{"record":{"id":"97bd2bc5a588fe29","repo":"openai/codex","slug":"createrestrictedtoken-failed","errorCode":null,"errorMessage":"CreateRestrictedToken failed: {}","messagePattern":"CreateRestrictedToken failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"codex-rs/windows-sandbox-rs/src/token.rs","lineNumber":493,"sourceCode":"    entries[logon_idx].Attributes = 0;\n    entries[logon_idx + 1].Sid = psid_everyone;\n    entries[logon_idx + 1].Attributes = 0;\n\n    let mut new_token: HANDLE = 0;\n    let flags = DISABLE_MAX_PRIVILEGE | LUA_TOKEN | WRITE_RESTRICTED;\n    let ok = CreateRestrictedToken(\n        base_token,\n        flags,\n        0,\n        std::ptr::null(),\n        0,\n        std::ptr::null(),\n        entries.len() as u32,\n        entries.as_mut_ptr(),\n        &mut new_token,\n    );\n    if ok == 0 {\n        return Err(anyhow!(\"CreateRestrictedToken failed: {}\", GetLastError()));\n    }\n\n    // Additional restricting SIDs are identity markers, not capabilities. Deliberately exclude\n    // them from the default DACL so possessing a route identity cannot grant object access.\n    let mut dacl_sids: Vec<*mut c_void> = Vec::with_capacity(psid_capabilities.len() + 2);\n    dacl_sids.push(psid_logon);\n    dacl_sids.push(psid_everyone);\n    dacl_sids.extend_from_slice(psid_capabilities);\n    set_default_dacl(new_token, &dacl_sids)?;\n\n    enable_single_privilege(new_token, \"SeChangeNotifyPrivilege\")?;\n    Ok(new_token)\n}\n\n#[cfg(test)]\n#[path = \"token_tests.rs\"]\nmod tests;\n","sourceCodeStart":475,"sourceCodeEnd":511,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/windows-sandbox-rs/src/token.rs#L475-L511","documentation":"Error \"CreateRestrictedToken failed: {}\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/windows-sandbox-rs/src/token.rs:493 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Run the command through the elevated Windows sandbox runner so the process has the privileges CreateRestrictedToken needs; inspect the inner Win32 error in the message payload for the concrete failure code."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}