{"record":{"id":"4a51487341e06eed","repo":"openai/codex","slug":"deny-read-overrides-require-the-elevated-windows-s","errorCode":null,"errorMessage":"deny-read overrides require the elevated Windows sandbox backend","messagePattern":"deny-read overrides require the elevated Windows sandbox backend","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/windows-sandbox-rs/src/lib.rs","lineNumber":553,"sourceCode":"            &command,\n            SpawnPrepOptions {\n                inherit_path: false,\n                add_git_safe_directory: false,\n            },\n        )?;\n        let permissions = common.permissions;\n        let current_dir = common.current_dir;\n        let logs_base_dir = common.logs_base_dir.as_deref();\n        let uses_write_capabilities = common.uses_write_capabilities;\n        if !permissions.has_full_disk_read_access() {\n            anyhow::bail!(\n                \"Restricted read-only access requires the elevated Windows sandbox backend\"\n            );\n        }\n        // WRITE_RESTRICTED tokens consult restricting SIDs only for writes, so this\n        // backend cannot make capability-SID deny-read ACLs authoritative.\n        if !additional_deny_read_paths.is_empty() {\n            anyhow::bail!(\"deny-read overrides require the elevated Windows sandbox backend\");\n        }\n        let capability_roots =\n            legacy_session_capability_roots(&permissions, &current_dir, &env_map, codex_home);\n        let security = prepare_legacy_session_security(\n            uses_write_capabilities,\n            codex_home,\n            cwd,\n            capability_roots,\n        )?;\n        allow_null_device_for_workspace_write(uses_write_capabilities);\n        apply_legacy_session_acl_rules(\n            &permissions,\n            codex_home,\n            &current_dir,\n            &env_map,\n            &additional_deny_read_paths,\n            &additional_deny_write_paths,\n            LegacyAclSids {","sourceCodeStart":535,"sourceCodeEnd":571,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/windows-sandbox-rs/src/lib.rs#L535-L571","documentation":"Error \"deny-read overrides require the elevated Windows sandbox backend\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/windows-sandbox-rs/src/lib.rs:553 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}