openai/codex · error · anyhow::Error

workspace-write sandbox has no writable root capability SIDs

Error message

workspace-write sandbox has no writable root capability SIDs

What it means

Error "workspace-write sandbox has no writable root capability SIDs" thrown in openai/codex.

Source

Thrown at codex-rs/windows-sandbox-rs/src/elevated_impl.rs:173

            crate::WindowsSandboxProxySettingsMode::Reconcile,
        )?;
        // Build capability SID for ACL grants.
        let caps = load_or_create_cap_sids(codex_home)?;
        let (sid_for_null, cap_sids) = if permissions.uses_write_capabilities_for_cwd(cwd, &env_map)
        {
            let write_roots = effective_write_roots_for_permissions(
                &permissions,
                cwd,
                &env_map,
                codex_home,
                write_roots_override,
            );
            let cap_sids = write_roots
                .iter()
                .map(|root| workspace_write_cap_sid_for_root(codex_home, cwd, root))
                .collect::<Result<Vec<_>>>()?;
            if cap_sids.is_empty() {
                anyhow::bail!("workspace-write sandbox has no writable root capability SIDs");
            }
            (LocalSid::from_string(&cap_sids[0])?, cap_sids)
        } else {
            let sid = LocalSid::from_string(&caps.readonly)?;
            (sid, vec![caps.readonly])
        };

        unsafe {
            allow_null_device(sid_for_null.as_ptr());
        }

        (|| -> Result<CaptureResult> {
            let spawn_request = SpawnRequest {
                command: command.clone(),
                cwd: cwd.to_path_buf(),
                env: env_map.clone(),
                permission_profile: permission_profile.clone(),
                workspace_roots: workspace_roots.to_vec(),

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/windows-sandbox-rs/src/elevated_impl.rs:173 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/4aee6421403083ea. Report an issue: GitHub.