Windows sandbox: command-runner crash loop due to C:\Users\Default permission denied (v0.147.0-alpha.6.5)

Start by tracing the Windows sandbox “hide users” initialization and command-runner startup from the sandbox runtime, using the reported sandbox.log errors as the reproduction signal. Verify behavior on Windows with C:\Users\Default present; done means protected directories are handled without failing junction setup or restarting the command-runner in a crash loop.

Version

codex-cli 0.147.0-alpha.6.5 on Windows 11 Home China (build 10.0.26200)
Also tested with ChatGPT Windows App v26.803.5235.0

Summary

The Windows sandbox command-runner enters a crash loop because the sandbox setup tries to operate on the system-protected directory C:\Users\Default, causing persistent "Access Denied" errors. This breaks all sandbox-dependent functionality including Computer Use and plugin execution.

Symptoms

1. Computer Use plugin fails to initialize — EPERM: operation not permitted, lstat 'C:\Users\huorenbo\AppData\Local\OpenAI\Codex'
2. All plugins that require sandbox are unresponsive
3. Cannot read desktop window titles from Computer Use

Errors from sandbox log (CODEX_HOME.sandbox\sandbox.log)

Error 1: "hide users" fails on C:\Users\Default (repeats every ~1 second)

hide users: failed to hide current user profile dir (C:\Users\Default):
SetFileAttributesW failed for C:\Users\Default: 5 (拒绝访问。)

Error 2: Junction creation fails on system-protected path

junction: failed to create C:\Users\Default\.codex\.sandbox\cwd: 拒绝访问。 (os error 5)

Error 3: Command-runner pipe closes repeatedly (crash loop)

runner output write failed: 管道正在被关闭。 (os error 232)
runner exit write failed: 管道正在被关闭。 (os error 232)

These three errors cycle continuously, with the command-runner being spawned, failing to hide C:\Users\Default, then crashing (pipe close), then being respawned.

Root Cause Analysis

The sandbox's "hide users" initialization walks user profile directories and tries to SetFileAttributesW on C:\Users\Default. However:

• C:\Users\Default is a system-protected template directory in Windows
• Even with Administrator privileges, modifying this directory requires special permissions
• The failure cascades: hide users fails → junction creation fails → command-runner pipe breaks → respawn → repeat

The sandbox should either skip C:\Users\Default (and similar system directories) or handle the Access Denied gracefully instead of entering a crash loop.

Additional Context

• Dual installation exists: ChatGPT Windows App (26.803.5235.0) + standalone Codex CLI (0.147.0-alpha.6.5), which caused version confusion where sandbox-setup.exe from 26.730.8199.0 was sometimes used alongside command-runner from 26.803.5235.0
• Multiple CUA Node runtimes were installed as duplicates (same version 0.0.6/20260723162306-088049353ddc in two directories)
• 10 historical command-runner versions accumulated in .sandbox-bin\
• After cleanup (removing old versions, deduplicating runtimes), the C:\Users\Default bug still persists as it is a code-level issue

codex doctor output

17 ok · 1 idle · 1 notes · 0 warn · 0 fail
Sandbox: filesystem unrestricted · network enabled

All checks pass at the installation level — the issue is in the sandbox runtime behavior.

Steps to Reproduce

1. Install Codex CLI v0.147.0-alpha.6.5 on Windows 11
2. Set sandbox_mode = "danger-full-access" in config.toml
3. Start the Codex CLI or ChatGPT Windows App
4. Enable the Computer Use plugin
5. Observe the sandbox log — the "hide users" error on C:\Users\Default will appear immediately and repeat

Expected Behavior

• Sandbox should skip system-protected directories like C:\Users\Default during "hide users"
• Access Denied on non-essential directory hiding should not cause command-runner crash/restart
• Computer Use should initialize successfully

Workaround

None confirmed. Cleaned up installation (removing old versions, deduplicating runtimes) does not fix the root cause.