[Windows Desktop] Terminating a shell command does not kill its descendant process tree

Codex version

Codex Desktop for Windows: 26.707.8479.0

Platform

Windows 11 x64

What happened?

Codex Desktop started a Git command that created multiple levels of child processes:

Codex / shell wrapper
└── git.exe
    └── git.exe
        ├── git.exe
        └── ssh.exe

The command was terminated through the Codex tool interface, and Codex reported:

Script terminated

However, the descendant processes were not terminated. They continued running and creating additional descendants after Codex reported successful termination.

The number of surviving processes initially reached approximately:

• 660+ git.exe
• 660+ ssh.exe

It later exceeded approximately:

• 1,200 git.exe
• 1,200 ssh.exe

Closing Codex Desktop did not terminate these processes.

Because surviving descendants continued creating new processes, terminating individual git.exe and ssh.exe processes was ineffective. A complete Windows restart was ultimately required.

System impact

The surviving process tree caused severe resource exhaustion:

• System committed memory increased to approximately 61.6 / 63.2 GB.
• The computer has 32 GB of physical RAM.
• The Windows page file expanded substantially.
• Free space on the system drive decreased by approximately 13 GB.
• The Windows graphical interface became unstable.
• Resource usage returned to normal after restarting Windows.

The memory was primarily consumed by the surviving command descendants rather than by the Codex Desktop process itself.

Expected behavior

When Codex reports that a command has been terminated, the entire process tree created by that command should be terminated, including grandchildren and deeper descendants.

On Windows, shell commands should be placed in a Windows Job Object configured with kill-on-job-close behavior, or managed using an equivalent process-tree termination mechanism.

Codex should not display Script terminated while descendants belonging to the command are still running.

Closing Codex Desktop should also clean up command descendants owned by that Codex session.

Actual behavior

Codex appears to have terminated only the directly tracked process or shell wrapper.

Deeper descendants survived, became detached from the terminated command, and continued running independently.

Triggering command

The incident was triggered by a Git partial-clone command over SSH, equivalent to:

git clone --filter=blob:none --sparse --depth=1 --no-checkout user@example-host:/redacted/repository redacted-local-directory

Git itself entered a recursive child-process condition. That Git behavior is already being addressed upstream and is not the primary subject of this report.

The Codex-specific issue is that terminating the command did not contain or terminate its complete process tree.

Related Codex issue

This appears related to:

https://github.com/openai/codex/issues/4337

That report describes child processes surviving command timeouts. It was closed after a fix, but this incident occurred in a current Windows Desktop build and may indicate that Windows descendant cleanup remains incomplete or has regressed.

Reproducibility

I have not deliberately reproduced the incident because it can create thousands of processes, exhaust system commit capacity, destabilize Windows, and require a restart.

All hostnames, usernames, repository names, SSH aliases, task identifiers, and local paths in this report have been redacted.