openai/codex · error · anyhow::Error

sandbox ACL path must be absolute: {}

Error message

sandbox ACL path must be absolute: {}

What it means

Error "sandbox ACL path must be absolute: {}" thrown in openai/codex.

Source

Thrown at codex-rs/windows-sandbox-rs/src/bin/setup_main/win/no_reparse_dir.rs:69

        allocation_size: *const i64,
        file_attributes: u32,
        share_access: u32,
        create_disposition: u32,
        create_options: u32,
        ea_buffer: *const c_void,
        ea_length: u32,
    ) -> NTSTATUS;
}

/// Opens or creates the final directory without following a reparse point in
/// any path component.
///
/// Parent directories must already exist; only the final directory is created.
///
/// The returned handle must remain open through any security mutation so the
/// mutation stays bound to the directory that passed this validation.
pub(super) fn open_or_create_no_reparse(path: &Path) -> Result<OwnedHandle> {
    ensure!(
        path.is_absolute(),
        "sandbox ACL path must be absolute: {}",
        path.display()
    );
    let source_offset = match path.components().next() {
        Some(Component::Prefix(prefix)) if matches!(prefix.kind(), Prefix::Disk(_)) => 0,
        Some(Component::Prefix(prefix)) if matches!(prefix.kind(), Prefix::VerbatimDisk(_)) => 4,
        _ => bail!(
            "sandbox ACL path must have a local disk prefix: {}",
            path.display()
        ),
    };
    // NtCreateFile expects an NT namespace path. Convert only the local-disk
    // spellings accepted by provisioning, without canonicalizing and following
    // the reparse points that OBJ_DONT_REPARSE must reject.
    let source: Vec<u16> = path.as_os_str().encode_wide().collect();
    let mut nt_path: Vec<u16> = OsStr::new("\\??\\").encode_wide().collect();
    for unit in source.into_iter().skip(source_offset) {

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/windows-sandbox-rs/src/bin/setup_main/win/no_reparse_dir.rs:69 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/6f1fac344578fb73. Report an issue: GitHub.