Windows Codex Workspace fails with helper_unknown_error: setup refresh had errors #35353

Activity

1. alexpmtk-afk

   added

   appIssues related to the Codex desktop appIssues related to the Codex desktop app

   on Jul 25, 2026
2. github-actions

   added

   bugSomething isn't workingSomething isn't working

   windows-osIssues related to Codex on Windows systemsIssues related to Codex on Windows systems

   sandboxIssues related to permissions or sandboxingIssues related to permissions or sandboxing

   on Jul 25, 2026
3. github-actions commented on Jul 25, 2026

   

   github-actionsBot

   on Jul 25, 2026 – with GitHub Actions

   Contributor

   More actions

   Potential duplicates detected. Please review them and close your issue if it is a duplicate.

   • Incident notice — Codex sandbox failure blocking DC-049 #35181

   Powered by Codex Action
4. bbingz commented on Jul 25, 2026

   

   bbingz

   on Jul 25, 2026

   More actions

   Analysis (community)

   Residual analysis for #35353 (helper_unknown_error: setup refresh had errors on Windows Workspace) under docs/contributing.md — invitation-only. No unsolicited PR. Related: #35349 (Setup Incomplete loop) shares the setup binary surface.

   Root-cause hypothesis (two OSS levers, one symptom)

   Windows sandbox setup has a hard bail on any non-empty refresh error list ("setup refresh had errors"), and untyped/anyhow failures are folded into HelperUnknownError, which wires as the non-actionable string helper_unknown_error. Users therefore see a single opaque code even when logs know more.

   Verified at HEAD 4c43465133 under codex-rs/windows-sandbox-rs (Apache OSS path):

   1. Refresh hard-fail (AD).
   codex-rs/windows-sandbox-rs/src/bin/setup_main/win.rs — when refresh_only && !refresh_errors.is_empty():

   • logs setup refresh completed with errors: {refresh_errors:?}
   • then anyhow::bail!("setup refresh had errors")

   Partial refresh problems become a full non-zero setup exit. The bail string itself is generic; detail lives in the log line immediately above, not in the typed failure code path unless something re-maps it.

   2. Unknown-error fold (AF).
   Same file, setup error handling:

   let failure = extract_setup_failure(err)
     .map(...)
     .unwrap_or_else(|| SetupFailure::new(SetupErrorCode::HelperUnknownError, err.to_string()));

   Any error without a typed SetupFailure becomes HelperUnknownError. Wire map in setup_error.rs: HelperUnknownError => "helper_unknown_error".

   So a refresh bail (or other untyped chain) that does not carry a structured SetupFailure collapses to the exact symptom string in this issue title.

   3. What is / is not OSS.

   • Error codes, setup binary, refresh spawn/logging (setup.rs “setup refresh: spawning…” region) — OSS.
   • Desktop “Setup Incomplete” chrome may be Electron/closed; treat UX copy as PARTIAL and keep the OSS residual focused on helper codes + refresh policy.

   4. Distinct from #17459 / SEC_E_NO_CREDENTIALS-class token issues.
   Different subsystem (windows-sandbox setup helper vs credential/token restricted flags).

   Ranked fix outline (all OSS):

   1. Map refresh failures to a specific SetupErrorCode (e.g. HelperSetupRefreshFailed) instead of Unknown — include aggregated refresh_errors in SetupErrorReport.message.
   2. Soften policy: do not hard-fail the entire setup on non-critical refresh roots when CLI exec is still viable (or classify critical vs non-critical refresh errors).
   3. Always surface log path + first concrete root error string in the report message (today the useful list is log-only).
   4. Preserve typed extract_setup_failure for known ACL/firewall/user-provision paths so they never fall through to Unknown.

   Fail-first tests: (1) non-empty refresh_errors in refresh_only mode → typed code ≠ helper_unknown_error (or message contains the logged errors); (2) known SetupFailure still round-trips its code; (3) untyped anyhow still produces a message that includes err.to_string(), not an empty unknown.

   Happy to help draft the error-code + message tests. No unsolicited PR.
5. ericblade commented on Sep 4, 2026

   

   ericblade

   on Sep 4, 2026

   More actions

   Same problem. Found that my directory -- as well as almost everything on my PC -- is owned by Administrator .. and the root directory of a project apparently needs to be owned by your user account to have it work.

   $projectOwner = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
   icacls "d:\path\to\project\root\dir" /setowner "$projectOwner"
   

   This is basically per the information in this thread: https://community.openai.com/t/codex-desktop-command-runner-completely-broken-helper-unknown-error-setup-refresh-had-errors/1391898
6. Acudivinix commented on Oct 8, 2026

   

   Acudivinix

   on Oct 8, 2026

   More actions

   I have the same issue Connected Windows computer; delegated task fails before PowerShell starts: helper_unknown_error: setup refresh had errors. Retry failed October 8 at 16:04:25 UTC.