Windows sandbox blocks Node child processes with EPERM; elevated setup also fails

Codex cannot complete website dependency installation on my Windows laptop. Please investigate this runtime failure and provide a supported repair.

Installed version last verified: OpenAI.Codex 26.908.9136.0.

The failure reproduces independently of the website:

• Basic shell commands and Node itself work.
• Node cannot launch cmd.exe to run “node --version”.
• The result is spawnSync EPERM.
• Package verification and downloads succeed, but esbuild/workerd postinstall scripts fail with spawn EPERM, errno -4048.

Minimal reproduction:

node -e "const r=require('node:child_process').spawnSync(process.env.ComSpec||'cmd.exe',['/d','/s','/c','node --version'],{encoding:'utf8'}); console.log({status:r.status,error:r.error?.code,stdout:r.stdout});"

Expected result: the child process prints the Node version and exits successfully.

Actual result: status is null and error is EPERM.

Recovery steps already tried:

• Updated Codex.
• Ran Windows app Repair.
• Restarted Codex and the laptop.
• Retried in a new task.
• Changed the Windows sandbox setting from unelevated to elevated.

Elevated mode failed before any administrator prompt appeared:
helper_sandbox_lock_failed
SetNamedSecurityInfoW sandbox dir failed: 5

Restoring unelevated mode and restarting restored basic command access, but Node child-process execution still fails.

The connection between the elevated setup error and the Node process-launch failure is unconfirmed.

Please provide a supported repair that preserves project files and sandbox protections. No security protections have been disabled and no permission bypass has been attempted.

Start by running the minimal Node child-process reproduction on Windows and compare it with the elevated setup error, helper_sandbox_lock_failed and SetNamedSecurityInfoW sandbox dir failed: 5. Trace the sandbox process-launch and setup entry points, then verify that a supported repair restores child processes without disabling protections or altering project files.