Codex Desktop Windows apply_patch fails with CryptUnprotectData after creating file

Start by reproducing the Windows sandbox helper failure with apply_patch using the minimal create, read, and remove task in a local workspace. Trace the handling around CryptUnprotectData and verify the fix by confirming that the helper can read, edit, and delete a file it created.

What version of the Codex App are you using (From “About Codex” dialog)?

Powered by Codex & OWL Version 26.727.51351

What subscription do you have?

Pro

What platform is your computer?

No response

What issue are you seeing?

Environment:

• Official OpenAI Codex Desktop
• Windows
• Workspace: C:\Projects\Project Genesis
• Git repository is healthy
• npm install and npm run build succeed
• Direct terminal file writes succeed
• Workspace is local and no longer inside OneDrive

Summary:
The Codex apply_patch sandbox can create a file, but subsequent read or delete
operations fail with a Windows DPAPI error.

Reproduction:

1. Open a local Git repository in Codex Desktop.
2. Start a new task.
3. Create codex-patch-test.tmp using apply_patch.
4. Confirm the creation patch reports success.
5. Attempt to remove the same file using apply_patch.

Actual result:
The removal fails because the sandbox cannot read the file:

apply_patch verification failed:
Failed to read C:\Projects\Project Genesis\codex-patch-test.tmp:
fs sandbox helper failed with status exit code: 1:
windows sandbox failed:
CryptUnprotectData failed: 2148073483

Expected result:
The patch sandbox should be able to read and remove a file that it just
created.

Additional observations:

• Direct terminal writes in the same workspace succeed.
• git status and production build work outside the broken sandbox.
• The issue persisted after moving the repository from OneDrive to a normal
  local path.
• The issue persisted across new Codex tasks.
• No source-code changes could be completed because project editing requires
  apply_patch.
• A temporary codex-patch-test.tmp file may remain after reproduction.

Impact:
Codex Desktop cannot modify the repository, so development work is blocked.

What steps can reproduce the bug?

Environment:

• Official OpenAI Codex Desktop app
• Windows 10/11
• Local Git workspace: C:\Projects\Project Genesis
• Repository is not inside OneDrive
• Git, npm, Prisma, and terminal file operations work normally

Steps to reproduce:

1. Open the official Codex Desktop app on Windows.
2. Create or open a Codex project using this local workspace:
   C:\Projects\Project Genesis
3. Start a new Codex task.
4. Ask Codex to verify patch access by creating a temporary file with apply_patch:
   codex-patch-test.tmp
5. The creation patch reports success and the UI shows:
   “Edited codex-patch-test.tmp +1 -0”
6. Ask Codex to remove the same file using apply_patch.
7. The removal fails because the sandbox helper cannot read the file it just created.

Actual error:

apply_patch verification failed: Failed to read
C:\Projects\Project Genesis\codex-patch-test.tmp:
fs sandbox helper failed with status exit code: 1:
windows sandbox failed:
CryptUnprotectData failed: 2148073483

Expected behavior:

Codex should be able to read, edit, and delete a file that it created with
apply_patch in the active writable workspace.

Actual behavior:

The first creation patch can report success, but subsequent patch operations
that need to read the created file fail with CryptUnprotectData. This blocks
all source-code editing because Codex requires apply_patch for modifications.

Minimal reproduction task:

“Use apply_patch to create a file named codex-patch-test.tmp containing the
text test. Then use apply_patch to remove the same file.”

Relevant observations:

• The active workspace root is correctly reported as:
  C:\Projects\Project Genesis
• git rev-parse --show-toplevel returns the correct local path.
• git status --short and git diff --check are clean before reproduction.
• Direct terminal creation and deletion of files in the same directory work.
• npm install, prisma generate, and npm run build succeed.
• The repository was previously copied from OneDrive to a normal local path,
  but the error persists in newly created Codex projects and tasks.
• Restarting Codex Desktop and creating new tasks did not resolve the issue.
• No application source-code changes are required to reproduce it.
• A temporary codex-patch-test.tmp file may remain after the failed removal.

Code snippet / reproduction instructions:

Workspace:
C:\Projects\Project Genesis

Task prompt:
1. Create codex-patch-test.tmp with apply_patch.
2. Read the file using the normal Codex sandbox.
3. Remove codex-patch-test.tmp with apply_patch.
4. Report any sandbox error.

### What is the expected behavior?

_No response_

### Additional information

_No response_