Last Windows Codex App Update Causing error sandbox

[jhsn]

What version of the Codex App are you using (From “About Codex” dialog)?

Versão 26.818.32112

What subscription do you have?

PLUS

What platform is your computer?

Windows 11 X64

What issue are you seeing?

The latest Codex desktop update is causing an error in the sandbox, this message appears. I tested a read-only operation (Get-Location and git status) and the sandbox failed before running the command, with the same error: helper_unknown_error: setup refresh had errors. So, the problem is still with the local Codex environment startup, not the project.

What steps can reproduce the bug?

when I request a code change that he has to access the folders of the research project

What is the expected behavior?

No response

Additional information

No response

[github-actions]

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• Workspace terminal fails to start with "setup refresh had errors" #39841
• Windows Desktop: setup refresh failure survives restart; new task works only outside sandbox #39697
• Codex IDE extension on Windows cannot execute commands: helper_unknown_error: setup refresh had errors #39933

Powered by Codex Action

[shleder]

@jhsn Regarding Codex CLI sandbox posture and unprompted execution safety:

Running Codex with --danger-full-access or unprompted permissions removes developer friction, but exposes host credentials to accidental leakage.

Instead of an all-or-nothing toggle, Vetto wraps Codex via Landlock LSM with zero-config network allowlists (api.openai.com, chatgpt.com), read/write compatibility for agent session DBs (state_*.sqlite), and real-time token stream sanitization (vetto mask). If an experiment goes sideways, vetto undo or vetto ephemeral restores the project instantly.

---

Disclaimer: I am the author/maintainer of Vetto, an open-source (Apache-2.0) daemon-less sandbox layer for AI coding agents.

[shleder]

Sandbox breakage right after an app update usually means a changed default or a new path the sandbox now requires. Most useful report shape: exact versions before and after plus the verbose sandbox log line. If you can bisect which update flipped it, maintainers can pinpoint the default change fast. ---
Disclaimer: I am the author/maintainer of Vetto, an open-source (Apache-2.0) daemon-less sandbox layer for AI coding agents.