Avoid loading Windows profiles for sandbox runner

codex-rs/windows-sandbox-rs/src/elevated/runner_client.rs

@@ -36,7 +36,6 @@ use windows_sys::Win32::System::Pipes::PeekNamedPipe;
 use windows_sys::Win32::System::Threading::CreateProcessWithLogonW;
 use windows_sys::Win32::System::Threading::GetCurrentProcess;
 use windows_sys::Win32::System::Threading::GetCurrentThread;
-use windows_sys::Win32::System::Threading::LOGON_WITH_PROFILE;
 use windows_sys::Win32::System::Threading::PROCESS_INFORMATION;
 use windows_sys::Win32::System::Threading::STARTUPINFOW;
 use windows_sys::Win32::System::Threading::TerminateProcess;
@@ -46,6 +45,7 @@ const RUNNER_SPAWN_READY_TIMEOUT: Duration = Duration::from_secs(15);
 const RUNNER_PIPE_CONNECT_TIMEOUT: Duration = Duration::from_secs(15);
 const RUNNER_SPAWN_READY_POLL_INTERVAL: Duration = Duration::from_millis(50);
 const RUNNER_ERROR_MODE_FLAGS: u32 = 0x0001 | 0x0002;
+const RUNNER_LOGON_FLAGS: u32 = 0;
 const WAIT_OBJECT_0: u32 = 0;
 
 pub(crate) struct RunnerTransport {
@@ -256,7 +256,10 @@ pub(crate) fn spawn_runner_transport(
             user_w.as_ptr(),
             domain_w.as_ptr(),
             password_w.as_ptr(),
-            LOGON_WITH_PROFILE,
+            // The runner only needs a sandbox-user logon token. Loading a full Windows profile
+            // on every spawn can create or attach `TEMP.<machine>` fallback profiles when the
+            // profile service is unhappy, which matches the leak pattern in issue #21455.
+            RUNNER_LOGON_FLAGS,
             exe_w.as_ptr(),
             cmdline_vec.as_mut_ptr(),
             windows_sys::Win32::System::Threading::CREATE_NO_WINDOW