[Windows][unelevated sandbox] apply_patch consistently fails with Access Denied while PowerShell writes succeed

What version of the Codex App are you using (From “About Codex” dialog)?

Codex Desktop App: 26.715.4045.0

What subscription do you have?

ChatGPT Plus

What platform is your computer?

• Windows 10 Pro 22H2 - OS build: 19045.2846 - Architecture: x64 - PowerShell: 7.4.17 - Corporate-managed computer - Administrator approval is unavailable due to company policy

What issue are you seeing?

The built-in apply_patch tool consistently fails in the Windows unelevated sandbox with an Access Denied or sandbox access error.

The workspace itself is writable. The same files can be read and modified successfully using PowerShell 7, but apply_patch cannot update them.

The failure is not caused by patch syntax, file encoding, repository state, or the workspace being read-only.

Observed behavior:

• apply_patch fails when updating existing files.
• In some fresh directories, creating a new file may initially work, while subsequent updates fail.
• In currently affected workspaces, even minimal apply_patch operations fail consistently.
• PowerShell can read and update the same target files successfully.
• The failure occurs before normal patch parsing or application.
• Restarting Codex does not resolve the issue.
• Installing PowerShell 7 and switching the shell to UTF-8 does not resolve the issue.

The agent typically goes through this unnecessary fallback sequence:

1. Try the built-in apply_patch tool.
2. Fail with a sandbox access error.
3. Search for a local apply_patch entry point.
4. Try the local helper, which also fails with Access Denied.
5. Request an elevated retry.
6. The elevated retry cannot run because this is a corporate-managed computer.
7. Finally fall back to a PowerShell text replacement, which succeeds.

This adds several failed tool calls to every file-editing task.

What steps can reproduce the bug?

1. Use Codex Desktop on Windows.
2. Configure the sandbox as follows:

```toml
sandbox_mode = "workspace-write"

[windows]
sandbox = "unelevated"
```

1. Open a writable local Git repository containing an existing text file.
2. Ask Codex to modify one line in that file using apply_patch.
3. Observe that apply_patch fails with Access Denied or a Windows sandbox access error.
4. Modify the same file using PowerShell 7.
5. Observe that the PowerShell modification succeeds.

A minimal patch is sufficient:

*** Begin Patch
*** Update File: existing-file.txt
@@
-old value
+new value
*** End Patch

What is the expected behavior?

apply_patch should be able to read and modify files inside the configured writable workspace when the Windows sandbox is set to unelevated.

Its behavior should be consistent with PowerShell commands running in the same sandbox and targeting the same files.

If apply_patch cannot work in this sandbox mode, Codex should:

1. Return the real underlying Windows error.
2. Avoid retrying the same helper multiple times.
3. Avoid requesting elevation when the environment only supports unelevated.
4. Automatically use a safe workspace-scoped fallback.
5. Provide a supported configuration option to disable apply_patch.

What is the expected behavior?

apply_patch should be able to read and modify files inside the configured writable workspace when the Windows sandbox is set to unelevated.

Its behavior should be consistent with PowerShell commands running in the same sandbox and targeting the same files.

If apply_patch cannot work in this sandbox mode, Codex should:

1. Return the real underlying Windows error.
2. Avoid retrying the same helper multiple times.
3. Avoid requesting elevation when the environment only supports unelevated.
4. Automatically use a safe workspace-scoped fallback.
5. Provide a supported configuration option to disable apply_patch.

Additional information

This appears related to existing Windows sandbox and ACL issues:

• #13965 — apply_patch cannot spawn codex.exe from WindowsApps
• #14585 — Windows sandbox creates incorrect ACLs and breaks apply_patch
• #14675 — apply_patch fails for nested files with a sandbox refresh error
• #21117 — apply_patch sandbox retry can request duplicate approval

Issue #13965 was reported against a much older Codex version. The problem remains reproducible in Codex Desktop App 26.715.4045.0.

Issue #14585 appears especially relevant because normal filesystem operations succeed while apply_patch fails.

I can provide additional sanitized diagnostics if maintainers specify the correct log location for the current Codex Desktop App and unelevated sandbox.