Windows-native agent sandbox fails when workspace is on a WSL UNC path: `setup refresh had errors`
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 125k
- Forks
- 19.4k
- PR merge metrics
- PR metrics pending
Description
What version of the Codex App are you using (From “About Codex” dialog)?
26.915.31945
What subscription do you have?
Plus
What platform is your computer?
Microsoft Windows NT 10.0.26100.0 x64
What issue are you seeing?
Description
Codex Desktop is configured with:
Agent Environment: Native Windows
The project files are stored inside WSL and opened from Windows via:
\\wsl.localhost\Ubuntu-24.04\home\user\project
When resuming or starting a task, the Windows sandbox attempts to apply Windows ACLs to the WSL UNC workspace and fails before the task starts.
The error shown by Codex is:
failed to load AGENTS.md instructions for environment 'local': fs sandbox helper failed with status exit code: 1: windows sandbox failed: helper_unknown_error: setup refresh had errors
Changing:
sandbox = "unelevated"
does not help.
Logs
write ACE check failed on \\?\UNC\wsl$\Ubuntu-24.04\home\user\project:
GetSecurityInfo failed ...: 1
granting write ACE ... for sandbox group and capability SID
write ACE grant failed on \\?\UNC\wsl$\Ubuntu-24.04\home\user\project:
GetSecurityInfo failed ...: 1
setup refresh completed with errors
setup error: setup refresh had errors
What steps can reproduce the bug?
Steps to reproduce
- Run Codex Desktop on Windows.
- Set Agent Environment to Native Windows.
- Open a project whose files are stored inside WSL, for example:
\\wsl.localhost\Ubuntu-24.04\home\user\project - Start or resume a Codex task.
- Sandbox initialization fails before the task starts.
What is the expected behavior?
No response
Additional information
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the failure using the Windows-native agent with a workspace at the reported WSL UNC path, then trace the Windows sandbox setup refresh that emits the ACL and GetSecurityInfo errors. Done means sandbox initialization no longer aborts before a task starts for this workspace configuration, with the relevant behavior covered by a regression test if the project provides one.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100