[Windows] MCP App sandbox fails to load on Microsoft Store Codex 26.727.6591.0 (error 5, sandbox setup)

Summary

On the Microsoft Store build of the Codex app (OpenAI.Codex 26.727.6591.0, Windows x64), an MCP App-based skill workflow (Codex Security) shows The MCP app sandbox failed to load. The underlying MCP tools remain callable and create the workspace, but the app cannot render/run the MCP App sandbox, so the UI path is unusable.

Environment

• App: OpenAI.Codex_26.727.6591.0_x64__2p2nqsd0c76g0 (Microsoft Store / MSIX)
• CLI: codex-cli 0.146.0-alpha.9.2 bundled with the app
• OS: Windows 10/11 x64, Chinese locale
• ~/.codex/config.toml: sandbox_mode = "workspace-write", [windows] sandbox = "elevated"
• Trigger: MCP App from codex-security@openai-curated (plugin MCP server codex-security, stdio)

Reproduction

1. Install the Microsoft Store build of Codex 26.727.6591.0.
2. Enable the codex-security@openai-curated plugin and open its security scan MCP App.
3. Run the setup flow that calls open_codex_security_workspace.

Actual: the tool call succeeds and returns a workspace/session, but the app surface displays The MCP app sandbox failed to load. The same failure happens for any MCP App sandbox.

Expected: the MCP App sandbox loads and the workspace UI renders, matching the non-sandboxed app behavior.

Diagnostics

~/.codex/.sandbox/sandbox.2026-08-01.log repeatedly shows:

codex-command-runner-0.146.0-alpha.9.2.exe] hide users: failed to hide current user profile dir (C:\Users\Default): SetFileAttributesW failed for C:\Users\Default: 5 (拒绝访问。)
setup refresh: spawning ...\codex-windows-sandbox-setup.exe (cwd=... payload_len=6928)

The same store-installed codex.exe fails under the default sandbox with Windows error 5 / access denied, while codex exec -s danger-full-access works. enable_mcp_apps is under development/disabled in this build, but the failure also occurs with the default app configuration.

Workarounds

• Run the scan through the terminal/chat workflow instead of the MCP App UI.
• Setting [windows] sandbox = "unelevated" may avoid the elevated sandbox setup path (see #35965).
• Related: #36382 covers the separate problem that DeepSeek-generated catalogs with supports_search_tool: true + tool_mode: null hide MCP tools entirely; the App sandbox failure here is independent and occurs even when the MCP tools are directly callable.