{"record":{"id":"4aee6421403083ea","repo":"openai/codex","slug":"workspace-write-sandbox-has-no-writable-root-capab","errorCode":null,"errorMessage":"workspace-write sandbox has no writable root capability SIDs","messagePattern":"workspace-write sandbox has no writable root capability SIDs","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/windows-sandbox-rs/src/elevated_impl.rs","lineNumber":173,"sourceCode":"            crate::WindowsSandboxProxySettingsMode::Reconcile,\n        )?;\n        // Build capability SID for ACL grants.\n        let caps = load_or_create_cap_sids(codex_home)?;\n        let (sid_for_null, cap_sids) = if permissions.uses_write_capabilities_for_cwd(cwd, &env_map)\n        {\n            let write_roots = effective_write_roots_for_permissions(\n                &permissions,\n                cwd,\n                &env_map,\n                codex_home,\n                write_roots_override,\n            );\n            let cap_sids = write_roots\n                .iter()\n                .map(|root| workspace_write_cap_sid_for_root(codex_home, cwd, root))\n                .collect::<Result<Vec<_>>>()?;\n            if cap_sids.is_empty() {\n                anyhow::bail!(\"workspace-write sandbox has no writable root capability SIDs\");\n            }\n            (LocalSid::from_string(&cap_sids[0])?, cap_sids)\n        } else {\n            let sid = LocalSid::from_string(&caps.readonly)?;\n            (sid, vec![caps.readonly])\n        };\n\n        unsafe {\n            allow_null_device(sid_for_null.as_ptr());\n        }\n\n        (|| -> Result<CaptureResult> {\n            let spawn_request = SpawnRequest {\n                command: command.clone(),\n                cwd: cwd.to_path_buf(),\n                env: env_map.clone(),\n                permission_profile: permission_profile.clone(),\n                workspace_roots: workspace_roots.to_vec(),","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/windows-sandbox-rs/src/elevated_impl.rs#L155-L191","documentation":"Error \"workspace-write sandbox has no writable root capability SIDs\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/windows-sandbox-rs/src/elevated_impl.rs:173 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}