Codex Desktop Windows sandbox setup fails on NTFS ACL / SetNamedSecurityInfoW error 5, then agents fall back to unsandboxed PowerShell escalation

What version of the Codex App are you using (From “About Codex” dialog)?

Version 26.623.141536 • Released 7 июл. 2026 г.

What subscription do you have?

plus

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Product:
Codex Desktop on Windows

Version / build observed:
OpenAI.Codex_26.623.19656.0_x64
codex-command-runner-0.142.5.exe

Environment:
Windows, non-elevated Codex Desktop.
Workspace roots on D:\Projects\..., NTFS owner was BUILTIN\Administrators.

Problem:
All sandbox modes that require filesystem setup can fail before any command runs.
The agent sees helper_unknown_error / setup refresh had errors.
After that, agents request require_escalated, so work continues through PowerShell outside sandbox. This is unsafe and extremely confusing.

Observed local errors:
C:\Users\arketov\.codex\.sandbox\setup_error.json:
{
"code": "helper_unknown_error",
"message": "setup refresh had errors"
}

Sandbox log:
write ACE grant failed on D:\Projects\miles\regionTMC: SetNamedSecurityInfoW failed: 5
setup refresh completed with errors
setup error: setup refresh had errors

Root cause:
Codex sandbox setup tries to grant write ACEs on workspace roots.
If the workspace root is owned by BUILTIN\Administrators and the non-elevated user lacks WRITE_DAC, Windows returns ERROR_ACCESS_DENIED (5).
Codex reports this as a generic helper failure instead of explaining the ACL problem or offering a UAC repair.

Expected behavior:
Codex should detect this and show a clear actionable error:
“Cannot prepare Windows sandbox ACLs for workspace root. Current user lacks WRITE_DAC. Run UAC repair / grant the user ACL rights / choose another workspace root.”
It should not silently degrade into agents requesting unsandboxed PowerShell escalation.

Workaround that fixed it locally:
Run elevated:
icacls "D:\Projects" /grant "%USERDOMAIN%\%USERNAME%:(OI)(CI)(F)"

After this:
setup_error.json disappeared
sandbox log shows errors=[]
sandboxed exec_command works without require_escalated

Impact:
Paid Codex Desktop app appears broken on Windows for any workspace tree with admin-owned ACLs.
The error message hides the real cause.
The fallback path encourages unsafe unsandboxed execution.

What steps can reproduce the bug?

setup and run

What is the expected behavior?

_No response_

Additional information

_No response_