Windows: app-server daemon start fails with Job Object error on a Modern Standby system

[gologames]

What version of Codex CLI is running?

codex-cli 0.154.0 (standalone installation)

What subscription do you have?

ChatGPT Pro (20x)

Which model were you using?

N/A — failure occurs during daemon startup, before model interaction.

What platform is your computer?

Windows 11 Professional, build 10.0.26200, x64. Modern Standby supported; DAM is running.

What terminal emulator and version are you using (if applicable)?

Windows Console Host (conhost.exe) 10.0.26100.8875; Windows PowerShell (powershell.exe file version 10.0.26100.8875); also reproduced with -NoProfile; no multiplexer.

Codex doctor report

{
  "schemaVersion": 1,
  "generatedAt": "1789037897s since unix epoch",
  "overallStatus": "warning",
  "codexVersion": "0.154.0",
  "checks": {
    "app_server.status": {
      "id": "app_server.status",
      "category": "app-server",
      "status": "ok",
      "summary": "background server is not running",
      "details": {
        "control socket": "C:\\Users\\<USER>\\.codex\\app-server-control\\app-server-control.sock",
        "daemon state dir": "C:\\Users\\<USER>\\.codex\\app-server-daemon",
        "mode": "ephemeral",
        "pid file": "C:\\Users\\<USER>\\.codex\\app-server-daemon\\app-server.pid (missing)",
        "settings": "C:\\Users\\<USER>\\.codex\\app-server-daemon\\settings.json (missing)",
        "status": "not running",
        "update-loop pid file": "C:\\Users\\<USER>\\.codex\\app-server-daemon\\app-server-updater.pid (missing)"
      },
      "remediation": null,
      "durationMs": 0
    },
    "auth.credentials": {
      "id": "auth.credentials",
      "category": "auth",
      "status": "ok",
      "summary": "auth is configured",
      "details": {
        "auth file": "C:\\Users\\<USER>\\.codex\\auth.json",
        "auth storage mode": "File",
        "stored API key": "false",
        "stored ChatGPT tokens": "true",
        "stored agent identity": "false",
        "stored auth mode": "chatgpt"
      },
      "remediation": null,
      "durationMs": 0
    },
    "config.load": {
      "id": "config.load",
      "category": "config",
      "status": "ok",
      "summary": "config loaded",
      "details": {
        "CODEX_HOME": "C:\\Users\\<USER>\\.codex",
        "active thread overrides": "not inspected",
        "config.toml": "C:\\Users\\<USER>\\.codex\\config.toml",
        "config.toml parse": "ok",
        "configuration load ms": "5",
        "configuration scope": "invocation config, including cloud-managed policy",
        "cwd": "C:\\Users\\<USER>",
        "enabled feature flags": "<redacted>",
        "feature flag overrides": "prevent_idle_sleep=true",
        "feature flags enabled": "50",
        "log dir": "C:\\Users\\<USER>\\.codex\\log",
        "mcp servers": "5",
        "model": "gpt-6-astra",
        "model provider": "openai",
        "sqlite home": "C:\\Users\\<USER>\\.codex"
      },
      "remediation": null,
      "durationMs": 0
    },
    "desktop.app.version": {
      "id": "desktop.app.version",
      "category": "desktop",
      "status": "ok",
      "summary": "the desktop application is installed",
      "details": {
        "log directory": "$HOME\\AppData\\Local\\Codex/Logs",
        "running": "false",
        "version": "26.901.6511.0"
      },
      "remediation": null,
      "durationMs": 0
    },
    "desktop.app_server.handshake": {
      "id": "desktop.app_server.handshake",
      "category": "desktop",
      "status": "ok",
      "summary": "the desktop application is not running",
      "details": {},
      "remediation": null,
      "durationMs": 0
    },
    "desktop.security.enforcement": {
      "id": "desktop.security.enforcement",
      "category": "desktop",
      "status": "ok",
      "summary": "no locally visible recent Codex security enforcement was found",
      "details": {},
      "remediation": null,
      "durationMs": 0
    },
    "git.environment": {
      "id": "git.environment",
      "category": "git",
      "status": "ok",
      "summary": "git executable found; execution not verified",
      "details": {
        "PATH git #1": "C:\\Program Files\\Git\\cmd\\git.exe",
        "PATH git entries": "1",
        "git execution": "not inspected (PATH helpers are not executed)",
        "repo detected": "false",
        "selected git": "C:\\Program Files\\Git\\cmd\\git.exe"
      },
      "remediation": null,
      "durationMs": 8
    },
    "git.worktree.dev_drive": {
      "id": "git.worktree.dev_drive",
      "category": "git",
      "status": "ok",
      "summary": "no Git worktree is active",
      "details": {},
      "remediation": null,
      "durationMs": 0
    },
    "installation": {
      "id": "installation",
      "category": "install",
      "status": "ok",
      "summary": "installation looks consistent",
      "details": {
        "PATH codex #1": "C:\\Users\\<USER>\\AppData\\Local\\Programs\\OpenAI\\Codex\\bin\\codex.exe",
        "current executable": "C:\\Users\\<USER>\\AppData\\Local\\Programs\\OpenAI\\Codex\\bin\\codex.exe",
        "install context": "standalone (windows, package C:\\Users\\<USER>\\.codex\\packages\\standalone\\releases\\0.154.0-x86_64-pc-windows-msvc, bin C:\\Users\\<USER>\\.codex\\packages\\standalone\\releases\\0.154.0-x86_64-pc-windows-msvc\\bin, resources C:\\Users\\<USER>\\.codex\\packages\\standalone\\releases\\0.154.0-x86_64-pc-windows-msvc\\codex-resources, path C:\\Users\\<USER>\\.codex\\packages\\standalone\\releases\\0.154.0-x86_64-pc-windows-msvc\\codex-path)",
        "managed by Vite+": "false",
        "managed by bun": "false",
        "managed by npm": "false",
        "managed by pnpm": "false",
        "managed package root": "not set"
      },
      "remediation": null,
      "durationMs": 6
    },
    "mcp.config": {
      "id": "mcp.config",
      "category": "mcp",
      "status": "ok",
      "summary": "MCP configuration is locally consistent",
      "details": {
        "configured servers": "5",
        "disabled servers": "2",
        "stdio servers": "3",
        "streamable_http servers": "2"
      },
      "remediation": null,
      "durationMs": 338
    },
    "network.env": {
      "id": "network.env",
      "category": "network",
      "status": "ok",
      "summary": "network-related environment looks readable",
      "details": {
        "managed proxy": "not configured",
        "proxy env vars": "none",
        "respect system proxy": "disabled"
      },
      "remediation": null,
      "durationMs": 0
    },
    "network.provider_reachability": {
      "id": "network.provider_reachability",
      "category": "reachability",
      "status": "ok",
      "summary": "active provider endpoints are reachable over HTTP",
      "details": {
        "ChatGPT inference URL": "https://chatgpt.com/backend-api/<redacted> reachable (HTTP 405)",
        "desktop assets CDN": "https://persistent.oaistatic.com/codex-app-prod/<redacted> reachable (HTTP 200)",
        "reachability mode": "ChatGPT auth"
      },
      "remediation": null,
      "durationMs": 327
    },
    "network.websocket_reachability": {
      "id": "network.websocket_reachability",
      "category": "websocket",
      "status": "ok",
      "summary": "Responses WebSocket handshake succeeded",
      "details": {
        "DNS": "2 IPv4, 2 IPv6, first IPv6",
        "auth mode": "chatgpt",
        "connect timeout": "15000 ms",
        "endpoint": "wss://chatgpt.com/backend-api/<redacted>",
        "handshake result": "HTTP 101 Switching Protocols",
        "model provider": "openai",
        "provider name": "OpenAI",
        "proxy env vars": "none",
        "reasoning header": "false",
        "server model present": "false",
        "supports websockets": "true",
        "wire API": "responses"
      },
      "remediation": null,
      "durationMs": 784
    },
    "runtime.provenance": {
      "id": "runtime.provenance",
      "category": "runtime",
      "status": "ok",
      "summary": "running standalone on windows-x86_64",
      "details": {
        "commit": "unknown",
        "current executable": "C:\\Users\\<USER>\\AppData\\Local\\Programs\\OpenAI\\Codex\\bin\\codex.exe",
        "install method": "standalone (windows, package C:\\Users\\<USER>\\.codex\\packages\\standalone\\releases\\0.154.0-x86_64-pc-windows-msvc, bin C:\\Users\\<USER>\\.codex\\packages\\standalone\\releases\\0.154.0-x86_64-pc-windows-msvc\\bin, resources C:\\Users\\<USER>\\.codex\\packages\\standalone\\releases\\0.154.0-x86_64-pc-windows-msvc\\codex-resources, path C:\\Users\\<USER>\\.codex\\packages\\standalone\\releases\\0.154.0-x86_64-pc-windows-msvc\\codex-path)",
        "platform": "windows-x86_64",
        "version": "0.154.0"
      },
      "remediation": null,
      "durationMs": 0
    },
    "runtime.search": {
      "id": "runtime.search",
      "category": "search",
      "status": "ok",
      "summary": "search command found (bundled); execution not verified",
      "details": {
        "search command": "C:\\Users\\<USER>\\.codex\\packages\\standalone\\releases\\0.154.0-x86_64-pc-windows-msvc\\codex-path\\rg.exe",
        "search command readiness": "file exists",
        "search provider": "bundled"
      },
      "remediation": null,
      "durationMs": 0
    },
    "sandbox.helpers": {
      "id": "sandbox.helpers",
      "category": "sandbox",
      "status": "ok",
      "summary": "sandbox configuration is readable",
      "details": {
        "approval policy": "OnRequest",
        "codex-linux-sandbox helper": "none",
        "denied-read glob rules": "0",
        "denied-read restrictions": "false",
        "denied-read rules": "0",
        "execve wrapper helper": "none",
        "filesystem sandbox": "restricted",
        "glob scan max depth": "unbounded",
        "managed filesystem source": "none",
        "network sandbox": "restricted",
        "sandbox backend": "elevated",
        "sandbox provisioning": "complete"
      },
      "remediation": null,
      "durationMs": 1
    },
    "security.endpoint": {
      "id": "security.endpoint",
      "category": "security",
      "status": "warning",
      "summary": "endpoint protection detected; Codex exclusions are unverified",
      "details": {
        "Codex exclusions": "not verified",
        "endpoint products": "Microsoft Defender",
        "exclusion targets": "signed Codex app; codex.exe; codex-windows-sandbox-setup.exe; codex-command-runner.exe; codex-code-mode-host.exe"
      },
      "issues": [
        {
          "severity": "warning",
          "cause": "Microsoft Defender can interfere with Codex. Verify Codex exclusions.",
          "measured": "not verified",
          "expected": "Codex application and helper exclusions",
          "remedy": "Microsoft Defender: Add a certificate or executable-path exclusion for Codex and its helpers. If Attack Surface Reduction blocks Codex, add a rule exclusion. If Controlled Folder Access blocks Codex, allow the app.",
          "fields": [
            "Codex exclusions"
          ]
        }
      ],
      "remediation": "ask your security administrator to verify Codex exclusions and required helper allowances",
      "durationMs": 24
    },
    "state.paths": {
      "id": "state.paths",
      "category": "state",
      "status": "ok",
      "summary": "state paths and databases are inspectable",
      "details": {
        "CODEX_HOME": "C:\\Users\\<USER>\\.codex (dir)",
        "active rollout files": "394 files, 6921941893 total bytes, 17568380 average bytes",
        "archived rollout files": "0 files, 0 total bytes, 0 average bytes",
        "goals DB": "C:\\Users\\<USER>\\.codex\\goals_1.sqlite (file)",
        "goals DB integrity": "ok",
        "log DB": "C:\\Users\\<USER>\\.codex\\logs_2.sqlite (file)",
        "log DB integrity": "ok",
        "log dir": "C:\\Users\\<USER>\\.codex\\log (dir)",
        "memories DB": "C:\\Users\\<USER>\\.codex\\memories_1.sqlite (file)",
        "memories DB integrity": "ok",
        "queue DB": "C:\\Users\\<USER>\\.codex\\queue_1.sqlite (file)",
        "queue DB integrity": "ok",
        "sqlite home": "C:\\Users\\<USER>\\.codex (dir)",
        "standalone release cache": "1 entries in C:\\Users\\<USER>\\.codex\\packages\\standalone\\releases",
        "state DB": "C:\\Users\\<USER>\\.codex\\state_5.sqlite (file)",
        "state DB integrity": "ok",
        "thread history DB": "C:\\Users\\<USER>\\.codex\\thread_history_1.sqlite (file)",
        "thread history DB integrity": "ok"
      },
      "remediation": null,
      "durationMs": 1252
    },
    "state.rollout_db_parity": {
      "id": "state.rollout_db_parity",
      "category": "threads",
      "status": "ok",
      "summary": "rollout files and state DB thread inventory agree",
      "details": {
        "default model provider": "openai",
        "rollout DB active files": "394",
        "rollout DB active rows": "394",
        "rollout DB archive mismatches": "0",
        "rollout DB archived files": "0",
        "rollout DB archived rows": "0",
        "rollout DB duplicate DB paths": "0",
        "rollout DB duplicate rollout thread ids": "0",
        "rollout DB malformed file names": "0",
        "rollout DB missing active rows": "0",
        "rollout DB missing archived rows": "0",
        "rollout DB model providers": "openai=394",
        "rollout DB rows": "394",
        "rollout DB scan cap reached": "false",
        "rollout DB scan errors": "0",
        "rollout DB sources": "cli=206, subagent:other=181, vscode=4, exec=2, subagent:thread_spawn=1",
        "rollout DB stale rows": "0"
      },
      "remediation": null,
      "durationMs": 160
    },
    "system.disk": {
      "id": "system.disk",
      "category": "disk",
      "status": "ok",
      "summary": "sufficient free disk space (1064.2 GiB)",
      "details": {
        "CODEX_HOME available": "1064.2 GiB",
        "failure threshold": "1.0 GiB",
        "warning threshold": "5.0 GiB",
        "worktree available": "1064.2 GiB"
      },
      "remediation": null,
      "durationMs": 0
    },
    "system.environment": {
      "id": "system.environment",
      "category": "system",
      "status": "ok",
      "summary": "OS language en-US",
      "details": {
        "EDITOR": "not set",
        "VISUAL": "not set",
        "os": "Windows 10.0.26200 (Windows 11 Professional) [64-bit]",
        "os language": "en-US",
        "os type": "Windows",
        "os version": "10.0.26200"
      },
      "remediation": null,
      "durationMs": 0
    },
    "terminal.env": {
      "id": "terminal.env",
      "category": "terminal",
      "status": "ok",
      "summary": "terminal metadata was detected",
      "details": {
        "WT_SESSION": "present",
        "color output": "disabled (stdout is not a terminal)",
        "console input code page": "850",
        "console output code page": "65001",
        "stderr console mode": "0x00000007 (VT processing: true)",
        "stderr is terminal": "true",
        "stdin is terminal": "true",
        "stdout console mode": "unavailable",
        "stdout is terminal": "false",
        "terminal": "Windows Terminal",
        "terminal size": "148x43"
      },
      "remediation": null,
      "durationMs": 0
    },
    "terminal.title": {
      "id": "terminal.title",
      "category": "title",
      "status": "ok",
      "summary": "terminal title configured",
      "details": {
        "terminal title activity": "true",
        "terminal title items": "activity, project-name",
        "terminal title project source": "cwd",
        "terminal title project value": "<USER>",
        "terminal title source": "configured"
      },
      "remediation": null,
      "durationMs": 0
    },
    "updates.status": {
      "id": "updates.status",
      "category": "updates",
      "status": "ok",
      "summary": "update configuration is locally consistent",
      "details": {
        "cached latest version": "0.154.0",
        "check for update on startup": "true",
        "desktop application": "OpenAI.Codex",
        "desktop latest build": "26.903.9818.0",
        "desktop update status": "available",
        "dismissed version": "0.136.0",
        "last checked at": "2026-09-10T09:48:09.822567800Z",
        "latest version": "0.154.0",
        "latest version status": "current version is not older",
        "update action": "standalone installer",
        "version cache": "C:\\Users\\<USER>\\.codex\\version.json"
      },
      "remediation": null,
      "durationMs": 454
    }
  }
}

What issue are you seeing?

Codex CLI 0.154.0 (standalone) cannot start the background server on Windows 11. It reports:

Error: host Job Object prevents daemon detachment; start from a host that allows breakaway

What steps can reproduce the bug?

1. Open PowerShell as a regular user.

2. Run:

   codex app-server daemon start

3. The command fails with the Job Object error.

Also reproduced with PowerShell -NoProfile.

What is the expected behavior?

The background server starts successfully and continues running after the terminal is closed.

Additional information

The error is returned when in_job != 0 in windows.rs.

A separate native probe using CREATE_SUSPENDED | DETACHED_PROCESS | CREATE_BREAKAWAY_FROM_JOB successfully creates and runs a child process. The child remains in a Job Object. Its immediate job has flags 0x1800:

• BREAKAWAY_OK: enabled
• SILENT_BREAKAWAY_OK: enabled
• KILL_ON_JOB_CLOSE: disabled

The machine supports Modern Standby, and Desktop Activity Moderator (DAM) is running. DAM may explain why the process remains in a job, but this has not been confirmed.

[84dnnvbdvp-debug]

One distinction seems important before treating IsProcessInJob(...)=TRUE as proof that this host cannot support a daemon.

Current ensure_detached_launch() already launches the probe with CREATE_BREAKAWAY_FROM_JOB, then rejects it solely because the child is still in some job. Windows' nested-job rules explicitly allow a breakaway child to leave the immediate job and successive parents only until it reaches a parent that does not permit breakaway: https://learn.microsoft.com/en-us/windows/win32/procthread/nested-jobs. So residual membership after a successful CREATE_BREAKAWAY_FROM_JOB is a valid nested-job outcome, not by itself evidence that the child's lifetime is still coupled to the launcher.

The useful next discriminator may be lifecycle rather than membership: with the same native probe, let the launcher exit and verify from a separate observer whether the child actually survives. Pair that with a control where the residual job has JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE, which Microsoft documents as terminating associated processes when the last job handle closes: https://learn.microsoft.com/en-us/windows/win32/procthread/job-objects. If the Modern Standby/DAM case remains in_job != 0 but survives launcher/terminal exit, the current guard is rejecting a benign residual association. If it dies, the existing refusal is doing real work and the remaining job/ancestor limits are the place to inspect.

That regression would also avoid assuming KILL_ON_JOB_CLOSE is the only relevant limit; jobs can impose other constraints. The narrower claim is just that IsProcessInJob(NULL) answers membership, while the daemon requirement is really about whether the residual job chain makes independent lifetime unsafe.

[etraut-openai]

(response written by codex)

Thanks for the detailed report. The current code rejects a child that remains in any Job Object, both during the launch probe and after the actual daemon starts. Windows permits residual job membership after breakaway, so that check alone doesn’t establish that the daemon cannot survive terminal closure.

Could you share the native probe source and check whether its child survives both launcher exit and closing the terminal, using a separate observer? The reported 0x1800 flags describe the immediate job; they don’t rule out restrictions in ancestor jobs.

That would help confirm whether we’re rejecting a harmless system-managed job and provide a regression case. DAM is a plausible explanation, but its involvement is still unconfirmed.