Repository navigation
Windows app sandbox hangs for every child process; packaged codex.exe returns Access is denied #32184
Description
Summary
In the Codex Windows app, every sandboxed shell command hangs without producing output. This affects both PowerShell and cmd.exe. The same commands complete normally when explicitly run outside the sandbox. A complete uninstall/reinstall did not resolve the issue because it restored the same app build.
Environment
- Codex Windows app:
26.707.3748.0 - Windows 11 Enterprise
10.0.26200(build 26200), AMD64 - PowerShell
7.6.2 - Package status:
Ok - Package install: Microsoft Store/MSIX under
C:\Program Files\WindowsApps
Minimal reproduction
- Open a local repository in the Codex Windows app.
- Run a sandboxed command such as:
Write-Output 'sandbox-ok'
- The command remains active indefinitely and produces no output.
- Run a sandboxed non-PowerShell child process:
cmd.exe /d /c "echo sandbox-cmd-ok"
- It hangs identically with no output.
- Run the first probe with explicit outside-sandbox/escalated execution. It completes successfully in a few seconds.
Additional diagnostic
Launching the helper installed with the app directly also fails:
C:\Program Files\WindowsApps\OpenAI.Codex_26.707.3748.0_x64__2p2nqsd0c76g0\app\resources\codex.exe
HELPER_LAUNCH_ERROR: ... Access is denied.
The app logs previously showed repeated child-process snapshot collection failures and stale Git snapshot messages. Node and npm work normally outside the Codex sandbox.
Expected behavior
Sandboxed child processes should start, stream output, and respect their configured timeout.
Actual behavior
Every sandboxed child process tested hangs without output until manually terminated. Outside-sandbox execution works normally.
Troubleshooting already performed
- Fully uninstalled and reinstalled the Codex Windows app.
- Confirmed the reinstalled package status is
Ok. - Confirmed the reinstall restored the same build,
26.707.3748.0. - Isolated the problem from PowerShell by reproducing it with
cmd.exe. - Confirmed the repository, PowerShell, Node, and npm operate normally outside the sandbox.
A fix or a supported workaround for the packaged helper/sandbox launcher would be appreciated.
Activity
github-actions commentedon Jul 10, 2026
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
git-geeky commentedon Jul 11, 2026
Fresh confirmation with hook isolation evidence on the same app build.
Current environment
26.707.3748.0Okcodex doctorCLI version:0.144.1Fresh minimal reproduction
A normal sandboxed tool call running:
produced no stdout/stderr and remained active for more than 50 seconds. The tool call had a 15-second command timeout configured, but that timeout did not complete the call; it had to be explicitly terminated.
The identical operation executed through the approved outside-sandbox path returned
outside-sandbox-okin 1 ms (excluding tool transport overhead).Custom-hook isolation
I suspected local hooks, so I replaced them with bounded fail-open implementations and tested each layer directly. The sandboxed trivial command still hangs.
Direct hook-chain invocations all returned successfully and silently:
Dedicated inherited-stdin/stalled-child regressions also pass:
This strongly suggests the persistent hang is after/below hook execution, in the desktop sandbox/helper launch or result/timeout path. In particular, the configured command timeout is not being honored while the call is stuck.
Please inspect the Windows desktop app -> sandbox helper/command-runner boundary and add a bounded failure response when helper launch or result collection cannot complete.