Windows sandbox: setup payload passed on the command line exceeds the CreateProcess limit (os error 206)

Environment

• Windows 11
• Codex Desktop app 26.810.7004.0 (helper: app\resources\codex-windows-sandbox-setup.exe); sandbox bin: codex-command-runner-0.148.0-alpha.9.exe, codex.exe
• sandbox_mode = "workspace-write", [windows] sandbox = "elevated", LongPathsEnabled = 1

Symptom

Every command executed through the Windows sandbox fails before it even runs:

[codex.exe] setup refresh: spawning ...\\codex-windows-sandbox-setup.exe (cwd=..., payload_len=35044)
[codex.exe] setup refresh: setup refresh failed to launch helper: helper=...\\codex-windows-sandbox-setup.exe, ...
error=The filename or extension is too long. (os error 206)

This is ERROR_FILENAME_EXCED_RANGE returned by CreateProcess: the assembled command line
(helper path + cwd + embedded payload) exceeds Windows' 32,767-character limit.

Repro

1. Place ~700 loose files directly in the user profile (e.g. C:\Users<user>*.sh).
2. Run any command through the Windows sandbox (default, non-escalated path).
3. The sandbox "setup refresh" step spawns codex-windows-sandbox-setup.exe with a payload
   whose size grows roughly linearly with the top-level item count of the user profile.
   Observed in %USERPROFILE%.codex.sandbox\sandbox.YYYY-MM-DD.log:
   • ~150 top-level items -> payload_len=15108, helper completes normally
   • ~500 top-level items -> still fine
   • ~700 top-level items -> payload_len=35044, CreateProcess fails with 206;
     EVERY sandboxed command fails from then on.
4. Escalated (non-sandboxed) commands bypass the helper and keep working,
   which makes the failure mode hard to diagnose.

Boundary (useful data point)

The threshold lies between 500 and 700 top-level profile items. After moving ~200 items
into a subfolder (697 -> 498 top-level entries) the sandbox recovered immediately on the
next command, no restart required.

Suggested fixes

• Pass the setup payload to the helper via a temp file or a pipe instead of the command line.
• Or keep the embedded profile-item list bounded (only roots that actually exist, or a
  digest instead of the full flat list).

Logs

%USERPROFILE%.codex.sandbox\sandbox.YYYY-MM-DD.log

Start by tracing the Windows sandbox setup refresh in codex.exe, including how it launches codex-windows-sandbox-setup.exe and constructs the payload. Use the sandbox log and the reported 500–700 top-level-item boundary to reproduce the failure; done means sandboxed commands still launch successfully with a payload that would otherwise exceed CreateProcess's limit.