Windows sandbox still fails with CreateProcessAsUserW error 2 on 0.154.0 after successful reprovision

Summary

On Windows 11 Pro build 26200, Codex CLI 0.154.0 still cannot launch any child process in the native Windows sandbox. The failure occurs in SpawnChild with:

CreateProcessAsUserW failed: 2 (The system cannot find the file specified)

This persists even after a successful elevated sandbox reprovision, where codex doctor --json reports:

sandbox.helpers: ok
sandbox backend: elevated
sandbox provisioning: complete

So the setup/provisioning layer is healthy, but actual sandboxed process creation is still broken.

Environment

• Windows 11 Professional, x64
• OS build: 10.0.26200
• Codex CLI: 0.154.0
• Install method: official standalone Windows installer
• Codex Desktop: 26.903.9818.0
• Approval policy: OnRequest
• Sandbox backend tested: elevated and unelevated

Reproduction

From PowerShell:

Set-Location "C:\Ticket Audit Copilot"
$cmd = "$env:WINDIR\System32\cmd.exe"

codex -c 'windows.sandbox="elevated"' sandbox windows `
  $cmd /c echo CODEX_SANDBOX_OK

Actual result:

windows sandbox failed: runner failed during SpawnChild: CreateProcessAsUserW failed: 2 (The system cannot find the file specified) | cwd=C:\Ticket Audit Copilot | cmd=windows C:\WINDOWS\System32\cmd.exe /c echo CODEX_SANDBOX_OK | ... (Windows error 2)

The same class of failure also occurred with:

codex -c 'windows.sandbox="unelevated"' sandbox windows `
  $cmd /c echo CODEX_UNELEVATED_OK

Troubleshooting already performed

1. Updated the official standalone CLI to 0.154.0 using:

codex update

2. Ran codex doctor --json. Initially the sandbox provisioning state failed with helper_unknown_error: setup refresh had errors.

3. Reprovisioned the sandbox successfully from an elevated PowerShell:

codex sandbox setup --elevated --current-user

Result:

Windows elevated sandbox setup completed for <user> at C:\Users\<user>\.codex.

4. Re-ran codex doctor --json; it now reports:

sandbox.helpers = ok
sandbox provisioning = complete
sandbox backend = elevated

5. Re-ran the sandbox smoke test using the absolute path to cmd.exe and a normal project working directory. It still fails during SpawnChild with CreateProcessAsUserW failed: 2.

6. Also tested from C:\Windows\System32 and from the project directory; the working directory does not change the result.

Expected behavior

codex -c 'windows.sandbox="elevated"' sandbox windows `
  C:\Windows\System32\cmd.exe /c echo CODEX_SANDBOX_OK

should print:

CODEX_SANDBOX_OK

Actual behavior

The sandbox setup succeeds and doctor reports a healthy sandbox, but the command runner fails later during child-process creation:

runner failed during SpawnChild: CreateProcessAsUserW failed: 2

Why this seems distinct/useful

This appears to confirm that the failure can persist on 0.154.0 even after the previously failing provisioning/setup layer has been repaired successfully. codex doctor therefore reports the sandbox as healthy while the actual command runner remains unusable.

Related reports:

• #43313 — same CreateProcessAsUserW failed: 2 regression on 0.153.4
• #36386 — standalone package reaches SpawnChild and then fails with error 2
• #28042 — direct Windows sandbox runner still fails after other Desktop/browser symptoms were fixed
• #29881 — WSL → Native setup flow repaired a similar state on another machine, but in this environment a successful explicit elevated reprovision did not repair SpawnChild

Additional information

• Authentication, network reachability, installation consistency, state DB integrity, and disk checks are all reported healthy by codex doctor.
• Microsoft Defender is present; doctor only reports that Codex exclusions are unverified. No Defender/ACL modifications were made for this reproduction.
• No project-specific command is required to reproduce the bug; a harmless cmd.exe /c echo ... is sufficient.
• No credentials, cookies, project contents, or private user data are included in this report.

Start at the SpawnChild path that calls CreateProcessAsUserW and compare it with the successful sandbox provisioning state reported by codex doctor --json. Reproduce with the documented cmd.exe smoke test in both elevated and unelevated modes. Done means a sandboxed child process launches successfully after setup, including from the reported working directories.