apply_patch fails on Windows because Codex cannot spawn codex.exe from WindowsApps (CreateProcessAsUserW failed: 5)

What version of the Codex App are you using (From “About Codex” dialog)?

0.108.0-alpha.12

What subscription do you have?

plus

What platform is your computer?

Microsoft Windows NT 10.0.26100.0 x64

What issue are you seeing?

Environment:

• OS: Windows
• Codex package path:

C:\Program Files\WindowsApps\OpenAI.Codex_26.305.950.0_x64__2p2nqsd0c76g0\app\resources

• codex.exe file version: 0.108.0-alpha.12
• Workspace used for reproduction:

E:\Codex-test

Summary:
The apply_patch tool fails for both Add File and Update File operations. The failure is not caused by patch syntax, target file state, or lack of write access to the workspace. The direct cause is that the Codex runner cannot spawn codex.exe in apply-patch mode. The sandbox log shows:

• ACL setup failure on the WindowsApps resources path
• CreateProcessAsUserW failed: 5
• final apply_patch result surfaces only as exit code 1

Observed behavior:
Any apply_patch call fails with exit code 1 and no useful diagnostic output.

Expected behavior:
apply_patch should successfully apply a valid patch, or at minimum return the actual underlying error.

What was verified:

• The workspace is writable with normal shell writes.
• Creating files with PowerShell succeeds.
• apply_patch fails on both Add File and Update File.
• The same pattern also occurred in another workspace, so this is not specific to one repository.

Direct evidence:

1. apply_patch wrapper:

C:\Users\Admin\.codex\tmp\arg0\codex-arg092Awvx\apply_patch.bat
Contents:
@echo off
"C:\Program Files\WindowsApps\OpenAI.Codex_26.305.950.0_x64__2p2nqsd0c76g0\app\resources\codex.exe" --codex-run-as-apply-patch %*

1. Sandbox log shows ACL failure on WindowsApps resources:

C:\Users\Admin\.codex\.sandbox\sandbox.log
Relevant entries:

• granting read ACE to E:\WindowsApps\OpenAI.Codex_26.305.950.0_x64__2p2nqsd0c76g0\app\resources for sandbox users
• grant read ACE failed ... SetNamedSecurityInfoW failed: 5
• setup error: read ACL run had errors
• runner: spawn failed: CreateProcessAsUserW failed: 5

1. Sandbox setup error file:

C:\Users\Admin\.codex\.sandbox\setup_error.json
Content:
{
"code": "helper_unknown_error",
"message": "read ACL run had errors"
}

1. Direct execution evidence:

• Running codex.exe from WindowsApps returns Access is denied.
• Running codex-command-runner.exe from WindowsApps returns Access is denied.
• Running the copied sandbox helper from:

C:\Users\Admin\.codex\.sandbox-bin\codex-command-runner.exe
does execute, proving the copied helper is runnable while the WindowsApps executable path is not.

Key conclusion:
apply_patch fails because its execution path depends on launching codex.exe from the WindowsApps install location, and that launch fails with Windows error 5. This prevents apply_patch from reaching patch parsing/application at all.

Request:
Please investigate the Windows apply_patch launch path and packaging/ACL handling for executables under:
C:\Program Files\WindowsApps\OpenAI.Codex_26.305.950.0_x64__2p2nqsd0c76g0\app\resources

In particular:

• why codex.exe in WindowsApps cannot be launched for apply_patch mode
• why sandbox setup fails to grant the required read ACLs
• why apply_patch does not surface the real underlying error instead of only exit code 1

What steps can reproduce the bug?

1. Open a writable workspace, for example:

E:\Codex-test

1. Run a minimal apply_patch:

* Begin Patch
* Add File: test.md
+Hello, World!
*** End Patch

1. Observe apply_patch failure with exit code 1.
2. Repeat with an existing file update:

* Begin Patch
* Update File: write_probe.txt
@@
-probe
+patched
*** End Patch

1. Observe the same failure.

What is the expected behavior?

apply_patch should successfully apply a valid patch, or at minimum return the actual underlying error.

Additional information

Related issues (possibly related, but not duplicates):

• #13887 "apply_patch fails everytime" - similar surface symptom in the Codex App on Windows: apply_patch returns exit code 1 with little or no diagnostic output, while direct shell-based writes still work.
• #13542 "Windows: bundled rg in Codex Desktop resolves on PATH but fails with Access Denied in integrated PowerShell" - likely related WindowsApps packaging / executable launch restrictions in the desktop app resources path.
• #10090 "elevated_windows_sandbox causing all agent commands to fail with (no output) (logs show CreateProcessAsUserW failed: 5)" - similar low-level sandbox/process creation failure signature.
• #10601 "Sandbox setup error on Windows" - likely related to Windows sandbox setup / ACL handling failures.
• #13721 "Codex App on Windows/WSL: targeted patch workflow is inconsistent, and review pane can show unstaged diffs while Git stays clean" - related App-on-Windows patch instability, but this report isolates a more specific launch-path failure for apply_patch.

I do not believe this is a duplicate of the issues above.

This report appears narrower and more specific:
apply_patch.bat resolves to codex.exe --codex-run-as-apply-patch inside the WindowsApps install location, sandbox setup fails while granting read ACLs on that resources path, and the runner then fails with CreateProcessAsUserW failed: 5. As a result, apply_patch never reaches actual patch parsing/application and only surfaces exit code 1.

sandbox.log

setup_error.json