[Windows Desktop] command runner tries to hide C:\Users\Default on every sandboxed command and logs error 5

What version of the Codex App are you using?

• Codex Desktop MSIX: 26.727.6591.0
• Bundled command runner: 0.146.0-alpha.9.2
• Standalone CLI used for diagnostics: 0.146.0

What platform is your computer?

Windows 11 Pro 10.0.26200 x64.

What issue are you seeing?

Every sandboxed shell launch records this warning:

codex-command-runner-0.146.0-alpha.9.2.exe] hide users: failed to hide current user profile dir (C:\Users\Default): SetFileAttributesW failed for C:\Users\Default: 5 (Access is denied.)

The command itself normally succeeds, but the warning is emitted once per command-runner launch and accumulates rapidly in the sandbox log.

The shell identity is the dedicated <machine>\CodexSandboxOffline account. C:\Users\Default is the protected Windows default-profile template, not a task workspace or user data root. The message also describes it as the “current user profile dir,” which suggests the runner is resolving a fallback/default profile path and then attempting to set filesystem attributes on it.

The behavior persists after the official elevated Windows sandbox setup completes successfully and after per-command setup refresh reports errors=[].

What steps can reproduce the bug?

1. Use Codex Desktop on Windows with the native elevated sandbox and a workspace-write task.
2. Run any sandboxed PowerShell command.
3. Inspect %USERPROFILE%\.codex\.sandbox\sandbox.<date>.log.
4. Observe the SetFileAttributesW failed for C:\Users\Default: 5 warning.
5. Run another command and observe another identical warning.

What is the expected behavior?

The command runner should not try to hide or modify C:\Users\Default.

If the dedicated sandbox account has no loaded profile and Windows resolves the default-profile template, the runner should either:

• use the correct dedicated sandbox profile path; or
• recognize C:\Users\Default as the OS template and skip the hide operation without logging an error for every command.

Fixing this should not require granting the sandbox account or CodexSandboxUsers broader permissions on C:\Users\Default.

Additional information

• Elevated sandbox setup result: success.
• ACL setup refresh result: errors=[].
• Workspace and normal tool execution remain functional.
• No ACL changes were made to C:\Users\Default.
• All usernames, machine names, SIDs, project paths, task/thread IDs, subscription/auth details, model configuration, and business command text have been removed.