Repository navigation
Windows Codex App: unified exec fails with helper_unknown_error: setup refresh had errors #40596
Description
What version of the Codex App are you using (From “About Codex” dialog)?
26.819.11345
What subscription do you have?
ChatGPT Plus
What platform is your computer?
Microsoft Windows NT 10.0.22631.0 x64
What issue are you seeing?
The Codex App cannot start the unified exec terminal helper.
Exact error:
Failed to create unified exec process: helper_unknown_error: setup refresh had errors
The failure occurs before any command starts, including read-only commands such as:
git rev-parse HEAD
Reproduced in:
- the existing project chat;
- a newly created chat in the same local project;
- after restarting the Codex App;
- after restarting Windows;
- after Workspace dependency diagnostics reported
Codex dependencies look healthy; - after reinstalling the Workspace bundle;
- with
[windows] sandbox = "elevated"; - with
[windows] sandbox = "unelevated".
The local project path contains Cyrillic characters. The project and commands worked previously with the same path.
Expected behavior:
The unified exec helper starts and executes the read-only command.
Actual behavior:
The helper fails during setup refresh before the command is launched.
Impact:
Terminal preflight cannot run. Repository staging and commit operations are intentionally paused. No repository changes, staging, or commits were performed during troubleshooting.
The existing .codex/.sandbox/sandbox.log does not contain the current failures. Its last records predate the currently installed Codex App version.
Feedback ID:
01a03853-2618-7b90-9ce3-1d74d3c81a1d
What steps can reproduce the bug?
- Open the Codex App on Windows.
- Open an existing local-project chat or create a new chat in the same project.
- Ask Codex to run a basic read-only terminal command such as
git rev-parse HEAD. - The terminal helper fails before the command starts with:
Failed to create unified exec process: helper_unknown_error: setup refresh had errors. - Repeat after restarting the app or creating another project chat; the same failure occurs.
What is the expected behavior?
The unified exec terminal helper should initialize successfully and execute the requested command in the configured local project directory.
Additional information
No response
Activity
github-actions commentedon Aug 25, 2026
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
kupakupich2026 commentedon Aug 25, 2026
The suggested duplicate #40215 describes the same failure, but it was closed automatically without a documented resolution or confirmed fixed version.
The issue remains reproducible in Codex App version
26.819.11345after restarting Windows, reinstalling the Workspace bundle, creating a new project chat, and testing both Windows sandbox modes.Regular Windows PowerShell works normally. A manual read-only Git check outside Codex confirmed that the local repository exists, its HEAD is readable, and the staged index is empty. The failure is isolated to the Codex unified exec/local command runner before process creation.
Please keep #40596 open, or link it to the current active tracking issue if this regression is already being investigated.
Feedback ID:
01a03853-2618-7b90-9ce3-1d74d3c81a1dMilkyWay008 commentedon Aug 25, 2026
Saw
helper_unknown_error: setup refresh had errorson 26.819.11345, it's the same Windows regression as #40215, which got auto-closed without a fix note, so staying on this build keeps you stuck. While you wait for a patched build, two things helped me: copy the project to a pure-ASCII path, your Cyrillic path is the one variable that's different from the other reporters, and tail.codex/.sandbox/sandbox.logright after the failure, that's where setup refresh writes the real error. And on the Windows install-breaks side of things, I built a portable Hermes OTG, a spare agent on a USB stick that runs outside the broken install so you can still dig in and fix things, https://github.com/MilkyWay008/Hermes-OTG.gsaiching commentedon Aug 25, 2026
Additional diagnostic information from another affected Windows user.
Environment
26.818.8289.026.819.1134526100, x64workspace-writeThe error occurred with both PowerShell and
cmd.exe, before the requested command was started. The bundled PowerShell executable itself works when launched manually.Concrete sandbox error
The sandbox log contains:
D:\Projecthas the following relevant ACL state:Ordinary file operations are possible, but the sandbox setup helper cannot modify the directory ACL.
Possible project/workspace-root synchronization bug
I also observed the following behavior:
D:\Projectremained in the sandbox setup payload.Expected behavior
Editing a project's source folders should refresh the sandbox workspace roots, or the UI should clearly state that changes apply only to newly created tasks.
Actual behavior
The existing task retained the old workspace root. Sandbox setup repeatedly attempted to modify its ACL, failed with Win32 error 5, and prevented every local command from starting.
Workaround
Creating a new Codex project with the actual repository folder registered during initial project creation worked correctly.
normandiazr64 commentedon Aug 26, 2026
Confirmed workaround on Windows
I was hitting the same error:
Codex could not start PowerShell, CMD, Git, or any local process.
I checked:
and found:
5=Access Denied.Then I checked the
.gitowner:It was unexpectedly owned by:
instead of my normal Windows account.
Fix
I closed Codex completely, opened PowerShell as Administrator, and ran:
After reopening Codex, local execution worked again immediately:
No reinstall, reclone,
.gitdeletion, or recursive permission reset was needed.So if you are seeing
setup refresh had errors, check whether your.gitdirectory is owned byCodexSandboxOffline. Restoring ownership to the normal Windows user may fix the issue.yanchao123585-a11y commentedon Aug 27, 2026
I’m experiencing the same issue in the ChatGPT/Codex desktop app on Windows.
App version: 26.820.9563.0
Windows build: 10.0.26200.9168
Subscription: ChatGPT Pro
Error:
Failed to create unified exec process: helper_unknown_error: setup refresh had errors
Standalone Windows CMD works normally, but the failure occurs before PowerShell or cmd can start inside Codex.
Troubleshooting already completed:
The error remains unchanged and no files were modified.
Feedback ID:
no-active-thread-01a041e7-0c0f-7852-90e8-f9c5f11dc036
normandiazr64 commentedon Aug 27, 2026
kupakupich2026 commentedon Aug 27, 2026
Thank you very much for sharing this workaround, and thanks to everyone who confirmed the same issue.
This resolved the problem on my system. The repository root was owned by my normal Windows account, but the
.gitdirectory was unexpectedly owned byCodexSandboxOffline.After fully closing Codex, restoring ownership of
.gitto my normal Windows account from an Administrator PowerShell session, and reopening Codex, unified exec started working again.A read-only preflight then confirmed the correct working directory, the expected HEAD, and an empty staged index. No project files were modified during the ownership repair.
This strongly suggests that the failure was caused by an incorrect Windows ownership/ACL state affecting
.git.Thank you again for identifying and sharing the fix.
ErikPoth-007 commentedon Aug 29, 2026
Another affected Windows user confirming the same exact failure:
Failed to create unified exec process
helper_unknown_error: setup refresh had errors
It recurred across separate project chats and remained after completely quitting and reopening the desktop app. Even a harmless read-only system-clock test failed before execution.
Environment:
I also submitted an in-app feedback report on August 29, 2026. No project files were modified because the failure occurred before command execution.
Exnuz commentedon Aug 29, 2026
Additional diagnostics from another affected Windows system. This case adds a distinction between the two Windows sandbox backends.
Environment
26.825.5331.00.151.0-alpha.7.110.0.26200(x64)[windows] sandbox = "elevated"Symptom
Every unified exec failed before process creation, including
Get-Location, with:codex doctor --jsonreported:Diagnostics performed
codex.exe,codex-code-mode-host.exe, andcodex-windows-sandbox-setup.exe) matched the files in the installed WindowsApps package by SHA-256 and had valid OpenAI signatures.CodexSandboxOffline,CodexSandboxOnline, andCodexSandboxUsersexisted and were enabled..gitand many build artifacts were owned byCodexSandboxOffline, but most retained inherited Modify access.Access is denied, even to the normal user. Their ownership/ACLs were repaired administratively.icacls /verify /T /Cthen found no remaining access errors, but the elevated backend still failed with the same setup-refresh error.Backend comparison / workaround
Without changing the config, this command was tested:
With that override,
sandbox.helpersimmediately becameOK. Persistently changing only:restored unified exec.
Suggested improvements
setup refresh had errorsin both the UI andcodex doctor.CodexSandboxOffline, or make elevated setup able to recover those ownership/ACL states safely.No project contents, credentials, IP addresses, or SSH data are included in this report.
xcai413 commentedon Sep 1, 2026
Additional confirmed case with a concrete ACL failure. This case involves
CodexSandboxOnline, rather than the previously reportedCodexSandboxOfflineowner.Environment
26.825.6671.00.149.1workspace-writeConcrete failure
Every unified exec command fails before the requested process starts:
The current sandbox log records the underlying error:
setup_error.jsoncontains:{ "code": "helper_unknown_error", "message": "setup refresh had errors" }Ownership evidence
A read-only command executed outside the broken sandbox succeeds, but Git reports that
<workspace>\.gitis owned byCodexSandboxOnline, while the interactive Windows account is the normal user. Git consequently reports dubious repository ownership.The bundled
pwsh.exealso runs successfully when launched manually, so the PowerShell binary itself is healthy.Troubleshooting already completed
This suggests that Codex left
.gitowned by a sandbox identity and then could not apply the deny ACE required by the next setup refresh.Please consider:
.gitownership from being transferred to either sandbox identity;helper_unknown_error.thinkdj commentedon Sep 2, 2026
Win 11, cmd, OpenAI Codex (v0.152.1) CLI. Cant make it work (1-2 weeks since this started):
pirolid commentedon Sep 7, 2026
I ran into the same Windows Codex error:
Root cause in my case
The Codex sandbox log showed:
That is Windows
Access Deniedduring sandbox ACL setup.The repository root was owned by my normal Windows account, but the repository's
.codexfolder was owned by:That ownership mismatch was the root cause.
How I verified it
Fix
I fully closed Codex, opened PowerShell as Administrator, and changed ownership of only the affected
.codexfolder back to my normal Windows user:Then I verified the owner again with
Get-Acland reopened Codex.Result
Command execution started working normally again and the
setup refresh had errorsfailure disappeared.So if you see this error, especially with
SetNamedSecurityInfoW failed: 5, check ownership of.codex,.git, and other protected project folders before resetting ACLs or reinstalling Codex.CHaP235 commentedon Sep 11, 2026
Holy shit, dude!
This solved the issue I had for weeks immediately - thx a million!
Turns out, all the folders, files and also git ownerships were not mapped to my current Windows user anymore - which causes the error.
I guess it happened after resetting Windows, losing the current owner which saves the leftover SID as current user (O:S-1-5-21-1699852358...) in all folders/files you keep on your HDD/SSD besides the current one with your new OS installed.
After reclaiming each of it via cmd (takes a while) Codex client works again. If you need help, just copy/paste this URL to your Codex Chat app, he knows what to do next. xD
This maybe is the solution to all of this related
helper_unknown_errorissues.pirolid commentedon Sep 12, 2026
@CHaP235 Yeah, same here. I was dealing with this for a while and had basically given up using Codex because I couldn't get local execution working reliably. Glad this helped.
GShenLin commentedon Oct 1, 2026
Additional reproduction of the same failure signature on Windows, observed through dot's connected-computer execution path on September 30 and October 1, 2026. The latest retest was at 04:43 UTC on October 1.
Reproduction
Get-Locationon that computer.Actual result
The request fails before the process is launched:
Repeated attempts returned the same error. The computer remained visible as connected and authorized, but the read-only command could not start. No local files were read or modified by these tests.
Expected result
The execution helper initializes and
Get-Locationreturns the current directory. If setup fails, the connection/task UI should surface an actionable execution-health error instead of only showing that the computer is connected.Environment and limits
Please advise on a supported diagnostic path or fix for this connected-but-unable-to-execute state.
cfears1968 commentedon Oct 4, 2026
Additional affected Windows user — October 4, 2026
I am experiencing the same Windows Codex unified-exec failure family described in this issue.
Environment
Observed Codex execution error
exec_command failed: CreateProcess { message: "Rejected("Failed to create unified exec process: helper ...
The failure occurred during an established development workflow that had previously been working normally on this same Windows machine/project.
During the incident, Codex became unable to reliably execute processes required for normal development. Restarting Codex and checking background processes did not immediately resolve the problem.
The behavior appears intermittent in my case. After the earlier failures, a later minimal diagnostic test asking Codex to execute a harmless command to print the current working directory succeeded. Therefore I do not want to claim that unified exec is permanently broken; rather, execution became unreliable after previously operating normally.
I submitted an in-app Codex diagnostic report from an affected session with diagnostic logs enabled.
Feedback ID: 01a10477-a016-7481-a4f0-c1915a9cd118
I also contacted OpenAI Support. Support associated this Feedback ID and my Windows/app/CLI versions with the case and recommended correlating my report with this existing Windows unified-exec/sandbox issue family.
Support additionally advised that if the problem reproduces I should capture:
CODEX_HOME/.sandbox/sandbox.log
before restarting, and identified [windows] sandbox = "unelevated" as a supported fallback if the elevated Windows sandbox continues to fail.
I have not yet changed sandbox modes, because execution subsequently worked during the minimal diagnostic test and I want to avoid changing variables before preserving additional evidence.
Please correlate Feedback ID 01a10477-a016-7481-a4f0-c1915a9cd118 with this issue or the active internal Windows unified-exec/sandbox investigation.
If the failure recurs, I can provide the contemporaneous sandbox log and additional exact error output.
777doesit commentedon Oct 7, 2026
I’m seeing the same Windows execution-helper failure on October 6, 2026. Observed versions: Desktop 26.930.7945.0, CLI 0.159.2, daemon 0.160.1.
A read-only file-read/hash-check failed before execution with ‘helper_unknown_error: setup refresh had errors,’ with a matching sandbox log entry. The retained command is truncated, so this is not a complete minimal reproducer.
Separately, resuming an existing session returned ‘account/read failed during TUI bootstrap: account/read transport error: remote app-server worker channel is closed.’ I don’t know whether the failures share a cause. CLI feedback was recorded without logs.
Please advise a supported diagnostic and recovery path that preserves conversations, files and security settings, and whether the transport failure needs a separate issue.
imi0 commentedon Oct 7, 2026
After ChatGPT codex update to Version 26.1002.51308, I got the "helper_unknown_error: setup refresh had errors" too, but in my sandbox log, the error was a shared-violation instead of a .git folder or permission issue:
[2026-10-07T07:09:22.374109+00:00] failed to grant non-inheriting read-attributes ACE on user profile C:\Users\...: open ACL target for root-only update: The process cannot access the file because it is being used by another process. (os error 32); continuing setupRestarting codex or whole windows machine did not help. monitoring node_repl.exe with procmon64.exe while codex was executing a simple Get-Date in the sandbox gave:
SHARING VIOLATION Desired Access: Read Attributes, Synchronize, Maximum Allowed, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/aI was running on elevated workspace - switching to unelevated works for now. :-/
elpirata78 commentedon Oct 8, 2026
I’m encountering the same error on Windows with tasks delegated by my dot. The computer is connected and authorized, and browser automation works, but PowerShell fails before starting, even with this minimal command: Write-Output 'NEXO_PS_OK'.
Error: Failed to create unified exec process: exec-server rejected request (-32603): helper_unknown_error: setup refresh had errors
The failure persisted after restarting the desktop app, reconnecting the computer, selecting Full Access, and creating a new delegated task. No command output or exit code was returned. The underlying setup error is still unknown.
Observed on October 8, 2026. In-app feedback ID: no-active-thread-01a11cb4-4f26-7a21-9d95-798484c6cbc2
Could you advise which diagnostics would help identify the underlying error and whether an available desktop release addresses this failure?
elpirata78 commentedon Oct 9, 2026
Update on my report above: on October 9, 2026, after installing the available Microsoft Store update and restarting the application, a new task delegated by my dot was able to execute PowerShell successfully (exit code 0), including Get-Location and a read-only directory listing. The installed Windows app package is 26.1007.2314.0.
The original
exec-server rejected request (-32603): helper_unknown_error: setup refresh had errorsfailure is no longer reproducing in that new task. No additional filesystem permission changes were needed for this recovery.This confirms recovery in my setup after the update and restart; I cannot confirm which specific change fixed it or whether this resolves all other reports. Thank you for the work on this!