Windows: AccessDeniedException during `codeql database create` TRAP finalization (`pools/0` move fails)

[timothywarner]

Title:
Windows: AccessDeniedException during codeql database create TRAP finalization (pools/0 move fails)

Description:

❗ Summary
On Windows 11, running codeql database create for a JavaScript project fails during TRAP import finalization with an AccessDeniedException. This occurs when attempting to move the final TRAP string pool into pools\0.

This happens even when:

• Using a short path (e.g. C:\github\glob-ghas)
• Running in an elevated PowerShell session
• Closing VS Code and other editors
• Disabling Windows Defender and indexing
• Running codeql from CLI (not extension)

💻 Environment

• OS: Windows 11 Pro (Build 26100+)
• CodeQL CLI version: 2.21.1
• Installed at: C:\tools\codeql
• Language: JavaScript
• Command: codeql database create my-db --language=javascript --source-root=. --overwrite

📄 Observed Output

Finalizing database at C:\github\glob-ghas\my-db.
Running TRAP import for CodeQL database at C:\github\glob-ghas\my-db...
Importing TRAP files
Merging relations
A fatal error occurred: Failed to move pool from C:\github\glob-ghas\my-db\db-javascript\default\strings\0 to C:\github\glob-ghas\my-db\db-javascript\default\pools\0
(eventual cause: AccessDeniedException ...)

🔄 Steps to Reproduce

1. Create a minimal JS repo under C:\github\glob-ghas
2. Run the CLI command above
3. Observe failure during TRAP finalization

✅ What I've Already Tried

• Using short paths (C:\github)
• Deleting the target DB folder before each run
• Disabling antivirus and indexing services
• Running with --no-autobuild
• Setting TEMP to C:\codeql-temp
• Confirmed no VS Code or Language Server processes active

📌 Expected Behavior
The database should finalize cleanly without permission errors, especially in an elevated shell with a clean local path.

🧩 Additional Help
Happy to provide a zipped repro repo with dummy JavaScript files and a test script upon request.

[hvitved]

Hi

What happens if you do not create the my-db inside the folder containing the source root? E.g., something like

codeql database create ../my-db --language=javascript --source-root=. --overwrite

instead?

[wpreston-msft]

Hi

What happens if you do not create the my-db inside the folder containing the source root? E.g., something like

codeql database create ../my-db --language=javascript --source-root=. --overwrite

instead?

Reviving this thread to help point in the direction of the fault, since this is the first Google result for a permissions error during db creation.

For me, it failed with a permission denied error when pointing to a target directory that exists in the parent directory of the repo being analyzed. e.g.

[myRepos]
    +-- myGitProject
    +-- cqlDb

PS> cd myGitProject

PS> codeql database create ..\cqlDb --language=csharp