{"record":{"id":"970cd8094d10aea0","repo":"openai/codex","slug":"workspace-write-sandbox-has-no-writable-root-capab-970cd8","errorCode":null,"errorMessage":"workspace-write sandbox has no writable root capability SIDs","messagePattern":"workspace-write sandbox has no writable root capability SIDs","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/windows-sandbox-rs/src/spawn_prep.rs","lineNumber":158,"sourceCode":"    )?;\n    if common.permissions.should_apply_network_block() {\n        apply_no_network_to_env(env_map)?;\n    }\n    Ok(common)\n}\n\npub(crate) fn prepare_legacy_session_security(\n    uses_write_capabilities: bool,\n    codex_home: &Path,\n    cwd: &Path,\n    capability_roots: impl IntoIterator<Item = PathBuf>,\n) -> Result<LegacySessionSecurity> {\n    let caps = load_or_create_cap_sids(codex_home)?;\n    let (h_token, readonly_sid, readonly_sid_str, write_root_sids) = unsafe {\n        if uses_write_capabilities {\n            let write_root_sids = root_capability_sids(codex_home, cwd, capability_roots)?;\n            if write_root_sids.is_empty() {\n                anyhow::bail!(\"workspace-write sandbox has no writable root capability SIDs\");\n            }\n            let base = get_current_token_for_restriction()?;\n            let cap_ptrs: Vec<*mut c_void> = write_root_sids\n                .iter()\n                .map(|root| root.sid.as_ptr())\n                .collect();\n            let h_token = create_workspace_write_token_with_caps_from(base, cap_ptrs.as_slice());\n            CloseHandle(base);\n            let h_token = h_token?;\n            (h_token, None, None, write_root_sids)\n        } else {\n            let psid = LocalSid::from_string(&caps.readonly)?;\n            let (h_token, _psid) = create_readonly_token_with_cap(psid.as_ptr())?;\n            (h_token, Some(psid), Some(caps.readonly), Vec::new())\n        }\n    };\n\n    Ok(LegacySessionSecurity {","sourceCodeStart":140,"sourceCodeEnd":176,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/windows-sandbox-rs/src/spawn_prep.rs#L140-L176","documentation":"Error \"workspace-write sandbox has no writable root capability SIDs\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/windows-sandbox-rs/src/spawn_prep.rs:158 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}