Thanks for posting this investigation. I ran into the same helper_unknown_error: setup refresh had errors issue on Codex Desktop 26.818.5229.0.
I tried your junction workaround first, but unfortunately the same setup-refresh failure still occurred in my case. That led me to look more closely at the sandbox log.
The relevant error was:
deny ACE failed on ...\.git
SetNamedSecurityInfoW failed for ...\.git: 5
setup refresh had errors
I then checked the owner of the repository root and the .git directory:
(Get-Acl ".").Owner
(Get-Acl ".git").Owner
The repository root was owned by my normal Windows user:
DESKTOP-...\myusername
but .git was owned by:
DESKTOP-...\CodexSandboxOffline
That turned out to be the important difference.
I completely closed Codex, opened PowerShell as Administrator, navigated to the repository, and changed only the owner of .git back to my normal Windows account:
icacls ".git" /setowner "DESKTOP-...\myusername"
I did not reset the ACLs, recursively change permissions, move the repository, or switch the sandbox to unelevated.
After confirming that:
(Get-Acl ".git").Owner
returned my normal user again, I reopened the original workspace in Codex with:
[windows]
sandbox = "elevated"
Command execution immediately started working again.
I successfully ran:
Get-Location
git status
git rev-parse HEAD
So in my case, the problem appears to have been that .git had been left owned by CodexSandboxOffline. The next elevated sandbox setup refresh then failed when it tried to modify the .git ACL, resulting in SetNamedSecurityInfoW ... error 5.
Your junction workaround did not resolve my particular case, but your investigation was very helpful in confirming that this was workspace/sandbox related rather than a broken Git repository.
For anyone else seeing the same error, it may be worth checking the ownership of .git before doing broader ACL resets or permanently switching to the unelevated sandbox.