.142.5"
},
"remediation": null,
"durationMs": 0
},
"runtime.search": {
"id": "runtime.search",
"category": "search",
"status": "ok",
"summary": "search is OK (bundled)",
"details": {
"search command": "C:\\Users\\Ta1z\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\codex-path\\rg.exe",
"search command readiness": "file exists",
"search provider": "bundled"
},
"remediation": null,
"durationMs": 0
},
"sandbox.helpers": {
"id": "sandbox.helpers",
"category": "sandbox",
"status": "ok",
"summary": "sandbox configuration is readable",
"details": {
"approval policy": "OnRequest",
"codex-linux-sandbox helper": "none",
"execve wrapper helper": "none",
"filesystem sandbox": "restricted",
"network sandbox": "restricted"
},
"remediation": null,
"durationMs": 0
},
"state.paths": {
"id": "state.paths",
"category": "state",
"status": "ok",
"summary": "state paths and databases are inspectable",
"details": {
"CODEX_HOME": "C:\\Users\\Ta1z\\.codex (dir)",
"active rollout files": "31 files, 3787410 total bytes, 122174 average bytes",
"archived rollout files": "0 files, 0 total bytes, 0 average bytes",
"goals DB": "C:\\Users\\Ta1z\\.codex\\goals_1.sqlite (file)",
"goals DB integrity": "ok",
"log DB": "C:\\Users\\Ta1z\\.codex\\logs_2.sqlite (file)",
"log DB integrity": "ok",
"log dir": "C:\\Users\\Ta1z\\.codex\\log (missing)",
"memories DB": "C:\\Users\\Ta1z\\.codex\\memories_1.sqlite (file)",
"memories DB integrity": "ok",
"sqlite home": "C:\\Users\\Ta1z\\.codex (dir)",
"standalone release cache": "2 entries in C:\\Users\\Ta1z\\.codex\\packages\\standalone\\releases",
"state DB": "C:\\Users\\Ta1z\\.codex\\state_5.sqlite (file)",
"state DB integrity": "ok"
},
"remediation": null,
"durationMs": 145
},
"state.rollout_db_parity": {
"id": "state.rollout_db_parity",
"category": "threads",
"status": "ok",
"summary": "rollout files and state DB thread inventory agree",
"details": {
"default model provider": "ATRAIN",
"rollout DB active files": "31",
"rollout DB active rows": "31",
"rollout DB archive mismatches": "0",
"rollout DB archived files": "0",
"rollout DB archived rows": "0",
"rollout DB duplicate DB paths": "0",
"rollout DB duplicate rollout thread ids": "0",
"rollout DB malformed file names": "0",
"rollout DB missing active rows": "0",
"rollout DB missing archived rows": "0",
"rollout DB model providers": "ATRAIN=29, openai=2",
"rollout DB rows": "31",
"rollout DB scan cap reached": "false",
"rollout DB scan errors": "0",
"rollout DB sources": "cli=21, subagent:other=5, vscode=5",
"rollout DB stale rows": "0"
},
"remediation": null,
"durationMs": 59
},
"system.environment": {
"id": "system.environment",
"category": "system",
"status": "ok",
"summary": "OS language zh-CN",
"details": {
"EDITOR": "not set",
"VISUAL": "not set",
"os": "Windows 10.0.19045 (Windows 10 Pro) [64-bit]",
"os language": "zh-CN",
"os type": "Windows",
"os version": "10.0.19045"
},
"remediation": null,
"durationMs": 0
},
"terminal.env": {
"id": "terminal.env",
"category": "terminal",
"status": "ok",
"summary": "terminal metadata was detected",
"details": {
"WT_SESSION": "present",
"color output": "enabled",
"console input code page": "936",
"console output code page": "936",
"stderr console mode": "0x00000007 (VT processing: true)",
"stderr is terminal": "true",
"stdin is terminal": "true",
"stdout console mode": "0x00000007 (VT processing: true)",
"stdout is terminal": "true",
"terminal": "Windows Terminal",
"terminal size": "210x46"
},
"remediation": null,
"durationMs": 0
},
"terminal.title": {
"id": "terminal.title",
"category": "title",
"status": "ok",
"summary": "terminal title default",
"details": {
"terminal title activity": "true",
"terminal title items": "activity, project-name",
"terminal title project source": "cwd",
"terminal title project value": "Ta1z",
"terminal title source": "default"
},
"remediation": null,
"durationMs": 0
},
"updates.status": {
"id": "updates.status",
"category": "updates",
"status": "ok",
"summary": "update configuration is locally consistent",
"details": {
"cached latest version": "0.142.5",
"check for update on startup": "true",
"dismissed version": "0.142.5",
"last checked at": "2026-07-01T06:07:23.579707200Z",
"latest version": "0.142.5",
"latest version status": "current version is not older",
"update action": "standalone installer",
"version cache": "C:\\Users\\Ta1z\\.codex\\version.json"
},
"remediation": null,
"durationMs": 745
}
}
}What issue are you seeing?
### What happened?
After installing/updating Codex CLI on Windows using the official installer:
```powershell
powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"
Codex CLI started successfully, but any sandboxed command failed.
Initial error:
windows sandbox: orchestrator_helper_launch_failed:
setup refresh failed to launch helper:
helper=codex-windows-sandbox-setup.exe
error=program not found
After manually copying codex-windows-sandbox-setup.exe into the Codex bin directory, the error changed to:
windows sandbox: CreateProcessWithLogonW failed: 2
The sandbox log then showed:
helper copy failed for command-runner:
helper not found next to current executable or under codex-resources:
C:\Users\<user>\AppData\Local\Programs\OpenAI\Codex\bin\codex.exe;
falling back to legacy path codex-command-runner.exe
.codex\.sandbox-bin was empty.
### Environment
- OS: Windows
- Shell: PowerShell 7.6.3
- Codex CLI: codex-cli 0.142.5
- Codex path:
C:\Users\<user>\AppData\Local\Programs\OpenAI\Codex\bin\codex.exe
PowerShell path after cleanup:
C:\Program Files\PowerShell\7\pwsh.exe
### Relevant files found
The required files existed in the standalone release package:
C:\Users\<user>\.codex\packages\standalone\releases\0.142.5-x86_64-pc-windows-msvc\codex-resources\codex-windows-sandbox-setup.exe
C:\Users\<user>\.codex\packages\standalone\releases\0.142.5-x86_64-pc-windows-msvc\codex-resources\codex-command-runner.exe
But they were not available where the running Codex binary expected them.
### Workaround
Manually copying these files fixed sandboxed command execution:
$release = "$env:USERPROFILE\.codex\packages\standalone\releases\0.142.5-x86_64-pc-windows-msvc"
$codexBin = Split-Path (Get-Command codex).Source
$sandboxBin = "$env:USERPROFILE\.codex\.sandbox-bin"
New-Item -ItemType Directory -Force $sandboxBin | Out-Null
Copy-Item "$release\codex-resources\codex-windows-sandbox-setup.exe" "$codexBin\codex-windows-sandbox-setup.exe" -Force
Copy-Item "$release\codex-resources\codex-windows-sandbox-setup.exe" "$sandboxBin\codex-windows-sandbox-setup.exe" -Force
Copy-Item "$release\codex-resources\codex-command-runner.exe" "$codexBin\codex-command-runner.exe" -Force
Copy-Item "$release\codex-resources\codex-command-runner.exe" "$sandboxBin\codex-command-runner.exe" -Force
Copy-Item "$release\codex-resources\codex-command-runner.exe" "$sandboxBin\codex-command-runner-0.142.5.exe" -Force
After this, sandboxed commands such as Get-Location succeeded.
What steps can reproduce the bug?
Send texts such as "Output the current directory" or "Create a folder in this directory" to Codex. When he needs to use the sandbox to use some commands, this issue occurs.
What is the expected behavior?
The official Windows installer should place or expose codex-windows-sandbox-setup.exe and codex-command-runner.exe in the paths expected by codex.exe, or the CLI should resolve them from the standalone
release package correctly.
Additional information
The CLI launches, but sandboxed tool execution fails because the sandbox setup helper and command runner are not found from the installed runtime location.
This issue has 2 comments on GitHub. Read the full discussion on GitHub ↗