Fix Codex helper_unknown_error: setup refresh had errors on Windows

TL;DR: On Windows Codex builds reported around 26.1002.x with bundled CLI 0.162.0-alpha.2, helper_unknown_error: setup refresh had errors is usually a likely elevated-sandbox sharing-violation regression, and the reported temporary workaround is to set [windows] sandbox = "unelevated" until an updated build is installed. This guide is based on GitHub user reports, sandbox logs, and user-cited OpenAI Windows sandbox documentation in openai/codex issues.

Applies to: Codex Desktop / ChatGPT Desktop local execution on Windows 10 and Windows 11, especially reported package versions 26.1002.6548.0 and 26.1002.7124.0, About versions 26.1002.51308 and 26.1002.52244, bundled CLI/helper 0.162.0-alpha.2. Last checked: 2026-11-03.

helper_unknown_error: setup refresh had errors in elevated sandbox

exec-server rejected request (-32603): helper_unknown_error: setup refresh had errors
windows sandbox failed: helper_unknown_error: setup refresh had errors

Codex shows helper_unknown_error: setup refresh had errors on Windows when the elevated sandbox setup likely fails during runtime read/execute ACL validation on active cua_node files, with Windows os error 32 / ERROR_SHARING_VIOLATION reported in sandbox logs (reported in openai/codex#51601, openai/codex#51634, and openai/codex#51590). This is your case if ordinary sandboxed commands such as Get-Location fail before PowerShell starts and the log names node_repl.exe, node.exe, or VCRUNTIME140_1.dll under %LOCALAPPDATA%\OpenAI\Codex\runtimes\cua_node\... (reported in openai/codex#51601).

1. Search the Codex sandbox logs for the fatal runtime validation line.

   Select-String -Path "$env:USERPROFILE\.codex\.sandbox\sandbox.*.log" `
     -Pattern "runtime read/execute validation failed","os error 32","helper_unknown_error" `
     -Context 0,3

2. If the log contains runtime read/execute validation failed and os error 32 on a cua_node runtime file, find the Codex config.toml file that contains the Windows sandbox setting.

   Get-ChildItem -Path $env:USERPROFILE -Filter config.toml -Recurse -ErrorAction SilentlyContinue |
     Select-String -Pattern '^\s*sandbox\s*=\s*"(elevated|unelevated)"' -List |
     Select-Object -ExpandProperty Path

3. Open the reported config.toml file and change the Windows sandbox block to the reported temporary workaround.

   [windows]
   sandbox = "unelevated"

4. Fully exit Codex Desktop or ChatGPT Desktop, then reopen the app so the sandbox setting is reloaded; restarting the app without changing the setting was reported not to resolve the elevated-sandbox failure (reported in openai/codex#51601 and openai/codex#51590).
5. Run one minimal sandboxed command from Codex, such as Get-Location, before retrying a build, test, Browser Use, or Computer Use workflow.

How to confirm it worked: The requested command should start and complete instead of failing before process creation. In successful workaround reports, a sandboxed PowerShell command completed and Browser Control initialized after switching to unelevated (reported as a workaround in openai/codex#51590).

If it still fails: Collect %USERPROFILE%\.codex\.sandbox\sandbox.<date>.log and %USERPROFILE%\.codex\.sandbox\setup_error.json, then report the Codex package version, About version, bundled CLI/helper version, Windows version, sandbox setting, failing runtime path, and the exact runtime read/execute validation failed line in the existing GitHub issue. Do not rely on manual ACL pre-granting as the next fix, because a report found recursive (RX) ACEs did not change the failure (reported in openai/codex#51634); if your next error is an API/provider error after local execution works, use the general error-handling guide to separate retryable API failures from this local Windows sandbox startup failure.

trusted Node process exited unexpectedly in Computer Use

trusted Node process exited unexpectedly
node_repl kernel exited unexpectedly
windows sandbox failed: helper_unknown_error: setup refresh had errors

Codex can show trusted Node process exited unexpectedly or node_repl kernel exited unexpectedly when Computer Use, Browser Use, or the Node REPL fails because the same Windows sandbox setup refresh fails first (reported in openai/codex#51590, openai/codex#51601, and openai/codex#51634). This is your case if await cua.getState(), sky.list_apps(), or browser/app discovery fails before returning any tabs or apps, and ordinary sandboxed shell commands also fail before execution (reported in openai/codex#51590).

1. Confirm the Node error is backed by the same sandbox setup failure.

   Select-String -Path "$env:USERPROFILE\.codex\.sandbox\sandbox.*.log" `
     -Pattern "node_repl.exe","VCRUNTIME140_1.dll","runtime read/execute validation failed","setup refresh had errors" `
     -Context 0,3

2. If the log shows the same runtime read/execute validation failure, apply the same temporary sandbox setting.

   [windows]
   sandbox = "unelevated"

3. Fully exit and reopen Codex Desktop or ChatGPT Desktop; terminating only node_repl.exe was reported not to provide a lasting recovery because the failure can move to another in-use runtime file such as VCRUNTIME140_1.dll (reported in openai/codex#51601 and openai/codex#51634).
4. Retry the smallest affected operation first: run a sandboxed Get-Location, then retry Browser Use or Computer Use initialization.

How to confirm it worked: Computer Use or Browser Use should initialize instead of failing before browser or app inventory, and the sandbox log should no longer show the fatal runtime read/execute validation failed line for the retry. One later user report said PowerShell, node_repl, Computer Use, and sky.list_apps() worked with latest checks and sandbox refreshes reported errors=[], but the material did not include a maintainer release note for that recovery (reported in openai/codex#51590).

If it still fails: If your updater offers a newer Codex Windows build, install it and retest with the same minimal command; if the updater reports the app is already current, attach the sandbox log and version details to the GitHub issue instead of repeatedly resetting the runtime directory. If you reinstalled or rolled back and provider configuration is missing after local execution works again, use Codex model-provider configuration to rebuild the Codex-side provider setup.

How We Verified

• Likely elevated Windows sandbox ACL sharing violation: multiple user reports on 2026-10-07 and 2026-10-08 included sandbox log lines for runtime read/execute validation failed, open ACL target for root-only update, and os error 32 on active cua_node files (openai/codex#51601, openai/codex#51634, openai/codex#51590).
• unelevated workaround: a user reported on 2026-10-08 that changing config.toml to [windows] sandbox = "unelevated" restored sandboxed PowerShell and Browser Control on Codex Desktop 26.1002.7124.0; the same report cited OpenAI documentation describing unelevated as a fallback with weaker isolation than elevated (openai/codex#51590).
• Downgrade as a user workaround, not the main fix here: users reported recovery after downgrading to earlier complete desktop builds such as package 26.930.7945.0 with bundled CLI 0.160.1, but the material did not provide an official rollback procedure or maintainer recommendation (openai/codex#51590 and openai/codex#51601).

Docs: Use Codex model-provider configuration to restore or update Codex provider settings after local command execution is working again. → Codex model-provider configuration

Related Docs

Codex users who have restored local command execution can use these docs for provider setup and non-sandbox error handling.

• Codex model-provider configuration
• General error-handling guide

Sources

Codex Windows sandbox findings in this article come from public GitHub issue reports and the official Windows sandbox documentation cited inside those reports.

• openai/codex#51601: Windows app 26.1002.51308 / build 13417 sandbox setup fails with sharing violation while validating active runtime files.
• openai/codex#51634: Windows sandbox provisioning fails with os error 32 when a cua_node runtime file is in use, reported against 0.162.0-alpha.2.
• openai/codex#51590: Windows sandbox fails opening running node_repl.exe for ACL update; includes reports of unelevated workaround and later recovery checks.
• OpenAI Windows sandbox documentation cited by users in openai/codex#51590: https://learn.chatgpt.com/docs/windows/windows-sandbox.