{"record":{"id":"6f1fac344578fb73","repo":"openai/codex","slug":"sandbox-acl-path-must-be-absolute","errorCode":null,"errorMessage":"sandbox ACL path must be absolute: {}","messagePattern":"sandbox ACL path must be absolute: (.+?)","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/windows-sandbox-rs/src/bin/setup_main/win/no_reparse_dir.rs","lineNumber":69,"sourceCode":"        allocation_size: *const i64,\n        file_attributes: u32,\n        share_access: u32,\n        create_disposition: u32,\n        create_options: u32,\n        ea_buffer: *const c_void,\n        ea_length: u32,\n    ) -> NTSTATUS;\n}\n\n/// Opens or creates the final directory without following a reparse point in\n/// any path component.\n///\n/// Parent directories must already exist; only the final directory is created.\n///\n/// The returned handle must remain open through any security mutation so the\n/// mutation stays bound to the directory that passed this validation.\npub(super) fn open_or_create_no_reparse(path: &Path) -> Result<OwnedHandle> {\n    ensure!(\n        path.is_absolute(),\n        \"sandbox ACL path must be absolute: {}\",\n        path.display()\n    );\n    let source_offset = match path.components().next() {\n        Some(Component::Prefix(prefix)) if matches!(prefix.kind(), Prefix::Disk(_)) => 0,\n        Some(Component::Prefix(prefix)) if matches!(prefix.kind(), Prefix::VerbatimDisk(_)) => 4,\n        _ => bail!(\n            \"sandbox ACL path must have a local disk prefix: {}\",\n            path.display()\n        ),\n    };\n    // NtCreateFile expects an NT namespace path. Convert only the local-disk\n    // spellings accepted by provisioning, without canonicalizing and following\n    // the reparse points that OBJ_DONT_REPARSE must reject.\n    let source: Vec<u16> = path.as_os_str().encode_wide().collect();\n    let mut nt_path: Vec<u16> = OsStr::new(\"\\\\??\\\\\").encode_wide().collect();\n    for unit in source.into_iter().skip(source_offset) {","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/windows-sandbox-rs/src/bin/setup_main/win/no_reparse_dir.rs#L51-L87","documentation":"Error \"sandbox ACL path must be absolute: {}\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/windows-sandbox-rs/src/bin/setup_main/win/no_reparse_dir.rs:69 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}