openai/codex · error · anyhow::Error

sandbox ACL path must have a local disk prefix: {}

Error message

sandbox ACL path must have a local disk prefix: {}

What it means

Error "sandbox ACL path must have a local disk prefix: {}" thrown in openai/codex.

Source

Thrown at codex-rs/windows-sandbox-rs/src/bin/setup_main/win/no_reparse_dir.rs:77

}

/// Opens or creates the final directory without following a reparse point in
/// any path component.
///
/// Parent directories must already exist; only the final directory is created.
///
/// The returned handle must remain open through any security mutation so the
/// mutation stays bound to the directory that passed this validation.
pub(super) fn open_or_create_no_reparse(path: &Path) -> Result<OwnedHandle> {
    ensure!(
        path.is_absolute(),
        "sandbox ACL path must be absolute: {}",
        path.display()
    );
    let source_offset = match path.components().next() {
        Some(Component::Prefix(prefix)) if matches!(prefix.kind(), Prefix::Disk(_)) => 0,
        Some(Component::Prefix(prefix)) if matches!(prefix.kind(), Prefix::VerbatimDisk(_)) => 4,
        _ => bail!(
            "sandbox ACL path must have a local disk prefix: {}",
            path.display()
        ),
    };
    // NtCreateFile expects an NT namespace path. Convert only the local-disk
    // spellings accepted by provisioning, without canonicalizing and following
    // the reparse points that OBJ_DONT_REPARSE must reject.
    let source: Vec<u16> = path.as_os_str().encode_wide().collect();
    let mut nt_path: Vec<u16> = OsStr::new("\\??\\").encode_wide().collect();
    for unit in source.into_iter().skip(source_offset) {
        nt_path.push(if unit == b'/' as u16 {
            b'\\' as u16
        } else {
            unit
        });
    }
    nt_path.push(0);
    let name_length = u16::try_from((nt_path.len() - 1) * size_of::<u16>())

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/windows-sandbox-rs/src/bin/setup_main/win/no_reparse_dir.rs:77 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/aead6889af4758a4. Report an issue: GitHub.