multica-ai/multica · error

ensure codex sandbox config: %w

Error message

ensure codex sandbox config: %w

What it means

Error "ensure codex sandbox config: %w" thrown in multica-ai/multica.

Source

Thrown at server/internal/daemon/execenv/codex_home.go:298

	// rationale. On Windows, resolve the native-sandbox state across the copied
	// config and the effective custom args so an explicit user opt-in is honored
	// and an undecidable config fails closed instead of loosening.
	configFile := filepath.Join(codexHome, "config.toml")
	winState := windowsSandboxAbsent
	if resolveGOOS(opts.GOOS) == "windows" {
		winState = resolveWindowsSandboxState(configFile, configSyncErr, statSharedCodexConfig(sharedHome), opts.CodexCustomArgs, logger)
	}
	policy := codexSandboxPolicyForConfig(opts.GOOS, opts.CodexVersion, winState)
	if err := ensureCodexSandboxConfig(configFile, policy, opts.CodexVersion, logger); err != nil {
		// The managed block is the authoritative on-disk sandbox policy. If it
		// can't be written, config.toml keeps whatever it already had — on a
		// reused home that may be a stale danger-full-access from a prior run —
		// so the fail-closed policy just computed above would only exist in
		// memory while the effective config silently stays loose. Abort rather
		// than launch Codex with an unenforced sandbox: on fresh Prepare this
		// fails the task; on Reuse the caller leaves env.CodexHome unset, which
		// configureCodexTaskShellEnvironment then refuses to start (MUL-4957).
		return fmt.Errorf("ensure codex sandbox config: %w", err)
	}

	// Disable Codex native multi-agent inside daemon-managed task sessions
	// so the parent thread's `turn/completed` is not interpreted as task
	// completion while spawned subagents are still running. See
	// codex_multi_agent.go for the full rationale and escape hatch.
	if err := ensureCodexMultiAgentConfig(filepath.Join(codexHome, "config.toml"), logger); err != nil {
		logger.Warn("execenv: codex-home ensure multi-agent config failed", "error", err)
	}

	// Disable Codex native auto-memory inside daemon-managed task sessions
	// so cross-task and cross-workspace context leaks (multica#3130) cannot
	// happen via `codex-home/memories/` or `~/.codex/memories/`. See
	// codex_memory.go for the full rationale and escape hatch.
	if err := ensureCodexMemoryConfig(filepath.Join(codexHome, "config.toml"), logger); err != nil {
		logger.Warn("execenv: codex-home ensure memory config failed", "error", err)
	}

View on GitHub (pinned to 2c0912b6ec)

Solutions

1. Check permissions for the codex sandbox config location.

When it happens

Trigger: Thrown at server/internal/daemon/execenv/codex_home.go:298 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of multica-ai/multica@2c0912b6ec (2026-08-15). Data as JSON: /api/errors/951edd04c06a2ba6. Report an issue: GitHub.