Repository navigation
Windows: visible console windows flash for shell process children on every session/turn #48422
Copy link
Copy link
Closed as duplicate
Closed as duplicate
Copy link
Labels
CLIIssues related to the Codex CLIIssues related to the Codex CLIapp-serverIssues involving app server protocol or interfacesIssues involving app server protocol or interfacesbugSomething isn't workingSomething isn't workingwindows-osIssues related to Codex on Windows systemsIssues related to Codex on Windows systems
Description
What version of Codex CLI is running?
codex-cli 0.157.1
What subscription do you have?
Plus
Which model were you using?
No response
What platform is your computer?
Microsoft Windows NT 10.0.26200.0 x64
What terminal emulator and version are you using (if applicable)?
Windows Terminal + Powershell
Codex doctor report
What issue are you seeing?
On Windows, a batch of visible console windows flashes for git.exe / pwsh.exe (and other helper) child processes:
- several
git.exewindows on every new session, and again on every turn; pwsh.exewindows for shell/exec child processes.
What steps can reproduce the bug?
- On Windows, run
codexinteractively (e.g. in Windows Terminal) on a project inside a git repository (default config, no--no-daemon). - Start a new thread and send a turn.
- Observe console windows flashing for
git.exe(session start + every turn) andpwsh.exe(shell/exec helpers).
Workaround that confirms the diagnosis: codex --no-daemon runs the session embedded in the TUI process (console attached), and the flashing stops.
What is the expected behavior?
No visible console windows. Helper subprocesses spawned by the console-less daemon backend should either inherit a hidden console or be created with CREATE_NO_WINDOW.
Additional information
Source analysis at tag rust-v0.157.1:
Why the spawning process has no console:
codex-rs/features/src/lib.rs:941-944—daemon_auto_startis enabled by default.codex-rs/tui/src/startup_orchestration.rs:494-544— TUI auto-starts the shared daemon and targetsAppServerTarget::LocalDaemon(session runs in the daemon's app-server backend, not in the TUI).codex-rs/app-server-daemon/src/backend/pid_start.rs:209— backend spawn usesDETACHED_PROCESS | CREATE_BREAKAWAY_FROM_JOB→ no console.spawn_without_inheriting_stdio(backend/windows.rs:56+) only clears stdio handle inheritance and adds no window suppression.
Unsuppressed child spawns from that console-less backend:
git.exe(dominant source):codex-rs/git-utils/src/git_process.rs:47-63goes throughJobObject::spawn_contained, andcodex-rs/utils/pty/src/win/job.rs:125-127only setsCREATE_SUSPENDED(noCREATE_NO_WINDOW); the fallback path resetscreation_flags(0). Volume: new session →codex-rs/rollout/src/recorder.rs:1977-1978→collect_git_info(git-utils/src/info.rs:66-82) = 4 spawns; every turn →codex-rs/core/src/turn_metadata.rs:547-551= 3 more (plus a possible fsmonitor probe). DirectCommand::new("git")sites ingit-utils(apply.rs / baseline.rs / branch.rs / operations.rs) share the gap.pwsh.exe/ shell helpers:codex-rs/exec-server/src/fs_sandbox.rs:516,codex-rs/exec-server/src/shell_snapshot.rs:287,codex-rs/windows-sandbox-rs/src/unified_exec/backends/legacy.rs:118(ConsoleMode::Inherit, mapped to flags 0 inprocess.rs:109-113; defaultWindowsSandboxLevel::Disabledtakes this path),codex-rs/hooks/src/engine/command_runner.rs:233-245,codex-rs/hooks/src/legacy_notify.rs:53-66,codex-rs/cli/src/desktop_app/windows.rs:34-56.- The codebase already sets
CREATE_NO_WINDOWcorrectly elsewhere (e.g.bin/command_runner/win.rs:351,rmcp-client/src/stdio_server_launcher.rs:297), so this looks like an omission. - Checked against current
main(e72da2b, 2026-09-26):git_process.rs,job.rs,legacy.rs,pid_start.rsare unchanged vs 0.157.1 — upgrading does not fix this.
Suggested fix:
- Minimal: in
codex-rs/app-server-daemon/src/backend/pid_start.rs:209, replaceDETACHED_PROCESSwithCREATE_NO_WINDOW(keeps the backend detached from the launching terminal and breakaway-safe, but gives it a hidden console that children inherit — removes the flashing for all daemon-managed backends in one line). - Robust: also set
CREATE_NO_WINDOWat the individual spawn sites above (git_process / job.rs, unified_exec legacy backend +(None, NoWindow)mapping inprocess.rs:109-113, exec-server spawns, hooks, desktop_app powershell) so any console-less parent is covered.
This issue is written by codex and review by human.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
CLIIssues related to the Codex CLIIssues related to the Codex CLIapp-serverIssues involving app server protocol or interfacesIssues involving app server protocol or interfacesbugSomething isn't workingSomething isn't workingwindows-osIssues related to Codex on Windows systemsIssues related to Codex on Windows systems
Activity
github-actions commentedon Sep 26, 2026
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
qwq233 commentedon Sep 26, 2026
i saw that v0.157.1 changelog claims it was fixed, but apparently it wasn't.
so i think it's necessary to create a new issue for it.
yecate commentedon Sep 26, 2026
A commit from last night indicated a fix, but testing showed otherwise; the issue persists.
remcoros commentedon Sep 26, 2026
codex is unusable on Windows like this. console windows keep opening and stealing focus
gafapa commentedon Sep 26, 2026
Additional Windows 11 Home (build 26200) reproduction: Codex CLI 0.157.1 and its 0.157.1 managed app-server daemon were installed/running. Launching an older standalone CLI 0.156.1 without
--no-daemonstill produced brief PowerShell windows during tasks. Relaunching the same 0.156.1 executable with--no-daemonstopped the extra windows in the user's test. Read-only process inspection showed the 0.157.1 managed daemon withpwsh.exe,node.exe,node_repl.exe, andcodex-code-mode-host.exedescendants; several hadconhost.exechildren. I did not capture a PID for each transient visible window. Thus downgrading the CLI executable alone did not resolve the symptom here, while bypassing the shared daemon did.dideldei commentedon Sep 26, 2026
Additional independent reproduction from the Codex desktop app (not only the CLI):
Environment
10.0.26200OpenAI.Codex_26.917.8451.0_x64codex-cli 0.157.1elevatedProcess evidence
While reproducing the issue, each shell/tool action created a matching group with the same start timestamp:
Four concurrent diagnostic shell calls produced four command-runner processes, four PowerShell processes, and four
conhost.exeprocesses at the same timestamp. The visible flashes correlated directly with those groups.PE subsystem inspection showed:
codex-command-runner-0.157.1.exe: Windows GUI subsystemnode_repl.exe: Windows Console subsystemcodex-computer-use.exe: Windows Console subsystemcodex.exe: Windows Console subsystemThis suggests the GUI command runner is launching console-subsystem children such as
pwsh.exewithout consistently usingCREATE_NO_WINDOW(or an equivalent hidden-console mechanism), causing Windows Terminal/conhost allocation.There are also two additional desktop-app paths that can add flashes:
node_repl.exeis launched during session/plugin startup.notifycommand invokescodex-computer-use.exe turn-ended, which can add another console flash when a turn finishes.Configuration checks
Expected behavior
All non-interactive helpers spawned by the desktop app or managed daemon should remain background-only and must not allocate visible Windows Terminal/conhost windows.
No private paths, command payloads, conversation content, credentials, or raw logs are included in this comment.
chennqqi commentedon Sep 27, 2026
Can alleviate this problem
Dieg0Code commentedon Sep 27, 2026
Additional reproduction on Windows 10 build 19045 with Codex CLI 0.157.1 (npm install), Windows Terminal as the default terminal, and PowerShell 7.6.6:
pwsh.exe,cmd.exe,node.exe,node_repl.exe, andcodex-code-mode-host.exechildren, with correspondingconhost.exe/OpenConsole.exeactivity. Creation times coincided with command execution. I cannot attribute each visible flash to one exact child PID.[features] daemon_auto_start = falsein the user's Codex config, stopped the existing daemon, then restarted Codex normally with plaincodex. A harmless agent command (Get-Date) ran afterward, and the user confirmed that no console window appeared or stole focus.Expected: background agent commands and helpers should not create foreground console windows. This is a serious usability regression because it interrupts typing in other applications. The config change is a workaround; users should not need to disable the shared daemon to avoid focus stealing.
No personal paths, raw logs, or conversation transcripts are included.
starSumi commentedon Sep 27, 2026
Additional reproduction with a more specific child/runtime configuration:
C:\Program Files\WindowsApps\Microsoft.PowerShell_7.6.6.0_x64__8wekyb3d8bbwe\pwsh.exe[windows] sandbox = "elevated"Every non-interactive agent shell execution opens a new Windows Terminal tab or window. This is reproducible across commands and does not depend on the model response. The same workflow did not produce these tabs with the previously installed Codex CLI 0.153.4.
I also checked current
mainat985cf47a4e. It includes #48483 (1a89aec960), which setsCREATE_NO_WINDOWincodex-rs/utils/ptyand adds detached-process coverage, but the released 0.157.1 behavior remains reproducible. This suggests that the shared-wrapper fix does not yet cover every helper or daemon launch path.Could the regression test matrix include the actual Microsoft Store
pwsh.exewith[windows] sandbox = "elevated", and verify that noconhost.exeor Windows Terminal tab is created? The fix should applyCREATE_NO_WINDOWto every non-interactive child spawn while preservingCREATE_SUSPENDEDand Job Object flags.daemon_auto_start = falseor--no-daemonis a useful diagnostic workaround, but not an acceptable default for the managed daemon.Olwiba commentedon Sep 27, 2026
Confirmed on another Windows x64 installation running Codex 0.157.1: launching with codex
--no-daemonmitigates the problem. After restarting in no-daemon mode, the repeated visible PowerShell/console flashes stopped during equivalent local tool activity. This supports the report's diagnosis that the regression is in the daemon-backed process-launch path.dushouke commentedon Sep 27, 2026
Additional affected user on Windows with codex-cli 0.157.1 (
codex --versionverified). Since the recent update, short-lived black console windows repeatedly open and close while Codex is doing ordinary work. They steal keyboard focus, interrupt typing, and make the CLI effectively unusable. This happens repeatedly during a task, not only at startup.Please prioritize a release that fully suppresses visible windows and focus stealing for non-interactive child processes, and verify it against the current Windows CLI behavior. I see that #48483 has been merged, but 0.157.1 still has this problem.
6 remaining items
jack1415926 commentedon Sep 28, 2026
Additional instrumented reproduction from ChatGPT/Codex Desktop on Windows (2026-09-28):
OpenAI.Codex_26.924.2738.0_x64. Its app-server log resolvedcodex.exefrom an override to a globally installed npmcodex-cli 0.157.1(source=override;CODEX_CLI_PATHis the selected browser-use path). The package also contains0.158.0-alpha.2.1, but I have not tested that bundled binary as a workaround.codex.exe -> pwsh.exe -> conhost.exeat 11:02:54 and 11:03:06 local time, withOpenConsole.exestarting in the same second. The user observed a brief PowerShell 7 window.git.exechildren directly under the same Codex app-server in each burst at 10:55:20–23 and 10:58:37, with correspondingconhost.exe/OpenConsole.exestarts. The user observed Git terminal windows opening and closing rapidly. This is intermittent across prompt submissions.asus_framework.exe) and is excluded from the Codex events above.The process parentage and timestamps are confirmed locally; the transient visible windows are the user's observation. I did not capture a window-handle-to-PID match, individual Git arguments/exit codes, or an A/B run with another Codex runtime. This adds a desktop override/runtime case to the CLI and desktop reports already in this issue. No user paths, repo names, credentials, or raw logs are included.
freezed-corpse-143 commentedon Sep 28, 2026
Adding one path that the patch in this thread does not cover, plus the mechanism why the windows are visible even when Codex itself owns a console.
Environment
10.0.26200, Windows Terminal1.24.11911set as default terminal applicationcodex-cli 0.157.1, TUI launched in a Windows Terminal tab (so the Codex process has a console)~/.codex/config.toml:[windows] sandbox = "elevated", default hooks (commandhooks onPreToolUse/PostToolUse/SessionStart/Stop), lean-ctx + omx hooks configuredRepro: run
codexin a WT tab, send a single message. Black console windows flash for the whole turn (one per sandboxed command; the count scales with the number of hooks/tool calls).Why it is visible although Codex has a console (cross-account detail)
create_process_as_userlaunches the child with the sandbox account's token, i.e. a different local user. A child owned by another account cannot attach to the console owned by your user, so Windows must allocate a new console for it — and withconsole_flags = 0that console is visible (the default terminal application renders it as a flashing Windows Terminal window). Inunelevatedmode the same call uses the caller's own restricted token, so the child attaches to the existing console and no window is created. I verified the conhost ownership differs exactly this way:elevated:conhost.exe <- cmd.exe <- codex-command-runner-0.157.1.exe <- codex.exe(child got its own console)unelevated: no conhost child for the sandboxedcmd.exe(it attached to the caller's console)The same spawn failure mode also produces the
0x800700E8/ERROR_NO_DATA (232)"git probe" windows reported in #48601 — see the comment there for the error path (CreateProcessAsUserW failed: 232 (管道正在被关闭) | … | cmd=git … core.fsmonitor).Gap left by the patch above
The patch changes
(None, ConsoleMode::NoWindow)inprocess.rsand switchesunified_exec/backends/legacy.rstoNoWindow, but leaves the matrix branch(Some(_), ConsoleMode::Inherit) => 0untouched. The elevated capture path still passes pipes together withInherit:codex-rs/windows-sandbox-rs/src/lib.rs#L760-L769—run_windows_sandbox_capture/run_windows_sandbox_capture_with_filesystem_overrides:So with that patch applied, sandboxed commands on this path keep allocating a visible console every time.
Suggested fix
Either switch those two call sites to
ConsoleMode::NoWindowas well, or make the matrix hide the console for every pipe-backed spawn, which is the safer default because a pipe-backed child never needs a console:Related: #44768, #48023, #48152, #48826, and #48601 for the
0x800700E8git-probe variant of the same spawn.TenofHearts commentedon Sep 28, 2026
Same issue on Windows 11. Seriously considering switching to Linux now :(
jack1415926 commentedon Sep 28, 2026
jadchene commentedon Sep 28, 2026
Still reproducible on
codex-cli 0.158.0.--no-daemonavoids the issue.leiliuliulei commentedon Sep 28, 2026
Also affected on Windows using PowerShell and Windows Terminal, with both the CLI and the running shared daemon on 0.157.1.
Updating the daemon from 0.157.0 to 0.157.1 using
codex app-server daemon update --from-clidid not resolve the problem. The update reported bothinstalledVersionandrunningVersionas0.157.1. Previously persistent helper terminal windows closed during the restart, but terminal windows still repeatedly flash open and close during normal use.Before the update, the shared daemon's child processes included
node_repl.exe,node.exerunningcua-repl.mjs,cmd.exelaunching Playwright MCP, andcodex-code-mode-host.exe. I have not yet traced which processes create the brief flashes after the update.The repeated popups are highly disruptive when working with multiple Codex sessions. Adding this as another reproduction on 0.157.1; I am not claiming a confirmed source-level root cause.
etraut-openai commentedon Sep 28, 2026
We thought we fully understood the cause and included a fix in
0.158.0. It sounds like some of you are still seeing the problem with the latest version. If so, could you please confirm that your daemon (background server) is also running0.158.0? You can tell by using/status, which should report the daemon version.If you are running
0.158.0for the daemon and you're still seeing this problem, then we could use some additional help in diagnosing the cause. This isn't happening for all users, and we are not seeing it in any of our internal testing, so there's likely something specific about some of your setups (a specific Windows version, specific MCPs, a specific brand of antimalware installed, etc.) that causes the problem to occur. It would help if you could repro the problem and then use/feedbackto upload your logs and post the session ID here.qwq233 commentedon Sep 28, 2026
fyi, i just updated my codex and it seems it's now fixed on my machine. but since there's still some people have this issue, i think this issue should be keep opening for more while.
update: just noticed a window flash briefly when executing "Implement the plan" from plan mode. however, the issue has been significantly alleviated.
remcoros commentedon Sep 28, 2026
This might be helpful
I captured the streak in this session: one batch of three tool calls opened three new Windows Terminal windows within 170 ms, all titled with the daemon’s
codex-windows-sandbox-setup.exepath. A second batch produced another three. That explains why you sometimes see one flash and sometimes several.The cause is specific: Codex 0.158.0’s sandbox refresh launch omits
CREATE_NO_WINDOW, while its [other setup launch](https://github.com/openai/codex/blob/rust-v0.158.0/codex-rs/windows-sandbox-rs/src/setup.rs#L926-L938) sets it. The detached daemon has no console for that helper to inherit;--no-daemonavoids the flash because the session runs in your terminal. The omission is still in currentmain.The
git.exeflash reported in issue #48422 may be an additional launch path; this capture established the sandbox helper streak specifically. The upstream fix should addCREATE_NO_WINDOWtorun_setup_refresh_payloadand address Git launches separately. My earlier Git-only diagnosis missed the tool-call cause.gafapa commentedon Sep 28, 2026
I still have the error
ID 01a0e92d-aed0-7ff1-a55d-e3c490631a47
JMauricioVLJunior commentedon Sep 28, 2026
Additional instrumented reproduction on stable 0.158.0, responding to the request to confirm the daemon version.
Both the standalone CLI and the managed daemon use the official
0.158.0-x86_64-pc-windows-msvcpackage. Theircodex.exefiles have the same SHA-256:AF02050CC0C95F5AEB714AF2C1077E635C58E9896C13C89D75099CF5B96477BEEnvironment: Windows x64, OS version
10.0.26200.0, Windows Terminal, PowerShell 7, Git2.45.2.windows.1.Observed startup path
Starting a normal CLI session in a Git workspace still causes rapid visible terminal flashes. A bounded process monitor recorded four
git.exeprocesses directly parented by the managed daemon. Immediately afterward, Windows Terminal had a nonzero main-window handle and the titleC:\Program Files\Git\cmd\git.exe.A read-only inspection of process parameters showed
ConsoleHandle=0for the production daemon. I am not attributing every historical flash or every shell-tool window to this one path.Controlled reproduction outside the original project
I also reproduced the startup behavior using the same official 0.158.0 executable with
app-server --listen stdio://, an isolatedCODEX_HOME, a minimal Git repository, and a local stub MCP returning empty lists. The real project scripts, plugins and MCP servers were absent. No model turn was started.The client performed
initialize, sentinitialized, then calledthread/startwithephemeral: trueand the Git repository ascwd. The server launch used Node'sspawnwithwindowsHide: truein every case, alternatingdetached: falseanddetached: true. Each case had an equivalent fresh isolated configuration. The detached launches had no console; the non-detached launches had a hidden console.Git-titled Windows Terminal windows were also observed in the detached runs. These are counts of newly observed console processes, not an exact count of visible windows. Sampling can miss short-lived processes, and a terminal title can briefly persist across runs. Merely observing
conhost.exewas not treated as proof of visibility.Remaining Git launch gap in stable 0.158.0
At release commit
064c6b8c737f5b41d171fdda80bd9ef10ad06eb3:DETACHED_PROCESS | CREATE_BREAKAWAY_FROM_JOB.spawn_git_commandpasses a raw Tokio command toJobObject::spawn_contained; its fallback resetscreation_flags(0).prepare_suspended_spawnreplaces creation flags withCREATE_SUSPENDED, withoutCREATE_NO_WINDOW.CREATE_SUSPENDED | CREATE_NO_WINDOWafter the helper. The Git path does not have the equivalent handling.Please include this raw Tokio/Job Object Git path in the remaining fix: preserve process containment and suspension while applying
CREATE_NO_WINDOW, including the fallback. Setting that flag before the current helper alone would be overwritten. This is a proposed source fix, not a compiled or validated patch.A regression test should start the parent without a console and trigger Git metadata collection at session startup, while checking that no visible console appears. Keeping the shared daemon enabled is important; bypassing it does not address the underlying launch defect.
This report contains a sanitized summary, without session transcripts, credentials or personal project paths.
kimlj commentedon Sep 29, 2026
Confirming on a 0.158.0 daemon, with the unelevated sandbox, which the patch and analysis above do not cover.
Environment:
10.0.26200.9457, Windows Terminal1.24.11911.0, default terminal left at "Let Windows decide" (resolves to Windows Terminal)codex-cli 0.157.1in a Windows Terminal tab; managed daemon0.158.0-x86_64-pc-windows-msvc(codex app-server --listen unix:// --managed-daemon)[windows] sandbox = "unelevated"Observed with
AttachConsoleper process: the TUI has a console, the managed daemon has none,codex-code-mode-host.exehas its own hidden one.~/.codex/.sandbox/sandbox.<date>.logshows the daemon starting each tool call aspowershell.exe -NoProfile -Command ...(daemon-routed commands first appear in the log on 2026-09-24). Windows flash in bursts matching parallel tool calls.Control:
codex exec(no daemon) ran three sandboxed commands, all logged in the same sandbox log, and a 100 msEnumWindowsdiff plus a WMI process-start trace recorded zero new visible windows.codex features disable daemon_auto_startfollowed bycodex app-server daemon stopstops it.Why 0.158.0 does not fix this setup, on
mainat 3a16c0b:unified_exec/mod.rs:59-88: any level other thanElevated(soRestrictedToken, the unelevated sandbox) takesbackends::legacy.unified_exec/backends/legacy.rs:118andlib.rs:767launch withConsoleMode::Inheritand piped stdio.process.rs:109-113maps(Some(_), ConsoleMode::Inherit)to creation flags0.app-server-daemon/src/backend/windows.rs:142andpid_start.rs:209start the daemon withDETACHED_PROCESS, so there is no console to inherit and each child allocates a new one, which the default terminal shows.The merged console fixes (#48138 code-mode host, #48238 MCP servers, #48483
utils/ptychildren) do not touchwindows-sandbox-rs. The elevated command runner already passesConsoleMode::NoWindow(bin/command_runner/win.rs:351); the legacy backend could do the same when stdio is piped, orcreate_process_as_usercould addCREATE_NO_WINDOWwhen the caller has no console.etraut-openai commentedon Sep 29, 2026
We think we've fixed the issue, but we could use your help validating the fix. I've posted instructions here.
I'm going to close this issue as a duplicate, and we'll use #48074 for additional discussions and updates on this topic.
Run piped legacy Windows sandbox processes without a console (#49308)