Windows sandbox failed spawn setup refresh OS error 740

[TheB1ak3]

What version of the Codex App are you using (From “About Codex” dialog)?

26.521.10419

What subscription do you have?

Pro

What platform is your computer?

OS: Windows 11 Home 25H2, build 26200.8457, x64

What issue are you seeing?

Codex Desktop Windows Computer Use failed with:

windows sandbox failed: spawn setup refresh
stdout_eof
OS error 740: The requested operation requires elevation

Findings:

• Failure occurred while spawning codex-windows-sandbox-setup.exe.
• Running Codex as Administrator did not fix it.
• Helper executable could run manually from elevated PowerShell, but required a payload argument.
• SHA256 matched the packaged helper.
• No requireAdministrator manifest found.
• No AppCompatFlags RUNASADMIN entry existed.
• Adding AppCompatFlags RUNASINVOKER for the helper path made Computer Use work.

Possible cause:
Windows UAC installer/elevation behavior during CreateProcessW for codex-windows-sandbox-setup.exe.

What steps can reproduce the bug?

1. Open Codex Desktop on Windows.
2. Start a Codex session.
3. Grant or request Computer Use access.
4. Ask Codex to inspect the screen, for example: "Can you see my screen?"
5. Computer Use fails during startup.

Observed error:
windows sandbox failed: spawn setup refresh
stdout_eof
OS error 740: The requested operation requires elevation

Running Codex Desktop as Administrator did not fix the issue.

Running the helper manually from elevated PowerShell showed that the executable can start, but it requires a payload argument:
helper_request_args_failed: expected payload argument

Applying RUNASINVOKER through AppCompatFlags Layers to the helper executable path made Computer Use start working.

Feedback ID: 019e7c04-9994-7722-93cd-e1d7d9b6edf8

What is the expected behavior?

Computer Use should initialize successfully after the user grants access. Codex should be able to start its Windows sandbox/helper process and inspect targetable windows without requiring a manual AppCompatFlags workaround.

Additional information

The failure appears to happen during process creation before the helper process fully starts.

Codex diagnostics indicated that the parent process attempted to spawn codex-windows-sandbox-setup.exe and Windows returned OS error 740.

Additional findings:

• The helper binary was not corrupted.
• The AppData helper and packaged WindowsApps helper had matching SHA256 hashes.
• No embedded requireAdministrator manifest was found.
• No existing RUNASADMIN AppCompatFlags entry was present for the helper.
• Adding RUNASINVOKER for the helper executable path made Computer Use work.
• I did not include session logs because the session contains private project/workspace details.
• Environment: Windows 11 Home 25H2, build 26200.8457, x64.
• Doctor was clean

[github-actions]

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• Windows Codex app: Browser/node_repl bridge fails with sandbox elevation error #24926
• Windows sandbox setup helper triggers UAC installer detection (os error 740) #24050
• Windows sandbox blocks bundled Chrome plugin/node_repl startup with os error 740 #24755
• Codex Desktop Windows: node_repl bridge fails with windows sandbox failed: spawn setup refresh #25226
• Windows Codex Desktop: node_repl fails with “windows sandbox failed: spawn setup refresh”, breaking Chrome plugin and in-app Browser #25357

Powered by Codex Action

[TheB1ak3]

This appears to be the same root cause as #24050, but reproduced through Codex Desktop Computer Use. My workaround was AppCompatFlags RUNASINVOKER instead of modifying the binary manifest.

[jiabaoy777-arch]

I can reproduce this issue on Codex Desktop for Windows.

Environment:

• Codex Desktop app version: 26.527.3686.0
• Platform: Windows x64
• Computer Use plugin version: 26.527.31326

Observed behavior:

• Computer Use cannot initialize.
• The first lightweight list_apps() check fails immediately.
• Restarting the Codex app and restarting Windows did not resolve the issue.
• Normal shell/file operations still work; the failure is specific to the Node REPL / Computer Use startup path.

Observed diagnostic output:

windows sandbox failed: spawn setup refresh
stdout_eof

The sandbox log shows the underlying failure while starting the AppData helper copy:

setup refresh: failed to spawn ...\\codex-windows-sandbox-setup.exe: The requested operation requires elevation. (os error 740)

I also verified that the helper executable exists. The AppData helper copy and packaged WindowsApps helper have matching file size and timestamp. This appears consistent with the Windows UAC installer-detection / missing explicit asInvoker manifest diagnosis described in this issue.

For privacy, I am not attaching the full sandbox log because it includes local workspace paths.

[tjmbradybot-eng]

Codex version: 26.527.3686.0
Windows 11

Symptoms:

• node_repl kernel exited unexpectedly
• windows sandbox failed: spawn setup refresh
• os error 740
• Admin Sandbox setup fails
• Backup Sandbox setup fails

Verified:

• Windows Sandbox enabled
• vmcompute running
• Virtualization enabled
• Chrome extension connected
• Native host manifest valid
• codex-windows-sandbox-setup.exe launches manually
• Browser plugin enabled
• js_repl enabled

Issue persists after:

• Reinstalling extension
• Rebuilding plugin cache
• Rebuilding Codex runtime cache
• Enabling Windows Sandbox
• Rebooting