Skip to content

Windows Codex App: unified exec fails with helper_unknown_error: setup refresh had errors #40596

Open

Description

@kupakupich2026

What version of the Codex App are you using (From “About Codex” dialog)?

26.819.11345

What subscription do you have?

ChatGPT Plus

What platform is your computer?

Microsoft Windows NT 10.0.22631.0 x64

What issue are you seeing?

The Codex App cannot start the unified exec terminal helper.

Exact error:

Failed to create unified exec process: helper_unknown_error: setup refresh had errors

The failure occurs before any command starts, including read-only commands such as:

git rev-parse HEAD

Reproduced in:

  • the existing project chat;
  • a newly created chat in the same local project;
  • after restarting the Codex App;
  • after restarting Windows;
  • after Workspace dependency diagnostics reported Codex dependencies look healthy;
  • after reinstalling the Workspace bundle;
  • with [windows] sandbox = "elevated";
  • with [windows] sandbox = "unelevated".

The local project path contains Cyrillic characters. The project and commands worked previously with the same path.

Expected behavior:
The unified exec helper starts and executes the read-only command.

Actual behavior:
The helper fails during setup refresh before the command is launched.

Impact:
Terminal preflight cannot run. Repository staging and commit operations are intentionally paused. No repository changes, staging, or commits were performed during troubleshooting.

The existing .codex/.sandbox/sandbox.log does not contain the current failures. Its last records predate the currently installed Codex App version.

Feedback ID:
01a03853-2618-7b90-9ce3-1d74d3c81a1d

What steps can reproduce the bug?

  1. Open the Codex App on Windows.
  2. Open an existing local-project chat or create a new chat in the same project.
  3. Ask Codex to run a basic read-only terminal command such as git rev-parse HEAD.
  4. The terminal helper fails before the command starts with: Failed to create unified exec process: helper_unknown_error: setup refresh had errors.
  5. Repeat after restarting the app or creating another project chat; the same failure occurs.

What is the expected behavior?

The unified exec terminal helper should initialize successfully and execute the requested command in the configured local project directory.

Additional information

No response

Activity

  1. added
    bugSomething isn't working
    windows-osIssues related to Codex on Windows systems
    tool-callsIssues related to tool calling
    sandboxIssues related to permissions or sandboxing
    on Aug 25, 2026
  2. kupakupich2026 commented on Aug 25, 2026

    @kupakupich2026
    Author

    The suggested duplicate #40215 describes the same failure, but it was closed automatically without a documented resolution or confirmed fixed version.

    The issue remains reproducible in Codex App version 26.819.11345 after restarting Windows, reinstalling the Workspace bundle, creating a new project chat, and testing both Windows sandbox modes.

    Regular Windows PowerShell works normally. A manual read-only Git check outside Codex confirmed that the local repository exists, its HEAD is readable, and the staged index is empty. The failure is isolated to the Codex unified exec/local command runner before process creation.

    Please keep #40596 open, or link it to the current active tracking issue if this regression is already being investigated.

    Feedback ID: 01a03853-2618-7b90-9ce3-1d74d3c81a1d

  3. MilkyWay008 commented on Aug 25, 2026

    @MilkyWay008

    Saw helper_unknown_error: setup refresh had errors on 26.819.11345, it's the same Windows regression as #40215, which got auto-closed without a fix note, so staying on this build keeps you stuck. While you wait for a patched build, two things helped me: copy the project to a pure-ASCII path, your Cyrillic path is the one variable that's different from the other reporters, and tail .codex/.sandbox/sandbox.log right after the failure, that's where setup refresh writes the real error. And on the Windows install-breaks side of things, I built a portable Hermes OTG, a spare agent on a USB stick that runs outside the broken install so you can still dig in and fix things, https://github.com/MilkyWay008/Hermes-OTG.

  4. gsaiching commented on Aug 25, 2026

    @gsaiching

    Additional diagnostic information from another affected Windows user.

    Environment

    • Codex Desktop: 26.818.8289.0
    • Workspace runtime: 26.819.11345
    • Windows build: 26100, x64
    • Sandbox mode: workspace-write

    The error occurred with both PowerShell and cmd.exe, before the requested command was started. The bundled PowerShell executable itself works when launched manually.

    Concrete sandbox error

    The sandbox log contains:

    granting write ACE to D:\Project for sandbox group and capability SID
    write ACE grant failed on D:\Project: SetNamedSecurityInfoW failed: 5
    setup refresh completed with errors:
    ["write ACE failed on D:\\Project: SetNamedSecurityInfoW failed: 5"]
    setup error: setup refresh had errors
    

    D:\Project has the following relevant ACL state:

    Owner: BUILTIN\Administrators
    Authenticated Users: Modify
    

    Ordinary file operations are possible, but the sandbox setup helper cannot modify the directory ACL.

    Possible project/workspace-root synchronization bug

    I also observed the following behavior:

    1. A folder registered when a new Codex project is initially created is readable and writable.
    2. A folder added later through Edit project was not propagated correctly to the existing task's sandbox workspace roots.
    3. The newly added folder was inaccessible and could even appear not to exist.
    4. Fully quitting and restarting Codex did not update the existing task.
    5. The old broad root D:\Project remained in the sandbox setup payload.
    6. Creating a new Codex project with the narrower repository folder registered from the beginning restored access.

    Expected behavior

    Editing a project's source folders should refresh the sandbox workspace roots, or the UI should clearly state that changes apply only to newly created tasks.

    Actual behavior

    The existing task retained the old workspace root. Sandbox setup repeatedly attempted to modify its ACL, failed with Win32 error 5, and prevented every local command from starting.

    Workaround

    Creating a new Codex project with the actual repository folder registered during initial project creation worked correctly.

  5. normandiazr64 commented on Aug 26, 2026

    @normandiazr64

    Confirmed workaround on Windows

    I was hitting the same error:

    Failed to create unified exec process:
    helper_unknown_error: setup refresh had errors
    

    Codex could not start PowerShell, CMD, Git, or any local process.

    I checked:

    %USERPROFILE%\.codex\.sandbox\sandbox.YYYY-MM-DD.log
    

    and found:

    deny ACE failed on C:\dev\sample-project\.git:
    SetNamedSecurityInfoW failed for C:\dev\sample-project\.git: 5
    

    5 = Access Denied.

    Then I checked the .git owner:

    (Get-Acl "C:\dev\sample-project\.git").Owner

    It was unexpectedly owned by:

    DESKTOP-EXAMPLE\CodexSandboxOffline
    

    instead of my normal Windows account.

    Fix

    I closed Codex completely, opened PowerShell as Administrator, and ran:

    $me = "$env:USERDOMAIN\$env:USERNAME"
    icacls "C:\dev\sample-project\.git" /setowner "$me"

    After reopening Codex, local execution worked again immediately:

    git status
    git --version
    cmd.exe /c echo CODEX_CMD_OK
    

    No reinstall, reclone, .git deletion, or recursive permission reset was needed.

    So if you are seeing setup refresh had errors, check whether your .git directory is owned by CodexSandboxOffline. Restoring ownership to the normal Windows user may fix the issue.

  6. yanchao123585-a11y commented on Aug 27, 2026

    @yanchao123585-a11y

    I’m experiencing the same issue in the ChatGPT/Codex desktop app on Windows.

    App version: 26.820.9563.0
    Windows build: 10.0.26200.9168
    Subscription: ChatGPT Pro

    Error:
    Failed to create unified exec process: helper_unknown_error: setup refresh had errors

    Standalone Windows CMD works normally, but the failure occurs before PowerShell or cmd can start inside Codex.

    Troubleshooting already completed:

    • Started a new chat
    • Restarted the ChatGPT app
    • Restarted Windows
    • Checked for app and Windows updates
    • Ran Windows App Repair
    • Retested with: cmd.exe /d /c echo CODEX_EXEC_OK

    The error remains unchanged and no files were modified.

    Feedback ID:
    no-active-thread-01a041e7-0c0f-7852-90e8-f9c5f11dc036

  7. normandiazr64 commented on Aug 27, 2026

    @normandiazr64
  8. kupakupich2026 commented on Aug 27, 2026

    @kupakupich2026
    Author

    Thank you very much for sharing this workaround, and thanks to everyone who confirmed the same issue.

    This resolved the problem on my system. The repository root was owned by my normal Windows account, but the .git directory was unexpectedly owned by CodexSandboxOffline.

    After fully closing Codex, restoring ownership of .git to my normal Windows account from an Administrator PowerShell session, and reopening Codex, unified exec started working again.

    A read-only preflight then confirmed the correct working directory, the expected HEAD, and an empty staged index. No project files were modified during the ownership repair.

    This strongly suggests that the failure was caused by an incorrect Windows ownership/ACL state affecting .git.

    Thank you again for identifying and sharing the fix.

  9. ErikPoth-007 commented on Aug 29, 2026

    @ErikPoth-007

    Another affected Windows user confirming the same exact failure:

    Failed to create unified exec process
    helper_unknown_error: setup refresh had errors

    It recurred across separate project chats and remained after completely quitting and reopening the desktop app. Even a harmless read-only system-clock test failed before execution.

    Environment:

    • ChatGPT Windows desktop app 1.2026.190
    • Windows NT 10.0.26200 x64
    • ChatGPT Pro

    I also submitted an in-app feedback report on August 29, 2026. No project files were modified because the failure occurred before command execution.

  10. Exnuz commented on Aug 29, 2026

    @Exnuz

    Additional diagnostics from another affected Windows system. This case adds a distinction between the two Windows sandbox backends.

    Environment

    • Codex Desktop: 26.825.5331.0
    • Bundled Codex CLI: 0.151.0-alpha.7.1
    • Windows 11 Pro: 10.0.26200 (x64)
    • Configured backend when failing: [windows] sandbox = "elevated"

    Symptom

    Every unified exec failed before process creation, including Get-Location, with:

    Failed to create unified exec process: helper_unknown_error: setup refresh had errors
    

    codex doctor --json reported:

    sandbox.helpers: FAIL
    elevated Windows sandbox provisioning recorded a structured failure
    error code: helper_unknown_error
    backend: elevated
    

    Diagnostics performed

    • The three bundled executables (codex.exe, codex-code-mode-host.exe, and codex-windows-sandbox-setup.exe) matched the files in the installed WindowsApps package by SHA-256 and had valid OpenAI signatures.
    • No related Windows Defender, AppLocker, or Code Integrity event was present.
    • CodexSandboxOffline, CodexSandboxOnline, and CodexSandboxUsers existed and were enabled.
    • The workspace root was owned by the normal Windows user. .git and many build artifacts were owned by CodexSandboxOffline, but most retained inherited Modify access.
    • Three generated wheel files had broken ACLs and returned Access is denied, even to the normal user. Their ownership/ACLs were repaired administratively. icacls /verify /T /C then found no remaining access errors, but the elevated backend still failed with the same setup-refresh error.

    Backend comparison / workaround

    Without changing the config, this command was tested:

    codex -c 'windows.sandbox="unelevated"' doctor --json

    With that override, sandbox.helpers immediately became OK. Persistently changing only:

    [windows]
    sandbox = "unelevated"

    restored unified exec.

    Suggested improvements

    1. Surface the specific path and native Win32/ACL error behind setup refresh had errors in both the UI and codex doctor.
    2. Avoid leaving workspace files owned by CodexSandboxOffline, or make elevated setup able to recover those ownership/ACL states safely.
    3. If elevated provisioning fails but unelevated is healthy, report that distinction and offer an explicit, user-approved fallback.

    No project contents, credentials, IP addresses, or SSH data are included in this report.

  11. xcai413 commented on Sep 1, 2026

    @xcai413

    Additional confirmed case with a concrete ACL failure. This case involves CodexSandboxOnline, rather than the previously reported CodexSandboxOffline owner.

    Environment

    • Codex Desktop: 26.825.6671.0
    • Bundled Codex CLI/runtime release: 0.149.1
    • Windows x64
    • Sandbox mode: workspace-write

    Concrete failure

    Every unified exec command fails before the requested process starts:

    Failed to create unified exec process:
    helper_unknown_error: setup refresh had errors
    

    The current sandbox log records the underlying error:

    deny ACE failed on <workspace>\.git:
    SetNamedSecurityInfoW failed for <workspace>\.git: 5
    
    setup refresh completed with errors:
    ["deny ACE failed on <workspace>\\.git: SetNamedSecurityInfoW failed for <workspace>\\.git: 5"]
    
    setup error: setup refresh had errors
    

    setup_error.json contains:

    {
      "code": "helper_unknown_error",
      "message": "setup refresh had errors"
    }

    Ownership evidence

    A read-only command executed outside the broken sandbox succeeds, but Git reports that <workspace>\.git is owned by CodexSandboxOnline, while the interactive Windows account is the normal user. Git consequently reports dubious repository ownership.

    The bundled pwsh.exe also runs successfully when launched manually, so the PowerShell binary itself is healthy.

    Troubleshooting already completed

    • Fully restarted the Codex app several times.
    • Reproduced in newly created same-directory tasks.
    • Ran Windows App Repair.
    • Renamed and rebuilt the Codex runtime cache.
    • Confirmed Workspace dependency discovery succeeds.
    • Confirmed sandbox-external read-only execution works.
    • Preserved the original sandbox logs; no repository data was deleted or reset.

    This suggests that Codex left .git owned by a sandbox identity and then could not apply the deny ACE required by the next setup refresh.

    Please consider:

    1. preventing .git ownership from being transferred to either sandbox identity;
    2. safely detecting and recovering this ownership drift;
    3. surfacing the failing path and Win32 error instead of only helper_unknown_error.
  12. thinkdj commented on Sep 2, 2026

    @thinkdj

    Win 11, cmd, OpenAI Codex (v0.152.1) CLI. Cant make it work (1-2 weeks since this started):

    • The shell helper is currently failing before it can run commands, so I’m retrying with a narrower read before editing.
    • I couldn’t make the edit because the workspace shell failed to start repeatedly (helper_unknown_error). No files were changed.
    
  13. pirolid commented on Sep 7, 2026

    @pirolid

    I ran into the same Windows Codex error:

    helper_unknown_error: setup refresh had errors
    

    Root cause in my case

    The Codex sandbox log showed:

    SetNamedSecurityInfoW failed: 5
    

    That is Windows Access Denied during sandbox ACL setup.

    The repository root was owned by my normal Windows account, but the repository's .codex folder was owned by:

    CodexSandboxOffline
    

    That ownership mismatch was the root cause.

    How I verified it

    (Get-Acl "<REPO>\.codex").Owner

    Fix

    I fully closed Codex, opened PowerShell as Administrator, and changed ownership of only the affected .codex folder back to my normal Windows user:

    icacls "<REPO>\.codex" /setowner "<MACHINE>\<USER>" /T /C

    Then I verified the owner again with Get-Acl and reopened Codex.

    Result

    Command execution started working normally again and the setup refresh had errors failure disappeared.

    So if you see this error, especially with SetNamedSecurityInfoW failed: 5, check ownership of .codex, .git, and other protected project folders before resetting ACLs or reinstalling Codex.

  14. CHaP235 commented on Sep 11, 2026

    @CHaP235

    Confirmed workaround on Windows

    I was hitting the same error:

    Failed to create unified exec process:
    helper_unknown_error: setup refresh had errors
    

    Codex could not start PowerShell, CMD, Git, or any local process.

    I checked:

    %USERPROFILE%\.codex\.sandbox\sandbox.YYYY-MM-DD.log
    

    and found:

    deny ACE failed on C:\dev\sample-project\.git:
    SetNamedSecurityInfoW failed for C:\dev\sample-project\.git: 5
    

    5 = Access Denied.

    Then I checked the .git owner:

    (Get-Acl "C:\dev\sample-project.git").Owner
    It was unexpectedly owned by:

    DESKTOP-EXAMPLE\CodexSandboxOffline
    

    instead of my normal Windows account.

    Fix

    I closed Codex completely, opened PowerShell as Administrator, and ran:

    $me = "$env:USERDOMAIN$env:USERNAME"
    icacls "C:\dev\sample-project.git" /setowner "$me"
    After reopening Codex, local execution worked again immediately:

    git status
    git --version
    cmd.exe /c echo CODEX_CMD_OK
    

    No reinstall, reclone, .git deletion, or recursive permission reset was needed.

    So if you are seeing setup refresh had errors, check whether your .git directory is owned by CodexSandboxOffline. Restoring ownership to the normal Windows user may fix the issue.

    Holy shit, dude!
    This solved the issue I had for weeks immediately - thx a million!
    Turns out, all the folders, files and also git ownerships were not mapped to my current Windows user anymore - which causes the error.

    I guess it happened after resetting Windows, losing the current owner which saves the leftover SID as current user (O:S-1-5-21-1699852358...) in all folders/files you keep on your HDD/SSD besides the current one with your new OS installed.

    After reclaiming each of it via cmd (takes a while) Codex client works again. If you need help, just copy/paste this URL to your Codex Chat app, he knows what to do next. xD

    This maybe is the solution to all of this related helper_unknown_error issues.

  15. pirolid commented on Sep 12, 2026

    @pirolid

    @CHaP235 Yeah, same here. I was dealing with this for a while and had basically given up using Codex because I couldn't get local execution working reliably. Glad this helped.

  16. GShenLin commented on Oct 1, 2026

    @GShenLin

    Additional reproduction of the same failure signature on Windows, observed through dot's connected-computer execution path on September 30 and October 1, 2026. The latest retest was at 04:43 UTC on October 1.

    Reproduction

    1. Connect and authorize a Windows computer for dot tasks.
    2. Confirm the computer is reported as connected, attached, and authorized for tasks.
    3. Request the minimal read-only PowerShell command Get-Location on that computer.

    Actual result

    The request fails before the process is launched:

    Failed to create unified exec process: exec-server rejected request (-32603): helper_unknown_error: setup refresh had errors
    

    Repeated attempts returned the same error. The computer remained visible as connected and authorized, but the read-only command could not start. No local files were read or modified by these tests.

    Expected result

    The execution helper initializes and Get-Location returns the current directory. If setup fails, the connection/task UI should surface an actionable execution-health error instead of only showing that the computer is connected.

    Environment and limits

    • Target computer: Windows; exact Windows build and architecture are not verified
    • Conversation surface: web browser on Windows
    • Desktop app version, bundled runtime version, and sandbox backend: unknown
    • Root cause is not established; matching the error text does not confirm that the ownership/ACL workarounds in this thread apply to this computer

    Please advise on a supported diagnostic path or fix for this connected-but-unable-to-execute state.

  17. cfears1968 commented on Oct 4, 2026

    @cfears1968

    Additional affected Windows user — October 4, 2026
    I am experiencing the same Windows Codex unified-exec failure family described in this issue.
    Environment

    • Windows 11
    • Codex Desktop: 26.930.31730
    • Build: 12947
    • Bundled Codex CLI: 0.160.0
    • ChatGPT paid account
      Observed Codex execution error
      exec_command failed: CreateProcess { message: "Rejected("Failed to create unified exec process: helper ...
      The failure occurred during an established development workflow that had previously been working normally on this same Windows machine/project.
      During the incident, Codex became unable to reliably execute processes required for normal development. Restarting Codex and checking background processes did not immediately resolve the problem.
      The behavior appears intermittent in my case. After the earlier failures, a later minimal diagnostic test asking Codex to execute a harmless command to print the current working directory succeeded. Therefore I do not want to claim that unified exec is permanently broken; rather, execution became unreliable after previously operating normally.
      I submitted an in-app Codex diagnostic report from an affected session with diagnostic logs enabled.
      Feedback ID: 01a10477-a016-7481-a4f0-c1915a9cd118
      I also contacted OpenAI Support. Support associated this Feedback ID and my Windows/app/CLI versions with the case and recommended correlating my report with this existing Windows unified-exec/sandbox issue family.
      Support additionally advised that if the problem reproduces I should capture:
      CODEX_HOME/.sandbox/sandbox.log
      before restarting, and identified [windows] sandbox = "unelevated" as a supported fallback if the elevated Windows sandbox continues to fail.
      I have not yet changed sandbox modes, because execution subsequently worked during the minimal diagnostic test and I want to avoid changing variables before preserving additional evidence.
      Please correlate Feedback ID 01a10477-a016-7481-a4f0-c1915a9cd118 with this issue or the active internal Windows unified-exec/sandbox investigation.
      If the failure recurs, I can provide the contemporaneous sandbox log and additional exact error output.
  18. 777doesit commented on Oct 7, 2026

    @777doesit

    I’m seeing the same Windows execution-helper failure on October 6, 2026. Observed versions: Desktop 26.930.7945.0, CLI 0.159.2, daemon 0.160.1.

    A read-only file-read/hash-check failed before execution with ‘helper_unknown_error: setup refresh had errors,’ with a matching sandbox log entry. The retained command is truncated, so this is not a complete minimal reproducer.

    Separately, resuming an existing session returned ‘account/read failed during TUI bootstrap: account/read transport error: remote app-server worker channel is closed.’ I don’t know whether the failures share a cause. CLI feedback was recorded without logs.

    Please advise a supported diagnostic and recovery path that preserves conversations, files and security settings, and whether the transport failure needs a separate issue.

  19. imi0 commented on Oct 7, 2026

    @imi0

    After ChatGPT codex update to Version 26.1002.51308, I got the "helper_unknown_error: setup refresh had errors" too, but in my sandbox log, the error was a shared-violation instead of a .git folder or permission issue:

    [2026-10-07T07:09:22.374109+00:00] failed to grant non-inheriting read-attributes ACE on user profile C:\Users\...: open ACL target for root-only update: The process cannot access the file because it is being used by another process. (os error 32); continuing setup

    Restarting codex or whole windows machine did not help. monitoring node_repl.exe with procmon64.exe while codex was executing a simple Get-Date in the sandbox gave:

    SHARING VIOLATION Desired Access: Read Attributes, Synchronize, Maximum Allowed, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a

    I was running on elevated workspace - switching to unelevated works for now. :-/

  20. elpirata78 commented on Oct 8, 2026

    @elpirata78

    I’m encountering the same error on Windows with tasks delegated by my dot. The computer is connected and authorized, and browser automation works, but PowerShell fails before starting, even with this minimal command: Write-Output 'NEXO_PS_OK'.

    Error: Failed to create unified exec process: exec-server rejected request (-32603): helper_unknown_error: setup refresh had errors

    The failure persisted after restarting the desktop app, reconnecting the computer, selecting Full Access, and creating a new delegated task. No command output or exit code was returned. The underlying setup error is still unknown.

    Observed on October 8, 2026. In-app feedback ID: no-active-thread-01a11cb4-4f26-7a21-9d95-798484c6cbc2

    Could you advise which diagnostics would help identify the underlying error and whether an available desktop release addresses this failure?

  21. elpirata78 commented on Oct 9, 2026

    @elpirata78

    Update on my report above: on October 9, 2026, after installing the available Microsoft Store update and restarting the application, a new task delegated by my dot was able to execute PowerShell successfully (exit code 0), including Get-Location and a read-only directory listing. The installed Windows app package is 26.1007.2314.0.

    The original exec-server rejected request (-32603): helper_unknown_error: setup refresh had errors failure is no longer reproducing in that new task. No additional filesystem permission changes were needed for this recovery.

    This confirms recovery in my setup after the update and restart; I cannot confirm which specific change fixed it or whether this resolves all other reports. Thank you for the work on this!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    appIssues related to the Codex desktop appbugSomething isn't workingsandboxIssues related to permissions or sandboxingtool-callsIssues related to tool callingwindows-osIssues related to Codex on Windows systems

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions