AgentFixFind a fix
CodexPartial workaroundUpdated Aug 20, 2026

Codex helper_unknown_error while applying deny-read ACLs

Fix the confirmed corrupted-state branch of Codex windows sandbox: helper_unknown_error: apply deny-read ACLs, and identify when the workaround does not apply.

Exact error

Match the message before using the fix

windows sandbox: helper_unknown_error: apply deny-read ACLssetup error: apply deny-read ACLsparse deny-read ACL state C:\Users\<user>\.codex\.sandbox\deny_read_acl_state.json: expected value at line 1 column 1

Quick answer

Start here

Expand the error first. If it includes `parse deny-read ACL state` and `expected value at line 1 column 1`, fully close Codex, rename that one JSON state file as a backup, and reopen Codex so it can recreate the file. That worked in the confirmed report. If the nested parse error is absent, do not assume the same fix applies: the broader ACL setup error has other unresolved branches.

Diagnosis

Why it happens

  • In the confirmed branch, `deny_read_acl_state.json` contained invalid NUL bytes, so the sandbox helper could not parse its saved state.
  • The same visible `apply deny-read ACLs` message can hide a different ACL or setup failure; another Windows report did not show the parse signature and remains unresolved.

Safest first

Fixes, in order

01

Match the corrupted-state signature

Applies when: Use before changing any file or Windows permission

The confirmed workaround is scoped to a nested JSON parse failure, not every deny-read ACL error.

  1. Open the full Codex error details or log.
  2. Look for both `parse deny-read ACL state` and `expected value at line 1 column 1`.
  3. Confirm the path ends in `.codex\.sandbox\deny_read_acl_state.json`.
  4. If those details are missing, skip to the unresolved branch below.

Expected: You know whether the source-confirmed state-file workaround applies to this failure.

02

Back up the invalid state file and let Codex recreate it

Applies when: Only when the full error contains the JSON parse signature above

The reporter restored sandbox startup by moving the corrupt state aside and allowing Codex to generate a clean replacement.

  1. Quit every Codex window and confirm the app is no longer running.
  2. Open `%USERPROFILE%\.codex\.sandbox` in File Explorer.
  3. Rename `deny_read_acl_state.json` to `deny_read_acl_state.json.corrupt-backup`; do not edit other sandbox files.
  4. Reopen Codex and run one harmless read-only command.

Expected: Codex creates a valid replacement state file and the sandboxed command starts.

03

Treat a different nested cause as an open issue

Applies when: When the visible error matches but the parse signature does not

A second report shows that moving the repository and restarting do not universally repair this error family.

  1. Keep the complete nested error instead of only the top-level toast.
  2. Record Codex version, Windows build, repository path, and whether the command works outside the sandbox.
  3. Do not reset broad folder ACLs or delete the whole `.codex\.sandbox` directory.
  4. Compare the nested cause with the linked open reports before making permission changes.

Expected: The unresolved branch is documented without applying an unrelated or overly broad permission reset.

Verification

Prove the fix worked

  1. Run a harmless read-only command with the normal Windows sandbox enabled.
  2. Confirm the recreated JSON file is non-empty and the parse error is gone.
  3. Keep the renamed backup until a second new session also starts correctly.

Escalation

If it still fails

  • Restore the backup if Codex does not create a replacement or a new failure appears.
  • Capture the complete nested error; `apply deny-read ACLs` alone is not enough to identify the branch.
  • Do not grant broad permissions to `C:\Users` or permanently disable the sandbox as a shortcut.

Scope

Environment and version notes

  • The confirmed corrupt-state report used Codex Desktop 26.814.41407 on Windows 11.
  • The broader issue is still open upstream, so this is a branch-specific workaround rather than a universal fix.
  • Sources rechecked August 20, 2026.

Evidence

Sources

Source labels describe the evidence available on the checked date. A closed issue is not automatically a shipped fix.