Apply_Patch is not working at all on windows system

Resolved 💬 4 comments Opened Jan 22, 2026 by umairshahid-1 Closed Mar 3, 2026

💡 Likely answer: A maintainer (etraut-openai, contributor) responded on this thread — see the highlighted reply below.

What version of Codex is running?

codex-cli 0.88.0

What subscription do you have?

Plus

Which model were you using?

gpt-5.2-codex

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What terminal emulator and version are you using (if applicable)?

PowerShell 7

What issue are you seeing?

Issue: apply_patch Failed with Windows Sandbox Error

Error Message

execution error: Io(Custom { kind: Other, error: "windows sandbox: CryptUnprotectData failed: 2148073483" })

What Happened
Attempted to add comment // Hyy G! to persistence/src/main/java/com/topedge/persistence/model/BusinessEntity.kt

Patch attempted:

  5  
  6 -@Entity(tableName = "business_profiles")
  6 +// Hyy G!
  7 +@Entity(tableName = "business_profiles")
  8  data class BusinessEntity(

Result: Failed twice (including retry with escalated permissions)

apply_patch fails due to Windows sandbox CryptUnprotectData error. Cannot escalate privileges to bypass.

What steps can reproduce the bug?

Please enable the Windows Sandbox experimental feature and elevate permissions. Then, try to edit files; it will attempt to use apply_patch but will fail.

Keep in mind that I am working on a company PC, which has both administrator and user accounts. I encounter this issue while logged in as a user.

What is the expected behavior?

It should edit files or read through using apply_patch. It fails and then continues working with commands that take extra time. Additionally, it has worsened the Codex CLI experience as well.

Additional information

My Config.toml files:

[features]
web_search_request = true
check_for_update_on_startup = true
unified_exec = true
shell_snapshot = true
powershell_utf8 = true
collab = true
steer = true
experimental_windows_sandbox = true
elevated_windows_sandbox = true

View original on GitHub ↗

4 Comments

etraut-openai contributor · 7 months ago

Thanks for the bug report. Assuming that you're able to repro this on demand, please use the /feedback slash command to upload logs and session details, then post the thread ID here.

umairshahid-1 · 7 months ago

Here is the thread ID: 019be434-e140-7502-aec2-d34b4b65ed81

Ashutosh0x contributor · 6 months ago

Hi @umairshahid-1! That CryptUnprotectData error (2148073483 / 0x8009000B) usually indicates a DPAPI "Key Not Valid" state. This often happens if the encryption keys used to store the sandbox login secrets become stale after a major Windows update or a hardware/OS change.

I'm working on a patch in #10648 to add a more robust fallback mechanism so Codex doesn't fail the entire tool call when DPAPI is wonky.

Quick Workaround:
As a temporary fix, you can try deleting the %USERPROFILE%\.codex\.sandbox-secrets directory. This will force Codex to re-run the elevated setup and regenerate fresh encryption keys, which usually clears this specific error.

Ashutosh0x contributor · 6 months ago

Hey @umairshahid-1, I've got a fix for this in PR #10648. I added a fallback that catches those DPAPI errors and automatically triggers a sandbox re-setup to refresh the keys. It should handle the recovery for you without having to manually regenerate anything. Just waiting on the merge now!