›_ Codex Issues
Codex Issues / #32121

Windows Codex app: `apply_patch` can add files but fails to update/delete with `apply deny-read ACLs`

Open 💬 2 comments Opened Jul 10, 2026 by csobrino00
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of the Codex App are you using (From “About Codex” dialog)?

OS: Windows Codex Desktop App package: OpenAI.Codex_26.707.3748.0_x64__2p2nqsd0c76g0

What subscription do you have?

Pro

What platform is your computer?

Windows

What issue are you seeing?

In the Windows Codex desktop app, apply_patch can successfully create new files, but it fails when trying to update or delete existing files inside writable workspace roots.

This happens even though the same files are readable and writable through PowerShell.

What steps can reproduce the bug?

Feedback ID: 019cfc4f-fccb-7550-8596-481e273ab17c

What is the expected behavior?

_No response_

Additional information

_No response_

View original on GitHub ↗

2 Comments

github-actions[bot] contributor · 1 month ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #31229

Powered by Codex Action

Lakshay-24 · 1 month ago

I can reproduce this exact failure on a native Windows host with an NTFS checkout.

Error

apply_patch verification failed:
Failed to read file to update
C:\Users\laksh\Reels Maker Stack\OpenMontage\apps\creator-studio-web\lib\jobExecution.ts:
fs sandbox helper failed with status exit code: 1:
windows sandbox failed:
helper_unknown_error: apply deny-read ACLs

Diagnostics

  • Workspace is under C:\Users\laksh\Reels Maker Stack on NTFS.
  • Normal sandboxed PowerShell reads succeed.
  • git status and git rev-parse succeed.
  • Unsandboxed/elevated reads succeed.
  • apply_patch can sometimes create a new file.
  • apply_patch cannot read, update, or replace an existing tracked file.
  • Both absolute and workspace-relative patch paths fail.
  • icacls /reset and re-enabling inherited permissions did not fix it.
  • Restarting Codex and rebooting Windows did not fix it.
  • The failure occurs during patch verification, before the patch is applied.
  • No repository file is modified when the operation fails.

This strongly suggests a failure in the Codex Windows sandbox ACL helper while applying the deny-read ACL profile, rather than a Git problem or ordinary repository permissions issue.