Launching another VS Code Codex window terminates Full access in the existing window (error 1312)

Environment

• OS: Windows 11 Pro, 10.0.26200, x64
• VS Code: 1.128.0
• Codex VS Code extension: openai.chatgpt@26.707.41301
• Bundled Codex CLI: codex-cli 0.144.0-alpha.4
• Multiple VS Code windows, each with its own codex.exe app-server process
• Shared ~/.codex/config.toml defaults:

approval_policy = "on-request"
sandbox_mode = "workspace-write"

[windows]
sandbox = "elevated"

What issue are you seeing?

Codex permission/sandbox state is not independent across multiple VS Code windows on native Windows.

The trigger is launching another VS Code window. If window A already has an active Codex session with Full access, launching window B with the Codex extension causes Full access in window A to end. Window A then falls back to the shared workspace-write / on-request defaults and may route commands through the elevated Windows sandbox.

The affected window can then fail to start commands because its sandbox logon session is no longer valid, producing Windows error 1312.

Closing or restarting a window is not required to trigger the problem.

Error

A representative sanitized error from the previously active VS Code window:

windows sandbox: runner failed during SpawnChild:
CreateProcessAsUserW failed: 1312
(The specified logon session does not exist. It may already have been terminated.)

The error is raised from codex_core::tools::router while starting a routine PowerShell command. No project-specific command is required to explain the failure.

Steps to reproduce

1. On native Windows, configure [windows] sandbox = "elevated".
2. Open VS Code window A and start a Codex session.
3. Select Full access in window A.
4. Leave window A open and launch another VS Code window B with the Codex extension active.
5. Return to window A.
6. Observe that Full access in window A has ended immediately after window B was launched.
7. Run a routine command in window A.
8. The command may now route through the elevated Windows sandbox and fail with CreateProcessAsUserW failed: 1312.

This reproduces repeatedly: launching another VS Code/Codex window is the Full access termination trigger.

Expected behavior

Each VS Code window/app-server should own an independent permission and Windows sandbox lifecycle. Launching another VS Code window should not:

• change or terminate the Full access selection in an existing active window;
• invalidate another window's elevated sandbox logon session; or
• cause commands in the existing window to fail with error 1312.

Additional evidence

Process inspection confirmed that multiple extension-owned codex.exe app-server --analytics-default-enabled processes were running concurrently. The problem occurs when another VS Code window/app-server starts, indicating that permission-state reconciliation or the Windows elevated sandbox/logon-session lifecycle is crossing app-server boundaries.

Related: #30024 reports the same CreateProcessAsUserW failed: 1312 runner error, but this report adds a repeatable multi-VS-Code-window launch trigger and the cross-window Full access termination.

Full logs are omitted because they contain project paths and command output, but sanitized timestamped excerpts can be provided if needed.