From 867820ac7e80d4e626836a9e4a70335f0a84766f Mon Sep 17 00:00:00 2001 From: iceweasel-oai Date: Thu, 23 Apr 2026 15:21:48 -0700 Subject: [PATCH] do not attempt ACLs on installed codex dir (#19214) We used to attempt a read-ACL on the same dir as `codex.exe` to grant the sandbox user the ability to invoke `codex-command-runner.exe`. That worked for the CLI case but it always fails for the installed desktop app. We have another solution already in place that copies `codex-command-runner.exe` to `CODEX_HOME/.sandbox-bin` so we don't even need this anymore. It causes a scary looking error in the logs that is a non-issue and is therefore confusing --- codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs b/codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs index 3774ab729..8c334000e 100644 --- a/codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs +++ b/codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs @@ -345,16 +345,9 @@ fn profile_read_roots(user_profile: &Path) -> Vec { } fn gather_helper_read_roots(codex_home: &Path) -> Vec { - let mut roots = Vec::new(); - if let Ok(exe) = std::env::current_exe() - && let Some(dir) = exe.parent() - { - roots.push(dir.to_path_buf()); - } let helper_dir = helper_bin_dir(codex_home); let _ = std::fs::create_dir_all(&helper_dir); - roots.push(helper_dir); - roots + vec![helper_dir] } fn gather_legacy_full_read_roots(