openai/codex · error · anyhow::Error

unexpected windows sandbox wrapper argument

Error message

unexpected windows sandbox wrapper argument: {arg}

What it means

The Windows sandbox wrapper's argument parser reached an argument that matches no known flag constant (network proxy SID, read/write roots JSON, platform defaults, codex home, cwd, env JSON, permission profile, sandbox level, or the '--' command separator). It fires when the parent process and wrapper binary disagree on the flag protocol, e.g. after a version skew between the launcher and the wrapper or a hand-edited command line.

Solutions

1. Remove the unexpected argument or correct it to a supported wrapper flag; check the wrapper help output.

When it happens

Trigger: Thrown at codex-rs/windows-sandbox-rs/src/wrapper.rs:282 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/fdcf98631f3a37cc. Report an issue: GitHub.

Appendix: source

Thrown at codex-rs/windows-sandbox-rs/src/wrapper.rs:282

            NETWORK_PROXY_RESTRICTING_SID_FLAG => {
                network_proxy_restricting_sid = Some(next_flag_value(&mut args, &arg)?);
            }
            READ_ROOTS_INCLUDE_PLATFORM_DEFAULTS_FLAG => {
                read_roots_include_platform_defaults = true;
            }
            READ_ROOTS_JSON_FLAG => {
                read_roots_override =
                    Some(json_flag_value(next_flag_value(&mut args, &arg)?, &arg)?);
            }
            WRITE_ROOTS_JSON_FLAG => {
                write_roots_override =
                    Some(json_flag_value(next_flag_value(&mut args, &arg)?, &arg)?);
            }
            "--" => {
                command = Some(args.collect::<Vec<_>>());
                break;
            }
            _ => bail!("unexpected windows sandbox wrapper argument: {arg}"),
        }
    }

    let codex_home = codex_home.ok_or_else(|| anyhow!("missing required {CODEX_HOME_FLAG}"))?;
    if !codex_home.is_absolute() {
        bail!(
            "{CODEX_HOME_FLAG} must be absolute: {}",
            codex_home.display()
        );
    }
    let command_cwd = command_cwd.ok_or_else(|| anyhow!("missing required {COMMAND_CWD_FLAG}"))?;
    if workspace_roots.is_empty() {
        workspace_roots.push(command_cwd.clone());
    }
    Ok(WindowsSandboxWrapperRequest {
        codex_home,
        command_cwd,
        workspace_roots,

View on GitHub (pinned to 339751715c)