VS Code extension (Windows sandbox): apply_batch rejected because codex-windows-sandbox-setup.exe is missing

What version of the VS Code extension are you using?

0.4.62

What subscription do you have?

plus/api

Which IDE are you using?

VS Code

What platform is your computer?

Microsoft Windows NT 10.0.19045.0 x64

What issue are you seeing?

When Windows sandbox mode is enabled in the Codex VS Code extension, file edit application via apply_batch fails. The VS Code UI shows the operation as "rejected" without an actionable reason.

Observed logs:

• Extension log: windows sandbox: spawn setup refresh
• ~/.sandbox/sandbox.log: error indicating setup refresh: failed to spawn codex-windows-sandbox-setup.exe: program not found .

Suspected root cause:

• The VS Code extension appears to ship and invoke its own bundled codex binary by default.
• That bundled copy does not include codex-windows-sandbox-setup.exe, so sandbox initialization fails.
• A separately installed Codex CLI (e.g. via npm) includes the exe and works, which explains why the standalone CLI succeeds while the extension fails.

Impact / risk:

• The UI only shows "rejected", and the model/tool response also lacks the underlying error cause. This can lead the model to misinterpret it as a permission/approval problem and either stop work or attempt workarounds (e.g., apply modification by shell code) that may bypass VS Code’s file-edit tracking / sandbox intent.

What steps can reproduce the bug?

1. In VS Code on Windows, install the Codex extension.
2. Open the Codex Chat tool and start a Codex agent session (either Full agent or the non-full mode).
3. In the agent UI, open the top-right settings/menu and enable Windows Sandbox.
4. Ask the agent to make a small file change that requires applying edits via the extension (i.e., an apply_patch / patch-apply edit).

Example prompt: “Edit README.md and change the first heading text, then apply the patch.”

1. Observe that the patch application fails (the UI shows the action as rejected / the edit is not applied).

What is the expected behavior?

• When Windows sandbox mode is enabled, the extension should either:

1) successfully initialize the sandbox and apply edits via apply_batch, or
2) fail with a clear, actionable error explaining the exact cause (e.g., missing codex-windows-sandbox-setup.exe) instead of a generic “rejected”.

• The tool response sent back to the model should include the underlying failure reason (e.g., ENOENT / missing helper binary), not only “rejected”.

• Safety/behavior: if an editor-mediated file edit tool fails, the assistant should not default to suggesting command-line file writes that bypass the editor/sandbox flow unless the user explicitly asks for such a workaround.

• The extension should document and support selecting the Codex CLI path (e.g., via chatgpt.cliExecutable, or by resolving codex from PATH) so users can use a working installed CLI when the bundled one is incomplete/outdated.

Additional information

Workaround / mitigation:
In VS Code settings.json, point the extension to a separately installed Codex CLI that includes the Windows sandbox helper:

{
  "chatgpt.cliExecutable": "C:\\Path\\To\\Working\\codex.exe"
}

Do not use codex.cmd. It doesn't work.