Skip to content

Windows elevated sandbox breaks node_repl and Browser Runtime #25478

Closed
Closed
Windows elevated sandbox breaks node_repl and Browser Runtime#25478
Labels
appIssues related to the Codex desktop appbrowserbugSomething isn't workingsandboxIssues related to permissions or sandboxingtool-callsIssues related to tool callingwindows-osIssues related to Codex on Windows systems

Description

@varhik-cyber
varhik-cyber
opened on Jun 1, 2026

What version of the Codex App are you using (From “About Codex” dialog)?

26.527.31326

What subscription do you have?

Plus

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

When Codex Desktop is configured with:

[windows]
sandbox = "elevated"

the node_repl kernel fails before executing any user JavaScript.

Minimal test:

nodeRepl.write("ok");

fails with:

node_repl kernel exited unexpectedly
windows sandbox failed: spawn setup refresh
reason: stdout_eof

Because Browser Runtime depends on node_repl, browser automation is also unavailable.

What steps can reproduce the bug?

  1. Configure Codex Desktop:

sandbox_mode = "danger-full-access"

[windows]
sandbox = "elevated"

  1. Restart Codex Desktop.

  2. Execute:

nodeRepl.write("ok");

  1. Observe:

node_repl kernel exited unexpectedly
windows sandbox failed: spawn setup refresh
reason: stdout_eof

Additional confirmation:

Changing

[windows]
sandbox = "unelevated"

and restarting Codex Desktop makes node_repl work again.

What is the expected behavior?

node_repl should start successfully and execute JavaScript regardless of whether Windows sandbox mode is set to elevated or unelevated.

The following call should return successfully:

nodeRepl.write("ok");

Browser Runtime should remain operational because it depends on node_repl.

Additional information

Confirmed workaround:

[windows]
sandbox = "unelevated"

After switching to unelevated and restarting Codex Desktop:

nodeRepl.write(JSON.stringify({ ok: true, cwd: nodeRepl.cwd }));

returns:

{"ok":true,"cwd":"D:\Antigravity\IronHill"}

Browser Runtime also becomes functional again.

Additional observations:

  • Codex-spawned environments contained both PATH and Path variables.
  • PowerShell Env provider reported:
    "An item with the same key has already been added."
  • Attempting:

[mcp_servers.node_repl]
args = ["--disable-sandbox"]

did not affect the actual node_repl.exe command line.

A detailed diagnostic report is attached.

codex-windows-elevated-sandbox-node-repl-report.md

Activity

  1. varhik-cyber
    added
    appIssues related to the Codex desktop app
    on Jun 1, 2026
  2. github-actions
    added
    bugSomething isn't working
    windows-osIssues related to Codex on Windows systems
    sandboxIssues related to permissions or sandboxing
    browser
    tool-callsIssues related to tool calling
    on Jun 1, 2026

  3. github-actions commented on Jun 1, 2026

    @github-actions
    github-actionsBot
    on Jun 1, 2026 – with GitHub Actions
    Contributor

    Potential duplicates detected. Please review them and close your issue if it is a duplicate.

    Powered by Codex Action

  4. LeoNotLao commented on Jun 4, 2026

    @LeoNotLao
    LeoNotLao
    on Jun 4, 2026

    I can confirm the same issue after updating Codex Desktop on Windows. In my case, switching [windows] sandbox from "elevated" to "unelevated" fixed node_repl and restored the Chrome plugin.

    Codex Desktop Windows node_repl / Chrome plugin failure after update

    Summary

    After updating Codex Desktop on Windows, the Chrome plugin and Browser Runtime failed because node_repl could not start. The Chrome extension itself appeared installed and connected, but any attempt to use the Chrome plugin failed before reading tabs or page content.

    The issue was fixed locally by changing:

    [windows]
sandbox = "elevated"

    to:

    [windows]
sandbox = "unelevated"

    and restarting Codex Desktop.

    Environment

    • Platform: Windows
    • Codex Desktop: updated after June 1, 2026
    • Shell: Windows PowerShell
    • Chrome plugin: chrome@openai-bundled
    • Computer Use plugin: computer-use@openai-bundled
    • Chrome extension state: installed and connected
    • Chrome profile detected by runtime after fix: Leo-Main
    • Chrome extension ID observed: hehggadaopoacecdllhhajmbjkdcmajg

    Symptoms

    Minimal node_repl heartbeat failed:

    nodeRepl.write("alive")

    Observed error:

    node_repl kernel exited unexpectedly
node_repl diagnostics: {"kernel_pid":35444,"kernel_status":"running","kernel_stderr_tail":"windows sandbox failed: spawn setup refresh","reason":"stdout_eof","stream_error":null}

    The same error occurred when trying to use the Chrome plugin to list Chrome tabs.

    Local Logs

    The local sandbox log contained:

    setup refresh: failed to spawn C:\Users\RCAO\AppData\Local\OpenAI\Codex\bin\716dda49c14d31a0\codex-windows-sandbox-setup.exe: 请求的操作需要提升。 (os error 740)

    This suggests the failing path was the Windows elevated sandbox setup refresh.

    What Was Verified

    • Chrome plugin files existed under .codex/plugins/cache/openai-bundled/chrome/26.601.21317.
    • Computer Use plugin files existed under .codex/plugins/cache/openai-bundled/computer-use/26.601.21317.
    • Chrome extension UI showed connected.
    • Ordinary shell commands still worked.
    • Plain Node could import the Chrome plugin browser client module, but Chrome bridge initialization outside trusted node_repl was not valid.
    • The failure happened before Gmail or Chrome page content could be accessed.

    Workaround Applied

    Created and ran:

    powershell -ExecutionPolicy Bypass -File "C:\Users\RCAO\Documents\Codex\2026-06-04\chrome-plugin-test\outputs\fix-codex-windows-sandbox-unelevated.ps1"

    The script backed up:

    C:\Users\RCAO\.codex\config.toml

    and changed:

    [windows]
sandbox = "unelevated"

    After restarting Codex Desktop:

    nodeRepl.write("alive")

    returned:

    alive

    The Chrome plugin then successfully listed tabs and read a Gmail tab.

    Impact

    When [windows] sandbox = "elevated" was active, the Chrome plugin and Browser Runtime were unusable because they depend on node_repl. The issue appeared after updating Codex Desktop; it had worked on June 1, 2026 before the update.

    Related Public Reports

    Suggested Upstream Request

    Please confirm whether this is a known Codex Desktop Windows regression in the elevated sandbox setup path, and whether [windows] sandbox = "unelevated" is currently a supported workaround. If elevated sandbox is expected to work, Codex Desktop should either repair the setup flow automatically or show a clearer actionable error when codex-windows-sandbox-setup.exe fails with os error 740.

  5. iceweasel-oai commented on Jun 12, 2026

    @iceweasel-oai
    iceweasel-oai
    on Jun 12, 2026 – with ChatGPT Codex Connector
    Contributor

    this is now fixed

  6. iceweasel-oai
    closed this as completedon Jun 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    appIssues related to the Codex desktop appbrowserbugSomething isn't workingsandboxIssues related to permissions or sandboxingtool-callsIssues related to tool callingwindows-osIssues related to Codex on Windows systems

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions