[Bug][Windows] Transient PowerShell console popup from proxy-internal identity lookup #1278

Client or integration

OpenCodex dashboard (also ocx CLI)

Area

Platform (Windows / macOS / Linux)

Summary

On Windows, a transient "Windows PowerShell" console window pops up at proxy startup, on config changes, and at shutdown, when the proxy runs from a headless (console-less) parent.

Root cause: src/codex/user-identity.ts resolves the effective Windows identity by spawning powershell.exe via Bun.spawnSync without windowsHide: true (verified: zero windowsHide occurrences in that file in v2.11.0). The resolution is not cached and is hit by every write-coordination path (startup injection/catalog reconciliation, config mutation → catalog/write-lock serialization, shutdown → native Codex restore), so each of those moments allocates a fresh visible console for the child.

This is distinct from #1236: that issue is the persistent bun.exe console window created by the npm launcher (bin/ocx.mjs → bun spawn, now fixed in PR #1268). This one is created by the proxy itself, after the launcher is gone, and closes as soon as the PowerShell child exits. I verified on a running instance that the proxy process owns no console window (enumerated ConsoleWindowClass windows), so the two windows are not the same artifact — and after #1268 lands, the launcher path becomes console-less and will hit this same transient-window bug.

Reproduction

1. Install the published npm package on Windows: npm install -g @bitkyc08/opencodex (v2.11.0).
2. Start the proxy from a headless context so the proxy itself has no console (e.g., dashboard "Drain & restart", or the detached ocx start path).
3. Trigger an identity resolution: proxy startup, saving a config change (secret/catalog writes), or shutdown (native Codex restore writes through the write path).
4. Observe a short-lived "Windows PowerShell" console window pop up and close; it does not stay open like the launcher window from [Bug][Windows] Visible console window pops up when the proxy starts/restarts from a headless parent (npm launcher spawn missing windowsHide) #1236.

Also reproduced in isolation with the bundled Bun 1.3.14: spawning powershell.exe from a console-less parent without windowsHide gives the child a visible console (GetConsoleWindow non-zero, window visible); with windowsHide: true the child has no console at all (hwnd = 0). So the fix is purely to add the flag (or avoid the PowerShell child entirely) on the proxy-internal spawn.

Version

2.11.0 (reproduced on 2.11.0-preview.20260808; source on main and dev has the same omission)

Operating system

Windows 11 (any Windows with a console host; reproduced on build 26200)

Provider and model

Not provider-specific.

Logs or error output

No logs. The popup is the child console of the powershell.exe launched from src/codex/user-identity.ts powershellValue() / localAppDataValue() (Bun.spawnSync without windowsHide), triggered on every write-coordination identity lookup.

Current implementation status

The original implementation attempt was PR #1279.

That PR expanded beyond the popup defect into broader Windows identity and process-introspection changes and was closed unmerged after review identified cross-platform and fallback concerns.

The focused replacement is:

• fix(windows): stop console popups from proxy-internal PowerShell lookups (#1278) #1347 — fix(windows): stop console popups from proxy-internal PowerShell lookups (#1278)

#1347 keeps the existing PowerShell-based behavior but hardens the affected spawn sites by:

• resolving PowerShell through the trusted System32 path rather than PATH;
• setting windowsHide: true;
• using hidden/non-interactive PowerShell invocation;
• bounding identity lookups with a timeout;
• adding focused regression coverage for the popup behavior.

The PR also reports a real-machine Windows end-to-end verification covering:

• proxy startup;
• config changes;
• shutdown.

The popup no longer reproduced on that branch.

This issue should remain open until the focused fix is accepted and merged into dev.

Redacted configuration

None needed.

Checks

• I searched existing issues and documentation.
• I removed secrets, tokens, account details, request credentials, and personal data.