Exact-error library
AI coding agent fixes
Find the error string you actually saw. Every page separates confirmed workarounds from partial results and open upstream issues.
Windows cannot find codex-windows-sandbox-setup.exe
Windows cannot find 'codex-windows-sandbox-setup.exe'Run Codex from the complete official installation directory, not a copied or stale PATH entry. In the confirmed report, launching the real versioned Codex executable triggered the UAC sandbox setup and restored the helper. If the versioned directory is incomplete, reinstall the official package instead of downloading a helper executable from an unofficial source.
Open fix →AbsolutePathBuf deserialized without a base path on Windows
Error creating task Invalid request: AbsolutePathBuf deserialized without a base pathFirst identify whether the workspace is native Windows or WSL. For a native Windows folder, use native Windows mode; a WSL-mode reporter restored chat creation by switching modes. If you are already native in VS Code, use Developer: Reload Window as a temporary recovery, then reopen the folder from a single path namespace. These are environment-scoped workarounds, not a confirmed universal fix.
Open fix →App-server queued follow-up no longer exists
App-server queued follow-up no longer existsCopy any unsent text before doing anything else. Do not keep editing or resubmitting the missing queue item. Switch to another conversation to clear the visible error, then wait for the active turn to finish and send the instruction as a new message. This clears the reported UI state, but it does not prove the original queued message was delivered. No permanent fix is confirmed in the open upstream reports.
Open fix →Claude Code Playwright MCP fails after /c becomes C:/
Failed to reconnect to plugin:playwright:playwrightBypass the affected plugin command on native Windows and register Playwright MCP through its JavaScript entry point with `node`. The reporter confirmed that a direct `node .../@playwright/mcp/cli.js` configuration connected, while the plugin and `cmd /c` form failed after `/c` became `C:/`. Back up Claude configuration first because package paths vary by installation.
Open fix →Windows setup didn't finish: helper_failed
Windows setup didn't finishTreat this as a summary message, not a root cause. Fully quit Codex, then inspect the newest `.codex\.sandbox\setup_error.json` and sandbox log. Route by the first underlying error: missing helper, JSON parse failure, `SetNamedSecurityInfoW ... 5`, NetFwPolicy2, or a missing UAC launch. Do not reset broad ACLs or disable security software just because the UI says `helper_failed`.
Open fix →Codex helper_unknown_error while applying deny-read ACLs
windows sandbox: helper_unknown_error: apply deny-read ACLsExpand the error first. If it includes `parse deny-read ACL state` and `expected value at line 1 column 1`, fully close Codex, rename that one JSON state file as a backup, and reopen Codex so it can recreate the file. That worked in the confirmed report. If the nested parse error is absent, do not assume the same fix applies: the broader ACL setup error has other unresolved branches.
Open fix →CreateProcessAsUserW failed: 1312 in the Codex Windows sandbox
windows sandbox: runner error: CreateProcessAsUserW failed: 1312Error 1312 is not the same branch as `CreateProcessAsUserW failed: 5`. If it began after opening another VS Code window, close the extra Codex/VS Code windows and start a fresh session in one window. If it occurs in a single window, preserve the sandbox log and version details: the upstream issue shows setup can succeed while process creation still fails, and no permanent fix is confirmed.
Open fix →MCP Filesystem disconnects when an allowed directory is missing
Error accessing directory ... ENOENT: no such file or directory, stat ...Check every configured allowed directory. Restore or remount the missing path, or remove only that stale entry while keeping at least one valid allowed directory, then restart the MCP server and client. One missing path can stop the entire server before tools become available. If the client supplies MCP Roots, update those roots instead of editing a duplicate command-line list.
Open fix →Claude Code WSL tries to create /mnt/c/Users/.claude
bwrap: Can't mkdir /mnt/c/Users/.claude: Permission deniedDo not create files under `C:\Users` or loosen that directory's permissions. In the confirmed reproduction, the failure appears when `/etc/claude-code/managed-settings.json` exists and disappears when a personally controlled test copy is moved aside. The upstream bug remains open. On managed machines, preserve the policy file and give the exact error and issue link to the administrator rather than removing organizational controls.
Open fix →MCP Filesystem rejects a mapped drive but allows its UNC path
Access denied - path outside allowed directories: Y:\k8s not in \\server\share\gitRun `list_allowed_directories`, then use the exact UNC spelling it returns for Filesystem tool calls instead of the mapped drive letter. In the confirmed report, `Y:\...` was rejected while the equivalent `\\server\share\...` path succeeded. Keep the allowed share narrow; do not authorize the whole server or drive.
Open fix →Codex times out waiting for runner spawn_ready
windows sandbox: timed out after 15000ms waiting for runner spawn_readyThere is no confirmed permanent fix yet. Match `waiting for runner spawn_ready` exactly, because pipe-input, `CreateProcessAsUserW`, and token errors occur at different phases. Confirm the versioned command-runner file exists, retry a harmless command in a fresh local session, and use broader execution permissions only as a one-command diagnostic if you knowingly accept the risk—not as the permanent setup.
Open fix →Claude Desktop passes a literal ${VAR} to an MCP server
MCP server receives the literal string ${VAR}Test with a non-secret sentinel value first. If Claude Code CLI expands `${VAR}` but Claude Desktop passes the placeholder literally on the same machine, restarting Windows will not address the confirmed branch. Use the CLI for that MCP server, or use a server-documented secret-file option such as `<VAR>_FILE`. Do not paste a real token into troubleshooting output or leave it hardcoded in `.claude.json`.
Open fix →Codex bundled MCP fails with JSON-RPC error -32603
MCP startup failed: handshaking with MCP server failed: JSON-RPC error: -32603First confirm that both bundled plugins fail with the same `-32603` message while the desktop-bundled CLI still connects. The source report isolates the trigger to a non-empty `capabilities.experimental` object sent by CLI 0.154.0; disabling auth elicitation did not remove it. Update Codex first. If the regression remains, use the known-working desktop-bundled client for those plugins rather than editing their installed files.
Open fix →Codex Windows sandbox fails HTTPS with SEC_E_NO_CREDENTIALS
SEC_E_NO_CREDENTIALS (0x8009030e)First prove this is the sandbox-specific Schannel branch: the same approved HTTPS target works outside Codex, raw connectivity works inside, and a non-Schannel client such as Python works inside while PowerShell or `curl.exe` returns `SEC_E_NO_CREDENTIALS`. There is no confirmed permanent fix. Using a non-Schannel client can unblock one task, but manually logging on as Codex sandbox accounts or changing profile permissions is only an investigation path, not a safe universal repair.
Open fix →Claude Code startup fails with ERR_SOCKET_CLOSED behind a proxy
Failed to connect to api.anthropic.com: ERR_SOCKET_CLOSEDConfirm the proxy is actually working before using this page: the two Anthropic preflight URLs must succeed through the same proxy while interactive Claude Code 2.1.220 alone returns `ERR_SOCKET_CLOSED`. Upgrade to the current supported release first. If the exact regression persists and your organization permits a temporary version pin, the reporter confirmed that 2.1.190 starts successfully. No documented skip-connectivity environment variable existed in the checked sources.
Open fix →account/read failed during TUI bootstrap
Error: account/read failed during TUI bootstrapRead and save the complete nested message after `account/read failed`. If there is no workspace-routing error, `codex logout` followed by `codex login` fixed one reported authentication case. If the nested error says `duplicate workspace in routing discovery`, logout, login, and reinstall did not fix the current report, so stop cycling credentials and report the exact code and workspace context.
Open fix →Codex sandbox DPAPI error followed by setup error 0xc0000142
windows sandbox: CryptUnprotectData failed: 2148073483Keep the two failures in sequence. The source report first saw `CryptUnprotectData failed: 2148073483`; after moving `.sandbox-secrets`, sandbox recreation failed because the setup executable returned `0xc0000142`. No durable fix is confirmed. If you already renamed the folder, close Codex and restore the original directory to return to the known DPAPI state. Do not delete the backup or apply generic DLL-repair advice to this branch.
Open fix →Codex Browser fails because browser-client is not trusted
privileged native pipe bridge is not available; browser-client is not trustedFirst separate page rendering from browser control: if the in-app browser opens sites but plugin initialization returns a trust or native-pipe error, the target website is not the cause. Restart on the current Codex build and use only the version-matched bundled client path supplied by the installed Browser skill. An older report found a bundled marketplace path worked when the cache path did not; direct Playwright also worked as a temporary testing fallback. Do not add arbitrary paths or hashes to the trusted list.
Open fix →bwrap loopback Failed RTM_NEWADDR: Operation not permitted
bwrap: loopback: Failed RTM_NEWADDR: Operation not permittedInstall the distribution `bubblewrap` package and verify Codex resolves `/usr/bin/bwrap`. On Ubuntu 24.04, install and load the packaged `bwrap-userns-restrict` AppArmor profile using the current OpenAI prerequisite steps. Prefer that narrow profile over disabling the AppArmor unprivileged-user-namespace restriction system-wide.
Open fix →Claude Desktop cancels MCP initialize after 60 seconds
Message from client: method="notifications/cancelled"Compare the MCP log timestamps first. If `initialize` is cancelled almost exactly 60 seconds after it starts while the package runner is still downloading dependencies, run the same package command once outside Claude Desktop to warm its cache, then restart Desktop. Pinning the server and dependency versions can reduce repeated cold resolution. The upstream issue remains open and does not confirm a client-side timeout setting.
Open fix →bwrap cannot create the Codex synthetic mount directory in /tmp
bwrap: Can't mkdir /tmp/codex-bwrap-synthetic-mount-targets-1000: Read-only file systemCheck the active managed permission profile before editing AGENTS.md. In the source reproduction, `:slash_tmp = "deny"` prevented bwrap from creating Codex's synthetic mount directory, so startup failed while loading instructions. If the policy is organization-managed, ask the administrator to provide the minimum temporary-directory access required by the supported sandbox; do not bypass the requirements file locally.
Open fix →Codex Windows sandbox fails with CreateProcessAsUserW error 5
windows sandbox: runner error: CreateProcessAsUserW failed: 5This error occurs before your command runs, so changing the command usually does not help. Update Codex, start a new session, and capture the full `cwd` and `cmd` lines beneath `SpawnChild`. If every sandboxed mode fails but the same harmless command runs outside the sandbox, you have isolated a Windows sandbox process-creation failure. There is no confirmed universal repair; do not reset broad Windows permissions or run permanently unsandboxed as a fix.
Open fix →CoCreateInstance NetFwPolicy2 failed in Codex sandbox setup
helper_firewall_policy_access_failed: CoCreateInstance NetFwPolicy2 failed: HRESULT(0x80110474)Match the full NetFwPolicy2 error and test whether PowerShell can create `HNetCfg.FwPolicy2`. If that succeeds while Codex fails, capture the sandbox helper's working directory and any literal `%systemroot%` path with ProcMon, then report it upstream. Do not create the junction shown in the issue: the reporter used it only to prove the path bug, not as a safe workaround.
Open fix →idle timeout waiting for SSE hides response.failed
idle timeout waiting for SSEAn `idle timeout waiting for SSE` message does not prove the server was silent. In the deterministic report, Codex had already parsed a terminal `response.failed` event but kept reading until EOF; an open socket then replaced the useful server error with the idle timeout. Update Codex and capture the raw SSE event before increasing retry or timeout values. A locally compiled patch in the issue is not an official signed release.
Open fix →Codex rewrites a WSL /mnt project path to a Windows drive
Project folder was deleted or movedCheck the path shown in the Codex sidebar. If a native Linux Codex Desktop process inside WSL displays `/mnt/d/project` as `D:\project` and says the folder moved, the source report found that projects under the WSL Linux filesystem, such as `/home/...`, remained usable. Move or clone the project into `/home`, or use native Windows Codex for a repository that must stay on a Windows drive. The issue is closed but no shipped fixed version is documented in the report.
Open fix →Codex Remote Control WebSocket returns HTTP 503
failed to connect to app-server remote control websocketIf the log says `has_enrollment=true` and the Remote Control WebSocket returns 503 on two independent networks, preserve the timestamp, Cloudflare ray/region, app version, and exact route error. That evidence supports an upstream/routing branch, not a broken local pairing. Do not delete enrollment or authentication state before checking the service path and a current build.
Open fix →Codex Desktop SQLite pool times out during startup
Codex cannot access its local databaseBack up the Codex data directory and fully stop Codex Desktop and its app-server. If `logs_2.sqlite` and its WAL are the large outliers, move only `logs_2.sqlite`, `logs_2.sqlite-wal`, and `logs_2.sqlite-shm` into a backup folder, leaving state, sessions, config, auth, goals, and memories untouched. The source report confirmed that Codex recreated a small healthy logs database and launched normally. Do not delete the whole `.codex` directory.
Open fix →configRequirements/read fails with No file descriptors available
configRequirements/read failed during TUI bootstrap`os error 24` is the decisive signal: the app-server has exhausted file descriptors, even if the message names `/etc/codex/requirements.toml`. Stop the long-lived app-server cleanly and let a current Codex build start a fresh one, then inspect its effective open-file limit and child-process count. Do not create or edit the missing requirements file unless your organization actually manages one.
Open fix →MCP SSE stream disconnects with TypeError: terminated
SSE stream disconnected: TypeError: terminated`TypeError: terminated` says the HTTP/SSE connection closed below the MCP tool layer; it does not identify which hop closed it. Record the interval, correlate client, server, and proxy logs, and test the endpoint directly on the same network path. A repeatable five-minute boundary points toward an idle/lifetime timer, but the upstream issue remains open and no universal timeout setting or one-command fix is confirmed.
Open fix →thread history projection expected ordinal N, got N-1
thread-store internal error: thread history projection ... expected ordinal 192591, got 192590 (code -32603)Copy the intended side-message before retrying. Stop using `/btw` or fork on the affected thread: one report shows the payload can fall through into the active main turn after the fork fails. Continue urgent work in a fresh thread and preserve the damaged thread for diagnosis. Do not edit SQLite projection cursors or delete rollout files; no supported repair is confirmed.
Open fix →MCP fails to open an SSE stream with Not Found
StreamableHTTPError: Streamable HTTP error: Failed to open SSE stream: Not FoundInspect the server access log before changing the URL. If initialize POST succeeds and the client then sends GET to the same MCP endpoint, a 404 can mean the server supports POST-only Streamable HTTP but has no GET SSE route. Upgrade the client SDK first. If you control the server, either implement the current SDK's GET SSE behavior or return 405 Method Not Allowed for an intentionally unsupported GET; the client already handles 405 as no SSE stream. Do not rewrite every 404 to 405 until you have ruled out a genuinely wrong endpoint.
Open fix →Codex app-server initialize handshake times out in WSL mode
Codex app-server initialize handshake timed outThe handshake timeout is an outer symptom, so read the lines immediately before it. In the verified report, the exact app-server command worked manually and SQLite checks passed, while Desktop logged a WSL Codex-home fallback and `bundled_executable_relocation_failed` for `bwrap` with ENOENT. Updating and restarting is safest first. If you need the app immediately, switching WSL mode off let native Windows mode start, but WSL-backed conversations became unavailable; treat that as a reversible bypass, not a repair.
Open fix →Codex fatal error: HW capability requested
Fatal Error: HW capability found: 0x178BFBFF 0x7EF8320B, but HW capability requested: 0x200000 0x00.Use Codex in WSL as the safer temporary path. A community report also found that 0.104 started while 0.105+ failed, but downgrading is a temporary, security-sensitive workaround—not an official fixed-version matrix. Prefer a current release once the upstream issue confirms the regression is resolved.
Open fix →Claude Desktop MCP tools fail with side_channel_waiting_key_absent
side_channel_waiting_key_absentDo not reinstall every MCP server first. Compare the MCP server log with `claude.ai-web.log`: if the server returns the tool result normally but Desktop's `tool_result` POST receives 404 with `side_channel_waiting_key_absent`, the failure is after the server has finished. Update Desktop and test a new conversation, but the primary report says a full restart and fresh conversations did not recover it. Preserve the request ID and report the client/backend failure; no confirmed durable user fix is published.
Open fix →Codex config.toml missing escaped value on Windows
failed to reload config: missing escaped value, expected `b`, `e`, `f`, `n`, `r`, `\`, `"`, `x`, `u`, `U`A Windows backslash inside a double-quoted TOML string starts an escape sequence. Change the path to forward slashes or use a TOML single-quoted literal string, then restart Codex. Back up config.toml before editing it.
Open fix →Claude Code MCP spawn npx ENOENT on Windows
SPAWN ERROR: ENOENT spawn npx ENOENTConfigure the MCP server to launch through `cmd /c npx` on native Windows. The reporter verified this across six plugins. A direct edit inside a plugin cache can be overwritten by updates, so prefer a user-owned MCP definition or wrapper that you control.
Open fix →Codex Linux sandbox helper ENOENT in WSL
Unable to spawn codex-linux-sandbox because it doesn't exist on the filesystem (ENOENT: No such file or directory)Quit Codex completely and reopen it so the app creates a fresh temporary sandbox helper path. That restored commands in the original report. If the helper is still missing after restart, run the repository directly in WSL with the WSL Codex CLI or repair the app; later reports show restart is not universal.
Open fix →MCP Filesystem rejects a Windows drive-letter case mismatch
Error: Access denied - path outside allowed directories: c:\Users\... not in C:\Users\...Normalize both the configured allowed directory and the requested path to the same canonical Windows spelling—especially the drive-letter case—and restart the MCP server. Do not broaden the allowed root. Current Filesystem server code includes path normalization, so if the mismatch persists on a current package, check symlinks, resolved paths, and the client-supplied roots instead of assuming casing is the only cause.
Open fix →