›_ Codex Issues
Codex Issues / #31888

Windows: workspace-write sandbox blocks apply_patch with EPERM on %USERPROFILE%

Open 💬 4 comments Opened Jul 9, 2026 by oconnor0
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of Codex CLI is running?

codex-cli 0.144.0

What subscription do you have?

enterprise

Which model were you using?

gpt-5.6-terra

What platform is your computer?

Microsoft Windows NT 10.0.19045.0 x64

What terminal emulator and version are you using (if applicable)?

Windows Terminal, no multiplexter

Codex doctor report

{
  "schemaVersion": 1,
  "generatedAt": "1783627320s since unix epoch",
  "overallStatus": "ok",
  "codexVersion": "0.144.0",
  "checks": {
    "app_server.status": {
      "id": "app_server.status",
      "category": "app-server",
      "status": "ok",
      "summary": "background server is not running",
      "details": {
        "control socket": "C:\\Users\\oconnor0\\.codex\\app-server-control\\app-server-control.sock",
        "daemon state dir": "C:\\Users\\oconnor0\\.codex\\app-server-daemon",
        "mode": "ephemeral",
        "pid file": "C:\\Users\\oconnor0\\.codex\\app-server-daemon\\app-server.pid (missing)",
        "settings": "C:\\Users\\oconnor0\\.codex\\app-server-daemon\\settings.json (missing)",
        "status": "not running",
        "update-loop pid file": "C:\\Users\\oconnor0\\.codex\\app-server-daemon\\app-server-updater.pid (missing)"
      },
      "remediation": null,
      "durationMs": 0
    },
    "auth.credentials": {
      "id": "auth.credentials",
      "category": "auth",
      "status": "ok",
      "summary": "auth is configured",
      "details": {
        "auth file": "C:\\Users\\oconnor0\\.codex\\auth.json",
        "auth storage mode": "File",
        "stored API key": "false",
        "stored ChatGPT tokens": "true",
        "stored agent identity": "false",
        "stored auth mode": "chatgpt"
      },
      "remediation": null,
      "durationMs": 0
    },
    "config.load": {
      "id": "config.load",
      "category": "config",
      "status": "ok",
      "summary": "config loaded",
      "details": {
        "CODEX_HOME": "C:\\Users\\oconnor0\\.codex",
        "config.toml": "C:\\Users\\oconnor0\\.codex\\config.toml",
        "config.toml parse": "ok",
        "cwd": "C:\\src\\project",
        "enabled feature flags": "<redacted>",
        "feature flag overrides": "none",
        "feature flags enabled": "35",
        "log dir": "C:\\Users\\oconnor0\\.codex\\log",
        "mcp servers": "0",
        "model": "gpt-5.6-terra",
        "model provider": "openai",
        "sqlite home": "C:\\Users\\oconnor0\\.codex"
      },
      "remediation": null,
      "durationMs": 0
    },
    "git.environment": {
      "id": "git.environment",
      "category": "git",
      "status": "ok",
      "summary": "git version 2.51.2.windows.1",
      "details": {
        ".git entry": "directory",
        "PATH git #1": "C:\\Users\\oconnor0\\scoop\\shims\\git.exe",
        "PATH git entries": "1",
        "git branch": "master",
        "git build options": "git version 2.51.2.windows.1; cpu: x86_64; built from commit: bd2ecbae58213046a468256b95fc4864de25bdf5; sizeof-long: 4; sizeof-size_t: 8; shell-path: D:/git-sdk-64-build-installers/usr/bin/sh; feature: fsmonitor--daemon; libcurl: 8.16.0; OpenSSL: OpenSSL 3.5.4 30 Sep 2025; zlib: 1.3.1; SHA-1: SHA1_DC; SHA-256: SHA256_BLK; default-ref-format: files; default-hash: sha1",
        "git exec path": "C:/Users/oconnor0/scoop/apps/git/2.51.2/mingw64/libexec/git-core",
        "git version": "git version 2.51.2.windows.1",
        "repo detected": "true",
        "repo root": "C:\\src\\project",
        "selected git": "C:\\Users\\oconnor0\\scoop\\shims\\git.exe"
      },
      "remediation": null,
      "durationMs": 134
    },
    "installation": {
      "id": "installation",
      "category": "install",
      "status": "ok",
      "summary": "installation looks consistent",
      "details": {
        "PATH codex #1": "C:\\Users\\oconnor0\\scoop\\apps\\nvm\\current\\nodejs\\nodejs\\codex",
        "PATH codex #2": "C:\\Users\\oconnor0\\scoop\\apps\\nvm\\current\\nodejs\\nodejs\\codex.cmd",
        "PATH codex entries": "2",
        "current executable": "C:\\Users\\oconnor0\\scoop\\persist\\nvm\\nodejs\\v23.3.0\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\bin\\codex.exe",
        "install context": "npm (package C:\\Users\\oconnor0\\scoop\\persist\\nvm\\nodejs\\v23.3.0\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc, bin C:\\Users\\oconnor0\\scoop\\persist\\nvm\\nodejs\\v23.3.0\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\bin, resources C:\\Users\\oconnor0\\scoop\\persist\\nvm\\nodejs\\v23.3.0\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex-resources, path C:\\Users\\oconnor0\\scoop\\persist\\nvm\\nodejs\\v23.3.0\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex-path)",
        "managed by bun": "false",
        "managed by npm": "true",
        "managed by pnpm": "false",
        "managed package root": "C:\\Users\\oconnor0\\scoop\\persist\\nvm\\nodejs\\v23.3.0\\node_modules\\@openai\\codex",
        "npm update target": "C:\\Users\\oconnor0\\scoop\\apps\\nvm\\current\\nodejs\\nodejs\\node_modules\\@openai\\codex"
      },
      "remediation": null,
      "durationMs": 268
    },
    "mcp.config": {
      "id": "mcp.config",
      "category": "mcp",
      "status": "ok",
      "summary": "no MCP servers configured",
      "details": {},
      "remediation": null,
      "durationMs": 0
    },
    "network.env": {
      "id": "network.env",
      "category": "network",
      "status": "ok",
      "summary": "network-related environment looks readable",
      "details": {
        "proxy env vars": "none"
      },
      "remediation": null,
      "durationMs": 0
    },
    "network.provider_reachability": {
      "id": "network.provider_reachability",
      "category": "reachability",
      "status": "ok",
      "summary": "active provider endpoints are reachable over HTTP",
      "details": {
        "ChatGPT base URL": "https://chatgpt.com/backend-api/ reachable (HTTP 403)",
        "reachability mode": "ChatGPT auth"
      },
      "remediation": null,
      "durationMs": 121
    },
    "network.websocket_reachability": {
      "id": "network.websocket_reachability",
      "category": "websocket",
      "status": "ok",
      "summary": "Responses WebSocket handshake succeeded",
      "details": {
        "DNS": "2 IPv4, 0 IPv6, first IPv4",
        "auth mode": "chatgpt",
        "connect timeout": "15000 ms",
        "endpoint": "wss://chatgpt.com/backend-api/<redacted>",
        "handshake result": "HTTP 101 Switching Protocols",
        "model provider": "openai",
        "models etag present": "true",
        "provider name": "OpenAI",
        "proxy env vars": "none",
        "reasoning header": "false",
        "server model present": "false",
        "supports websockets": "true",
        "wire API": "responses"
      },
      "remediation": null,
      "durationMs": 689
    },
    "runtime.provenance": {
      "id": "runtime.provenance",
      "category": "runtime",
      "status": "ok",
      "summary": "running npm on windows-x86_64",
      "details": {
        "commit": "unknown",
        "current executable": "C:\\Users\\oconnor0\\scoop\\persist\\nvm\\nodejs\\v23.3.0\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\bin\\codex.exe",
        "install method": "npm (package C:\\Users\\oconnor0\\scoop\\persist\\nvm\\nodejs\\v23.3.0\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc, bin C:\\Users\\oconnor0\\scoop\\persist\\nvm\\nodejs\\v23.3.0\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\bin, resources C:\\Users\\oconnor0\\scoop\\persist\\nvm\\nodejs\\v23.3.0\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex-resources, path C:\\Users\\oconnor0\\scoop\\persist\\nvm\\nodejs\\v23.3.0\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex-path)",
        "platform": "windows-x86_64",
        "version": "0.144.0"
      },
      "remediation": null,
      "durationMs": 0
    },
    "runtime.search": {
      "id": "runtime.search",
      "category": "search",
      "status": "ok",
      "summary": "search is OK (bundled)",
      "details": {
        "search command": "C:\\Users\\oconnor0\\scoop\\persist\\nvm\\nodejs\\v23.3.0\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex-path\\rg.exe",
        "search command readiness": "file exists",
        "search provider": "bundled"
      },
      "remediation": null,
      "durationMs": 0
    },
    "sandbox.helpers": {
      "id": "sandbox.helpers",
      "category": "sandbox",
      "status": "ok",
      "summary": "sandbox configuration is readable",
      "details": {
        "approval policy": "OnRequest",
        "codex-linux-sandbox helper": "none",
        "execve wrapper helper": "none",
        "filesystem sandbox": "restricted",
        "network sandbox": "restricted"
      },
      "remediation": null,
      "durationMs": 0
    },
    "state.paths": {
      "id": "state.paths",
      "category": "state",
      "status": "ok",
      "summary": "state paths and databases are inspectable",
      "details": {
        "CODEX_HOME": "C:\\Users\\oconnor0\\.codex (dir)",
        "active rollout files": "582 files, 240700236 total bytes, 413574 average bytes",
        "archived rollout files": "0 files, 0 total bytes, 0 average bytes",
        "goals DB": "C:\\Users\\oconnor0\\.codex\\goals_1.sqlite (file)",
        "goals DB integrity": "ok",
        "log DB": "C:\\Users\\oconnor0\\.codex\\logs_2.sqlite (file)",
        "log DB integrity": "ok",
        "log dir": "C:\\Users\\oconnor0\\.codex\\log (dir)",
        "memories DB": "C:\\Users\\oconnor0\\.codex\\memories_1.sqlite (file)",
        "memories DB integrity": "ok",
        "sqlite home": "C:\\Users\\oconnor0\\.codex (dir)",
        "state DB": "C:\\Users\\oconnor0\\.codex\\state_5.sqlite (file)",
        "state DB integrity": "ok"
      },
      "remediation": null,
      "durationMs": 3072
    },
    "state.rollout_db_parity": {
      "id": "state.rollout_db_parity",
      "category": "threads",
      "status": "ok",
      "summary": "rollout files and state DB thread inventory agree",
      "details": {
        "default model provider": "openai",
        "rollout DB active files": "582",
        "rollout DB active rows": "582",
        "rollout DB archive mismatches": "0",
        "rollout DB archived files": "0",
        "rollout DB archived rows": "0",
        "rollout DB duplicate DB paths": "0",
        "rollout DB duplicate rollout thread ids": "0",
        "rollout DB malformed file names": "0",
        "rollout DB missing active rows": "0",
        "rollout DB missing archived rows": "0",
        "rollout DB model providers": "openai=582",
        "rollout DB rows": "582",
        "rollout DB scan cap reached": "false",
        "rollout DB scan errors": "0",
        "rollout DB sources": "subagent:thread_spawn=342, cli=205, subagent:review=35",
        "rollout DB stale rows": "0"
      },
      "remediation": null,
      "durationMs": 2627
    },
    "system.environment": {
      "id": "system.environment",
      "category": "system",
      "status": "ok",
      "summary": "OS language en-US",
      "details": {
        "EDITOR": "not set",
        "VISUAL": "not set",
        "os": "Windows 10.0.19045 (Windows 10 Enterprise) [64-bit]",
        "os language": "en-US",
        "os type": "Windows",
        "os version": "10.0.19045"
      },
      "remediation": null,
      "durationMs": 0
    },
    "terminal.env": {
      "id": "terminal.env",
      "category": "terminal",
      "status": "ok",
      "summary": "terminal metadata was detected",
      "details": {
        "WT_SESSION": "present",
        "color output": "enabled",
        "console input code page": "437",
        "console output code page": "437",
        "stderr console mode": "0x00000007 (VT processing: true)",
        "stderr is terminal": "true",
        "stdin is terminal": "true",
        "stdout console mode": "0x00000007 (VT processing: true)",
        "stdout is terminal": "true",
        "terminal": "Windows Terminal",
        "terminal size": "109x62"
      },
      "remediation": null,
      "durationMs": 0
    },
    "terminal.title": {
      "id": "terminal.title",
      "category": "title",
      "status": "ok",
      "summary": "terminal title default",
      "details": {
        "terminal title activity": "true",
        "terminal title items": "activity, project-name",
        "terminal title project source": "git repo root",
        "terminal title project value": "project",
        "terminal title source": "default"
      },
      "remediation": null,
      "durationMs": 0
    },
    "updates.status": {
      "id": "updates.status",
      "category": "updates",
      "status": "ok",
      "summary": "update configuration is locally consistent",
      "details": {
        "cached latest version": "0.143.0",
        "check for update on startup": "true",
        "last checked at": "2026-07-09T14:48:52.218015900Z",
        "latest version": "0.144.0",
        "latest version status": "current version is not older",
        "npm update target": "C:\\Users\\oconnor0\\scoop\\apps\\nvm\\current\\nodejs\\nodejs\\node_modules\\@openai\\codex",
        "update action": "npm install -g @openai/codex",
        "version cache": "C:\\Users\\oconnor0\\.codex\\version.json"
      },
      "remediation": null,
      "durationMs": 609
    }
  }
}

What issue are you seeing?

--sandbox workspace-write prevents apply_patch from editing an in-workspace file; --sandbox danger-full-access succeeds.

Corroborating failures

The following commands were run as sandboxed child processes.

codex --version

Output:

node:fs:2706
Error: EPERM: operation not permitted, lstat 'C:\Users\<USER>'
    at Object.realpathSync (...)
    ...
syscall: 'lstat'
path: 'C:\Users\<USER>'
node C:\Users\<USER>\.codex\skills\.system\openai-docs\scripts\fetch-codex-manual.mjs

Output:

Error: EPERM: operation not permitted, lstat 'C:\Users\<USER>'
git status --short

Output:

warning: unable to access 'C:\Users\<USER>\.config\git\ignore': Permission denied

The Windows sandbox appears to fail during setup because a required runtime path resolves through
%USERPROFILE%.

This blocks apply_patch even for a file entirely within the workspace.

What steps can reproduce the bug?

  1. Create a git worktree and from it: code --sandbox workspace-write
  2. Ask Codex to make a small edit to an existing file.
  3. Codex invokes its native apply_patch helper.
  4. The helper fails before the patch is evaluated:

``
apply_patch verification failed: Failed to read file to update
C:\src\xledger-c\docs\Files\specs\open\008-fileserver4-validation-harness-and-smoke.md:
fs sandbox helper failed with status exit code: 1:
windows sandbox failed: helper_unknown_error: setup refresh had errors
``

  1. Retrying with a relative workspace path fails identically.

What is the expected behavior?

That running codex --sandbox workspace-write can edit files in the directory.

The sandbox should not require broad access to %USERPROFILE% merely to initialize its patch helper or run
Codex/Node child processes.

Additional information

_No response_

View original on GitHub ↗

4 Comments

github-actions[bot] contributor · 1 month ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #31776

Powered by Codex Action

Stevenwo · 1 month ago

Corroborating on a newer CLI build — codex-cli 0.144.6, Windows 11 Home 10.0.26200, codex login status → ChatGPT subscription auth (not API key).

Reproduced with codex exec --sandbox workspace-write -C <repo> asking Codex to create a small file via apply_patch. Error surfaced was more terse than the EPERM/lstat trace above — no %USERPROFILE% mention, just:

apply patch
patch: failed
<path>\<file>.txt
ERROR codex_core::tools::router: error=Exit code: 1
Output:
Failed to write file <path>\<file>.txt

Two additional data points that might help narrow this down:

  1. Confirmed on both [windows] sandbox variants — elevated and unelevated in ~/.codex/config.toml fail identically (same error, same exit code). So this doesn't look specific to the unelevated restricted-token path.
  2. Workaround confirmed: same sandbox, same session — if Codex is told "apply_patch is broken here, write files via PowerShell Set-Content/Out-File instead," the shell-based write succeeds every time. So the sandbox's shell-exec path has working write access even when the apply_patch tool's own write broker doesn't — consistent with the "PowerShell succeeds, apply_patch fails" pattern reported elsewhere in this bug class (e.g. #34294, #30712), suggesting one shared root cause across the CLI and Desktop App.

Happy to run codex doctor or any other diagnostic if useful.

yenoh2 · 26 days ago

Adding trace-level diagnostics that I believe pinpoint where this fails, plus confirmation it is still broken on 0.146.0 (current stable, updated yesterday).

Environment: Windows 11 Home 10.0.26200 x64, ChatGPT-subscription auth, standalone installer, [windows] sandbox = "unelevated". Reproduced identically on codex-cli 0.145.0 and codex-cli 0.146.0, via codex exec -s workspace-write -c approval_policy=never asking for a one-line file via apply_patch.

Symptom matches this thread exactly (same terse form as the earlier corroborating comment):

apply patch
patch: failed
<path>\<file>.txt
ERROR codex_core::tools::router: error=Exit code: 1
Output:
Failed to write file <path>\<file>.txt

...and codex exec still exits 0 and the model reports success, so failed edits are silent unless you check the working tree.

Trace evidence (RUST_LOG=trace codex exec ..., same failing run):

codex_core::session::world_state: building step world state selected_capability_root_count=0
...
writable_roots: []
...
event.name="codex.sandbox_outcome" tool_name=apply_patch call_id=... outcome=denied

The tool decision is approved, then ~60ms later the sandbox layer itself returns outcome=denied. The apply_patch path is being constructed with an empty writable-roots list — the world-state/capability-selection step selects zero capability roots for the turn — so every write is denied before the filesystem is ever consulted. Meanwhile the exec banner for the same session correctly shows sandbox: workspace-write [workdir, /tmp, $TMPDIR], and model-driven shell writes succeed in the same directory in the same session (consistent with the PowerShell-fallback observations above and in #30712 / #34294).

Negative results that rule out the filesystem (each tested directly, no effect):

  • Granting the per-workspace sandbox capability SID (from .codex/cap_sid workspace_by_cwd) Full Control on C:\tmp and on the workspace root
  • Redirecting TMPDIR to a user-owned directory
  • Reproducing in a workspace owned by the running user (rules out cross-profile ACL issues)
  • Replacing a stale codex-command-runner.exe fallback in .codex/.sandbox-bin with the current build
  • -c features.code_mode_host=false (dispatch and outcome unchanged)

The instant (~60ms) failure with no entry in .codex/.sandbox/sandbox.<date>.log — while shell commands from the same session do log there — also suggests the denial happens in the tool's own policy layer, not in the spawned sandbox helper.

Workaround that removes the failure mode entirely: -c include_apply_patch_tool=false. With the tool absent, the model edits via the (working) shell path — verified end-to-end. This is sturdier than prompting "apply_patch is broken, use PowerShell," since nothing depends on the model remembering the instruction mid-session.

Timing note in case it helps triage: on this machine apply_patch was verified working on 0.145.0 on Jul 22 and was broken by Jul 26 with no CLI version change — the Codex Desktop app (which shares CODEX_HOME) updated in that window, which fits the #30712 observation that the desktop app's writable-roots injection is involved.

Happy to attach the full RUST_LOG=trace stderr (10.8k lines) or run further diagnostics.

flocrossbridge · 22 days ago

I can reproduce the same failure in the Windows Codex desktop app.

In a local Markdown workspace, apply_patch failed twice before evaluating the patch with:

windows sandbox failed: helper_unknown_error: setup refresh had errors

The failure prevented an edit entirely. Read operations run with the approved elevated path succeeded, which suggests the workspace and files themselves were accessible and the failure was in sandbox setup.

This was observed on 2026-08-05. I have not attached logs because they may contain unrelated local paths or session data.