codex exec: internal tool-call traces + cross-session memory-search transcripts leak into stdout (Windows)

Summary

When running codex exec -s read-only -C <repo> "<prompt>" non-interactively (output captured by a calling process), Codex's internal agentic tool-call traces are printed to the same stdout stream as the final answer, with no delimiter that a programmatic caller can rely on. The leaked trace includes:

1. Full contents of repository files Codex read internally while working (with UTF-8 mojibake, e.g. — for em-dash — suggesting a codepage mismatch on Windows),
2. The complete command line + results of Codex's own memory search — a PowerShell Select-String over ~/.codex/memories/MEMORY.md, exposing prior-session thread IDs, rollout file paths under ~/.codex/sessions/..., and memory summaries from unrelated earlier sessions (memories feature enabled: [memories] generate_memories = true, use_memories = true),
3. Internal ERROR log lines (e.g. ERROR codex_core::tools::router: error=Exit code: 1 ... rg : The term 'rg' is not recognized... — Codex assuming ripgrep exists on a stock Windows box).

Why this matters

• Isolation/hygiene: callers piping codex exec output into another system (CI, review bots, other agents) receive cross-session memory content and local filesystem paths they never requested. In our case this repeatedly surfaced as apparent "content injection" in an automated review pipeline until we traced it to Codex's own trace verbosity + memory feature.
• Determinism: the final labeled answer is preceded by an unbounded, non-deterministic trace, making programmatic parsing fragile.

Environment

• Codex CLI 0.144.0 (also observed on 0.130.0), Windows 11 Home 10.0.26200, PowerShell 5.1 host
• Codex desktop app also installed (shared CODEX_HOME); [features] memories = true
• Invocation: codex exec -s read-only -C <git repo> "<review prompt>", stdout captured by the calling process

Expected

• Internal tool-call traces go to stderr (or require an explicit --verbose), stdout carries only the final answer; or a stable machine-readable delimiter/--json mode for exec.
• Memory-search internals (thread IDs, rollout paths, prior-session summaries) never printed unless explicitly requested.

Workaround

Per-call -c memories.use_memories=false -c memories.generate_memories=false stops the memory-content portion; the file-read traces still leak.

Repro sketch

1. Windows machine with Codex desktop app + CLI sharing CODEX_HOME, memories enabled, several prior sessions in the same repo.
2. codex exec -s read-only -C <that repo> "Review this diff for bugs" > out.txt 2>&1
3. out.txt contains file dumps, the PowerShell memory-search transcript with prior-session identifiers, and router ERROR lines ahead of the final answer.