Windows browser control fails before initialization: sandbox setup refresh hits sharing violation on node_repl.exe
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 20/100
Research direction
The failure sits in the Windows sandbox setup refresh, which runs an ACL update on the cua_node runtime's node_repl.exe under LOCAL_APP_DATA; the log names the 'open ACL target for root-only update' step and the os error 32 sharing violation. Start by locating where the sandbox setup refresh and its root-only ACL update are implemented in the repository, and identify what could hold a lock on that file. Done would mean the refresh completes without errors on a restarted machine, with a test or reproduction showing the sharing violation no longer occurs.
Written by the indexing model from the issue text.
Description
Environment
- Windows desktop, Codex app.
- Local execution uses workspace-write sandbox and automatic approval review.
- Browser control tool: cua_repl.
- Reproduced on 2026-10-09 after a full computer restart.
- Exact current desktop app version not freshly verified; avoid inferring it from the bundled CLI or package directory.
Steps to reproduce
- Open the desktop app after restarting the computer.
- Ask the assistant to connect to an existing website tab using the supported browser control tool.
- The in-app browser connection fails before returning tool documentation or page state.
- Reset the tool session and try the supported Chrome fallback. It fails at the same initialization stage.
Expected result
Browser control initializes and returns a page snapshot, or reports a browser-specific connection problem.
Actual result
Both entry points fail before any page interaction:
node_repl kernel exited unexpectedly
kernel_status: exited(code=1)
kernel_stderr_tail: windows sandbox failed: helper_unknown_error: setup refresh had errors
reason: stdout_eof
Sanitized sandbox log excerpt:
runtime read/execute validation failed:
validate runtime read/execute access on
<LOCAL_APP_DATA>\OpenAI\Codex\runtimes\cua_node\<runtime-id>\bin\node_repl.exe:
open ACL target for root-only update:
another program is using this file; the process cannot access it. (os error 32)
setup refresh completed with errors
setup error: setup refresh had errors
The log excerpt corresponds to local attempts around 09:07–09:08, UTC+08:00 on 2026-10-09.
Impact and attempted recovery
- Browser automation is unavailable; no generation/form-submission action was performed.
- Restarting the desktop app previously did not resolve it; a full computer restart also did not resolve the current reproduction.
- Resetting the browser-control tool and testing the supported Chrome fallback did not resolve it.
- Standard sandboxed shell initialization also failed with setup-refresh errors, while explicitly approved elevated read-only diagnostics succeeded.
- This localizes the observed failure to initialization rather than website authentication. The process holding the file and the underlying root cause are not established by this excerpt.
- No sandbox protections were disabled and no ACL settings were changed.
Privacy
This report excludes customer assets, project details, account credentials, session transcripts, real user paths, and complete raw logs. Sharing the full conversation or raw log is not authorized by this report.
- Dominant language
- Rust
- Stars
- 129k
- Forks
- 20.3k
- Avg merge
- 1m
- Merged PRs (30d)
- 998
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from openai/codex
-
app bug
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
Maintainers usually reply within 1 day
-
app-server documentation
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
app bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
openai/codex#55328 · 1 comment ·
Maintainers usually reply within 1 day
-
bug CLI
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
openai/codex#55122 · 2 comments ·
Maintainers usually reply within 1 day
-
Python SDK: CodexClient.close() leaves the app-server's stdout/stderr pipes open (and never waits after kill)Possibly taken @akhil9tiet claimed this 3 days ago. Openapp-server bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
openai/codex#54908 · 2 comments ·
Maintainers usually reply within 1 day
Similar issues
-
engine-rs P3 review-deferral wasm
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
maniator/verticopolis#1154 ·
Maintainers usually reply within 1 day
-
FFMPEG_BIN/FFPROBE_BIN are always overridden, so a working system ffmpeg cannot be usedPossibly taken @Bilker1422 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Stremio/stremio-service#116 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
Maintainers usually reply within 1 day