Codex Extension running Powershell behind every command

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #17094

Powered by Codex Action

I am seeing a similar issue on Windows with Norton Antivirus following Codex activity.

Norton flags or blocks PowerShell-related execution as heuristic threats, including detections such as IDP.HELU.PSE75 - Command line detection on powershell.exe and IDP.Generic on a .ps1 helper script. This appears to be triggered by the command-line/process shape rather than by repository-specific content.

The practical impact is that normal Codex workflows can be interrupted by AV blocking or quarantine of PowerShell/script execution. I am omitting local paths and user-specific details, but this looks like the same general class of issue: Codex-driven PowerShell invocations can trip Windows AV heuristics.

Additional impact: this is not only a one-off interrupted command. After a restart, the AV block can leave the Windows environment in a degraded state because PowerShell itself is blocked or quarantined, which interferes with normal startup/recovery and makes the machine difficult to use until the AV action is manually remediated.

That raises the severity: Codex-triggered PowerShell command shapes can lead to system-level disruption on Windows, not just failed Codex tasks.

Clarification on my Norton comments above: that report is from the Codex Windows desktop app, not the IDE extension. It may share the same underlying PowerShell/AV heuristic class, but it is not an exact duplicate of this extension-specific report.

I opened a separate desktop-app issue for that case: #25425.

I reproduced this in the Windows desktop app and traced the visible tab to the long-lived PowerShell AST parser rather than to a user shell or task runner.

Environment:

• Codex Desktop 26.727.6591.0
• Windows 10.0.26200.0
• PowerShell 7.6.4
• Windows Terminal 1.24.11911.0
• Windows Terminal windowingBehavior = useAnyExisting

Sanitized evidence:

• Process lineage: ChatGPT.exe -> codex.exe app-server -> pwsh.exe
• The child command shape is -NoLogo -NoProfile -NonInteractive -EncodedCommand (payload intentionally omitted).
• Two live children were independently classified as Codex PowerShell AST parsers.
• A separate durable task worker was created after the screenshot and uses a hidden/no-window process contract, so it is not the source.

Source-level cause:

• PowershellParserProcess::spawn in codex-rs/shell-command/src/command_safety/powershell_parser.rs redirects stdio but does not set a Windows process creation flag.
• parse_with_cached_process caches the child and retries once after a broken stream. Closing the visible tab terminates the parser; the next safety parse then creates a new child, which explains repeated tabs.
• useAnyExisting appears to amplify the missing creation contract by surfacing the console child in the existing Windows Terminal window.

I prepared a focused patch that applies CREATE_NO_WINDOW through std::os::windows::process::CommandExt::creation_flags only on Windows, without changing the parser protocol, pipes, cache, or retry behavior:
https://github.com/ibocon/codex/commit/c8b97701a986978853e8777e88a9b209a45e3d5f

Validation:

• just test -p codex-shell-command: 141/141 passed on Linux
• cargo check -p codex-shell-command --tests --target x86_64-pc-windows-gnu: passed
• just fix -p codex-shell-command: passed

I did not open an unsolicited PR because docs/contributing.md currently requires an explicit maintainer invitation. If this approach matches the intended fix, I can open the prepared branch as a PR.