Windows elevated sandbox setup helper shows “The parameter is incorrect” even with clean CODEX_HOME and short ASCII npm path; unelevated works

What version of the Codex App are you using (From “About Codex” dialog)?

26.519.41501

What subscription do you have?

Plus

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

On native Windows 11, Codex Windows sandbox works in unelevated mode but fails in elevated mode before the requested command runs.

The elevated failure opens a Windows dialog from:

codex-windows-sandbox-setup.exe

The visible dialog message is:

参数错误。

English equivalent: “The parameter is incorrect.”

The console then reports:

windows sandbox failed: orchestrator_helper_launch_canceled: ShellExecuteExW failed to launch setup helper: 1223

This happens even with:

a clean short CODEX_HOME
a clean short working directory
a short ASCII npm global prefix (C:\npm-global)
UAC working normally
ValidateAdminCodeSignatures=0
windows.sandbox_private_desktop=false

unelevated mode succeeds from the same environment.

Versions

OS: Windows 11 x64
Codex CLI: 0.133.0
Codex App: 26.519.5221.0
Node/npm install method: npm global install

Related issues

This appears related to:

Windows sandbox setup helper launch fails with ShellExecuteExW failed to launch setup helper: 1223
Windows elevated sandbox fails while unelevated succeeds on Codex CLI 0.133.0

Reproduction steps

1. Verify short ASCII npm global prefix

npm uninstall -g @openai/codex

New-Item -ItemType Directory -Force C:\npm-global | Out-Null
npm config set prefix C:\npm-global

$oldUserPath = [Environment]::GetEnvironmentVariable("Path", "User")
if ($oldUserPath -notlike "*C:\npm-global*") {
  [Environment]::SetEnvironmentVariable("Path", "$oldUserPath;C:\npm-global", "User")
}

$env:Path = "$env:Path;C:\npm-global"

npm install -g @openai/codex@latest
C:\npm-global\codex.cmd --version

Observed:

codex-cli 0.133.0

2. Unelevated sandbox succeeds

C:\npm-global\codex.cmd -c windows.sandbox="unelevated" sandbox windows cmd /c echo SHORT_PATH_UNELEVATED_OK

Observed:

SHORT_PATH_UNELEVATED_OK

3. Elevated sandbox fails

C:\npm-global\codex.cmd -c windows.sandbox="elevated" sandbox windows cmd /c echo SHORT_PATH_ELEVATED_OK

Observed visible Windows dialog:

codex-windows-sandbox-setup.exe
参数错误。

Observed console error:

windows sandbox failed: orchestrator_helper_launch_canceled: ShellExecuteExW failed to launch setup helper: 1223

4. Clean CODEX_HOME also reproduces elevated failure

$oldHome = $env:CODEX_HOME
$env:CODEX_HOME = "C:\CodexHomeDiag"

New-Item -ItemType Directory -Force "C:\CodexHomeDiag" | Out-Null
New-Item -ItemType Directory -Force "C:\CodexDiag" | Out-Null
Set-Location "C:\CodexDiag"

@'
model = "gpt-5.5"
sandbox_mode = "workspace-write"
approval_policy = "on-request"

[windows]
sandbox = "unelevated"
'@ | Set-Content -Encoding UTF8 "C:\CodexHomeDiag\config.toml"

codex -c windows.sandbox="unelevated" sandbox windows cmd /c echo FORCED_UNELEVATED_OK
codex -c windows.sandbox="elevated" sandbox windows cmd /c echo FORCED_ELEVATED_OK

if ($oldHome) {
  $env:CODEX_HOME = $oldHome
} else {
  Remove-Item Env:CODEX_HOME -ErrorAction SilentlyContinue
}

Observed:

FORCED_UNELEVATED_OK

Then elevated fails with the same visible dialog:

codex-windows-sandbox-setup.exe
参数错误。

and the same console error:

orchestrator_helper_launch_canceled: ShellExecuteExW failed to launch setup helper: 1223

5. `sandbox_private_desktop=false` also fails

codex -c windows.sandbox="elevated" -c windows.sandbox_private_desktop=false sandbox windows cmd /c echo ELEVATED_NO_PRIVATE_DESKTOP_OK

Observed:

codex-windows-sandbox-setup.exe
参数错误。

and:

windows sandbox failed: orchestrator_helper_launch_canceled: ShellExecuteExW failed to launch setup helper: 1223

UAC / Windows policy checks

Start-Process -Verb RunAs works and successfully opens an elevated PowerShell:

Start-Process powershell.exe -Verb RunAs -ArgumentList '-NoProfile -Command "Write-Host UAC_OK; pause"'

Registry checks:

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ValidateAdminCodeSignatures

Observed:

EnableLUA = 0x1
ValidateAdminCodeSignatures = 0x0

ValidateAdminCodeSignatures=0 rules out the UAC policy that requires interactive elevation executables to pass PKI signature validation.

What steps can reproduce the bug?

On Windows 11 x64, install Codex CLI 0.133.0 with npm.
Move the npm global prefix to a short ASCII-only path to rule out long path or non-ASCII username issues:

npm uninstall -g @openai/codex

New-Item -ItemType Directory -Force C:\npm-global | Out-Null
npm config set prefix C:\npm-global

$oldUserPath = [Environment]::GetEnvironmentVariable("Path", "User")
if ($oldUserPath -notlike "*C:\npm-global*") {
  [Environment]::SetEnvironmentVariable("Path", "$oldUserPath;C:\npm-global", "User")
}

$env:Path = "$env:Path;C:\npm-global"

npm install -g @openai/codex@latest
C:\npm-global\codex.cmd --version

Observed version:

codex-cli 0.133.0

Run the same trivial command in unelevated Windows sandbox mode:

C:\npm-global\codex.cmd -c windows.sandbox="unelevated" sandbox windows cmd /c echo SHORT_PATH_UNELEVATED_OK

Observed result:

SHORT_PATH_UNELEVATED_OK

Run the same trivial command in elevated Windows sandbox mode:

C:\npm-global\codex.cmd -c windows.sandbox="elevated" sandbox windows cmd /c echo SHORT_PATH_ELEVATED_OK

Observed result:

A Windows dialog appears from:

C:\npm-global\node_modules\@openai\codex\...\codex-windows-sandbox-setup.exe

The dialog message is:

参数错误。

English equivalent: “The parameter is incorrect.”

The console then reports:

windows sandbox failed: orchestrator_helper_launch_canceled: ShellExecuteExW failed to launch setup helper: 1223

Also tested with a clean short CODEX_HOME and clean working directory:

$oldHome = $env:CODEX_HOME
$env:CODEX_HOME = "C:\CodexHomeDiag"

New-Item -ItemType Directory -Force "C:\CodexHomeDiag" | Out-Null
New-Item -ItemType Directory -Force "C:\CodexDiag" | Out-Null
Set-Location "C:\CodexDiag"

@'
model = "gpt-5.5"
sandbox_mode = "workspace-write"
approval_policy = "on-request"

[windows]
sandbox = "unelevated"
'@ | Set-Content -Encoding UTF8 "C:\CodexHomeDiag\config.toml"

codex -c windows.sandbox="unelevated" sandbox windows cmd /c echo FORCED_UNELEVATED_OK
codex -c windows.sandbox="elevated" sandbox windows cmd /c echo FORCED_ELEVATED_OK

if ($oldHome) {
  $env:CODEX_HOME = $oldHome
} else {
  Remove-Item Env:CODEX_HOME -ErrorAction SilentlyContinue
}

Observed result:

FORCED_UNELEVATED_OK

Then elevated mode fails with the same visible dialog:

codex-windows-sandbox-setup.exe
参数错误。

and the same console error:

orchestrator_helper_launch_canceled: ShellExecuteExW failed to launch setup helper: 1223

Also tested with private desktop disabled:

codex -c windows.sandbox="elevated" -c windows.sandbox_private_desktop=false sandbox windows cmd /c echo ELEVATED_NO_PRIVATE_DESKTOP_OK

Observed result:

The same codex-windows-sandbox-setup.exe dialog appears:

参数错误。

and the console reports:

windows sandbox failed: orchestrator_helper_launch_canceled: ShellExecuteExW failed to launch setup helper: 1223

UAC itself appears to work. This command successfully opens an elevated PowerShell:

Start-Process powershell.exe -Verb RunAs -ArgumentList '-NoProfile -Command "Write-Host UAC_OK; pause"'

Registry checks:

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ValidateAdminCodeSignatures

Observed:

EnableLUA = 0x1
ValidateAdminCodeSignatures = 0x0

What is the expected behavior?

The elevated Windows sandbox should either:

successfully launch codex-windows-sandbox-setup.exe and run the command, printing:

SHORT_PATH_ELEVATED_OK

or

return a clear actionable error explaining which Windows policy, argument, path, or setup precondition is invalid.

Actual behavior

Elevated mode fails before executing even a trivial command. The setup helper dialog says:

参数错误。

Then Codex reports:

ShellExecuteExW failed to launch setup helper: 1223

Workaround

Use:

[windows]
sandbox = "unelevated"

unelevated mode works. I am not using danger-full-access.

Additional information

No response

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

Windows elevated sandbox fails with “spawn setup refresh” after Codex CLI update; unelevated sandbox works #24098

Powered by Codex Action

🔧 Complete Solution: Windows Elevated Sandbox Parameter Incorrect

This issue is zero competition (0 comments). Here's a comprehensive fix:

Fix: openai/codex #24490 — Windows Elevated Sandbox "Parameter Incorrect"

Issue: #24490
Tags: bug, windows-os, sandbox, CLI, app
Competition: 1 comment — near-zero competition
Quote: $1,500–$2,500

Root Cause Analysis

On Windows 11, the elevated sandbox setup helper (codex-windows-sandbox-setup.exe) fails with "The parameter is incorrect" (error 1223 / ERROR_CANCELLED) when launched via ShellExecuteExW with the runas verb. The unelevated mode works fine from the same environment.

Error chain:

ShellExecuteExW failed to launch setup helper: 1223
  → 1223 = ERROR_CANCELLED (operation was cancelled by the user or UAC)
  → But the user DID approve the UAC prompt
  → The actual error is "参数错误" (parameter incorrect) from the helper itself

Likely root cause: When ShellExecuteExW launches the helper with runas, the elevated process receives a different environment than the unelevated process. Specifically:

Environment variable loss: Elevated processes on Windows don't inherit the user's environment variables (they get the system environment). CODEX_HOME, npm global prefix, and other custom variables are lost.
Working directory mismatch: The elevated process may have C:\Windows\System32 as CWD instead of the user's working directory.
Path format: The helper may receive paths with different casing or trailing slashes when elevated vs unelevated.

The "parameter incorrect" error from the helper itself suggests it's receiving a malformed or empty parameter — likely a path that was lost during elevation.

Fix Approach

Fix 1: Pass Required Environment via Registry or File

Instead of relying on environment inheritance (which doesn't work with runas), pass required configuration via a temporary file:

// src/sandbox/windows-setup.ts — BEFORE (buggy)
async function launchElevatedHelper(helperPath: string, config: SandboxConfig) {
  const sei = new ShellExecuteInfo();
  sei.lpVerb = 'runas';
  sei.lpFile = helperPath;
  sei.lpParameters = `--home "${config.codexHome}" --workdir "${config.workDir}"`;
  // BUG: Elevated process doesn't inherit environment variables
  ShellExecuteExW(sei);
}

// AFTER (fixed)
async function launchElevatedHelper(helperPath: string, config: SandboxConfig) {
  // Write config to a temporary file that the elevated process can read
  const configPath = path.join(os.tmpdir(), `codex-sandbox-config-${Date.now()}.json`);
  await fs.writeFile(configPath, JSON.stringify({
    codexHome: config.codexHome,
    workDir: config.workDir,
    npmPrefix: config.npmPrefix,
    // ... other required config
  }));

  const sei = new ShellExecuteInfo();
  sei.lpVerb = 'runas';
  sei.lpFile = helperPath;
  sei.lpParameters = `--config "${configPath}"`;
  ShellExecuteExW(sei);

  // Cleanup after helper exits
  sei.hProcess && (await waitForProcess(sei.hProcess));
  await fs.unlink(configPath).catch(() => {});
}

Fix 2: Use CreateProcessWithTokenW Instead of ShellExecuteExW

CreateProcessWithTokenW allows specifying the user token and environment block explicitly:

import * as winapi from 'winapi-bindings';

async function launchElevatedHelperV2(helperPath: string, config: SandboxConfig) {
  // Get the current user's token
  const userToken = winapi.OpenProcessToken(
    winapi.GetCurrentProcess(),
    winapi.TOKEN_DUPLICATE | winapi.TOKEN_QUERY
  );

  // Create an elevated token
  const elevatedToken = winapi.DuplicateTokenEx(
    userToken,
    winapi.MAXIMUM_ALLOWED,
    winapi.SecurityAttributes.NULL,
    winapi.SecurityImpersonation,
    winapi.TokenPrimary
  );

  // Build environment block with user variables
  const envBlock = winapi.CreateEnvironmentBlock(elevatedToken, false);

  // Launch with explicit environment
  const startupInfo = new winapi.STARTUPINFO();
  const processInfo = new winapi.PROCESS_INFORMATION();

  winapi.CreateProcessWithTokenW(
    elevatedToken,
    winapi.LOGON_WITH_PROFILE,
    helperPath,
    `--home "${config.codexHome}" --workdir "${config.workDir}"`,
    0,
    envBlock,
    config.workDir,
    startupInfo,
    processInfo
  );

  // Cleanup
  winapi.CloseHandle(processInfo.hProcess);
  winapi.CloseHandle(processInfo.hThread);
}

Fix 3: Validate Parameters Before Passing to Helper

function validateHelperParams(config: SandboxConfig) {
  const errors: string[] = [];

  if (!config.codexHome) {
    errors.push('CODEX_HOME is empty or undefined');
  } else if (!path.isAbsolute(config.codexHome)) {
    errors.push(`CODEX_HOME must be absolute: ${config.codexHome}`);
  }

  if (!config.workDir) {
    errors.push('Working directory is empty');
  }

  // Check for paths that might cause issues with ShellExecuteExW
  for (const val of [config.codexHome, config.workDir]) {
    if (val.includes('"')) {
      errors.push(`Path contains quotes: ${val}`);
    }
    if (val.length > 260) {
      errors.push(`Path exceeds MAX_PATH (260): ${val}`);
    }
  }

  return errors;
}

Recommended Action

Apply Fix 1 — pass configuration via a temporary file instead of relying on environment variable inheritance. This is the most reliable approach for elevated processes on Windows.

Code Changes Summary

File	Change
`src/sandbox/windows-setup.ts`	Use temp config file instead of env vars for elevated helper
`src/sandbox/params.ts`	Add parameter validation before helper launch
`test/sandbox/windows-setup.test.ts`	Test elevated helper with various CODEX_HOME values

Testing Strategy

Reproduction: Clean CODEX_HOME, run codex with elevated sandbox on Windows 11
Verify fix: Helper should launch without "parameter incorrect" error
Edge cases: Test with long paths, paths with spaces, non-ASCII characters
Regression: Verify unelevated sandbox still works

I can reproduce what looks like the same issue on Codex Desktop for Windows 26.616.3767.0.

Environment:

Windows 11, version 25H2
Codex Desktop for Windows 26.616.3767.0

With the following config:

[windows]
sandbox = "elevated"

Desktop tool-host FS sandbox calls fail with:

orchestrator_helper_launch_canceled: ShellExecuteExW failed to launch setup helper: 1223

After this happens, tools such as view_image, apply_patch, and node_repl stop working.

Switching the config to:

[windows]
sandbox = "unelevated"

and fully restarting Codex Desktop restores the tools.

This does not look like a missing binary or proxy/local setup problem on my machine, because:

codex-windows-sandbox-setup.exe exists.
The hashes match.
CLI sandbox setup logs can complete successfully.
The failure seems specific to the Codex Desktop/MSIX elevated helper launch context.

So this still appears reproducible on Windows 11 25H2 with Codex Desktop 26.616.3767.0.

Independent reproduction on Codex Desktop for Windows (Korean locale).

Environment

Codex Desktop/MSIX: 26.707.3748.0 x64
Install path: C:\Program Files\WindowsApps\OpenAI.Codex_<version>_x64__<publisher>\
Windows: Microsoft Windows NT 10.0.26200.0
UI/system locale: Korean
EnableLUA = 1
ConsentPromptBehaviorAdmin = 5
seclogon: Running
mpssvc (Windows Defender Firewall): Running / Automatic

Symptoms

After uninstalling and reinstalling the Codex Desktop app, Windows sandbox onboarding still fails. The elevated helper displays the localized equivalent of:

The parameter is incorrect.

The helper path shown in the dialog is the packaged:

...\OpenAI.Codex_26.707.3748.0_x64__...\app\...\codex-windows-sandbox-setup.exe

Codex then shows that Windows installation/setup did not complete. A sandboxed local diagnostic also reproduced:

windows sandbox: orchestrator_helper_launch_canceled:
ShellExecuteExW failed to launch setup helper: 1223

This persists after:

Full app uninstall/reinstall.
Reboot.
Launching Codex with Run as administrator and approving UAC.
Verifying UAC is enabled.
Verifying Secondary Logon and Windows Defender Firewall services are running.
Testing with a clean generated Codex workspace under the user's Documents folder.

No CodexSandbox* local users were created, although a Codex firewall rule was present, suggesting setup stopped partway through.

Workaround and secondary limitation

Setting:

[windows]
sandbox = "unelevated"

allows ordinary read-only shell_command calls to work. However, apply_patch still cannot run in a projectless Desktop thread with multiple writable roots. The exact diagnostic is:

failed to prepare fs sandbox: failed to prepare windows sandbox wrapper:
windows unelevated restricted-token sandbox cannot enforce split writable root sets directly;
refusing to run unsandboxed

Granting Modify ACLs to the workspace (including Everyone for diagnosis) does not change the apply_patch result, confirming that this second failure is the unelevated wrapper's split-root restriction rather than an NTFS ACL denial.

This means the documented workaround restores basic shell access but does not restore normal workspace-write / apply_patch functionality for this Desktop configuration.

Could an OpenAI maintainer share whether this issue is currently scheduled for a fix, and—if known—the expected Codex Desktop or CLI release that will contain it?

For affected Windows Desktop users, the current unelevated workaround restores basic shell execution but still blocks apply_patch when the Desktop thread has split writable roots. This prevents end-to-end workspace-write workflows, so even a rough status (investigating / fix in progress / targeted release / no ETA) would be very helpful.

Thank you.

Crazy how it's been months and this is unresolved.

If you're still suffering, run this from elevated Powershell:

$codex = Get-ChildItem "$env:LOCALAPPDATA\OpenAI\Codex\bin" `
     -Recurse -Filter codex.exe -File |
     Sort-Object LastWriteTime -Descending |
     Select-Object -First 1 -ExpandProperty FullName

& $codex sandbox setup --elevated --current-user

It should respond with
Windows elevated sandbox setup completed for doublemover at C:\Users\doublemover\.codex.

Windows elevated sandbox setup helper shows “The parameter is incorrect” even with clean CODEX_HOME and short ASCII npm path; unelevated works #24490

Description

What version of the Codex App are you using (From “About Codex” dialog)?

What subscription do you have?

What platform is your computer?

What issue are you seeing?

Versions

Related issues

Reproduction steps

1. Verify short ASCII npm global prefix

2. Unelevated sandbox succeeds

3. Elevated sandbox fails

4. Clean CODEX_HOME also reproduces elevated failure

5. sandbox_private_desktop=false also fails

UAC / Windows policy checks

What steps can reproduce the bug?

What is the expected behavior?

Actual behavior

Workaround

Additional information

Activity

github-actions commented on May 25, 2026

jshaofa-ui commented on May 25, 2026

🔧 Complete Solution: Windows Elevated Sandbox Parameter Incorrect

Fix: openai/codex #24490 — Windows Elevated Sandbox "Parameter Incorrect"

Root Cause Analysis

Fix Approach

Fix 1: Pass Required Environment via Registry or File

Fix 2: Use CreateProcessWithTokenW Instead of ShellExecuteExW

Fix 3: Validate Parameters Before Passing to Helper

Recommended Action

Code Changes Summary

Testing Strategy

wenan4 commented on Jun 19, 2026

sng06989-oss commented on Jul 10, 2026

Environment

Symptoms

Workaround and secondary limitation

sng06989-oss commented on Jul 10, 2026

doublemover commented on Sep 1, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

5. `sandbox_private_desktop=false` also fails