Windows: Codex Security scan directory is inaccessible to the sandbox reviewer despite ready preflight

Windows: Codex Security scan directory is inaccessible to the sandbox reviewer despite ready preflight

Summary

A native desktop diff scan reaches reporting but cannot create its required artifacts/01_context/threat_model.md. The plugin can retain semantic checkpoints through its MCP tools, while the reviewer and coordinator both receive filesystem access-denied errors for the plugin-created scan directory. The native scan remains incomplete.

Environment

• Observed: 2026-09-08, native Windows desktop.
• Desktop's bundled engine: codex-cli 0.153.4, obtained from the running engine's executable path. This is not the desktop application package version.
• Codex Security plugin: 0.1.23, from its installed plugin manifest.
• Windows: Microsoft Windows NT 10.0.26200.0; PowerShell: 7.6.5.
• Coordinator permission mode: workspace-write.
• Sandboxed commands run as the dedicated codexsandboxonline user.
• Repository helper Python: 3.14.7. The separate MCP host's Python version was not established.

Observed reproduction

1. Launch the native desktop prompt-only diff workflow for a frozen, one-file Git change.
2. Complete the installed security_diff_scan capability preflight. It reports ready; its profile checks delegation/goals rather than artifact access.
3. Use the authoritative directory returned by the launcher. Its shape is %TEMP%/codex-security-scans-<random>/<repo>/<revision>_<timestamp>_<random>/.
4. Attempt the required threat-model artifact write through the reviewer's normal file-writing tool.

The observed write error is Failed to create parent directories. A read-only check of that exact scan directory also reproduces the failure:

Get-ChildItem -LiteralPath '<authoritative scanDir>' -Name -ErrorAction Stop

Observed result: Access to the path ... is denied.

The same directory access check fails from the coordinator. Native scan-context retrieval and a previously accepted complete:false semantic checkpoint remain available. Both native inventories include the changed file; this is not an inventory-omission failure.

Expected behavior and impact

The native workflow should preserve its required evidence using its authorized writer, or detect unavailable artifact access before source review. It should not spend the review budget and then discover that it cannot complete its evidence bundle.

The source review finished, but native artifact completion and sealing remain unavailable. This report describes a workflow failure, not a demonstrated security bypass.

Evidence and root-cause hypothesis

The installed scripts/workbench_scan_start.py, in insert_running_scan, creates the per-scan directory with tempfile.mkdtemp. The parent directories' readable ACLs grant the sandbox group Modify access; the per-scan directory and its ACL reject sandbox access.

Python documents private temporary directories, and Windows Python 3.13+ applies creator/administrator-only access for os.mkdir(..., 0o700). A creator-versus-sandbox identity mismatch is therefore a strong hypothesis. The leaf ACL and the MCP creator's Python version remain unverified; this report does not claim that the exact ACL mechanism has been proved.

Suggested repair in the owning plugin

Extend the existing native semantic-draft persistence operation to materialize the required threat-model artifact from the accepted canonical threatModel, using the plugin's existing secure scan-local writer. Preserve authoritative scan identity, private storage, path containment, atomic writes and native finalization. Make artifact readiness part of preflight through the actual required writer.

This is a proposed implementation direction, not a claim that the existing desktop API already supports that operation. A supported host-level solution providing equivalently narrow access may also satisfy the contract. Changing the parent temporary location alone is not a demonstrated fix.

Regression acceptance

• Exercise the actual native Windows host and dedicated sandbox identity.
• Verify required artifact creation/readback without broad permission changes or source edits.
• Preserve canonical threat-model content and the native scan ID across continuation.
• Reject path escape and reparse-point substitution through the existing native writer.
• Complete native validation/sealing and reopen the retained bundle after restart.
• Detect denied artifact access before source analysis, retaining the same incomplete scan.
• Verify the fix against a newly created scan directory; a one-off ACL repair is insufficient.

References

• Codex Windows sandbox
• Native change-review workflow
• Python temporary-directory contract
• Python Windows mkdir permissions

Start by inspecting scripts/workbench_scan_start.py, especially insert_running_scan, then trace the native semantic-draft writer and preflight path described in the issue. Reproduce with a newly created scan directory under the dedicated sandbox identity; done means the required artifact can be safely written and read, denied access is detected before review, and path-containment protections remain intact.