Windows: allow configuring -NoProfile for PowerShell shell tool calls

This issue was drafted with AI assistance.

What variant of Codex are you using?

App / CLI / IDE Extension on Windows where shell tool calls execute through powershell.exe or pwsh.exe.

What feature would you like to see?

Add a configuration option that lets users choose whether Codex launches PowerShell shells with -NoProfile.

Today, normal Windows shell tool calls can be launched as pwsh.exe -Command ... or powershell.exe -Command ... without -NoProfile. That means every tool call may load the user's PowerShell profile before the requested command runs. Profiles commonly initialize prompt/theme tooling such as oh-my-posh, import modules, configure SDKs, or do other interactive-shell setup. In Codex tool calls this can add avoidable startup latency, print unrelated errors into command output, or fail in sandboxed/non-interactive contexts.

A config setting would let users pick the behavior that matches their workflow, for example:

[windows]
powershell_no_profile = true

or a shell-scoped shape if that better fits the existing config model:

[shell.powershell]
no_profile = true

Expected behavior when enabled:

• apply to both powershell.exe and pwsh.exe
• insert -NoProfile before -Command / -EncodedCommand when Codex builds the shell argv
• avoid adding a duplicate flag if the argv already includes -NoProfile
• leave the default behavior unchanged unless maintainers want to make -NoProfile the default for non-interactive tool calls

Additional information

Related issues and prior work:

• #18531 reports user PowerShell profiles, especially oh-my-posh, failing inside Codex tool calls.
• #17112 reports Windows sandbox/profile startup failures and explicitly discusses avoiding profile loading.
• #21400 already added a scoped fix that avoids PowerShell profiles for elevated Windows sandbox attempts, but that does not cover ordinary direct shell tool calls.

A concrete observed command line from a current Windows Codex tool call in danger-full-access mode was:

"C:\Program Files\PowerShell\7\pwsh.exe" -Command "..."

and checking that process command line showed no -NoProfile argument. This suggests the non-sandboxed/direct Windows tool-call path can still pay profile startup cost and remain exposed to profile side effects even after the elevated sandbox-specific fix.

This request is intentionally framed as configurable because some users may rely on profile initialization for PATH/module setup, while others want non-interactive Codex commands to be clean and fast.