Windows sandbox fails with Smart App Control enabled because unsigned node_repl.exe is blocked

Summary

Codex Desktop cannot create a Windows sandbox on Windows 11 Pro with Smart App Control enabled.

The sandbox fails before PowerShell starts with:

windows sandbox: helper_unknown_error: setup refresh had errors

Investigation shows Windows Code Integrity blocks an unsigned runtime executable (node_repl.exe) while the main codex.exe is properly signed.

Environment

• Codex Desktop: 26.707.3748.0
• Windows 11 Pro 24H2 (Build 26200)
• Installed from OpenAI
• Personal PC (not enterprise managed)

Security:

• SmartAppControlState: On
• DeviceGuardCodeIntegrityPolicyEnforcementStatus: EnforcementMode
• DeviceGuardUserModeCodeIntegrityPolicyEnforcementStatus: EnforcementMode

Reproduction

1. Open Codex Desktop.
2. Create a new task.
3. Sandbox initialization immediately fails.

Actual result

windows sandbox: helper_unknown_error: setup refresh had errors

Diagnostics

Windows Code Integrity logs:

codex.exe attempted to load ...\\OpenAI\\Codex\\runtimes\\cua_node\\...\\bin\\node_repl.exe that did not meet Enterprise signing level requirements or violated code integrity policy.

Authenticode:

• codex.exe: Valid signature (OpenAI OpCo, LLC)
• node_repl.exe: Status = NotSigned

Virtualization is enabled and functioning (VM Monitor Mode Extensions, SLAT, DEP, Virtualization Enabled in Firmware).

Expected

Either:

• sandbox initializes successfully under Smart App Control, or
• Codex reports a descriptive error indicating Windows Code Integrity blocked an unsigned runtime executable.

The generic helper_unknown_error made diagnosis difficult.

If node_repl.exe is expected to execute under Smart App Control / WDAC, it may need to be Authenticode signed or otherwise packaged in a compatible way.