Repository navigation
[Windows] App stuck on logo splash at startup (renderer misses the initial local app-server "connected" state), and Windows sandbox setup always fails with "only managed permission profiles can be enforced by the Windows sandbox" #49718
Description
What version of the Codex App are you using (From “About Codex” dialog)?
26.928.21956 (MSIX package OpenAI.Codex 26.928.2636.0, bundled app-server 0.159.2). The startup hang also happened on 26.924.22138 and 26.928.20755.
What subscription do you have?
ChatGPT Pro (auth token reports plan type "prolite")
What platform is your computer?
Microsoft Windows NT 10.0.26200.0 x64 (Windows 11 Pro, pt-BR locale)
What issue are you seeing?
There are two separate problems. The first one blocks the app from opening. The second one blocks sending any message once the app opens.
1. App stays on the logo splash forever at startup (intermittent, about 50-60% of cold launches)
Clicking the app icon opens the window, but it only shows the centered Codex logo on a dark background. It stays like that for hours. All processes are idle (0 CPU). Clicking the icon again only refocuses the same stuck window, because the app is single-instance. There is no user-facing way to reload the window, so the only way out is to kill ChatGPT.exe and codex.exe and try again.
Timeline:
- Last normal launch: 2026-09-29 22:27 local time, on 26.924.22138.
- First stuck launch: 2026-09-30 01:16 local time, still on 26.924.22138. This was before the update to 26.928, so the update did not cause it.
- Reinstalling the MSIX (fresh
LocalCache/ Electron profile) did not fix it. - Repeated tests today: launched 4 times from the exe (2 stuck, 2 ok), then 3 times through
shell:AppsFolder\OpenAI.Codex_2p2nqsd0c76g0!App(2 stuck, 1 ok).
Root cause (from the desktop logs in %LOCALAPPDATA%\Packages\OpenAI.Codex_2p2nqsd0c76g0\LocalCache\Local\Codex\Logs)
It is a startup race between the main process and the renderer:
- The main process spawns the app-server over stdio. Right after launch (about 0.2 s), it reaches
post_initialize_connection_stateforhostId=local(currentState=connecting,initialized=true). - The renderer takes about 5-10 s to boot. On a successful launch the log says
[startup][renderer] app routes mounted after 10738ms. - Stuck launches: the renderer never logs
remote_connections.manager_state_set hostId=local. It only receiveshostId=durabletransitions (connecting, then connected).Handled 'ready' messagenever appears, and the main window stays on the splash loader. My reading is that the initial local connection state is broadcast before the renderer subscribes, and it is never replayed. - Successful launches: by luck, a later app-server stderr WARN arrives after the renderer has subscribed. For example:
ignoring invalid experimental feature enablement keys: apps_mcp_path_override, or
ignoring interface.defaultPrompt[0]: prompt must be at most 128 characters.
These lines are surfaced ashost_connection_state_changedforhostId=localwithnextState=connectedandnextError={"code":"connection-failed","message":"<the stderr WARN json>"}. That tells the renderer that local is connected, and it mounts right away. So whether the app opens depends on that timing.
Supporting evidence from Chrome DevTools, attached with --remote-debugging-port:
- In the stuck main window (
app://-/index.html),#rootonly contains the splash loader (body.innerHTMLabout 10 KB,innerTextempty,readyStatecomplete). - There are no exceptions and no console errors. The only console messages are the usual warnings: react-router
Matched leaf route at location "/" does not have an element or Component, and StatsigThe user does not have the required id_type "workspace_id". - Calling
Page.reloadon that same stuck window always renders the full UI immediately (innerHTMLabout 247 KB). - A second window (
app://-/detached-window.html?initialRoute=/detached-window) also exists and is empty. - While stuck, the app-server is healthy. It answers
initialize,experimentalFeature/enablement/set,remoteControl/enable,skills/list,windowsSandbox/readinessandconfig/batchWrite.
2. "Não foi possível enviar a mensagem / Atualize a sandbox do Agent para continuar"
Once the app does open, every message fails. The dialog says "Não foi possível enviar a mensagem" ("Could not send the message") and "Atualize a sandbox do Agent para continuar" ("Update the Agent sandbox to continue"). The composer banner says "A configuração do Windows não foi concluída" ("Windows setup was not completed") and "Configuração interrompida" ("Setup interrupted"). Clicking "Refazer configuração" ("Redo setup") fails instantly, with no UAC prompt and nothing written to ~/.codex/.sandbox (the folder does not exist).
I reproduced it by talking to the bundled app-server directly (codex.exe app-server over stdio):
-> windowsSandbox/readiness
<- {"id":2,"result":{"status":"updateRequired"}}
-> windowsSandbox/setupStart {"mode":"elevated","cwd":"C:/Users/<user>/Documents/<repo>"}
<- {"id":3,"result":{"started":true}}
<- {"method":"windowsSandbox/setupCompleted","params":{"mode":"elevated","success":false,"error":"only managed permission profiles can be enforced by the Windows sandbox"}}
Relevant ~/.codex/config.toml:
approval_policy = "never"
sandbox_mode = "danger-full-access"
[windows]
sandbox = "elevated"So readiness reports updateRequired and blocks sending messages. But setup refuses to run while the user's configured permission mode is danger-full-access ("Acesso completo", i.e. full access). The UI only shows the generic "Configuração interrompida" text and does not show the real error.
What steps can reproduce the bug?
Startup hang
- On Windows 11, have Codex Desktop 26.928.21956 (MSIX) installed and signed in, with an existing
~/.codexthat has real usage history. Mine hasthread_history_1.sqliteof about 810 MB,logs_2.sqliteof about 230 MB,.codex-global-state.jsonof about 340 KB, several MCP servers and plugins. - Fully quit the app (kill
ChatGPT.exeandcodex.exe). - Launch it from the Start menu or taskbar icon.
- About half of the cold launches stay on the logo splash forever. Look at the newest
codex-desktop-*-t0-*.log: there is noremote_connections.manager_state_set hostId=localand noHandled 'ready' message. - Optional: launch
ChatGPT.exe --remote-debugging-port=9333, attach toapp://-/index.htmland runPage.reload. The UI appears immediately.
Sandbox setup failure
- Set
sandbox_mode = "danger-full-access"and[windows] sandbox = "elevated"in~/.codex/config.toml(this worked on earlier versions). - Open the app and send any message. It fails with "Atualize a sandbox do Agent para continuar".
- Click "Refazer configuração". It fails instantly with "Configuração interrompida".
windowsSandbox/setupStartreturnssetupCompletedwithsuccess:falseanderror:"only managed permission profiles can be enforced by the Windows sandbox".
No session id: the problem happens before any thread loads.
What is the expected behavior?
- The main window should always finish loading on launch. The renderer should get the current local host connection state when it subscribes (replay the last state, or let it pull the state), not only later change events. A timeout or "reload" fallback would also help.
- App-server stderr WARN lines should not be reported as
connection-failederrors. - The Windows sandbox update should work (or not be required) when the user chose full access (
danger-full-access). If setup cannot run in that mode, the UI should show the real error and tell the user what to change, instead of the generic "Configuração interrompida" text. It also should not block sending messages in a mode that does not use the sandbox.
Additional information
- Workaround for the hang: kill
ChatGPT.exeandcodex.exeand relaunch until the UI loads (usually 2-3 tries). - Things I ruled out for the hang: disabling 4 remote MCP servers that fail at startup with "OAuth authorization required" did not change the failure rate. The Electron profile was brand new after the reinstall.
.codex-global-state.jsonparses fine. - Startup noise seen on every launch, possibly related: the
codex_appMCP server logstimed out awaiting tools/list after 10s,Failed to start the Artifact Session host: Unix-socket transport is not available on Windows, andfs/readFile requires an environmentId(-32602). - When the app is launched by running
ChatGPT.exedirectly instead of through package activation, it uses%APPDATA%\Codexinstead of the virtualizedLocalCachepath. I mention this in case anyone tries to reproduce the problem that way. - I can share full desktop logs (redacted) if useful.
- Probably the same bug as [Windows] Codex Desktop 26.924.1866.0 stuck on startup spinner until app-server codex.exe is terminated #48333, which reports the same startup spinner on 26.924.1866.0. There, killing the child
codex.exemakes the UI load. That fits the race described above: restarting the app-server produces a newhostId=localstate change after the renderer has subscribed, so the renderer finally learns the connection state and mounts.
Activity
github-actions commentedon Sep 30, 2026
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
arthurmarabin commentedon Sep 30, 2026
Update: workarounds that work for both problems
Sandbox setup ("only managed permission profiles can be enforced by the Windows sandbox")
The setup succeeds if it runs with a sandboxed permission mode, even though the saved config still says
danger-full-access. After setup, Full access works normally again, and readiness staysreadywith the unchanged config.What I did:
config.tomlwas not edited:CodexSandboxOffline/CodexSandboxOnlineand wrote~/.codex/.sandbox/setup_marker.json(version 5).codex-windows-sandbox-setup.exethen spent about 20 minutes in the "read ACL run" phase. It grants read ACEs to the sandbox users on everything under the user profile. MyDocumentshas about 930k files, and the log sat ongranting read ACE to C:\Users\<user>\Documentsfor most of that time. It finished withread ACL run completedand nosetup_error.json.windowsSandbox/readinessreturned{"status":"ready"}with the normal config (sandbox_mode = "danger-full-access"). After an app restart the "Windows setup was not completed" banner was gone, and messages send in Full access.Changing the permission picker in the composer is not enough. It only affects the current thread, and "Redo setup" keeps reading the global
sandbox_mode, so it keeps failing instantly. The setup also gives no progress feedback during the long ACL phase. It just looks hung.Startup splash hang
Confirming the workaround from #48896: while the window is stuck on the logo, kill only the child
codex.exe ... app-serverprocess and leaveChatGPT.exerunning. The app respawns the app-server and the UI mounts within a few seconds. This worked on both of my restarts today, and both launches had hung. This is consistent with the missedhostId=localconnection-state race described above.Side effect worth knowing if you debug this by launching the exe directly
If you launch
ChatGPT.exedirectly (outside package activation), it creates the real%APPDATA%\Codexand%LOCALAPPDATA%\Codexfolders. After that, the packaged app also starts reading and writing the existing real%APPDATA%\Codex\web\Codexfiles, because MSIX uses real AppData files when they already exist. The result is a split profile. In my case the UI language also flipped from pt-BR to English, probably because of this. Removing those two folders with the app closed restored the normalLocalCache-only profile.Nikechukwugrd commentedon Sep 30, 2026
I am experiencing the same Windows startup failure today (September 30, 2026) on a ChatGPT Plus account.
The app opens to the centered OpenAI/Codex logo on a dark background and remains there indefinitely. The main UI never renders.
Troubleshooting already attempted:
A clean reinstall temporarily made the app work. I then spent about 30 minutes recovering/re-locating previous project files and getting my chats/project state back. After that, a later launch returned to the exact same infinite loading screen.
This is especially disruptive because deleting/resetting local Codex state can temporarily make existing project/chat state disappear. Users should not have to purge ~/.codex or other local project/session state just to launch the app.
My visible failure is the same as described here:
Windows app opens → centered logo/spinner → indefinite hang → no sidebar/composer/UI.
Please prioritize a fix that preserves existing conversations, project/workspace registrations, and local Codex state. I can provide a screenshot of the frozen splash screen and additional diagnostics/logs if useful.
Akhull commentedon Oct 1, 2026
Additional diagnostic evidence for the startup/logo hang on Windows, collected on 2026-10-01. This also records a separate user-reported follow-up-send problem. The sandbox setup failure in the original issue was not established on this machine.
Environment and user impact
Controlled startup reproduction
The same installed official program was launched in isolated CODEX_HOME and Chromium profiles using Invoke-CommandInDesktopPackage. Package identity was verified in both comparison instances. Existing authentication/configuration was copied locally for the test; original chat databases and automations were not copied. Comparing saved UI atoms against empty UI atoms reproduced the logo hang in both variants.
This reproduces the startup failure with fresh Chromium profiles and without copied chat databases. It is not a full original-profile acceptance test.
Runtime observations
Early trace and narrower recovery experiment
An early trace, without debugger pauses, recorded a local version message at approximately 171.7 ms, the shared message bus at 199 ms, and the corresponding version handler at 2939.9 ms. Initial fetch and ready(initializationOnly=true) requests later remained unanswered; new reads after approximately 6.6 s succeeded.
Native sendMessageFromView promises resolved even for requests whose answers were not observed. Successful native submission is therefore not proof that the renderer received a usable response.
A later ready(initializationOnly=true) handshake returned genuine version snapshots and released the logo gate without reloading the renderer or restarting the main process/backend. The six old queries then still required cancellation/refetch using their original QueryFns.
A diagnostic prototype combined:
It opened 3/3 isolated blocked cold starts, each using one recovery attempt, and reduced stale startup reads from six to zero. One run used empty saved UI atoms. No invented version values were inserted. This prototype depends on private React structures and is not a production-ready extension or installed permanent fix.
What is still unproven
We have not identified whether the initial requests are skipped in main-process handling or their responses are lost on the return path. The early version/handler ordering is evidence of a vulnerable startup sequence, not a complete proof of the exact lost message. No chunked-message traffic was observed in the failing trace; a chunk/ACK explanation is unproven. Disabling automatic avatar opening did not eliminate the hang. Debugger timing could change the outcome.
Repeated actual sends in the original primary window and long-term cold-start reliability were not verified in these experiments. An older build previously had a confirmed loading-local-config submit block with pending codex-home queries, recovered by retrying those reads, but that historical cause must not be assumed for the latest send symptom.
Requested engineering fix
Please investigate initial snapshot delivery and startup request completion, retain/replay early version/connection state, and use bounded initialization-handshake and idempotent-read retries with an explicit recoverable error instead of an infinite logo screen. Regression coverage should include cold starts, delayed renderer subscribers, lost startup responses, multiple windows and two successive messages in an existing chat.
Original application/package files, chat data and configuration were not reset during these experiments. No auth files, tokens, account identifiers, chat contents, personal filesystem paths or unreviewed raw traces are attached to this public report.
XAN9xXx commentedon Oct 1, 2026
I can reproduce the startup/hydration issue on Windows 10 with Microsoft Store package
OpenAI.Codex 26.928.3736.0and local app-server0.159.2.I am only reporting the startup/UI hydration problem here; I have not reproduced the sandbox issue from the original report.
I observed two useful variants.
1. The UI can recover without restarting the app-server
In one launch, the local app-server initialized successfully and remained the same process throughout the hang and recovery.
config/readalso succeeded repeatedly while the splash was still visible.Much later:
The app-server PID did not change. This seems consistent with the renderer missing or not applying the initial local connection state, then recovering when a later
host_connection_state_changedevent arrives.2.
Page.reloadwas not an immediate/reliable workaround in another reproductionI launched the packaged app with
--remote-debugging-port=9333through package activation and reproduced the stuck splash again.The local backend was already connected and the main window was ready:
Auth/config reads also succeeded, but the UI remained stuck.
I sent CDP
Page.reloadtoapp://-/index.htmlat 15:01:33Z. The app-server PID remained unchanged.The reload did not immediately recover the UI. Instead, the renderer later logged:
102862msaligns closely with the time since the renderer reload. So on this machine, reloading the primary renderer appears able to hit the same startup race again rather than reliably fixing it.I later replayed:
but that happened at 15:04:52Z, after routes had already mounted, so it was not responsible for this recovery.
After the shell became visible, the app was also not fully healthy:
config/readcontinued to succeed, but I observed separate startup failures/timeouts including Statsig bootstrap, model refresh, andapp/list. I am not claiming those are the cause of the splash hang, only that a visible shell did not necessarily mean startup/hydration had fully completed.I can provide a sanitized log excerpt if useful.
XAN9xXx commentedon Oct 1, 2026
Additional observation after checking Windows AppX deployment history:
The startup failure became effectively deterministic for me after updating to
OpenAI.Codex 26.928.3736.0. Before this update I did not observe this high failure rate.I checked
Microsoft-Windows-AppXDeploymentServer/Operationaland found the following timeline:14:19:29—OpenAI.Codex_26.928.3736.0_x64__2p2nqsd0c76g0Stage started.14:19:44— Stage completed successfully.21:32:14— Windows attempted to update26.928.2636.0to26.928.3736.0, but the registration failed because the application was still running:21:40:10— After another maintenance/register cycle, the26.928.3736.0package registration completed successfully.I cannot conclude that the AppX update lifecycle caused the startup race, because similar startup issues have been reported on older builds as well. However, the timing is notable: the failure rate changed from occasional to nearly every cold launch after this update.
This may be useful as an additional variable when investigating whether package update/relaunch state, persisted desktop state, or initialization timing changes affect the renderer/app-server startup handoff.
SteveStich commentedon Oct 1, 2026
I reproduced the startup race on a separate Windows 10 machine and found a clean workaround that preserves the ChatGPT side of the unified desktop app.
Environment:
Startup evidence matches this issue closely:
post_initialize_connection_state ... hostId=local ... next=connectedwithin ~0.4sremote_connections.manager_state_set hostId=localmanager_state_set ... connectedin_app_updates_policy_timeoutfires after 5 minutes but does not recover the UIImportant secondary finding: killing the child
codex.exe app-serveris NOT a clean workaround on this build. It wakes the shell, but afterward the ChatGPT cloud side becomes partially broken:Desktop network policy does not allow this destination, thenAuthenticated workspace changedfor requests including/wham/tasks/list,/wham/onboarding/context, and/settings/userBy contrast, reloading only the main Electron renderer via Chrome DevTools Protocol fixes the splash hang AND preserves normal ChatGPT behavior (Recents sync, search works, New chat works).
For the Store/MSIX build, launching
ChatGPT.exedirectly withStart-Processreturns Access denied, so I used package-context launch:Then, after allowing startup to settle (~20 seconds), re-query the CDP targets and send
Page.reloadspecifically toapp://-/index.html:Timing mattered in automation: sending the reload only ~1.5s after discovering the renderer did not reliably work. Waiting ~20s, then re-querying
/json/listto get the current renderer/WebSocket URL immediately beforePage.reload, worked reliably.This looks like strong confirmation that the primary failure is renderer bootstrap/state replay rather than app-server health. A renderer reload fixes the app without disturbing the authenticated ChatGPT workspace, whereas app-server restart can create a second workspace-routing failure.
ver102-cmd commentedon Oct 2, 2026
Additional report for the Windows startup/logo hang, based on troubleshooting performed on 2026-10-02 (Asia/Seoul). This concerns startup recovery; the sandbox setup error in the original issue was not established in these tests.
Environment and impact
Sandbox readiness test
While the desktop UI remained stuck, a separate app-server process was started and queried directly with
windowsSandbox/readiness. It returnedstatus: ready.This weakens the hypothesis that the UI is waiting for incomplete sandbox setup. Because this query used a separate app-server, it does not prove that the stuck desktop process had received the same readiness response or shared every launch parameter.
Startup-log comparison recorded in earlier diagnostic notes
The earlier troubleshooting summary records a comparison of 13 launches:
remote_connections.manager_state_setforhostId=localwas present.These are previously recorded diagnostic observations, not newly re-audited raw-log excerpts. The original logs are not attached to this comment. The warning/state correlation alone does not establish causation.
Recovery test and user confirmation
In a launch recorded as still stuck after approximately 15 seconds, only the desktop child
codex.exe app-serverwas terminated; the desktop UI process was left running. The desktop app respawned its backend.The diagnostic notes then recorded local-state entries, renderer route mounts, and model-list requests. The user subsequently confirmed that the application worked and that relaunching also worked. No authentication-file move or fresh login was needed for this recovery.
This verifies a useful recovery on this machine, but does not establish long-term cold-start reliability. ChatGPT cloud sync, search, and all other surfaces were not systematically tested after the backend restart.
Other isolation attempts recorded
These tests do not prove file corruption. Fresh-profile completeness and all launch-path differences were not independently verified.
Interpretation and requested investigation
The observations are consistent with an initialization/state-delivery failure between the backend/main process and renderer, as discussed here and in #49557. The exact initiating race or lost message remains a hypothesis.
Please investigate:
No raw logs, credentials, account identifiers, personal paths, or conversation contents are attached.
TucikCoder commentedon Oct 2, 2026
The startup splash hang still occurs with Codex for Windows 26.928.40906 (build 12694), on every launch on two different AMD PCs. Reinstalling and regenerating
.codex/config.tomldid not help.An additional workaround consistently restores the UI immediately: terminate only the
ChatGPT.exerenderer processes:The main ChatGPT process and Codex app-server remain running and functional. The hang returns on the next launch. This concerns the startup issue; it does not confirm the proposed root cause or the separate sandbox issue.
I have also experienced automatic updates not working, but that has not been independently verified or linked to this hang. The current update check reports the installed version as up to date.
XAN9xXx commentedon Oct 2, 2026
Additional observation from a
26.928.3736.0Windows 10 startup today: the app reached the visible shell after reproducing the same delayed local-host state transition, but the resulting session was not fully initialized.The startup timing again matched the race described here:
So the main process knew the local app-server was connected about 101.5 seconds before the renderer applied that state.
This time, however, the UI that eventually appeared was visibly incomplete/default-looking (English UI and missing/newer feature state). The running package was still
OpenAI.Codex 26.928.3736.0, and the log identified the frontend release as26.928.31416, so this was not an actual binary rollback.In the same startup, the post-login Statsig bootstrap failed:
Shortly afterwards:
Bundled-plugin reconciliation then wrote a reduced runtime marketplace:
and removed:
It also attempted to remove
chrome@openai-bundled, but that failed with:causing
bundled_plugins_reconcile_failed.app/listsubsequently failed twice after ~60 seconds with:There are existing reports for parts of this second symptom:
statsig-disabledstatsig-disabledproducing a reduced bundled marketplacestatsig-disabled→["codex-app-tools","latex","visualize"]→ bundled Browser/Chrome/Computer Use removalI am not claiming that the startup local-state race causes the Statsig/plugin failure. They may be separate failures occurring during the same unhealthy startup. The useful observation here is that recovering past the splash/loading gate does not necessarily leave the Desktop fully hydrated or usable.
In this instance,
config/read, authentication, and latermodel/listcalls were succeeding, while Statsig/plugin/apps initialization remained degraded.tomhda commentedon Oct 2, 2026
For the logo splash: sending
{type: 'ready', initializationOnly: true}throughelectronBridge.sendMessageFromViewfrom the stuck window makes the main process re-send the initialization snapshot, and the app opens immediately without a reload (seen on 26.928.31416, 26.928.40906 and 26.930.21537). The one-timecodex-app-server-initializedmessage is sent before the renderer listens and is not kept for later.Messages that arrive before the renderer is ready can also stall the whole host→window channel when they are chunked: #50203