›_ Codex Issues
Codex Issues / #31708

Windows desktop app elevated sandbox setup resolves codex-windows-sandbox-setup.exe to package root instead of app\resources

Open 💬 3 comments Opened Jul 9, 2026 by alfabo09083390-lang
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What issue are you seeing?

On Windows, the Codex desktop app can show a native Windows error dialog when elevated sandbox setup is triggered. The dialog attempts to launch:

C:\Program Files\WindowsApps\OpenAI.Codex_<version>_x64__2p2nqsd0c76g0\codex-windows-sandbox-setup.exe

This root-level path does not exist in the MSIX package. On the affected install, the actual executable exists at:

C:\Program Files\WindowsApps\OpenAI.Codex_<version>_x64__2p2nqsd0c76g0\app\resources\codex-windows-sandbox-setup.exe

The Windows dialog message is localized Chinese:

找不到指定的模块。

Equivalent English meaning: "The specified module could not be found."

Environment

  • OS: Windows 11 x64, zh-CN locale
  • Codex desktop app package observed: OpenAI.Codex_26.623.19656.0_x64__2p2nqsd0c76g0
  • Codex CLI/runtime observed: 0.142.5
  • Microsoft Store / WindowsApps install layout

Reproduction conditions observed

  1. Use Codex desktop app on Windows.
  2. Have the following config present in ~/.codex/config.toml:
[windows]
sandbox = "elevated"
  1. Start an action that triggers Windows sandbox setup / setup helper.
  2. A native Windows error dialog appears pointing to the package root path for codex-windows-sandbox-setup.exe.

Actual behavior

The desktop app / elevated setup helper appears to resolve the setup executable as if it were in the package install root:

...\OpenAI.Codex_<version>_x64__2p2nqsd0c76g0\codex-windows-sandbox-setup.exe

That path is missing, so Windows displays "找不到指定的模块。"

Expected behavior

The setup helper should resolve and launch the executable under:

...\OpenAI.Codex_<version>_x64__2p2nqsd0c76g0\app\resources\codex-windows-sandbox-setup.exe

or otherwise dynamically resolve the current package install location and append app\resources\codex-windows-sandbox-setup.exe.

Additional notes

  • Local sandbox logs from codex.exe show successful setup refreshes when using the correct app\resources\codex-windows-sandbox-setup.exe path.
  • Removing [windows] sandbox = "elevated" avoids the native error dialog, but the desktop app/settings flow can later recreate that config, which makes the issue recur.
  • This looks like a path resolution bug in the Windows desktop app / elevated sandbox setup path, not a missing file in the package.

View original on GitHub ↗

2 Comments

github-actions[bot] contributor · 1 month ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #30732

Powered by Codex Action

alfabo09083390-lang · 1 month ago

Additional local evidence from the same Windows machine:

The native Windows dialog is non-fatal. The requested Codex task continues and shell commands complete successfully after the dialog appears.

The local sandbox log does not show a failed setup. Instead, for the same time window it repeatedly shows successful setup refreshes using the correct app\resources path, for example:

[2026-07-09 16:24:37.082 codex.exe] setup refresh: spawning C:\Program Files\WindowsApps\OpenAI.Codex_26.623.19656.0_x64__2p2nqsd0c76g0\app\resources\codex-windows-sandbox-setup.exe (cwd=C:\Program Files\WindowsApps\OpenAI.Codex_26.623.19656.0_x64__2p2nqsd0c76g0\app, payload_len=4676)
[2026-07-09T08:24:37.154944700+00:00] setup refresh: processed 2 write roots (read roots delegated); errors=[]
[2026-07-09 16:24:37.155 codex-windows-sandbox-setup.exe] setup binary completed

The dialog appears around normal sandboxed command execution. The trigger sequence in the log is:

  1. Codex starts a sandboxed command.
  2. setup refresh runs before command execution.
  3. read-acl-only mode: applying read ACLs appears.
  4. The command then succeeds.

Example:

[2026-07-09 16:24:36.323 codex.exe] START: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe ...
[2026-07-09 16:24:37.082 codex.exe] setup refresh: spawning ...\app\resources\codex-windows-sandbox-setup.exe ...
[2026-07-09 16:24:37.155 codex-windows-sandbox-setup.exe] setup binary completed
[2026-07-09T08:24:37.183183900+00:00] read-acl-only mode: applying read ACLs
[2026-07-09 16:24:37.819 codex.exe] SUCCESS: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe ...

No matching failure was found in the Codex sandbox log or Windows Application/System event logs for codex-windows-sandbox-setup.exe.

So the original report may be incomplete: the visible dialog path is truncated by Windows, and the failure may not simply be the missing root-level exe. It may be a duplicate UI/elevation/helper launch path or Windows loader/module failure occurring during sandbox setup refresh/read-ACL handling, while the main setup path succeeds.

Showing cached comments. Read the full discussion on GitHub ↗