Codex Desktop sandbox error: apply deny-read ACLs

English translation:

What version of the Codex App are you using (From “About Codex” dialog)?

Version 26.623.70822

What subscription do you have?

ChatGPT Plus

What platform is your computer?

Microsoft Windows NT 10.0.19045.0

What issue are you seeing?

Codex Desktop cannot read my workspace under C:\CodexWork\commit86\tcp-cleaning-backend-phase1. Every file access fails with: windows sandbox: helper_unknown_error: apply deny-read ACLs. The Windows ACLs are correct, and the error also occurs with files directly in the shared workspace. Restarts did not help. Please check the sandbox/ACL error.

What steps can reproduce the bug?

Feedback ID: 019f1a1d-7033-7681-ac0c-75299e1e5cfd

What is the expected behavior?

Codex Desktop should be able to list, read, and modify files inside the configured workspace without an ACL or sandbox error. Filesystem commands should execute normally.

Additional information

_No response_

<!-- codex-issue-translator -->

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #30540
• #30251

Powered by Codex Action

I ran into the same windows sandbox: helper_unknown_error: apply deny-read ACLs error on Codex Desktop for Windows and found a workaround that fixed it for me.

In my case, the problem was not the ACL of the workspace itself. icacls showed normal permissions, and the same error also occurred with a completely new/clean workspace.

The issue turned out to be this file:

%USERPROFILE%\.codex\.sandbox\deny_read_acl_state.json

The file existed and had a non-zero size, but when I opened it, its contents were essentially NUL/null bytes instead of valid JSON.

I completely closed Codex Desktop and renamed the file:

$state = "$env:USERPROFILE\.codex\.sandbox\deny_read_acl_state.json"
Rename-Item $state "deny_read_acl_state.json.bak"

Then I started Codex Desktop again.

The apply deny-read ACLs error disappeared immediately and the sandbox started working normally again.

So if anyone else encounters this error, I suggest checking:

$state = "$env:USERPROFILE\.codex\.sandbox\deny_read_acl_state.json"

Test-Path $state
Get-Item $state | Select-Object FullName, Length, LastWriteTime
Get-Content $state -Raw

If deny_read_acl_state.json is corrupted/empty/filled with NUL bytes, close Codex completely and rename or remove it so Codex can recreate the sandbox state.

It may also be worth investigating why this state file can become corrupted and why Codex doesn't automatically recover when it contains invalid JSON.