openai/codex · error · SetupFailure

HelperFirewallPolicyAccessFailed

HelperFirewallPolicyAccessFailed

Error message

CoCreateInstance NetFwPolicy2 failed: {err:?}

What it means

Error "CoCreateInstance NetFwPolicy2 failed: {err:?}" thrown in openai/codex.

Source

Thrown at codex-rs/windows-sandbox-rs/src/bin/setup_main/win/firewall.rs:75

    proxy_ports: &[u16],
    allow_local_binding: bool,
    log: &mut dyn Write,
) -> Result<()> {
    let local_user_spec = format!("O:LSD:(A;;CC;;;{offline_sid})");

    let hr = unsafe { CoInitializeEx(None, COINIT_APARTMENTTHREADED) };
    if hr.is_err() {
        return Err(anyhow::Error::new(SetupFailure::new(
            SetupErrorCode::HelperFirewallComInitFailed,
            format!("CoInitializeEx failed: {hr:?}"),
        )));
    }

    let result = unsafe {
        (|| -> Result<()> {
            let policy: INetFwPolicy2 = CoCreateInstance(&NetFwPolicy2, None, CLSCTX_INPROC_SERVER)
                .map_err(|err| {
                    anyhow::Error::new(SetupFailure::new(
                        SetupErrorCode::HelperFirewallPolicyAccessFailed,
                        format!("CoCreateInstance NetFwPolicy2 failed: {err:?}"),
                    ))
                })?;
            ensure_local_policy_rules_take_effect(&policy)?;
            let rules = policy.Rules().map_err(|err| {
                anyhow::Error::new(SetupFailure::new(
                    SetupErrorCode::HelperFirewallPolicyAccessFailed,
                    format!("INetFwPolicy2::Rules failed: {err:?}"),
                ))
            })?;

            if allow_local_binding {
                // Remove the legacy overlapping allow rule before returning to the local-binding
                // mode so stale proxy exceptions do not linger.
                remove_rule_if_present(&rules, OFFLINE_PROXY_ALLOW_RULE_NAME, log)?;
                remove_rule_if_present(&rules, OFFLINE_BLOCK_LOOPBACK_UDP_RULE_NAME, log)?;
                remove_rule_if_present(&rules, OFFLINE_BLOCK_LOOPBACK_TCP_RULE_NAME, log)?;

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/windows-sandbox-rs/src/bin/setup_main/win/firewall.rs:75 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/9144ea2df7071b22. Report an issue: GitHub.