I ran into the same helper_unknown_error: setup refresh had errors issue on Windows, but only in one specific workspace.
I was able to identify the cause in my case. The sandbox log contained:
deny ACE failed on <repository>\.git
SetNamedSecurityInfoW failed: 5 (Access denied)
I then checked the owner of the .git directory:
(Get-Acl "<repository>\.git").Owner
The .git directory was owned by:
CodexSandboxOffline
instead of my normal Windows user.
After completely closing Codex, I opened PowerShell as Administrator and changed the owner of the .git directory back to my normal Windows user:
icacls "<repository>\.git" /setowner "<your-windows-user>"
After restarting Codex, the sandbox immediately worked normally again. No reinstall, repository clone, cache deletion, or junction was required.
So in my case, the problem appears to have been incorrect ownership of the .git directory. The elevated sandbox setup refresh was unable to modify its ACL and then surfaced the generic setup refresh had errors message.
This may not be the cause for everyone seeing this error, but checking the owner of .git could be worth trying before more invasive troubleshooting.