Windows elevated sandbox blocked by runtime ACL sharing violation; local access-mask probe and verified recovery #51767

Summary

Windows elevated sandbox initialization fails before ordinary shell commands or Node tools can run. Restarting the desktop app and rebooting Windows did not restore execution. A narrow ACL workaround restored the affected tools while retaining the elevated sandbox.

Verified environment

• Bundled core: codex-cli 0.162.0-alpha.2.
• App update checker: installedVersion 26.1002.52244, installedBuildVersion 13536, production channel, up_to_date.
• Windows sandbox configuration: elevated.
• Windows reboot verified by LastBootUpTime on October 8, 2026; the same failure occurred afterwards.

Failure

Even Get-Location failed before process creation:
helper_unknown_error: setup refresh had errors

Sanitized setup log:

runtime read/execute validation failed:
validate runtime read/execute access on
%LOCALAPPDATA%\OpenAI\Codex\runtimes\cua_node\<runtime>\bin\node_repl.exe:
open ACL target for root-only update:
The process cannot access the file because it is being used by another process. (os error 32)
setup refresh completed with errors
setup error: setup refresh had errors

Stopping node_repl processes did not fully recover execution: the next failure targeted VCRUNTIME140_1.dll loaded by codex-computer-use-swift.exe. Rebooting Windows reproduced the node_repl failure.

Local controlled measurements

On the active node_repl.exe, CreateFileW was called with share flags 7, OPEN_EXISTING and FILE_FLAG_BACKUP_SEMANTICS; handles were immediately closed and no ACLs were changed during the probe:

• READ_CONTROL: success.
• READ_CONTROL | WRITE_DAC: success.
• MAXIMUM_ALLOWED: Windows error 32.

The published rust-v0.162.0-alpha.2 acl.rs uses MAXIMUM_ALLOWED in the root-only ACL update branch with the exact error context. This strongly supports an access-mask sharing conflict, but the installed helper has not been debugger/hash-matched to the source.

Temporary recovery and validation

With explicit user authorization, original access ACLs were saved and a rollback script preserved. A non-inheriting deny ACE for the current user, limited to FILE_WRITE_DATA | FILE_APPEND_DATA (mask 0x6), was applied to these six bundled runtime files:

• node_repl.exe
• node.exe
• codex-computer-use-swift.exe
• VCRUNTIME140_1.dll
• VCRUNTIME140.dll
• MSVCP140.dll

Afterwards:

• Ordinary sandbox shell commands succeeded under CodexSandboxOffline.
• Project file listing succeeded.
• apply_patch creation, shell reading and apply_patch deletion of a temporary allowed-path probe succeeded.
• Node REPL executed successfully.
• Creating a fresh file outside the allowed workspace was denied.
• Configuration remained elevated.

This is a temporary local workaround, not an upstream fix. It may interfere with in-place runtime updates. No project code was changed.

Requested fix

Please investigate requesting minimum required access for active EXEs/DLLs when validating ACLs, add regression coverage with bundled runtime processes already running, and provide a supported recovery path. Surface the failing file and Win32 error rather than only helper_unknown_error.

Related reports: #51613, #51601, #51590.

Duplicate review

Reviewed all five suggested candidates (#51613, #51601, #51634, #51590, #51623). Closing as a duplicate of #51601: the affected core, runtime ACL failure, sharing violation, access-mask-dependent measurements and workaround match the existing reports. #51613 and #51623 have already consolidated their evidence into #51601.

This closure consolidates tracking; it does not indicate an official fix has been released. The independent local measurements and recovery validation remain preserved above.