RAP Sheet home
Install the bug reporting skill
Rank, 14 days: 91 on the Codex sheet
17 people reported

All time, since Sep 16, including 3 thumbs-up on GitHub.

Workspace file access denied in sandbox

“The Windows desktop Work/Codex sandbox denies native Windows path resolution even for newly created files inside its authorized writable workspace.”

Is this your bug? What gets counted gets fixed. Pile on.

Paste this into your agent. It files your report, with your error and version.

I hit this bug: rapsheet.dev/sheets/codex/themes/161/file
Follow it to file my report. Show me the text before you send.

No install. No account. Public and anonymous. The link asks your agent for one report, nothing else. What it sends

Fading. 1 report or thumbs-up in the last 7 days and 2 the week before, down from 6 a week at the mid-October peak.

4 bugs in this theme

  1. Sandbox denies path resolutionHas a workaround9 people
  2. Browser client realpath EPERMNo workaround yet4 people
  3. Nested folder writes deniedNo workaround yet2 people
  4. Existing files denied write accessNo workaround yet2 people

What's included

  • Native realpath or Path.resolve(strict=True) fails with EPERM / WinError 5 while reading the file works
  • Browser/Chrome client import fails with "EPERM: operation not permitted, realpath" on browser-client.mjs
  • Existing workspace files cannot be opened for writing (0x80070005) while new files can
  • Commands whose working directory is a subfolder lose write access to existing nested folders

Not included

  • Files created by the sandbox becoming inaccessible to the normal Windows user
  • Sandbox setup failing before any command starts

Original reports14, newest first

  1. Windows Codex child: GetFinalPathNameByHandleW returns ERROR_ACCESS_DENIED after successful CreateFileWOn GitHub#59035
  2. Windows elevated sandbox: workspace root writable, nested directory access deniedOn GitHub#57610
  3. [Windows sandbox] Existing workspace file denied write access (0x80070005); restricted SID grant present on parents but missing on fileOn GitHub#56905
  4. [Windows] Browser bootstrap fails with native realpath EPERM under MXC/AppContainerOn GitHub#53967
  5. Windows AppContainer: EPERM when loading browser-client.mjsOn GitHub#53638
  6. Windows Codex Desktop: built-in Browser fails with EPERM during realpath under MXCOn GitHub#53332
  7. Windows: Browser tool fails to load in MXC (realpath EPERM), neither Chrome nor Edge worksOn GitHub#53045
  8. Windows desktop: Python Path.resolve(strict=True) fails with WinError 5 despite successful file readsOn GitHub#52639
  9. Windows sandbox: native realpath returns EPERM inside writable workspaceOn GitHub#52593
  10. Windows sandbox: Path.resolve(strict=True) fails with WinError 5 in default execution, succeeds in approved outside executionOn GitHub#51989
Show all 14Show only the newest 10
  1. Windows: native Chrome/Browser client fails with EPERM realpath before extension handshake (26.1002.51308)On GitHub#51669
  2. Windows elevated sandbox: a command whose workdir is a subfolder of the workspace root loses write access to existing subfolders (capability SID churn + non-propagating ACE)On GitHub#49791
  3. Windows sandbox: access denied for existing workspace files while new files are writableOn GitHub#47218
  4. CODEX_HOME fails to load inside a Windows AppContainer/lowbox — find_codex_home()'s canonicalize() needs \GLOBAL?? DOS-drive-letter access the sandbox deniesOn GitHub#45871

Do you work on Codex?

Claim its RAP Sheet to see what your users report and answer them in one place.

Claim a tool