openai / openai/codex

Windows sandbox fails with “apply deny-read ACLs”; Node runtime, Browser, and Computer Use cannot start

Open
#41,818 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

app browser bug computer-use sandbox windows-os
Dominant language
Rust
Stars
125k
Forks
19.4k
PR merge metrics
PR metrics pending

Description

What version of the Codex App are you using (From “About Codex” dialog)?

26.825.6671.0

What subscription do you have?

Chat GPT Plus

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

node_repl kernel exited unexpectedly

node_repl diagnostics: {
"kernel_pid": "[REDACTED]",
"kernel_status": "exited(code=1)",
"kernel_stderr_tail": "windows sandbox failed: helper_unknown_error: apply deny-read ACLs",
"reason": "stdout_eof",
"stream_error": null
}
node_repl kernel exited unexpectedly

node_repl diagnostics: {
"kernel_pid": "[REDACTED]",
"kernel_status": "exited(code=1)",
"kernel_stderr_tail": "windows sandbox failed: orchestrator_helper_exit_nonzero: setup helper exited with status Some(1)",
"reason": "stdout_eof",
"stream_error": null
}

What steps can reproduce the bug?

Feedback ID: 01a04875-a204-7b10-9d3e-d5a4190856c1

What is the expected behavior?

the runtime starts and returns 2.

Actual result: the process exits while the Windows sandbox helper is applying deny-read ACLs. No project files or browser state are modified.

Additional information

Feedback Id: 01a04875-a204-7b10-9d3e-d5a4190856c1

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the Windows sandbox failure for the node_repl runtime using feedback ID 01a04875-a204-7b10-9d3e-d5a4190856c1, then trace the Windows sandbox helper path that applies deny-read ACLs. Check whether the same failure affects Browser and Computer Use. Done means the sandbox setup completes and the runtime starts and returns 2 without modifying project files or browser state.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.