{"record":{"id":"fae6a61579f70176","repo":"openai/codex","slug":"restricted-read-only-access-requires-the-elevated-fae6a6","errorCode":null,"errorMessage":"Restricted read-only access requires the elevated Windows sandbox backend","messagePattern":"Restricted read-only access requires the elevated Windows sandbox backend","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"codex-rs/windows-sandbox-rs/src/unified_exec/backends/legacy.rs","lineNumber":334,"sourceCode":"    additional_deny_write_paths: &[AbsolutePathBuf],\n    tty: bool,\n    stdin_open: bool,\n    use_private_desktop: bool,\n) -> Result<SpawnedProcess> {\n    let common = prepare_legacy_spawn_context(\n        permission_profile,\n        workspace_roots,\n        codex_home,\n        cwd,\n        &mut env_map,\n        &command,\n        SpawnPrepOptions {\n            inherit_path: false,\n            add_git_safe_directory: false,\n        },\n    )?;\n    if !common.permissions.has_full_disk_read_access() {\n        anyhow::bail!(\"Restricted read-only access requires the elevated Windows sandbox backend\");\n    }\n    // WRITE_RESTRICTED tokens consult restricting SIDs only for writes, so this\n    // backend cannot make capability-SID deny-read ACLs authoritative.\n    if !additional_deny_read_paths.is_empty() {\n        anyhow::bail!(\"deny-read overrides require the elevated Windows sandbox backend\");\n    }\n    let additional_deny_write_paths = additional_deny_write_paths\n        .iter()\n        .map(AbsolutePathBuf::to_path_buf)\n        .collect::<Vec<_>>();\n    let capability_roots = legacy_session_capability_roots(\n        &common.permissions,\n        &common.current_dir,\n        &env_map,\n        codex_home,\n    );\n    let security = prepare_legacy_session_security(\n        common.uses_write_capabilities,","sourceCodeStart":316,"sourceCodeEnd":352,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/windows-sandbox-rs/src/unified_exec/backends/legacy.rs#L316-L352","documentation":"Error \"Restricted read-only access requires the elevated Windows sandbox backend\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/windows-sandbox-rs/src/unified_exec/backends/legacy.rs:334 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Enable the elevated Windows sandbox backend for this exec request, or drop the restricted read-only requirement."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}