[Bug][Windows] Transient PowerShell console popup from proxy-internal identity lookup

[wade19990814-hue]

Client or integration

OpenCodex dashboard (also ocx CLI)

Area

Platform (Windows / macOS / Linux)

Summary

On Windows, a transient "Windows PowerShell" console window pops up at proxy startup, on config changes, and at shutdown, when the proxy runs from a headless (console-less) parent.

Root cause: src/codex/user-identity.ts resolves the effective Windows identity by spawning powershell.exe via Bun.spawnSync without windowsHide: true (verified: zero windowsHide occurrences in that file in v2.11.0). The resolution is not cached and is hit by every write-coordination path (startup injection/catalog reconciliation, config mutation → catalog/write-lock serialization, shutdown → native Codex restore), so each of those moments allocates a fresh visible console for the child.

This is distinct from #1236: that issue is the persistent bun.exe console window created by the npm launcher (bin/ocx.mjs → bun spawn, now fixed in PR #1268). This one is created by the proxy itself, after the launcher is gone, and closes as soon as the PowerShell child exits. I verified on a running instance that the proxy process owns no console window (enumerated ConsoleWindowClass windows), so the two windows are not the same artifact — and after #1268 lands, the launcher path becomes console-less and will hit this same transient-window bug.

Reproduction

1. Install the published npm package on Windows: npm install -g @bitkyc08/opencodex (v2.11.0).
2. Start the proxy from a headless context so the proxy itself has no console (e.g., dashboard "Drain & restart", or the detached ocx start path).
3. Trigger an identity resolution: proxy startup, saving a config change (secret/catalog writes), or shutdown (native Codex restore writes through the write path).
4. Observe a short-lived "Windows PowerShell" console window pop up and close; it does not stay open like the launcher window from [Bug][Windows] Visible console window pops up when the proxy starts/restarts from a headless parent (npm launcher spawn missing windowsHide) #1236.

Also reproduced in isolation with the bundled Bun 1.3.14: spawning powershell.exe from a console-less parent without windowsHide gives the child a visible console (GetConsoleWindow non-zero, window visible); with windowsHide: true the child has no console at all (hwnd = 0). So the fix is purely to add the flag (or avoid the PowerShell child entirely) on the proxy-internal spawn.

Version

2.11.0 (reproduced on 2.11.0-preview.20260808; source on main and dev has the same omission)

Operating system

Windows 11 (any Windows with a console host; reproduced on build 26200)

Provider and model

Not provider-specific.

Logs or error output

No logs. The popup is the child console of the powershell.exe launched from src/codex/user-identity.ts powershellValue() / localAppDataValue() (Bun.spawnSync without windowsHide), triggered on every write-coordination identity lookup.

Current implementation status

The original implementation attempt was PR #1279.

That PR expanded beyond the popup defect into broader Windows identity and process-introspection changes and was closed unmerged after review identified cross-platform and fallback concerns.

The focused replacement is:

• fix(windows): stop console popups from proxy-internal PowerShell lookups (#1278) #1347 — fix(windows): stop console popups from proxy-internal PowerShell lookups (#1278)

#1347 keeps the existing PowerShell-based behavior but hardens the affected spawn sites by:

• resolving PowerShell through the trusted System32 path rather than PATH;
• setting windowsHide: true;
• using hidden/non-interactive PowerShell invocation;
• bounding identity lookups with a timeout;
• adding focused regression coverage for the popup behavior.

The PR also reports a real-machine Windows end-to-end verification covering:

• proxy startup;
• config changes;
• shutdown.

The popup no longer reproduced on that branch.

This issue should remain open until the focused fix is accepted and merged into dev.

Redacted configuration

None needed.

Checks

• I searched existing issues and documentation.
• I removed secrets, tokens, account details, request credentials, and personal data.

[github-actions]

_{Automated translation bookkeeping — detected language: English.}

[Ingwannu]

Maintainer triage: this remains a valid Windows bug on current dev. src/codex/user-identity.ts still invokes powershell.exe without windowsHide, so the reported transient console path is still present.\n\nDraft PR #1279 is the correct implementation tracker, but its current head is 69 commits behind dev and it has grown beyond the popup fix into a broader WMIC/process-introspection rewrite. The outstanding review blockers are substantive: a macOS batch start-time regression, missing fallback when WMIC is absent or unhealthy, an unbounded startup identity child, and security-sensitive SID parsing.\n\nPlease rebase onto current dev and either narrow the PR to the identity/profile popup fix or resolve those cross-platform blockers with focused tests. Keeping this issue open; #1279 is not ready to merge yet.

[Wibias]

Resolved on dev by #1347.

The focused fix has now merged as:

0757b10e8f6cb96587e18a515758b9181948a674

The affected proxy-internal Windows PowerShell paths now:

• execute with windowsHide: true;
• use hidden/non-interactive PowerShell invocation;
• resolve PowerShell from the trusted System32 location rather than PATH;
• bound identity lookups with a timeout;
• have focused regression coverage for the console-popup behavior.

The fix was also verified end-to-end on Windows across proxy startup, config changes, and shutdown, with the transient console popup no longer reproducing.

Closing as completed.