zed-industries/zed · error

cannot grant sandbox write access to `{}`: it resolves to `{

Error message

cannot grant sandbox write access to `{}`: it resolves to `{}`, which is not a Windows drive path

What it means

A path intended as a Windows drive (NTFS) grant did not parse as a native drive-letter path, so it cannot be resolved on the Windows host for sandbox write access. The requested grant is in an unsupported form (e.g. a UNC or WSL path where a drive path was required).

Source

Thrown at crates/sandbox/src/windows_wsl.rs:337

    wsl_zed_release: (String, String),
) -> Result<ResolvedGrant> {
    let path_string = requested.to_string_lossy();

    // A Windows drive grant (NTFS) is resolved on the Windows host, which is
    // authoritative about junctions and symlinks (see the doc comment above).
    if parse_native_drive_path(&path_string).is_ok() {
        let canonical = smol::fs::canonicalize(&requested).await.with_context(|| {
            format!(
                "failed to resolve writable path `{}` on the Windows host",
                requested.display()
            )
        })?;
        // `canonicalize` yields a `\\?\` verbatim path; store the plain native
        // spelling so a non-junction grant compares equal to what was requested.
        // A junction resolving off the local drives (onto a UNC/WSL path) is
        // rejected — only a Windows drive path maps to a DrvFs bind.
        let canonical = strip_windows_verbatim_prefix(canonical);
        ensure!(
            parse_native_drive_path(&canonical.to_string_lossy()).is_ok(),
            "cannot grant sandbox write access to `{}`: it resolves to `{}`, \
             which is not a Windows drive path",
            requested.display(),
            canonical.display()
        );
        // A Windows drive is reached inside WSL via DrvFs (weaker guarantees), so
        // a native-drive grant is on a Windows filesystem by definition.
        return Ok(ResolvedGrant {
            canonical,
            on_windows_fs: true,
        });
    }

    // Otherwise the grant must be a Linux-absolute WSL path, which only WSL can
    // canonicalize. `\\wsl.localhost\...` and other shapes are rejected.
    let wsl_path = parse_wsl_absolute_path(&path_string).map_err(|_| {
        anyhow::anyhow!(

View on GitHub (pinned to f4178619ac)

Solutions

1. Pass a native drive-letter Windows path (e.g. C:\work\repo) for the grant
2. Route non-drive paths through the WSL-side resolution path instead of Windows-host canonicalization

When it happens

Trigger: Thrown at crates/sandbox/src/windows_wsl.rs:337 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of zed-industries/zed@f4178619ac (2026-08-20). Data as JSON: /api/errors/c78f6ffacee42c75. Report an issue: GitHub.