Windows app cannot perform git operations when sandbox settings are set to "Workspace write"

Resolved 💬 7 comments Opened Apr 4, 2026 by Lightborne Closed Apr 4, 2026

💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of the Codex App are you using (From “About Codex” dialog)?

26.325.31654

What subscription do you have?

Pro

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

If I set sandbox settings to "Workspace write", the agent cannot perform any git operations in my local repo. All commands come back with

fatal: Unable to create '<path>/.git/index.lock': Permission denied

What steps can reproduce the bug?

set sandbox settings to "Workspace write" and set up the agent sandbox. This is the config.toml it wrote for me:

model = "gpt-5.4"
model_reasoning_effort = "xhigh"
sandbox_mode = "workspace-write"
approval_policy = "never"
network_access = true

[windows]
sandbox = "elevated"

Then ask the agent to perform a git operation like

git commit -m "test" --dry-run

It fails with the error mentioned above.

What is the expected behavior?

It should be able to perform git operations.

Additional information

I need to set Sandbox Settings to "Full Access" to get it to be able to do stuff with git in my local workspace.

View original on GitHub ↗

7 Comments

github-actions[bot] contributor · 3 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

#15505
#15165
#15850

Powered by Codex Action

Lightborne · 3 months ago

The other issues are centered around the Codex CLI - mine is the windows app.

etraut-openai contributor · 3 months ago

The app uses the CLI under the covers, so this is the same issue as #15505.

Lightborne · 3 months ago

Added this comment to #15505 as well:

I modified my app's config.toml to try to use the workaround:

model = "gpt-5.4"
model_reasoning_effort = "xhigh"
sandbox_mode = "workspace-write"
approval_policy = "never"
network_access = true

[windows]
sandbox = "elevated"

sandbox_workspace_write.writable_roots = ["C:\\<path>\\.git"]

The agent still can't write to .git:

Same result again: git commit -m "test" --dry-run fatal: Unable to create 'C:/<path>/.git/index.lock': Permission denied Nothing changed on this attempt.

hassanp50287 · 2 months ago

احصل على Outlook لـ iOS<https://aka.ms/o0ukef>
________________________________
من: Lightborne @.*>
تاريخ الإرسال: السبت, أبريل 4, 2026 8:10 م
إلى: openai/codex @.*>
نسخة: Subscribed @.***>
الموضوع: Re: [openai/codex] Windows app cannot perform git operations when sandbox settings are set to "Workspace write" (Issue #16794)

[https://avatars.githubusercontent.com/u/1616685?s=20&v=4]Lightborne left a comment (openai/codex#16794)<https://github.com/openai/codex/issues/16794#issuecomment-4187426579>

Added this comment to #15505<https://github.com/openai/codex/issues/15505> as well:

I modified my app's config.toml to try to use the workaround:

model = "gpt-5.4"
model_reasoning_effort = "xhigh"
sandbox_mode = "workspace-write"
approval_policy = "never"
network_access = true

[windows]
sandbox = "elevated"

sandbox_workspace_write.writable_roots = ["C:\\<path>\\.git"]

The agent still can't write to .git:

Same result again:

git commit -m "test" --dry-run
fatal: Unable to create 'C://.git/index.lock': Permission denied

Nothing changed on this attempt.

—
Reply to this email directly, view it on GitHub<https://github.com/openai/codex/issues/16794#issuecomment-4187426579>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BTUVD2QQBWW346GS3FWWEVT4UE6XXAVCNFSM6AAAAACXMWY4KWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DCOBXGQZDMNJXHE>.
You are receiving this because you are subscribed to this thread.

hassanp50287 · 2 months ago

احصل على Outlook لـ iOS<https://aka.ms/o0ukef>
________________________________
من: حسن علي @.*>
تاريخ الإرسال: الخميس, مايو 21, 2026 6:35 م
إلى: openai/codex @.*>
الموضوع: Re: [openai/codex] Windows app cannot perform git operations when sandbox settings are set to "Workspace write" (Issue #16794)

[https://avatars.githubusercontent.com/u/1616685?s=20&v=4]Lightborne left a comment (openai/codex#16794)<https://github.com/openai/codex/issues/16794#issuecomment-4187426579>

Added this comment to #15505<https://github.com/openai/codex/issues/15505> as well:

I modified my app's config.toml to try to use the workaround:

model = "gpt-5.4"
model_reasoning_effort = "xhigh"
sandbox_mode = "workspace-write"
approval_policy = "never"
network_access = true

[windows]
sandbox = "elevated"

sandbox_workspace_write.writable_roots = ["C:\\<path>\\.git"]

The agent still can't write to .git:

Same result again:

git commit -m "test" --dry-run
fatal: Unable to create 'C://.git/index.lock': Permission denied

Nothing changed on this attempt.

hassanp50287 · 2 months ago

احصل على Outlook<https://aka.ms/o0ukef>

في ما يلي بعض الأوقات التي تناسبني:

لـ iOS<https://aka.ms/o0ukef>
احصل على Outlook لـ iOS<https://aka.ms/o0ukef>