Windows sandbox recovery fails: codex-windows-sandbox-setup.exe exits with 0xc0000142 after DPAPI error

What version of the Codex App are you using (From “About Codex” dialog)?

Versão atual: 26.813.12317

What subscription do you have?

Plus

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

The Codex Windows native sandbox can no longer start any local command.

Every command fails before PowerShell or any child process starts:

windows sandbox: CryptUnprotectData failed: 2148073483

The error corresponds to 0x8009000B (NTE_BAD_KEY_STATE).

Current-user DPAPI encryption and decryption work correctly. The failure appears to be specific to the Codex sandbox credentials.

As a recovery test, with Codex completely closed, I renamed:

%USERPROFILE%\.codex\.sandbox-secrets

to .sandbox-secrets-backup.

After reopening Codex, sandbox recreation also failed with:

codex-windows-sandbox-setup.exe - Application Error
The application was unable to start correctly (0xc0000142).

Restoring the original directory returns Codex to the original CryptUnprotectData failure.

Related issue: #35841

What steps can reproduce the bug?

1. Open Codex on Windows using the native Windows sandbox.
2. Open any local project.
3. Ask Codex to run Get-Location.
4. Observe CryptUnprotectData failed: 2148073483.
5. Close Codex completely.
6. Rename %USERPROFILE%\.codex\.sandbox-secrets to .sandbox-secrets-backup.
7. Reopen Codex.
8. Observe that codex-windows-sandbox-setup.exe fails with 0xc0000142.

What is the expected behavior?

If the stored sandbox credentials cannot be decrypted, Codex should safely regenerate its sandbox credentials. The sandbox setup executable should start successfully, and local commands should execute normally.

Additional information

I can reproduce the same CryptUnprotectData failed: 2148073483 error.

I also observed a failure in the recovery path. With Codex completely closed, I temporarily renamed:

%USERPROFILE%\.codex\.sandbox-secrets

After reopening Codex, sandbox recreation failed with:

codex-windows-sandbox-setup.exe - Application Error
The application was unable to start correctly (0xc0000142).

Restoring the original .sandbox-secrets directory returns Codex to the original DPAPI failure.

Troubleshooting performed:

• Restarted Windows
• Reset and reinstalled the app
• Recreated the runtime cache
• Restored an older config.toml
• Confirmed that current-user DPAPI encryption/decryption works

Reproduce the failure using the native Windows sandbox, the CryptUnprotectData error, and the %USERPROFILE%\.codex\.sandbox-secrets recovery path. Start by tracing the entry point for codex-windows-sandbox-setup.exe and its handling of undecryptable credentials. Done means credentials are safely regenerated, the setup executable starts, and local commands run normally.