Windows: apply_patch stalls for 49-86 seconds while WindowsApps launcher returns Access is denied

What version of the Codex App are you using (From “About Codex” dialog)?

26.715.8383.0

What subscription do you have?

Pro

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

This appears to be a persistence/regression of #13965 in Codex App 26.715.8383.0.

A one-line apply_patch operation eventually succeeds, but only after approximately 49 to 86 seconds. The Codex App-generated wrapper invokes:

@echo off
"C:\Program Files\WindowsApps\OpenAI.Codex_26.715.8383.0_x64__2p2nqsd0c76g0\app\resources\codex.exe" --codex-run-as-apply-patch %*

Invoking that generated wrapper directly returns:

Access is denied.
ExitCode: 1

Running the same --codex-run-as-apply-patch operation with the Codex executable under %LOCALAPPDATA%\OpenAI\Codex\bin succeeds in approximately 23.7 ms to 705 ms.

Observed one-line patch timings:

| State | Add file | Update file |
|---|---:|---:|
| Initial measurements | 81.734 s | 64.391-86.521 s |
| After restarting Codex App | 53.049 s | 64.298 s |
| After Windows Settings Repair | 48.707 s | 64.837 s |
| After uninstall/reinstall | 52.883 s | 65.711 s |
| After rebooting Windows | 49.173 s | 77.760 s |

Invalid/empty patches are rejected in about 0.4 seconds, so the delay is specific to the path that applies a real file change.

What steps can reproduce the bug?

1. Start Codex App 26.715.8383.0 on Windows.
2. Open any writable workspace.
3. Ask Codex to apply this minimal patch:

*** Begin Patch
*** Add File: apply-patch-probe.txt
+probe
*** End Patch

1. Measure the time until the tool completes. In this environment it takes about 49-53 seconds.
2. Apply this update:

*** Begin Patch
*** Update File: apply-patch-probe.txt
@@
-probe
+probe-2
*** End Patch

1. The update takes about 64-78 seconds.
2. In a Codex task PowerShell environment, inspect the generated wrapper:

$wrapper = (Get-Command apply_patch -All -ErrorAction Stop | Select-Object -First 1).Path
Get-Content -LiteralPath $wrapper

1. Invoke the wrapper with a minimal patch. It returns Access is denied. and exit code 1.
2. Invoke the same patch engine through a Codex executable under %LOCALAPPDATA%\OpenAI\Codex\bin. It succeeds in under one second.

What is the expected behavior?

A valid one-line patch should complete within a few seconds. The generated wrapper should be able to launch the packaged WindowsApps codex.exe --codex-run-as-apply-patch process without an access-denied error.

If the packaged executable cannot be launched, the actual Windows error should be surfaced immediately instead of retrying or stalling for approximately one minute before a fallback succeeds.

Additional information

The workspace storage was separately verified healthy:

• ReFS volume status: Healthy / Online / OK
• Approximately 254 GB free
• Direct 1 MB write median: 0.462 ms
• Direct 1 MB read median: 0.357 ms
• Direct delete median: 0.200 ms
• No storage errors specific to the workspace volume

The delay occurs before the file write. In one measurement the file timestamp changed about 66.267 seconds after tool start, and the tool returned about 424 ms after the write.

Troubleshooting already completed without improvement:

• Fully restarted Codex App
• Windows Settings Repair
• Uninstalled and reinstalled Codex App
• Rebooted Windows

No WindowsApps ownership or ACL changes were made.

Related:

• #13965 - same WindowsApps / CreateProcess access-denied root cause, currently closed
• #15371 - related open Windows apply_patch interception issue

This report contains no private source code, customer data, credentials, or private workspace paths.