Windows: Node.js spawnSync returns EPERM with pid=0 and status=null inside Codex CLI

What version of Codex CLI is running?

0.153.4 — recorded in the affected Codex CLI session.

What subscription do you have?

ChatGPT Pro

Which model were you using?

No response

What platform is your computer?

No response

What terminal emulator and version are you using (if applicable)?

No response

Codex doctor report

What issue are you seeing?

A Node.js process launched through Codex CLI's Windows command execution tool cannot start a child Node.js process, even when the child operation is only printing its version.

The retained minimal operation was:

child_process.spawnSync(process.execPath, ['--version'], { windowsHide: true })

Observed result:

• errorCode: EPERM
• errorClass: Error
• syscall: spawnSync E:\node\node.exe
• pid: 0
• status: null
• stdoutPresent: false
• stderrPresent: false

This blocks tests that require real subprocess execution. The parent Node.js process runs far enough to serialize the failure, but the child does not start. The diagnostic wrapper's exit code of 0 must not be interpreted as successful child execution.

Recorded environment:

• Windows, using Windows PowerShell.
• Codex CLI 0.153.4.
• Node executable: E:\node\node.exe.
• Recorded approval policy: on-request.
• Recorded sandbox policy: workspace-write.
• A subsequent configuration inspection showed the Windows sandbox setting as unelevated; its causal relevance is unconfirmed.

I have not established whether the failure originates from Codex's execution environment, Windows process restrictions, or an invocation issue. I have not bypassed the sandbox or changed permissions to retry.

Expected behavior: the version-only child process should execute if permitted by the effective policy. If it is intentionally denied, an actionable diagnostic identifying the relevant restriction would help.

Feedback was uploaded for thread:
01a09392-98b9-7b30-8084-630fde25c9b1

Original probe call ID:
call_o65r2IRu5WQUOgbAphppWO7c

Command item ID:
exec-aac1b954-9299-436d-9d51-f16e2ca085dc

Recorded execution window:
2026-09-12T03:53:26.586Z to 2026-09-12T03:53:26.786Z

Please help identify the cause and a supported remediation that preserves the intended execution restrictions.

What steps can reproduce the bug?

Uploaded thread: 01a09392-98b9-7b30-8084-630fde25c9b1

What is the expected behavior?

No response

Additional information

No response

Start with the retained Node.js spawnSync(process.execPath, ['--version'], { windowsHide: true }) operation and the Codex CLI Windows command execution tool. Compare the effective sandbox and approval policies with the EPERM result, then identify the cause and a supported remediation or actionable restriction diagnostic that preserves execution limits.