Bug: win11 gpt-5.5无法使用powershell

[masterkunm]

What happened?

在猫猫咖啡馆尝试调用缅因猫操作的时候，缅因猫遇到CreateProcessWithLogonW failed: 1326，无法启动powershell进行命令访问

Steps to reproduce

Expected behavior

No response

Environment

windows11

Logs / Screenshots

[zts212653]

Thanks for reporting. The screenshots are useful: this looks like the Windows process-creation / RunAs credential layer failing before PowerShell itself can start.

CreateProcessWithLogonW failed: 1326 usually means Windows rejected the logon credentials (for example unknown username, bad password, or an account/domain mismatch). To investigate safely, could you add the details below? Please do not paste any password or token.

1. Clowder AI version / install source — release version or commit/build you are running.
2. How GPT-5.5 is configured — is it using full-access / sandbox mode, and did you configure a Windows username for command execution?
3. Windows account shape — local account vs Microsoft account vs domain account; if domain account, only share the domain format, not secrets.
4. Exact reproduction path — from a fresh thread, what prompt/action triggers the PowerShell launch?
5. Logs — the issue says api.2026-06-20.1.log failed to upload. Could you retry attaching that log, or paste only the surrounding error lines around CreateProcessWithLogonW failed: 1326?
6. Manual check — from normal Windows PowerShell, does whoami work, and can you start the same shell manually outside Clowder AI?

For now I’m marking this as needs-info. The report is a valid Windows bug report, but we need the credential/config context before deciding whether this is a product bug, a clearer-error-message bug, or a local credential setup issue.

[砚砚/gpt-5.5🐾]

[masterkunm]

1. cat-cafe version 0.9.2.0
2. danger-full-access; No, I did not configure a windows username for command execution.
3. I am using the local account, I did not setup any Microsoft account.
4. I try to let GPT-5.5 to set up the proxy for itself, however, it shows up it cannot use powershell and return error

api.2026-06-20.1.log
6. normal Windows PowerShell is woking with "whoami".

[zts212653]

Thanks, this is enough context to start engineering diagnosis.

The key facts are: Clowder AI 0.9.2.0, GPT-5.5 running in danger-full-access, no Windows username configured for command execution, local Windows account, normal PowerShell whoami works outside Clowder AI, and the failure happens when GPT-5.5 tries to use PowerShell while setting up proxy configuration.

I’m moving this from needs-info to accepted. One note for the investigation: the attached API log does not appear to contain the lower-level CreateProcessWithLogonW failed: 1326 line, so we will also inspect whether the command-execution error path is missing server-side logging.

[砚砚/gpt-5.5🐾]

[zts212653]

Follow-up from engineering triage: we traced the literal CreateProcessWithLogonW failed: 1326 text to the Codex Windows sandbox runner path, where Codex launches codex-command-runner.exe with managed sandbox account credentials.

So this no longer looks like “Clowder AI needs your personal Windows username”. The important inconsistency is narrower: Clowder AI believes this GPT-5.5 run is using danger-full-access; if that sandbox mode actually reaches Codex, the Windows managed sandbox account path should normally not be involved.

Could you add one targeted check? Please do not paste passwords, tokens, or file contents.

1. In the API log around the repro, search for [codex-diag] Auth + env setup and paste only these fields if present: sandboxMode, authMode, platform.
2. Please say whether these paths exist on your machine, but do not paste their contents:
   • %USERPROFILE%\.codex\.sandbox\
   • %USERPROFILE%\.codex\.sandbox\setup_error.json
   • %USERPROFILE%\.codex\.sandbox-secrets\sandbox_users.json
3. If you can, retry once from a fresh Clowder AI thread after restarting the app and confirm whether the same CreateProcessWithLogonW failed: 1326 appears.

This keeps the issue accepted; the extra data is to decide whether the bug is in Clowder AI’s sandbox-mode propagation / diagnostics, or in Codex’s Windows sandbox managed-account refresh path.

[砚砚/gpt-5.5🐾]

[zts212653]

Reopening for reporter re-validation on Windows.

#1014 has been merged (bae13c54), which fixes one specific path: codex exec resume was not replaying the sandbox mode and could drift back to a CLI default sandbox. This is a real bug we should have caught earlier — the code comment "sandbox locked at creation" was stale.

However, this PR only covers the resume path. Fresh exec already passes --sandbox <mode> explicitly, so if you're hitting CreateProcessWithLogonW failed: 1326 on a brand-new conversation (turn 1), #1014 may not fully resolve it.

@masterkunm — could you re-test on the next Clowder AI release that includes this fix? Specifically:

1. Try the exact scenario again (let GPT-5.5 set up the proxy via PowerShell)
2. If it still fails with 1326, please share:
   • The [codex-diag] Auth + env setup log line (it includes the sandboxMode field)
   • Whether %USERPROFILE%\.codex\.sandbox* or .sandbox-secrets\sandbox_users.json exist on your machine (don't share contents/secrets — just whether the files/folders exist)
   • Whether the failure happens on the first turn of a fresh thread, or after resuming an older session

If it passes after the fix lands, we'll close this. If it still fails, we have a second hypothesis around the upstream Codex Windows sandbox runner that we'll need to investigate separately.

Thanks again for the careful repro and the patient back-and-forth.

[宪宪/Opus 4.7🐾]