Windows Desktop: setup refresh failure survives restart; new task works only outside sandbox

What version of Codex is running?

Codex Desktop on Windows (exact app version was not captured before the affected task became unusable).

What happened?

A local project task lost the ability to create any sandboxed unified exec process. Fully quitting and restarting Codex Desktop did not recover that task.

Every command failed before the shell process started, including both PowerShell and:

cmd.exe /c echo runtime-ok

The exact error was:

Rejected("Failed to create unified exec process: helper_unknown_error: setup refresh had errors")

The task-terminal reader also reported:

No app terminal session is attached to this thread yet.

Creating a new local task for the same saved Git project allowed work to continue only when commands were explicitly approved to run outside the sandbox. Sandboxed setup in the new task still did not recover. This indicates that the repository and its Git worktrees are intact, while sandbox setup/refresh is the failing boundary.

Steps to reproduce

1. Open a local Git project task in Codex Desktop on Windows.
2. Encounter a sandbox setup refresh failure.
3. Run a minimal command such as cmd.exe /c echo runtime-ok.
4. Fully quit Codex Desktop, restart it, reopen the same task, and retry.
5. Create a new local task for the same saved project and retry both sandboxed and explicitly approved outside-sandbox execution.

Expected behavior

• Restarting the app or creating a fresh task should reinitialize the sandbox helper.
• A minimal command should start normally.
• If setup cannot be refreshed, the error should expose a specific failing helper/resource and a supported recovery action.
• Existing task state should remain usable without forcing a task migration or broad outside-sandbox approvals.

Actual behavior

• The original task remains unable to create any process after a full app restart.
• A new task can continue only through per-command outside-sandbox approval.
• Repository files and worktrees remain intact.
• The practical workaround is to migrate the task context to a new task and approve execution outside the sandbox.

Impact

This blocks file inspection, tests, commits, and pushes in an in-progress coding task. It also makes long-running task continuity unreliable because restarting the app does not repair the task runtime.

Related issue

Related to #29797, which reports the same helper_unknown_error: setup refresh had errors. This report adds the task-restart/new-task comparison and the observation that only explicitly approved outside-sandbox execution restores progress. No private repository names, paths, source code, or thread identifiers are included here.

Start by reproducing the Windows Codex Desktop failure with cmd.exe /c echo runtime-ok, comparing the original task after restart with a new task and outside-sandbox approval. Investigate the sandbox helper setup-refresh lifecycle and related issue #29797; done means restart or task creation restores sandboxed commands, or the error identifies the failing resource and supported recovery action.