Windows elevated sandbox cannot launch helper from long npm/WinGet path (os error 3)

Version

Codex CLI 0.144.5 (global npm installation; the reproduction was captured on this version)

Operating system

Microsoft Windows NT 10.0.26200.0, x64; native PowerShell 7.6.2

Installation method

Node.js LTS installed with WinGet, then npm install -g @openai/codex.

Plan and model

N/A. The failure occurs before model execution.

Sandbox configuration

[windows]
sandbox = "elevated"

Problem

On native Windows, every ordinary sandboxed tool call fails before the command starts. The orchestrator reports:

windows sandbox: orchestrator_helper_launch_failed: setup refresh failed to launch helper
error=The system cannot find the path specified. (os error 3)

The generated helper path is the normal WinGet/npm package path (redacted here) ending in codex-windows-sandbox-setup.exe.

Reproduction steps

1. Install Node.js LTS with WinGet.
2. Run npm install -g @openai/codex.
3. Configure native Windows sandboxing with [windows] sandbox = "elevated" and restart Codex.
4. Run any trivial sandboxed shell command.
5. Observe the helper launch failure before the command is executed.

Diagnostics

• The helper file exists at the generated path; the full path is 272 characters long.
• Other binaries in the same installation tree are also deep (codex.exe: 238 characters; codex-command-runner.exe: 265 characters).
• Windows LongPathsEnabled is enabled.
• Launching the helper directly from its original path fails at process creation.
• Copying the identical helper binary to a short temporary path (68 characters) allows it to start; it then reaches application-level payload parsing and reports helper_request_args_failed because no valid payload was supplied. This indicates the binary itself is intact and that the failure is associated with the original path or launch context.
• codex doctor --json reports that installation/config parsing succeeds and the sandbox configuration is readable. The full output is intentionally omitted because it contains local paths and provider details.

Expected behavior

The elevated sandbox helper should launch from a valid npm installation path, including a deep WinGet path, and the sandboxed command should run. If the launcher cannot support such a path, it should resolve or materialize the helper in a short managed location and report a specific launch/path error.

Additional context

This appears related to Windows helper path/launch handling rather than a missing file or malformed sandbox setting. Related reports include #32359, #32655, #29072, and #32315, but this reproduction is specifically a global npm install under a WinGet Node path with a 272-character helper path and a short-path launch comparison.