[Q&A] Codex Windows CLI error

[SpecializedBaby]

What kind of help do you need?

Installation or setup

Your question

1. Is AAS Core 2.0 officially supported with Codex CLI 0.144.6 on native Windows 10?
2. Is AAS_ADAPTER_WINDOWS_ACL_FAILED a known issue in AAS 15.1.0?
3. Which internal ACL command or validation is returning status 1?

I have not used --approve, because the preview fails before producing an approval digest.

Environment and context

• Tool: Codex CLI
• Codex CLI version: 0.144.6
• AAS package: agentic-awesome-skills@15.1.0
• AAS Core version reported: 2.0.0
• Node.js: v22.23.1
• OS: Win 10
• Shell: non-administrator PowerShell
• Config: C:\Users\<USER>\.codex\config.toml
• Cache: C:\Users\<USER>\.codex\aas-cache

What have you already tried?

• I am trying to configure AAS Core as a user-scoped MCP server for Codex CLI on native Windows 10

The preview command fails before generating an approvalDigest:

npm exec --yes --ignore-scripts `
  --package=agentic-awesome-skills@15.1.0 -- `
  aas mcp configure `
  --host codex `
  --scope user `
  --config "$CodexConfig" `
  --cache-root "$AasCache"

Result:

{
  "catalogSchemaVersion": "2.0.0",
  "category": "filesystem",
  "code": "AAS_ADAPTER_WINDOWS_ACL_FAILED",
  "coreVersion": "2.0.0",
  "details": {
    "status": 1
  },
  "ok": false,
  "protocolVersion": "2025-06-18",
  "schemaVersion": 1,
  "status": "error"
}

• I confirmed that icacls.exe works successfully from the same non-administrator PowerShell session.

• I recreated the AAS cache and restricted it to the current user:

icacls "$AasCache" /inheritance:r
icacls "$AasCache" /grant:r "${CurrentUser}:(OI)(CI)F"

The resulting cache ACL contains only the current user with Full Control.

Before posting

• I checked the README, FAQ, and relevant docs first.

[sickn33]

Fixed on main in #964, with the generated plugin state synchronized by #966.

The failure was in the Windows ACL bridge: it passed sensitive paths through the PowerShell command boundary, eagerly translated every ACE identity, and then discarded the inspected path/phase diagnostics when Get-Acl or identity translation failed. The adapter now passes paths through a sanitized environment, handles unresolved inherited ACE identities without crashing translation, and returns bounded path, phase, status, and diagnostic fields. Regression coverage was added for the exact Windows failure mode.

Important release note: agentic-awesome-skills@15.2.0 is still the currently published npm version and therefore still contains the old adapter. This maintenance did not publish a new package version. Please retest when the next Core-capable release is published; do not add --approve unless preview first returns an approval digest. On the fixed build, any remaining AAS_ADAPTER_WINDOWS_ACL_FAILED will name the actual Codex configuration path being inspected (%USERPROFILE%\.codex or config.toml), not the cache.

[SpecializedBaby]

Thank you, a good job. I'm looking forward to a new release.

[sickn33]

Released in agentic-awesome-skills 15.3.0 and now available on npm latest. The native Windows Codex ACL preview fix from #964 is included. Please retry with the exact 15.3.0 runtime; as before, only pass --approve after preview returns its approval digest. Release: https://github.com/sickn33/agentic-awesome-skills/releases/tag/v15.3.0