Windows sandbox fails before every shell command: deny_read_acl_state.json contains null bytes #51605

What version of the Codex App are you using (From “About Codex” dialog)?

26.1002.51308

What subscription do you have?

ChatGPT Pro 100

What platform is your computer?

Microsoft Windows NT 10.0.19045.0 x64

What issue are you seeing?

Codex desktop on Windows cannot launch sandboxed shell commands, including
a minimal read-only Get-Location command. Execution fails before the command
runs.

User-facing error:

Failed to create unified exec process: helper_unknown_error: apply deny-read ACLs

The sandbox log identifies the underlying failure:

[2026-10-07T06:44:30.018997800+00:00] setup error: apply deny-read ACLs

Caused by:
0: parse deny-read ACL state C:\Users<USER>.codex.sandbox\deny_read_acl_state.json
1: expected value at line 1 column 1

[2026-10-07 10:44:30.023 codex.exe] setup refresh: exited with status ExitStatus(ExitStatus(1))

The affected state file is 22 bytes long. Its first 16 bytes are:

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

I preserved a backup without modifying or deleting the original file.

What steps can reproduce the bug?

These steps reproduce the execution failure on my affected installation.
I do not know how to reproduce the original state-file corruption.

1. Open a local project in Codex desktop on Windows.
2. Ask Codex to run this minimal command using its normal sandboxed shell:
   Get-Location
3. Use login: false, with the project directory as the working directory.
4. Execution fails before the shell process starts:
   Failed to create unified exec process: helper_unknown_error: apply deny-read ACLs

Exact diagnostic prompt:

“Perform one minimal execution diagnostic only. Using the normal shell tool,
run Get-Location with login: false in the project directory. Do not invoke Git,
read project files, create files, request escalation, change permissions, or
try alternative execution routes. Report whether the process started and the
exact output or error. Stop after this single attempt.”

The failure persists after fully restarting the desktop app.

It also occurs in a newly created independent Git clone with its own .git
directory, not just in the original linked Git worktree.

Ordinary PowerShell outside Codex successfully runs Git and file operations.

The observed failure occurs during sandbox setup, before command execution.

What is the expected behavior?

A permitted read-only command such as Get-Location should launch successfully.

If the sandbox ACL state file is malformed, Codex should report the specific
problem and provide a supported recovery procedure that reconciles existing
filesystem permissions.

Recovery should preserve sandbox protections and should not require users to
guess whether deleting the ACL state file or replacing it with empty JSON is safe.

Additional information

Troubleshooting already performed:

• Fully restarted Codex desktop.
• Tested a minimal Get-Location command with no Git operations.
• Reproduced the failure in an independent Git clone.
• Verified the new clone's Git integrity successfully using ordinary PowerShell.
• Used Settings > Diagnose: “Codex dependencies look healthy.”
• Preserved the malformed state file and relevant sandbox log excerpt.
• Did not delete/reset sandbox state or manually change ACLs during this investigation.

Settings visible during troubleshooting:

• Approval policy: On request
• Sandbox settings: Read only

Workspace Dependencies version shown in Settings: 26.904.11930.
This is the dependency-bundle version, not a confirmed desktop app or CLI version.

A separate warning appears in Settings:
“[features.guardianv2].thread_context is deprecated and ignored.”
No causal connection to the sandbox failure has been established.

A support case has also been opened.

Please advise how to safely recover the corrupted deny_read_acl_state.json
while accounting for ACL changes previously applied by Codex.