openai/codex · error · std::io::Error

sandboxed filesystem operations require ReadOnly or Workspac

Error message

sandboxed filesystem operations require ReadOnly or WorkspaceWrite sandbox policy

What it means

Error "sandboxed filesystem operations require ReadOnly or WorkspaceWrite sandbox policy" thrown in openai/codex.

Source

Thrown at codex-rs/exec-server/src/sandboxed_file_system.rs:431

            source_path,
            destination_path,
            options,
            sandbox,
        ))
    }
}

fn validate_native_path(path: &PathUri) -> FileSystemResult<()> {
    path.to_abs_path().map(drop)
}

fn require_platform_sandbox(
    sandbox: Option<&FileSystemSandboxContext>,
) -> FileSystemResult<&FileSystemSandboxContext> {
    sandbox
        .filter(|sandbox| sandbox.should_run_in_sandbox())
        .ok_or_else(|| {
            io::Error::new(
                io::ErrorKind::InvalidInput,
                "sandboxed filesystem operations require ReadOnly or WorkspaceWrite sandbox policy",
            )
        })
}

fn map_sandbox_error(error: JSONRPCErrorError) -> io::Error {
    match error.code {
        -32004 => io::Error::new(io::ErrorKind::NotFound, error.message),
        -32600 => io::Error::new(io::ErrorKind::InvalidInput, error.message),
        _ => io::Error::other(error.message),
    }
}

#[cfg(all(test, any(unix, windows)))]
#[path = "sandboxed_file_system_path_uri_tests.rs"]
mod path_uri_tests;

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/exec-server/src/sandboxed_file_system.rs:431 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/161eee7fcb4aecab. Report an issue: GitHub.