Skip to main content
Use ZeroCode on Windows with the native ZeroTwo desktop app. The ZeroTwo desktop app on Windows supports core workflows such as parallel chats, worktrees, scheduled tasks, Git functionality, the built-in browser, file previews, plugins, and skills. The app can run natively in PowerShell with a Windows sandbox instead of requiring WSL or a virtual machine. This keeps ZeroCode in Windows-native workflows while enforcing bounded filesystem and network permissions.
ZeroCode Windows sandbox setup prompt above the message composer
Use the ZeroTwo desktop app on Windows
The native Windows sandbox has two modes:
  • natively on Windows with the stronger elevated sandbox,
  • natively on Windows with the fallback unelevated sandbox.

​
Configure the Windows sandbox

When you run ZeroCode natively on Windows, agent mode uses a Windows sandbox to block filesystem writes outside the working folder and prevent network access without your explicit approval. Native Windows sandbox support includes two modes that you can configure in config.toml:
elevated is the preferred native Windows sandbox. It uses dedicated lower-privilege sandbox users, filesystem permission boundaries, firewall rules, and local policy changes needed for commands that run in the sandbox. unelevated is the fallback native Windows sandbox. It runs commands with a restricted Windows token derived from your current user, applies ACL-based filesystem boundaries, and uses environment-level offline controls instead of the dedicated offline-user firewall rule. It’s weaker than elevated, but it is still useful when administrator-approved setup is blocked by local or enterprise policy. If both modes are available, use elevated. If the default native sandbox doesn’t work in your environment, use unelevated as a fallback while you troubleshoot the setup. Enterprise administrators can constrain which native sandbox implementations ZeroCode can use through requirements.toml:
This example requires the elevated sandbox and prevents users from falling back to unelevated. To permit either implementation, include both values; ZeroCode prefers elevated when no mode is selected. See the requirements.toml reference for the supported values. By default, both sandbox modes also use a private desktop for stronger UI isolation. Set windows.sandbox_private_desktop = false only if you need the older Winsta0\\Default behavior for compatibility.

​
Sandbox permissions

Running ZeroCode in full access mode means ZeroCode is not limited to your project directory and might perform unintentional destructive actions that can lead to data loss. For safer automation, keep sandbox boundaries in place and use rules for specific exceptions, or set your approval policy to never to have ZeroCode attempt to solve problems without asking for escalated permissions, based on your approval and security setup.

​
Windows version matrix

Additional environment assumptions:
  • winget should be available. If it’s missing, update Windows or install the Windows Package Manager before setting up ZeroCode.
  • The recommended native sandbox depends on administrator-approved setup.
  • Some enterprise-managed devices block the required setup steps even when the OS version itself is acceptable.

​
Grant sandbox read access

When a command fails because the Windows sandbox can’t read a directory, use:
The path must be an existing absolute directory. After the command succeeds, later commands that run in the sandbox can read that directory during the current session. Use the native Windows sandbox by default. Choose WSL when you need Linux-native tooling, your workflow already lives in WSL2, or neither native Windows sandbox mode meets your needs.

​
Troubleshooting and FAQ

If you are troubleshooting a managed Windows machine, start with the native sandbox mode, Windows version, and any policy error shown by ZeroCode. Most native Windows support issues come from sandbox setup, logon rights, or filesystem permissions rather than from the editor itself. My native sandbox setup failed If ZeroCode cannot complete the elevated sandbox setup, the most common causes are:
  • the Windows UAC or administrator prompt was declined,
  • the machine does not allow local user or group creation,
  • the machine does not allow firewall rule changes,
  • the machine blocks the logon rights needed by the sandbox users,
  • or another enterprise policy blocks part of the setup flow.
What to try:
  1. Try the elevated sandbox setup again and approve the administrator prompt if your environment allows it.
  2. If your company laptop blocks this, ask your IT team whether the machine allows administrator-approved setup for local user/group creation, firewall configuration, and the required sandbox-user logon rights.
  3. If the default setup still fails, use the unelevated sandbox so you can continue working while the issue is investigated.
ZeroCode switched me to the unelevated sandbox This means ZeroCode could not finish the stronger elevated sandbox setup on your machine.
  • ZeroCode can still run in a sandboxed mode.
  • It still applies ACL-based filesystem boundaries, but it does not use the separate sandbox-user boundary from elevated and has weaker network isolation.
  • This is a useful fallback, but not the preferred long-term enterprise configuration.
If you are on a managed enterprise laptop, the best long-term fix is usually to get the elevated sandbox working with help from your IT team. I see Windows error 1385 If sandboxed commands fail with error 1385, Windows is denying the logon type the sandbox user needs in order to start the command. In practice, this usually means ZeroCode created the sandbox users successfully, but Windows policy is still preventing those users from launching sandboxed commands. What to do:
  1. Ask your IT team whether the device policy grants the required logon rights to the ZeroCode-created sandbox users.
  2. Compare group policy or OU differences if the issue affects only some machines or teams.
  3. If you need to keep working immediately, use the unelevated sandbox while the policy issue is investigated.
  4. Send ZEROTWO_HOME/.sandbox/sandbox.log along with your Windows version and a short description of the failure.
ZeroCode warns that some folders are writable by Everyone ZeroCode may warn that some folders are writable by Everyone. If you see this warning, Windows permissions on those folders are too broad for the sandbox to fully protect them. What to do:
  1. Review the folders ZeroCode lists in the warning.
  2. Remove Everyone write access from those folders if that is appropriate in your environment.
  3. Restart ZeroCode or re-run the sandbox setup after those permissions are corrected.
If you are not sure how to change those permissions, ask your IT team for help. Sandboxed commands cannot reach the network Some ZeroCode chats are intentionally run without outbound network access, depending on the permissions mode in use. If a task fails because it cannot reach the network:
  1. Check whether the task was supposed to run with network disabled.
  2. If you expected network access, restart ZeroCode and try again.
  3. If the issue keeps happening, collect the sandbox log so the team can check whether the machine is in a partial or broken sandbox state.
Sandboxing worked before and then stopped This can happen after:
  • moving a repo or workspace,
  • changing machine permissions,
  • changing Windows policies,
  • or other system configuration changes.
What to try:
  1. Restart ZeroCode.
  2. Try the elevated sandbox setup again.
  3. If that does not fix it, use the unelevated sandbox as a temporary fallback.
  4. Collect the sandbox log for review.
I need to send diagnostics to ZeroTwo If you still have problems, send:
  • ZEROTWO_HOME/.sandbox/sandbox.log
It is also helpful to include:
  • a short description of what you were trying to do,
  • whether the elevated sandbox failed or the unelevated sandbox was used,
  • any error message shown in the app,
  • whether you saw 1385 or another Windows or PowerShell error,
  • and whether you are on Windows 11 or Windows 10.
Do not send:
  • the contents of ZEROTWO_HOME/.sandbox-secrets/
The desktop app is installed but unresponsive Your system may be missing C++ development tools, which some native dependencies require:
  • Visual Studio Build Tools (C++ workload)
  • Microsoft Visual C++ Redistributable (x64)
  • With winget, run winget install --id Microsoft.VisualStudio.2022.BuildTools -e
Then fully restart the ZeroTwo desktop app after installation.