PowerShell error when Codex is running shell commands in a sandbox

### What version of Codex CLI is running?

0.104.0

### What subscription do you have?

Plus

### Which model were you using?

gpt-5.3-codex

### What platform is your computer?

Microsoft Windows NT 10.0.19045.0 x64

### What terminal emulator and version are you using (if applicable)?

PowerShell 7.5.4

### What issue are you seeing?

For commands being run in sandboxed mode, the commands seem to be working, but I keep getting the following error message:

_InvalidOperation: Cannot set property. Property setting is supported only on core types in this language mode._

Sometimes the AI output also notifies me about these errors.

### What steps can reproduce the bug?

Have Codex CLI and Git installed and configured.

`mkdir test`
`cd test`
`codex`

Choose: `yes` to "Do you trust...".

`/permissions`
Choose: `Default`

Issue a prompt that causes shell command access.

For instance, I issued the following prompt: `What non-committed changes are there?` That resulted in Codex starting to execute necessary shell commands, as below, and the error messages appearing in connection to each command.

```
• I’ll check the git working tree and summarize all uncommitted changes (staged, unstaged, and untracked).

• Ran git status --short --branch
  └ InvalidOperation: Cannot set property. Property setting is supported only on core types in this language mode.
    fatal: not a git repository (or any of the parent directories): .git

────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

• The current folder isn’t a git repository, so I’m locating where the repo root is (if any) under this workspace and
  then I’ll report changes there.

• Ran Get-ChildItem -Force
  └ InvalidOperation: Cannot set property. Property setting is supported only on core types in this language mode.

• Ran cmd /c dir
  └  Volume in drive F is Data
     Volume Serial Number is 5688-5D62
    … +6 lines
                   2 Dir(s)  65ÿ170ÿ722ÿ816 bytes free
    InvalidOperation: Cannot set property. Property setting is supported only on core types in this language mode.

────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

• There are no non-committed changes in F:\dev\C#\test because it isn’t a git repo (and the folder is empty).
```

### What is the expected behavior?

No error messages if there are no errors from executing the actual shell commands.

It seems that something is trying to set something that should not be tried to be set when running PowerShell commands in a restricted sandbox. I don't know what it is, but clearly that something should check whether the environment is sandboxed, and if it is, not try to perform forbidden actions.

### Additional information

### Environment

I'm running Codex CLI from the standard command prompt present in Windows 10 22H2, and have the latest PowerShell (7.5.4.0) installed.

```
F:\>winget search --id Microsoft.PowerShell

Name               Id                           Version   Source
-----------------------------------------------------------------
PowerShell         Microsoft.PowerShell         7.5.4.0   winget
PowerShell Preview Microsoft.PowerShell.Preview 7.6.0.101 winget

F:\>pwsh
PowerShell 7.5.4
PS F:\>
```

### Does not occur with Full Access

I tried to use `/permissions` to give Codex a Full Access (level 3), and with that, the error messages do not occur. This behaviour occurs only in a sandboxed environment. Switching to Read Only permissions also executes commands and gives the same error messages, as below:

```
› What non-committed changes are there?


• I’ll inspect the git working tree and summarize all uncommitted changes (staged, unstaged, and untracked).

• Ran git status --short --branch
  └ InvalidOperation: Cannot set property. Property setting is supported only on core types in this language mode.
    fatal: not a git repository (or any of the parent directories): .git

────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

• The current folder isn’t a git repo. I’ll quickly locate the nearest .git directory under this workspace and then
  report the changes from there.

✔ You approved codex to run Get-ChildItem -Path . -Directory -Recurse -Force -ErrorAction SilentlyContinu... this time

• Ran Get-ChildItem -Path . -Directory -Recurse -Force -ErrorAction SilentlyContinue | Where-Object { $_.Name -eq
  │ '.git' } | Select-Object -ExpandProperty FullName
  └ InvalidOperation: Cannot set property. Property setting is supported only on core types in this language mode.

✗ You canceled the request to run $p = Resolve-Path .; while($p -ne $null){ if(Test-Path (Join-Path $p '.git'))...

• Ran $p = Resolve-Path .; while($p -ne $null){ if(Test-Path (Join-Path $p '.git')){ $p; break }; $parent = Split-Path
  │ $p -Parent; if($parent -eq $p -or [string]::IsNullOrEmpty($parent)){ break }; $p = $parent }
  └ exec command rejected by user

■ Conversation interrupted - tell the model what to do differently. Something went wrong? Hit `/feedback` to report the
issue.
```

### The command being executed seems not to matter

Regarding the reproduction instructions, being or not being a Git repo does not matter; it is not about the command to be run. Instead, the error message seems to appear with all (?) commands, whatever is being executed. For instance (expecting that the `dotnet` command is available):

```
› Please list me the installed .NET SDK versions.

• I’ll query the local dotnet installation and list the installed SDK versions.

• Ran dotnet --list-sdks
  └ 10.0.103 [C:\Program Files\dotnet\sdk]
    InvalidOperation: Cannot set property. Property setting is supported only on core types in this language mode.

────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

• Installed .NET SDK versions:

  - 10.0.103 at C:\Program Files\dotnet\sdk
```

The same happens with script-like commands:

```
• The current folder isn’t a git repo. I’ll quickly locate the nearest .git directory under this workspace and then
  report the changes from there.

✔ You approved codex to run Get-ChildItem -Path . -Directory -Recurse -Force -ErrorAction SilentlyContinu... this time

• Ran Get-ChildItem -Path . -Directory -Recurse -Force -ErrorAction SilentlyContinue | Where-Object { $_.Name -eq
  │ '.git' } | Select-Object -ExpandProperty FullName
  └ InvalidOperation: Cannot set property. Property setting is supported only on core types in this language mode.
```

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

PowerShell error when Codex is running shell commands in a sandbox #12496

What version of Codex CLI is running?

What subscription do you have?

Which model were you using?

What platform is your computer?

What terminal emulator and version are you using (if applicable)?

What issue are you seeing?

What steps can reproduce the bug?

What is the expected behavior?

Additional information

Environment

Does not occur with Full Access

The command being executed seems not to matter

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

PowerShell error when Codex is running shell commands in a sandbox #12496

Description

What version of Codex CLI is running?

What subscription do you have?

Which model were you using?

What platform is your computer?

What terminal emulator and version are you using (if applicable)?

What issue are you seeing?

What steps can reproduce the bug?

What is the expected behavior?

Additional information

Environment

Does not occur with Full Access

The command being executed seems not to matter

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions