# Codex Desktop command runner completely broken: helper\_unknown\_error: setup refresh had errors

**URL:** <https://community.openai.com/t/codex-desktop-command-runner-completely-broken-helper-unknown-error-setup-refresh-had-errors/1391898>\
**Category:** Bugs\
**Tags:** windows-app, codex-app\
**Created:** [August 22, 2026, 5:17pm UTC](https://community.openai.com/t/codex-desktop-command-runner-completely-broken-helper-unknown-error-setup-refresh-had-errors/1391898 "2026-08-22T17:17:29Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![tendencymilk](https://avatars.discourse-cdn.com/v4/letter/t/9fc29f/32.png) [@tendencymilk](https://community.openai.com/u/tendencymilk)\
**Post date:** [August 22, 2026, 9:15pm UTC](https://community.openai.com/t/codex-desktop-command-runner-completely-broken-helper-unknown-error-setup-refresh-had-errors/1391898/7 "2026-08-22T21:15:59Z")

</div>

Thanks for posting this investigation. I ran into the same `helper_unknown_error: setup refresh had errors` issue on Codex Desktop `26.818.5229.0`.

I tried your junction workaround first, but unfortunately the same setup-refresh failure still occurred in my case. That led me to look more closely at the sandbox log.

The relevant error was:

```auto
deny ACE failed on ...\.git
SetNamedSecurityInfoW failed for ...\.git: 5
setup refresh had errors

```

I then checked the owner of the repository root and the `.git` directory:

```auto
(Get-Acl ".").Owner
(Get-Acl ".git").Owner

```

The repository root was owned by my normal Windows user:

```auto
DESKTOP-...\myusername

```

but `.git` was owned by:

```auto
DESKTOP-...\CodexSandboxOffline

```

That turned out to be the important difference.

I completely closed Codex, opened PowerShell as Administrator, navigated to the repository, and changed **only the owner of `.git`** back to my normal Windows account:

```auto
icacls ".git" /setowner "DESKTOP-...\myusername"

```

I did not reset the ACLs, recursively change permissions, move the repository, or switch the sandbox to `unelevated`.

After confirming that:

```auto
(Get-Acl ".git").Owner

```

returned my normal user again, I reopened the original workspace in Codex with:

```auto
[windows]
sandbox = "elevated"

```

Command execution immediately started working again.

I successfully ran:

```auto
Get-Location
git status
git rev-parse HEAD

```

So in my case, the problem appears to have been that `.git` had been left owned by `CodexSandboxOffline`. The next elevated sandbox setup refresh then failed when it tried to modify the `.git` ACL, resulting in `SetNamedSecurityInfoW ... error 5`.

Your junction workaround did not resolve my particular case, but your investigation was very helpful in confirming that this was workspace/sandbox related rather than a broken Git repository.

For anyone else seeing the same error, it may be worth checking the ownership of `.git` before doing broader ACL resets or permanently switching to the unelevated sandbox.

---

_[View the full topic](https://community.openai.com/t/codex-desktop-command-runner-completely-broken-helper-unknown-error-setup-refresh-had-errors/1391898)._