codex - 💡(How to fix) Fix Windows sandbox applies DENY ACLs to .git directories in writable_roots, breaking git commits [2 comments, 2 participants]

What version of Codex CLI is running?

0.122.0

What subscription do you have?

PRO

Which model were you using?

gpt-5.4

What platform is your computer?

Windows 11 PRO

What terminal emulator and version are you using (if applicable)?

Gitbash/Powershell

What issue are you seeing?

Summary

After updating to the version released ~2026-04-20, Codex applies DENY ACEs to .git directories inside any path listed in writable_roots, permanently breaking git commit (and any operation requiring .git/index.lock) for the sandboxed process.

Root Cause

PR #18443 changed sandbox ACL setup to expand USERPROFILE into its direct children rather than granting the root. For users whose repos live under a USERPROFILE child (e.g. C:\Users\me\OneDrive...), those repos are now in scope for sandbox ACL grants. The sandbox applies DENY ACEs to the repo's .git directory — presumably to protect git history — but those DENY ACEs are not cleaned up and persist after Codex exits, reapplied on every startup.

Observed Behavior

fatal: Unable to create '.../.git/index.lock': Permission denied

icacls .git shows explicit DENY ACEs for the sandbox SID:

.git S-1-5-21-<sandbox-domain>-<id>:(DENY)(W,D,Rc,DC) S-1-5-21-<sandbox-domain>-<id>:(OI)(CI)(IO)(DENY)(W,D,Rc,GW,DC)

• The DENY SID is the Codex sandbox identity (different domain from the local machine SID)
• Removing the ACEs manually with icacls /remove:d works temporarily
• Codex reapplies the DENY ACEs on next startup
• The user's own account (vasan) retains full control and is unaffected — only the sandboxed process is blocked

Environment

• OS: Windows 11 Pro
• Codex version: updated ~2026-04-20 (post-PR #18443)
• sandbox_mode = "workspace-write", [windows] sandbox = "elevated"
• Repo path: under C:\Users<user>\OneDrive... (OneDrive is a direct USERPROFILE child, so it falls into the expanded roots after #18443)

Expected Behavior

.git directories inside writable_roots should be excluded from DENY ACE grants, consistent with how .ssh is excluded. Git operations must work from within the sandbox.

Suggested Fix

In codex-windows-sandbox, add .git to the same exclusion list used for .ssh, .tsh, .brev. Apply the same pattern PR #18493 uses for SSH config scanning — just statically exclude .git at any depth within a writable root, since the sandbox has no legitimate reason to DENY-lock version control internals.

// alongside .ssh, .tsh, .brev exclusions: ".git",

What steps can reproduce the bug?

create .git under onedrive and have codex commit to it -- was working flawlessly till this upgrade.

What is the expected behavior?

"• I found the root cause: ACL on .git has an explicit DENY write entry for the Codex sandbox SID, so this session cannot create index.lock (staging/commit blocked). I’ll try removing that deny ACE and then finish commit/issue closeout." -- per codex itself

Additional information

No response