Windows Remote: apply_patch fs sandbox helper exits with 0xc0000142 on update/delete

What version of the Codex App are you using (From “About Codex” dialog)?

版本 26.818.41509

What subscription do you have?

Plus

What platform is your computer?

Windows

What issue are you seeing?

Local Codex App platform: Windows
Remote host: Windows Server 2022 Datacenter x64, connected through Remote SSH
Remote Codex CLI: 0.148.0

In a Codex App Remote SSH workspace on Windows Server 2022, controlled apply_patch operations fail when reading an existing file.

Creating a new file with apply_patch succeeds, but updating or deleting that same file fails with:

apply_patch verification failed: Failed to read file to update :
fs sandbox helper failed with status exit code: 0xc0000142

The issue reproduces with different files and also reproduces when sandbox_mode is temporarily set to "danger-full-access".

Environment:

• Local Codex App: latest available version on Windows
• Remote host: Windows Server 2022 Datacenter x64, build 20348.4893
• Connection: Remote SSH
• Remote Codex CLI: 0.148.0
• Microsoft Visual C++ 2015–2022 x64: 14.44.35211.0

Diagnostics already completed:

• Rebooted the remote host and reconnected
• Reinstalled the remote Codex CLI
• Updated the VC++ runtime
• codex-code-mode-host.exe starts successfully
• codex sandbox cmd.exe /d /c ver succeeds
• codex doctor reports the installation and ordinary sandbox as healthy
• No matching Defender, AppLocker, or Code Integrity block events
• The failure still occurs with danger-full-access

Expected behavior:
apply_patch should be able to read, update, and delete files inside the remote workspace.

Actual behavior:
The fs sandbox helper fails to initialize with Windows status 0xc0000142, preventing all apply_patch updates and deletions.

What steps can reproduce the bug?

1. On a Windows computer, open the latest Codex App.

2. Connect through Remote SSH to a Windows Server 2022 Datacenter x64 host.

3. Open an existing remote workspace, for example:
   C:\CodexWorkspace\ai-execution-card

4. Start a new Codex task using the default controlled workspace-write sandbox.

5. Use apply_patch to create a temporary file:
   C:\CodexWorkspace\ai-execution-card.codex-sandbox-probe.txt

   Initial content:
   created-by-sandbox-probe

6. Confirm that creating the file succeeds.

7. Use apply_patch to change the existing content from:
   created-by-sandbox-probe

   to:
   updated-by-sandbox-probe

8. Observe that the update fails with:
   apply_patch verification failed: Failed to read file to update ...:
   fs sandbox helper failed with status exit code: 0xc0000142

9. Attempt to delete the same file with apply_patch.

10. Observe that deletion fails with the same fs sandbox helper error.

11. Optional: set sandbox_mode = "danger-full-access" in the project
    .codex/config.toml, fully restart the task, and repeat the test.

12. Observe that the same 0xc0000142 error still occurs. Restore the original
    sandbox configuration after testing.

What is the expected behavior?

No response

Additional information

No response

Start by reproducing the failure on the documented Windows Server 2022 Remote SSH setup, using the apply_patch create-then-update sequence and codex sandbox cmd.exe /d /c ver for comparison. Check the fs sandbox helper path involved in controlled workspace writes and confirm that updates and deletions work without the 0xc0000142 exit, while the existing sandbox diagnostics remain healthy.