unsupported filesystem permissions for Windows sandbox setup

Error message

unsupported filesystem permissions for Windows sandbox setup

What it means

Error "unsupported filesystem permissions for Windows sandbox setup" thrown in openai/codex.

Source

Thrown at codex-rs/windows-sandbox-rs/src/setup.rs:328

    let file_system = file_system.materialize_project_roots_with_workspace_roots(workspace_roots);
    let command_cwd = AbsolutePathBuf::from_absolute_path(command_cwd)?;
    resolve_windows_deny_read_paths(&file_system, &command_cwd)
        .map(|paths| {
            paths
                .into_iter()
                .map(AbsolutePathBuf::into_path_buf)
                .collect()
        })
        .map_err(|err| anyhow!(err))
}

fn run_setup_refresh_inner(
    request: SandboxSetupRequest<'_>,
    overrides: SetupRootOverrides,
    offline_proxy_settings_override: Option<&OfflineProxySettings>,
) -> Result<()> {
    if !request.permissions.is_enforceable_by_windows_sandbox() {
        anyhow::bail!("unsupported filesystem permissions for Windows sandbox setup");
    }
    let (read_roots, write_roots) = build_payload_roots(&request, &overrides);
    let deny_read_paths = build_payload_deny_read_paths(overrides.deny_read_paths);
    let deny_write_paths = build_payload_deny_write_paths(&request, overrides.deny_write_paths);
    let offline_proxy_settings =
        offline_proxy_settings_for_request(&request, offline_proxy_settings_override);
    let payload = ElevationPayload {
        version: SETUP_VERSION,
        offline_username: OFFLINE_USERNAME.to_string(),
        online_username: ONLINE_USERNAME.to_string(),
        codex_home: request.codex_home.to_path_buf(),
        command_cwd: request.command_cwd.to_path_buf(),
        read_roots,
        write_roots,
        deny_read_paths,
        deny_write_paths,
        proxy_ports: offline_proxy_settings.proxy_ports,
        allow_local_binding: offline_proxy_settings.allow_local_binding,

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/windows-sandbox-rs/src/setup.rs:328 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/ff35f95446afb8c6. Report an issue: GitHub.