WSL child processes survive Codex shell timeout/cancellation and keep consuming CPU

Summary

Codex Desktop on Windows can return control after a shell tool timeout/cancellation while descendant processes launched inside WSL continue running. In my case, two stale node - processes survived after large-file inspection attempts and each kept one CPU core near 100% for more than 30 minutes.

Environment

• Product: Codex Desktop on Windows
• Host OS: Windows
• Local environment: WSL2 Ubuntu
• Command path: PowerShell / Codex shell -> wsl -e bash -lc ... -> inline node - <<'NODE' ...
• File location pattern involved: large file under /mnt/c/...

Impact

• Two abandoned Node.js child processes kept running after the useful work had moved on.
• Each process held roughly one CPU core near 100%.
• CPU temperature stayed materially elevated during an otherwise idle/low-load state.
• User had to notice the heat/load and ask the agent to inspect WSL processes.

Repro Shape

The failure involved inline Node.js stream scanning of a large Windows-mounted file from WSL:

wsl -e bash -lc 'node - <<'"'"'NODE'"'"'
const fs = require("node:fs");
const stream = fs.createReadStream("/mnt/c/path/to/large-file.rtf", { encoding: "utf8" });
stream.on("data", chunk => {
  // CPU-heavy regex/count processing
});
stream.on("end", () => console.log("done"));
NODE'

After the Codex shell invocation timed out or the work was abandoned, descendant node - processes remained alive in WSL and continued consuming CPU.

Expected Behavior

When a Codex shell command times out, is canceled, or otherwise returns control as failed/abandoned, Codex should terminate the full descendant process tree for that tool invocation, including WSL child process groups.

Actual Behavior

Codex returned control while WSL descendant processes continued running.

Diagnostic Evidence

Process inspection later showed:

node -    elapsed ~33 minutes    ~100% CPU
node -    elapsed ~31 minutes    ~100% CPU

Both were children of bash -lc node - <<'NODE' ... commands launched through WSL. They were manually killed with kill -TERM.

Workaround

I added local agent guardrails to avoid unbounded inline Node/Python scanners over large /mnt/c files, prefer bounded rg --count-matches or scripts with explicit timeouts, and verify process cleanup with ps/pgrep after large scans or timed-out commands.

Suggested Fix

Codex should reliably kill the full process tree/process group for timed-out or canceled shell tool invocations, including descendants spawned through wsl.exe and bash -lc. If full cleanup cannot be guaranteed, Codex should warn that child processes may remain and expose their PIDs for cleanup.