Windows: custom permission profile plus non-empty AGENTS.md prevents task creation with os error 206

What version of the Codex App are you using (From “About Codex” dialog)?

Version 26.818.41509

What subscription do you have?

Pro

What platform is your computer?

Windows 11 Pro, build 26200.9168

What issue are you seeing?

n Windows, a trusted repository cannot start a Codex task when both of the following are active:

1. The repository has a non-empty AGENTS.md.
2. Its trusted project-local .codex/config.toml selects a custom permission profile containing denied-read paths.

Task creation fails before the first turn with Windows error 206. Replacing the custom profile with the built-in :workspace or :read-only profile immediately fixes the problem. Disabling project-document loading with project_doc_max_bytes=0 also fixes it.

The same failure reproduces outside the desktop UI with codex debug prompt-input, so this appears to be an interaction in core session/config/instruction initialization rather than only a renderer issue.

Environment

• OS: Windows 11 Pro, build 26200.9168
• Codex desktop app: 26.818.5229.0
• Bundled Codex CLI: 0.149.0-alpha.4.1
• Agent environment: Windows native
• Windows sandbox implementation: elevated
• Repository: trusted Git worktree on a local NTFS drive
• Windows LongPathsEnabled: 1

Project configuration

The project-local .codex/config.toml is equivalent to:

default_permissions = "project_profile"

[permissions.project_profile.workspace_roots]
"." = true

[permissions.project_profile.filesystem]
glob_scan_max_depth = 3
":workspace_roots" = { "." = "write", "projects/**" = "deny", "personalities.json" = "deny" }

The repository also has a non-empty root-level AGENTS.md.

Isolation results

| Configuration | Result |
|---|---|
| Custom profile + normal AGENTS.md loading | Fails with error 206 |
| Custom profile + project_doc_max_bytes=32768 | Fails |
| Custom profile + project_doc_max_bytes=1 | Fails |
| Custom profile + project_doc_max_bytes=0 | Succeeds |
| Built-in :workspace + original AGENTS.md | Succeeds |
| Built-in :read-only + original AGENTS.md | Succeeds |
| Custom profile + unrelated config override | Fails |
| Another repository on the same drive | Succeeds |

Additional checks:

• Longest path anywhere in the affected repository was 237 characters, below the legacy 260-character limit.
• No global AGENTS.md or AGENTS.override.md was present in CODEX_HOME.
• codex doctor --json reported config loading, Git detection, sandbox provisioning, authentication, network connectivity, and state database integrity as healthy.
• Sandbox logs showed setup refresh completing with errors=[]; error 206 was not emitted by the command runner.
• The error occurs before any model-generated command executes.

Impact

The affected repository is completely unusable from the desktop app until either its custom denied-read permission profile or its project instructions are disabled.

Suspected area

This appears to involve the interaction between project-instruction discovery and custom permission profiles with denied-read restrictions on Windows. The error's reference to the AGENTS.md filename/path appears misleading because no tested filesystem path exceeds 260 characters.

What steps can reproduce the bug?

1. On Windows, create or open a trusted Git repository.
2. Add a non-empty root-level AGENTS.md.
3. Add the project-local .codex/config.toml shown above.
4. In the Codex desktop app, add the repository and try to start a local task.
5. Alternatively, run this read-only prompt-construction diagnostic:

``powershell
codex -C "X:\path\to\repo" debug prompt-input probe
``

Actual behavior

The desktop app cannot create the task. The CLI diagnostic fails with the same error:

Error: Fatal error: Failed to initialize session: failed to load AGENTS.md instructions for environment `local`: The filename or extension is too long. (os error 206)

What is the expected behavior?

Expected behavior

Codex should load project instructions and initialize the selected custom permission profile. The desktop app should create the task, and debug prompt-input should return the rendered prompt JSON.

Confirmed workaround

Changing only this line fixes both desktop task creation and debug prompt-input:

default_permissions = ":workspace"

The built-in :read-only profile also succeeds.

Keeping the custom profile but setting the following also succeeds, although it disables AGENTS.md instructions:

project_doc_max_bytes = 0

Additional information

_No response_