{"record":{"id":"1d1b9b16581359f8","repo":"openai/codex","slug":"permission-profile-requests-full-disk-filesystem-w","errorCode":null,"errorMessage":"permission profile requests full-disk filesystem writes, which cannot be enforced by the Windows sandbox","messagePattern":"permission profile requests full-disk filesystem writes, which cannot be enforced by the Windows sandbox","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/windows-sandbox-rs/src/resolved_permissions.rs","lineNumber":50,"sourceCode":"pub enum WindowsSandboxTokenMode {\n    ReadOnlyCapability,\n    WritableRootsCapability,\n}\n\n/// Chooses the restricted-token family needed for a managed permission profile.\npub fn token_mode_for_permission_profile(\n    permission_profile: &PermissionProfile,\n    workspace_roots: &[AbsolutePathBuf],\n    cwd: &Path,\n    env_map: &HashMap<String, String>,\n) -> Result<WindowsSandboxTokenMode> {\n    let permissions =\n        ResolvedWindowsSandboxPermissions::try_from_permission_profile_for_workspace_roots(\n            permission_profile,\n            workspace_roots,\n        )?;\n    if permissions.file_system.has_full_disk_write_access() {\n        anyhow::bail!(\n            \"permission profile requests full-disk filesystem writes, which cannot be enforced by the Windows sandbox\"\n        );\n    }\n    if permissions.writable_roots_for_cwd(cwd, env_map).is_empty() {\n        Ok(WindowsSandboxTokenMode::ReadOnlyCapability)\n    } else {\n        Ok(WindowsSandboxTokenMode::WritableRootsCapability)\n    }\n}\n\nimpl ResolvedWindowsSandboxPermissions {\n    pub fn try_from_permission_profile(permission_profile: &PermissionProfile) -> Result<Self> {\n        if !matches!(permission_profile, PermissionProfile::Managed { .. }) {\n            anyhow::bail!(\n                \"only managed permission profiles can be enforced by the Windows sandbox\"\n            );\n        }\n        let (file_system, network) = permission_profile.to_runtime_permissions();","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/windows-sandbox-rs/src/resolved_permissions.rs#L32-L68","documentation":"Error \"permission profile requests full-disk filesystem writes, which cannot be enforced by the Windows sandbox\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/windows-sandbox-rs/src/resolved_permissions.rs:50 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}