ACL and apply_patch always requests approval in writable workspace.

[Norlandz]

If you meet the problem:

ACL and apply_patch always requests approval in writable workspace.

My solution was using icacls + /setowner:

$Folder='C:\usp\jobhp\your_project_name';

$Me   = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
icacls "$Folder" /setowner "$Me" /T /C /Q;

If that doesnt help, try /remove + CodexSandboxUsers:

$CodexAclEntries = @(
    'Azih\CodexSandboxUsers'
)

foreach ($Entry in $CodexAclEntries) {
    icacls.exe $Folder /remove:g $Entry /T /C
}

---

I was using both codex vscode extension + codex app.
Or it could be codex version. Which i mentioned in another post: #28982 (comment)

--
Other related issue found by AI is:

Codex Desktop on WSL: apply_patch always requests approval in writable workspace, while normal shell writes do not · Issue #18365 · openai/codex
#18365

apply_patch sandbox retry can request duplicate approval and hang app-server turns · Issue #21117 · openai/codex
#21117

[Windows] CodexSandboxUsers gets Modify on C:\ root + orphan SIDs persist (post-redesign, follow-up #12343) · Issue #24256 · openai/codex
#24256

Security concern: CodexSandboxOffline/Online assigned to entire user profile tree on Windows 11 · Issue #12343 · openai/codex
#12343

--

The discovery of this is by AI, after i mention that using a new directory for the project vs move the old corrupted directory, then mention about checking ACL, then found things like CodexSandboxUsers.