Windows ARM64 elevated sandbox: CreateProcessAsUserW failed: 5 launching Store PowerShell after successful setup

What version of Codex is running?

codex-cli 0.146.0

Platform

• Windows 11 Home
• Version/build: 10.0.26200 / 26200
• Architecture: ARM64
• PowerShell: Store-packaged PowerShell 7.6.4 ARM64
• PowerShell path: C:\Program Files\WindowsApps\Microsoft.PowerShell_7.6.4.0_arm64__8wekyb3d8bbwe\pwsh.exe

Configuration

approvals_reviewer = "auto_review"

[windows]
sandbox = "elevated"

[projects.'c:\users\<USER>']
trust_level = "trusted"

Issue

Every ordinary sandboxed shell command fails before PowerShell starts, including a harmless identity check:

Write-Output "sandbox-launch-ok"
whoami

The tool reports:

windows sandbox: runner failed during SpawnChild:
CreateProcessAsUserW failed: 5 (Access denied)

Running the same command through approved external execution succeeds. The external process runs under the normal user at medium integrity (S-1-16-8192).

Relevant sanitized sandbox log

Sandbox setup itself reports success and the copied command runner is resolved:

setup refresh: processed 31 write roots (read roots delegated); errors=[]
codex-windows-sandbox-setup.exe] setup binary completed
helper copy: reused command-runner source=C:\Users\<USER>\AppData\Local\Programs\OpenAI\Codex\bin\codex-command-runner.exe destination=C:\Users\<USER>\.codex\.sandbox-bin\codex-command-runner-0.146.0.exe
helper launch resolution: using copied command-runner path C:\Users\<USER>\.codex\.sandbox-bin\codex-command-runner-0.146.0.exe
codex-command-runner-0.146.0.exe] hide users: failed to hide current user profile dir (C:\Users\Default): SetFileAttributesW failed for C:\Users\Default: 5 (Access denied)

Immediately after that, the client reports CreateProcessAsUserW failed: 5. The sandbox log itself ends at the SetFileAttributesW line and does not record the subsequent process-creation error.

Reproduction

1. Configure [windows] sandbox = "elevated".
2. Fully restart Codex.
3. Run any trivial shell command in the sandbox, such as whoami or Write-Output "test".
4. Observe CreateProcessAsUserW failed: 5 before PowerShell executes.
5. Approve external execution of the same command; it succeeds.

Additional context

• The Microsoft optional Windows Sandbox feature should not be relevant; this is Codex's native local-user/ACL/firewall sandbox.
• The setup helper exists and completes.
• The copied codex-command-runner-0.146.0.exe exists and is selected.
• This may be ARM64-specific, related to launching Store-packaged ARM64 PowerShell under the sandbox user/token, or related to the preceding failure to hide C:\Users\Default.
• Similar generic reports include #25436 and #27987, but this reproduction adds ARM64, Codex 0.146.0, PowerShell 7.6.4 ARM64, and a successful setup/runner-resolution trace.

Expected behavior

A trivial PowerShell command should run through the elevated sandbox, or the runner should return a more actionable diagnosis identifying the denied object or missing right.