Windows app stuck on "Finish Windows setup" — sandbox setup never triggers a real UAC prompt, "Retry" fails instantly

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #32149
• #32248
• #32255

Powered by Codex Action

I deleted my .codex/config.toml and restarted the app and it fixed it

I am seeing the same issue on Windows 11 with a ChatGPT Pro account.

Symptoms:

• The app is stuck on Finish Windows setup.
• Clicking Try Windows setup again does not trigger a real Windows UAC prompt.
• The app reports that Windows setup did not finish.
• Continue with limited access does not provide a stable workaround; the app may briefly show the main Codex screen and then return to the same setup loop.

Troubleshooting already attempted without success:

• Reset the app and restarted Windows.
• Uninstalled and reinstalled the app multiple times, including a fresh reinstall again today.
• Confirmed that %USERPROFILE%\.codex\config.toml contained [windows] sandbox = "unelevated".
• Tried the setup button repeatedly; no actual UAC dialog appears.

The same behavior persists after today’s reinstall. This appears to be the same native Windows sandbox/onboarding failure described in this issue, not a one-time installation problem.

Additional detail from another affected Windows user: after a fresh reinstall, %USERPROFILE%\.codex\config.toml does not exist, so the workaround of deleting or renaming config.toml is not applicable. The app still loops on “Finish Windows setup”; clicking Retry does not trigger a real UAC prompt.

Additional reproduction detail from my Windows 11 / ChatGPT Pro installation:

• I renamed %USERPROFILE%\.codex\config.toml so the app would start without the existing user configuration.
• On the next launch, the app temporarily passed the Finish Windows setup gate and displayed the main ChatGPT Work/Codex home screen.
• It then automatically attempted to download/install a ChatGPT update.
• The update failed with the dialog: “Unable to install the ChatGPT update. Try checking for updates again.”
• This machine previously also returned Microsoft Store / winget source connectivity errors (WinHttpSendRequest: 12029, 0x80072efd).

So disabling config.toml changes the failure mode but does not yet produce a stable working installation. Screenshot available if needed.

I found another confirmed root cause that can produce this exact desktop symptom.

The ChatGPT/Codex Windows app was stuck on Finish Windows setup and clicking Retry/UAC did not recover it. Repair, restart, running as administrator, and changing [windows].sandbox did not help.

The actual problem was a malformed %USERPROFILE%\.codex\config.toml. Two project table headers containing non-ASCII/Chinese folder names were missing the closing single quote, for example:

# Invalid
[projects.'D:\codeX\Example项目]

# Valid
[projects.'D:\codeX\Example项目']

The desktop app surfaced this as a Windows setup failure instead of reporting the TOML parse error.

A safe diagnostic was:

npx @openai/codex resume

The CLI reported the exact location:

Error loading config.toml:
...config.toml:87:31: unclosed table, expected `] `

After backing up config.toml and correcting only the malformed project table headers, the Windows desktop app opened normally again with all projects intact.

Suggested troubleshooting before reinstalling or resetting data:

1. Back up %USERPROFILE%\.codex\config.toml.
2. Run npx @openai/codex resume (or another CLI command) to force config parsing and obtain an exact line number.
3. Check every [projects.'...'] header, especially paths with non-ASCII characters, for a missing closing quote/bracket.
4. Fix only the malformed lines; do not rename/delete the whole .codex directory.

It would be helpful if Desktop displayed the underlying config.toml parse error instead of routing users to the Windows sandbox setup screen.

I've discovered another critical root cause for the "Finish Windows setup" hang (where the UAC prompt never triggers) that is related to authentication rather than Windows privileges or system features.

The Underlying Issue

If your user session has expired or the OAuth refresh token has been revoked, the desktop app fails to fetch the cloud configuration bundle (cloudConfigBundle) during startup:

failed to load configuration: Your access token could not be refreshed because your refresh token was revoked. Please log out and sign in again.

This causes the backend windowsSandbox/setupStart call to fail with a 401 Unauthorized / Auth error. Instead of displaying a prompt to log out and log in again, the Desktop UI incorrectly routes this error to the "Finish Windows setup" gate, making it appear as a permissions/sandbox setup failure.

The Fix / Workaround

To break the loop and force the app to show the login screen:

1. Close the ChatGPT/Codex Desktop application completely.
2. Open File Explorer and navigate to your user profile directory: %USERPROFILE%\.codex (usually C:\Users\<username>\.codex).
3. Locate the file named auth.json.
4. Rename auth.json to auth.json.bak (or delete it).
5. Relaunch the ChatGPT/Codex app.

The app will now detect that no login session exists, skip the sandboxing gate, and successfully route you to the Sign In screen. Once you log back in, a fresh OAuth session will be established, and the app will open normally.