Windows: literal read root containing [] is parsed as a glob and prevents Node REPL startup

What version of Codex is running?

• Codex Desktop: 26.721.4979.0
• Bundled CLI: codex-cli 0.146.0-alpha.3.1
• Bundled node_repl.exe SHA-256: 2FCF3EC72C2C5FCCD5448E2478C6635BF1D48D3D55223BF2B1B3AD1B50CEAE2D

What platform is your computer?

Windows 11 Pro 10.0.26200 x64.

Relevant installed runtimes:

• PowerShell 7.6.4 at C:\Program Files\PowerShell\7\pwsh.exe
• Node.js v24.16.0 at C:\Program Files\nodejs\node.exe

What issue are you seeing?

A literal, existing Windows directory containing square brackets is accepted as a workspace root by the main Codex session, but the nested Node REPL sandbox re-parses the path as a filesystem glob and exits before any JavaScript executes.

Redacted example path:

D:\media\[course]\folder [8gb]

The Node REPL kernel exits with:

Error: filesystem glob path `D:\media\[course]\folder [8gb]` only supports `deny` access; use an exact path or trailing `/**` for `read` subtree access

This path is intended as an exact filesystem path, not a glob.

The relevant current source appears to classify [ and ] as glob characters on Windows in contains_glob_chars_for_platform, after which compile_read_write_glob_path rejects the read rule:

https://github.com/openai/codex/blob/main/codex-rs/core/src/config/permissions.rs

The protocol already distinguishes FileSystemPath::Path from FileSystemPath::GlobPattern:

https://github.com/openai/codex/blob/main/codex-rs/protocol/src/permissions.rs

This suggests the exact-path identity is being lost during permission-profile or sandbox-state serialization/recompilation.

What steps can reproduce the bug?

1. Create a real directory whose name contains square brackets, for example:

``text
D:\media\[course]\folder [8gb]
``

1. Use a project-local permission profile such as:

```toml
default_permissions = "bracket-read-root"
approval_policy = "never"

[permissions.bracket-read-root]

[permissions.bracket-read-root.workspace_roots]
'D:\media\[course]\folder [8gb]' = true

[permissions.bracket-read-root.filesystem]
":minimal" = "read"
":tmpdir" = "write"

[permissions.bracket-read-root.filesystem.":workspace_roots"]
"." = "read"

[permissions.bracket-read-root.network]
enabled = false
```

1. Open the project in Codex Desktop with that profile active.
2. Invoke the Node REPL with a minimal call such as:

``js
nodeRepl.write("ok")
``

1. Observe that the kernel exits before the JavaScript runs with the filesystem-glob error above.

Control evidence

• The main Codex PowerShell sandbox starts successfully.
• PowerShell can access the exact bracketed directory.
• Native Node.js launched through that PowerShell sandbox successfully runs fs.statSync() on the exact same path.
• No symlink, junction, cloud placeholder, or reparse point is involved.
• Therefore the directory and Windows filesystem permissions are valid; the failure is isolated to the nested Node REPL permission round-trip.

What is the expected behavior?

A literal absolute Windows path containing legal filename characters [ and ] should remain an exact FileSystemPath::Path when passed into the nested Node sandbox. The Node REPL should start with read access limited to that exact subtree.

The workaround should not require:

• disabling the Node sandbox;
• granting read access to a broader parent directory;
• renaming the real directory;
• creating a junction or symbolic link; or
• changing NTFS short-name behavior.

Suggested fix / regression coverage

Either preserve the tagged FileSystemPath::Path variant across the sandbox-state round-trip, or ensure read/write exact Windows paths can contain [ and ] without being treated as glob patterns. * and ? handling and deny-glob behavior can remain unchanged.

A Windows regression test should cover an exact readable root such as:

C:\tmp\[literal]\folder [1]

and prove that a nested Node REPL command starts and reads only the authorized subtree.

Additional information

All paths in this report are synthetic and redacted. No media or private file contents are involved.