Windows sandbox provisioning fails with helper_unknown_error: setup refresh had errors

Problem

Codex Desktop on Windows is unable to execute any command.

Every execution fails before PowerShell or the requested command starts.

Exact error:

Failed to create unified exec process: helper_unknown_error: setup refresh had errors

Example:

exec_command failed for:
"C:\Users\Seb.cache\codex-runtimes\codex-primary-runtime\dependencies\native\powershell\pwsh.exe"

CreateProcess {
message: "Rejected("Failed to create unified exec process: helper_unknown_error: setup refresh had errors")"
}

Environment

• Windows 11 Professional, 64-bit
• Windows build: 10.0.26200
• ChatGPT Desktop: 26.825.6671.0
• Codex runtime: approximately 0.151.0-alpha.7.2
• sandbox_mode: workspace-write
• approval_policy: on-request
• Codex authentication configured with ChatGPT
• Network connectivity test succeeds

Codex Doctor

codex doctor reports:

• sandbox provisioning: FAILED
• error code: helper_unknown_error
• sandbox backend: elevated
• filesystem sandbox: restricted
• network sandbox: enabled
• CrowdStrike Falcon detected with a warning that it can interfere with Codex
• thread inventory warnings
• search/ripgrep warning

The hard failure reported by Doctor is the Windows sandbox provisioning failure.

Troubleshooting already performed

• Restarted ChatGPT/Codex
• Rebooted Windows
• Used Windows app "Repair"
• Retested in new Codex conversations
• Verified normal Windows PowerShell works
• Verified Codex runtime files exist
• Verified project directory ownership
• Project owner is the normal Windows user, not a CodexSandbox account
• Parent directory has the same normal owner
• CodexSandboxUsers already has explicit Modify/Synchronize permissions on the workspace
• No Azure AD, Windows domain, or Workplace Join is configured
• CrowdStrike Falcon Sensor is installed and running
• No explicit CrowdStrike blocking event was found in the Windows Application/System logs
• CrowdStrike has NOT been disabled or modified

The failure occurs before the requested PowerShell command starts.

Expected behavior

Codex should provision/refresh its Windows sandbox and execute commands in the authorized workspace.

Actual behavior

Sandbox setup/refresh fails before process creation, so no Codex command can execute.

Please advise whether this is a known Windows sandbox provisioning issue and whether additional diagnostic information from codex doctor would help.

Start with codex doctor and its reported Windows sandbox provisioning failure, then inspect the sandbox refresh path that runs before pwsh.exe is launched. Reproduce in the listed Windows 11 environment and use the error details and CrowdStrike warning to isolate the failing setup step. Done means sandbox provisioning succeeds and an authorized workspace command executes.