Windows Desktop 26.901: setup_marker.json grants domain SID instead of user; Read grant restores elevated sandbox

What version of the Codex App are you using (From “About Codex” dialog)?

Windows AppX package: 26.901.6511.0, verified with Get-AppxPackage. The current About-dialog version was not captured; I am not treating the package version as the UI version.

What subscription do you have?

Not included in this report.

What platform is your computer?

Microsoft Windows NT 10.0.22631.0 x64 (Windows 11 23H2; OS information captured during diagnosis).

What issue are you seeing?

Related to #30445 and #40217. This is a newer Desktop reproduction of the same apparent marker-ACL problem, not a claim of a distinct root cause. The marker ACE contains a machine/domain SID without an account RID, and granting only Read to the actual user restored operation.

Confirmed with Windows package version 26.901.6511.0 (AppX version, not the About-dialog version). Adding a newer Desktop reproduction and confirmation that a read-only grant on the marker was sufficient.

Environment

• Windows 11 23H2, x64; OS API reported 10.0.22631.0 during diagnosis.
• AppX package status: Ok.
• Configuration:

[windows]
sandbox = "elevated"

Failure and evidence

The Desktop UI reported a setup failure (English translation: “Setup could not be completed”). A normal agent command failed before it could start:

orchestrator_helper_incomplete: setup helper exited successfully before setup completed

The latest setup log contained:

sandbox setup required: sandbox setup marker missing or incompatible
WFP setup succeeded for CodexSandboxOffline with 12 installed filters
setup binary completed
read-acl-only mode: applying read ACLs
read ACL run completed

The marker existed and had a fresh modification time. setup_error.json was absent at that point. From the normal user context, reading the marker with Get-Content failed with access denied; icacls and Get-Acl also could not inspect the file.

From an administrator PowerShell, the marker ACL was:

Owner: BUILTIN\Administrators

NT AUTHORITY\SYSTEM                  Allow FullControl
BUILTIN\Administrators               Allow FullControl
S-1-5-21-<A>-<B>-<C>                  Allow FullControl

The third SID ended at the machine/domain portion, without an account RID. icacls rendered that entry as <HOST>\:(F). This is consistent with the domain-SID ACL pattern reported in #30445. I have not independently traced the source code used by this Desktop runtime.

Narrow workaround verified on this machine

In an administrator PowerShell, I resolved the explicitly qualified account name to its SID and granted Read only on the single marker file. The command below is the redacted form of what I ran; the qualified account must identify the normal user running Desktop:

$sid = ([System.Security.Principal.NTAccount]'<HOST>\<user>').Translate([System.Security.Principal.SecurityIdentifier]).Value
icacls "$env:USERPROFILE\.codex\.sandbox\setup_marker.json" /grant "*${sid}:(R)"

After fully exiting and reopening Desktop:

• The setup warning disappeared.
• An ordinary agent shell command returned sandbox-command-ok successfully.
• The configuration still contained sandbox = "elevated".

No WindowsApps permission change, ownership change, recursive ACL reset, or full-control grant was needed for this workaround. I have not tested whether it survives the next setup/marker rewrite, and I am not presenting it as a fix for every Windows setup failure.

It would help if marker access denied were surfaced distinctly from “missing or incompatible,” and the intended user SID were preserved when setup writes the marker ACL.

This report was prepared with AI assistance from observed local command output and the recovery I performed. Personal paths and SID values are redacted.

What steps can reproduce the bug?

Observed sequence on the affected machine (not a clean-install reproducer):

1. Configure [windows] sandbox = "elevated" and attempt Desktop Windows sandbox setup.
2. Setup reports failure despite the helper completion and read-ACL success messages above.
3. Try an ordinary agent command; it fails with orchestrator_helper_incomplete.
4. Confirm that the freshly written marker exists but is unreadable by the normal user; inspect its ACL from an administrator PowerShell.
5. Grant Read to the explicitly resolved user SID on this one file, then fully exit and reopen Desktop.
6. The setup warning disappears and the ordinary agent command succeeds with the configuration still set to elevated.

What is the expected behavior?

Successful setup should leave its marker readable by the user running Desktop. An inaccessible marker should produce a specific permissions error, rather than being reported as missing or incompatible and causing repeated setup attempts.

Start by tracing the Windows elevated-sandbox setup that creates .codex\.sandbox\setup_marker.json, focusing on how its ACL is written and how unreadable markers are reported. Reproduce the reported domain-SID ACL and read-only user grant, then verify that setup leaves the marker readable by the Desktop user and distinguishes access denied from a missing or incompatible marker.