{"record":{"id":"70e0e637c27f3a24","repo":"openai/codex","slug":"runner-empty-capability-sid-list","errorCode":null,"errorMessage":"runner: empty capability SID list","messagePattern":"runner: empty capability SID list","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"codex-rs/windows-sandbox-rs/src/bin/command_runner/win.rs","lineNumber":252,"sourceCode":"fn spawn_ipc_process(req: &SpawnRequest) -> Result<IpcSpawnedProcess> {\n    let log_dir = req.codex_home.clone();\n    hide_current_user_profile_dir(req.codex_home.as_path());\n    let token_mode = token_mode_for_permission_profile(\n        &req.permission_profile,\n        &req.workspace_roots,\n        &req.cwd,\n        &req.env,\n    )\n    .context(\"resolve permission profile token mode\")?;\n    let mut cap_psids: Vec<LocalSid> = Vec::new();\n    for sid in &req.cap_sids {\n        cap_psids.push(\n            LocalSid::from_string(sid)\n                .context(\"ConvertStringSidToSidW failed for capability SID\")?,\n        );\n    }\n    if cap_psids.is_empty() {\n        anyhow::bail!(\"runner: empty capability SID list\");\n    }\n    let network_proxy_restricting_sid = req\n        .network_proxy_restricting_sid\n        .as_deref()\n        .map(LocalSid::from_string)\n        .transpose()\n        .context(\"ConvertStringSidToSidW failed for network proxy restricting SID\")?;\n\n    // The token helpers still take raw SID pointers, but we keep ownership in `LocalSid`\n    // wrappers for as long as possible. That way any failure after SID parsing but before the\n    // child is fully spawned still releases the backing LocalAlloc memory automatically.\n    let cap_psid_ptrs: Vec<*mut _> = cap_psids.iter().map(LocalSid::as_ptr).collect();\n    let additional_restricting_sid_ptrs: Vec<*mut _> = network_proxy_restricting_sid\n        .iter()\n        .map(LocalSid::as_ptr)\n        .collect();\n    let base = OwnedWinHandle::new(unsafe { get_current_token_for_restriction()? });\n    let h_token = OwnedWinHandle::new(unsafe {","sourceCodeStart":234,"sourceCodeEnd":270,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/windows-sandbox-rs/src/bin/command_runner/win.rs#L234-L270","documentation":"Error \"runner: empty capability SID list\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/windows-sandbox-rs/src/bin/command_runner/win.rs:252 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}