[luvs01]

Summary

A Windows CLI installer can leave descendants running after its primary process exits. This adds an internal Windows x64 helper that owns the process tree through a Job object and reports a terminal result only after the original primary handle is signaled and the Job's active-process count reaches zero.

Creation is suspended until Job assignment succeeds. STARTUPINFOEXW restricts inherited handles to owned standard handles, and a private overlapped named pipe drains bounded output without blocking synchronous pipe polling. Wait/query failures remain unknown; exit code 259 is a valid exit code.

Installer and pack policies add no deadline, process-count cap or kill-on-close behavior. The version-probe policy alone uses the existing eight-second deadline and separate one-second reap window. Failure paths retain owned lifetime until it can be reconciled and close each acquired handle once.

Stacked on #7596, targeting codex/windows-cli-provenance-stack-20261023. This is an eleven-file helper/fixture delta above refreshed parent f7e55ab0; after the parent lands, retarget to dev and verify the combined head.

Scope and follow-up

No production consumer imports this helper yet, and Windows apply remains disabled. Integration must adopt ownership before every pack/install/probe spawn and retain the lease and staging while lifetime is unknown. This supplies one prerequisite for #2811; it is not complete Windows update support.

This is process-lifetime ownership, not an OS sandbox. ARM64 is unsupported. WMI-created escape processes and reverse inheritance by an unrelated unrestricted CreateProcess call are outside the guarantee.

Verification

• Current head 0a4eb35a85007f7ad3e6c5948fe5150df92024e3 is a normal-merge composition of original head 3a260c0e and refreshed parent f7e55ab0 (current dev plus the shared Bun 1.4.4 baseline from chore(test): align Bun runner with the 1.4.4 security baseline #7627), plus the shared one-row CI duration-table correction. Helper implementations and their fixtures/tests are unchanged from the reviewed originals.
• Runtime and configured test runner are now both Bun 1.4.4.
• On this exact head, official Bun 1.4.4, native Windows x64, bun test --isolate --timeout 60000: tests/codex-integration/codex-cli-windows-child.test.ts 17 passed / 0 failed / 300 assertions, including the actual owned native child Job/pipe and reap-deadline cases; the cached-PAC reconnect case in tests/clients/desktop-compatibility-runtime.test.ts passed. Root tsc --noEmit, structure SSOT, skill-surface and scoped static checks all exited 0.
• The new duration-table row is a scheduling sample from a successful Bun 1.4.4 integration run, not a measurement of every current parent head.
• Dependency inputs are byte-identical across the eight refreshed heads; versus dev only testRunnerBun changes to 1.4.4.
• The stack fan-in head (feat(codex): apply Windows CLI updates with owned transactions #7648, bc08a484), which contains this change, passed 510 tests / 64 platform skips / 0 failures / 2,911 assertions across 18 units on the same validation.
• Remaining: no production consumer yet (per Scope), native POSIX/ARM64 execution, and required maintainer security acceptance. Current-head CI is pending on this head; additional native runs follow sequentially after the first wave. No live app, service, account or installation was changed.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.