Windows Desktop: unelevated sandbox still repeatedly launches elevated setup helper #23712

What version of the Codex App are you using (From “About Codex” dialog)?

26.513.40821

What subscription do you have?

Plus

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Codex Desktop on Windows keeps attempting sandbox setup even with:

sandbox_mode = "workspace-write"

[windows]
sandbox = "unelevated"

Each sandboxed shell command opens a Windows credential prompt for Codex helper elevated access. I cancel it every time.

sandbox.log shows:

[2026-05-20 17:50:35.639 codex.exe] sandbox setup required: sandbox setup marker missing or incompatible
[2026-05-20 17:50:56.218 codex.exe] START: C:\Program Files\PowerShell\7\pwsh.exe -NoProfile -Command [Console]::OutputEncoding=[System.Text.Encoding]::UTF8;
Get-ChildItem -Force
[2026-05-20 17:50:56.229 codex.exe] sandbox setup required: sandbox setup marker missing or incompatible

What steps can reproduce the bug?

1. Install and launch Codex Desktop on Windows.

2. Open or create C:\Users\<user>\.codex\config.toml.

3. Configure Codex with:

   sandbox_mode = "workspace-write"

   [windows]
   sandbox = "unelevated"

4. Fully restart Codex Desktop.

5. Open any local workspace.

6. Ask Codex to run a simple sandboxed shell command, for example Get-ChildItem -Force or Get-Location.

7. Observe that a Windows credential/UAC prompt appears for the Codex sandbox/helper elevated setup.

8. Cancel the credential prompt.

9. Repeat another simple shell command.

10. Observe that the same helper prompt appears again.

What is the expected behavior?

With windows.sandbox = "unelevated", Codex should not repeatedly prompt for elevated helper setup, or should provide a documented config option to disable that setup attempt while keeping sandbox_mode = "workspace-write".

Additional information

No response