Windows: local command runner fails before process creation with “helper_unknown_error: setup refresh had errors” #40215

What version of the Codex App are you using (From “About Codex” dialog)?

Version 26.818.41705

What subscription do you have?

Plus

What platform is your computer?

Microsoft Windows NT 10.0.19045.0 x64

What issue are you seeing?

Codex desktop on Windows cannot run any local command. Every command fails before launching PowerShell with:

Failed to create unified exec process:
helper_unknown_error: setup refresh had errors

This happens for Get-Location in C:\CodexProjects.

I restarted Codex, started new tasks, and reinstalled the desktop app. The bundled PowerShell works when launched manually, so PowerShell itself is healthy:

& "C:\Users\Nick.cache\codex-runtimes\codex-primary-runtime\dependencies\native\powershell\pwsh.exe" -NoProfile -Command "Get-Location"

The local Codex helper/sandbox setup appears to fail before process creation. Please investigate the Windows setup refresh / unified-exec helper failure.

What steps can reproduce the bug?

Feedback ID: 019ff0e5-1899-7353-aadc-68f5c9e4dd3b

1. Open Codex Desktop on Windows.
2. Open local workspace: C:\CodexProjects.
3. Ask Codex to run a harmless read-only command such as Get-Location.
4. Observe the unified-exec failure before PowerShell launches.

Session/feedback ID: 019ff0e5-1899-7353-aadc-68f5c9e4dd3b

Troubleshooting already attempted:

• Restarted Codex.
• Started a new Codex task.
• Reinstalled the Codex Desktop app.
• Confirmed the bundled PowerShell executable runs normally outside Codex.

What is the expected behavior?

Codex should start the local PowerShell helper and return the working directory for Get-Location, subject to the configured approval and sandbox settings.

Additional information

This does not appear to be a firewall or PowerShell-installation problem: the exact bundled pwsh.exe starts successfully outside Codex. The failure is specific to Codex’s unified-exec/helper setup-refresh path.

No project files, API keys, or workflow exports are attached because the issue occurs before any workspace command executes.