[Windows Desktop] Defer automatic update restart until active tasks finish or the user confirms

Summary

The Codex Windows desktop app can automatically install an update and forcibly terminate the running app while active tasks are still executing.

Updates should be downloaded in the background, but the restart should be deferred until:

1. All active tasks have finished, or
2. The user explicitly confirms the restart.

Observed behavior

This happened repeatedly while the app was being actively used.

Latest occurrence

• Platform: Windows 11 x64, build 10.0.26200
• Previous app version: 26.727.4816.0
• Updated app version: 26.727.6591.0
• Time zone: Asia/Shanghai

Relevant timeline:

2026-08-01 15:06:31
[sparkle] Production Sparkle update event
action=download_completed
result=succeeded

2026-08-01 15:06:35
AppXDeploymentServer started RegisterByPackageFamilyName with:
ForceTargetApplicationShutdownOption

2026-08-01 15:06:36
OpenAI.Codex_26.727.4816.0 was updated to
OpenAI.Codex_26.727.6591.0

The existing AppX container was destroyed and the new version launched afterward.

There was no corresponding Windows Application Error, WER crash report, GPU crash, or Crashpad dump. This confirms that the visible “crash” was caused by the update lifecycle forcibly terminating the running application.

A similar forced update occurred earlier when updating from 26.721.11231.0 to 26.727.4816.0.

Impact

• Active tasks are interrupted without warning.
• Multiple parallel tasks may all stop simultaneously.
• Browser, terminal, approval, and remote-control workflows may lose their active state.
• The sudden disappearance looks like an application crash.
• Users cannot safely rely on Codex for long-running work if an update can terminate it at any time.

Expected behavior

The update flow should:

1. Download and stage updates in the background.
2. Detect whether any task is running, waiting for approval, using Browser/Computer Use, or executing a command.
3. If work is active, wait until all tasks reach a safe idle/completed state.
4. Show a visible prompt with:

• Restart and update now
• Restart after active tasks finish
• Remind me later

1. Never forcibly terminate active work without a warning and countdown.
2. If an immediate restart is required for a critical security update, clearly explain why and safely preserve/recover active task state.

Related: #31989, which also documents Store-update lifecycle interruptions on Windows.