Codex CLI installs a persistent, self-updating background daemon by default

CLI — 0.157.0, installed via npm install -g @openai/codex, Linux (WSL2)

CLI — 0.157.0，通过 npm install -g @openai/codex 安装，Linux (WSL2)

Please make daemon_auto_start opt-in (default false) for the CLI, or at least ask once before turning it on.

请将 CLI 的 daemon_auto_start 设置为选择性加入（默认关闭），或者至少在开启前询问一次。

Since 0.157.0, just opening an interactive codex session:

自 0.157.0 版本起，只需打开一个交互式 codex 会话：

For a CLI, the least surprising default is that the backend lives and dies with the window, runs the binary I installed, and doesn’t update itself in the background. A shared, self-updating daemon makes sense for Remote Control / the desktop app, so it would be fine to enable it there, or when the user explicitly runs codex app-server daemon start / bootstrap.

对于 CLI 而言，最符合预期的默认设置是后端随窗口的开启而启动、随窗口的关闭而终止，运行我所安装的二进制文件，且不会在后台自动更新。共享的、自更新的守护进程对于远程控制或桌面应用来说是有意义的，因此在这些场景下启用它是可以接受的，或者当用户明确运行 codex app-server daemon start / bootstrap 时启用也可以。

If it stays on by default, please at least:

如果它必须保持默认开启，请至少做到：

Bug found while turning it off: codex app-server daemon stop stops the app-server but leaves the pid-update-loop updater running (still alive 70 s later, had to kill it manually).

在关闭时发现的错误：codex app-server daemon stop 命令停止了应用服务器，但 pid-update-loop 更新程序仍在运行（70 秒后依然存活，必须手动终止）。

Workaround I’m using:

我正在使用的临时解决方案：

With the flag off, a new TUI session no longer spawns a daemon.

关闭该标志后，新的 TUI 会话不再生成守护进程。

Related: #40969, #41188, #46468, #48050, #42457, #37537

相关问题：#40969, #41188, #46468, #48050, #42457, #37537

@Yihua-Liu-1997 thanks for reporting this, I hit it myself… stuff should not be creating mystery servers and processes all of a sudden on small version number bumps without giving people a heads-up…

@Yihua-Liu-1997 感谢反馈，我也遇到了同样的问题……在小版本更新时，不应在未告知用户的情况下突然创建神秘的服务器和进程……

agreed. the CLI is unusable until this is fixed.

同意。在修复此问题之前，CLI 无法使用。

I can confirm this on Windows 10 LTSC with Codex CLI 0.157.0 Setting daemon_auto_start = false in config.toml resolves the issue

我可以在 Windows 10 LTSC 上使用 Codex CLI 0.157.0 确认此问题。在 config.toml 中设置 daemon_auto_start = false 可以解决该问题。

Two improvements would help:

以下两项改进会有所帮助：

This would preserve the security restrictions without disrupting the normal CLI workflow.

这样既能保持安全限制，又不会干扰正常的 CLI 工作流程。

@tagorr Indeed — both 1 and 2 would work~

@tagorr 确实如此——方案 1 和 2 都可行~

codex: disable daemon auto-start by default

codex：默认禁用守护进程自动启动

The Codex CLI is unusable due to this bug on Windows.

由于此错误，Codex CLI 在 Windows 上无法使用。

This is terrible. I can’t input anything on the CLI at all. You should fix this problem as soon as possible and give us 100 banked reset!

这太糟糕了。我在 CLI 上根本无法输入任何内容。你们应该尽快修复这个问题，并给我们 100 次重置机会！

There is a useful provenance boundary behind this request:

此请求背后存在一个有用的来源界限：

installed CLI identity != daemon execution identity

已安装的 CLI 身份 != 守护进程执行身份

Once the CLI copies itself into a managed release directory and a background updater can replace that copy, the process that services a later turn is no longer necessarily the artifact the user explicitly installed or invoked.

一旦 CLI 将自身复制到受管理的发布目录中，且后台更新程序可以替换该副本，那么后续提供服务的进程就不一定再是用户明确安装或调用的原始程序了。

I would make the daemon expose a small execution receipt for each client attachment containing at least:

我建议让守护进程为每个客户端连接提供一份简短的执行凭证，至少包含：

client_cli_version + daemon_binary_digest + daemon_generation + updater_state + inherited_environment_generation

客户端 CLI 版本 + 守护进程二进制摘要 + 守护进程代次 + 更新程序状态 + 继承的环境代次

Then a client can distinguish:

这样客户端就可以区分：

A strong regression would start the daemon under environment A, attach from environment B, update the installed CLI, and verify that the client can see exactly which daemon generation/binary/environment is authoritative for the turn rather than inferring it from the foreground CLI version.

一个强回归测试应当在环境 A 下启动守护进程，从环境 B 进行连接，更新已安装的 CLI，并验证客户端能否准确识别出当前回合由哪个守护进程代次、二进制文件或环境负责，而不是仅仅根据前台 CLI 版本进行推断。

Related runtime behavioral-integrity work: https://github.com/AETHERXGLOBAL/execsurface

相关的运行时行为完整性工作：https://github.com/AETHERXGLOBAL/execsurface

Update codex to 0.160.1 with a sandbox patch for nix-user-chroot

将 codex 更新至 0.160.1，包含针对 nix-user-chroot 的沙盒补丁

feat(codex): package Codex CLI from official release binaries

feat(codex)：从官方发布二进制文件打包 Codex CLI

Add Oct 12 tech news (incremental scan window 18:00-19:00 UTC Oct 12 …

添加 10 月 12 日科技新闻（增量扫描窗口 10 月 12 日 18:00-19:00 UTC……

Basically - a trait of malware. TBF I don’t even think this was done by accident

基本上——这是恶意软件的特征。平心而论，我不认为这是无意中造成的。

+1 for disabling this

+1 支持禁用此功能。

Basically - a trait of malware. TBF I don’t even think this was done by accident

基本上——这是恶意软件的特征。平心而论，我不认为这是无意中造成的。

Honestly, that’s exactly what it feels like.

老实说，感觉确实如此。

The part in the docs about wanting full read/write access to the entire host filesystem is why I’m running codex-cli in a hardened Raspberry Pi and ssh’ing into it.

文档中提到需要对整个主机文件系统进行完全读写访问，这就是我为什么在加固后的树莓派上运行 codex-cli 并通过 SSH 连接的原因。

No daemons running that I can see, v0.160.0 from last week.

我没看到有任何守护进程在运行，使用的是上周的 v0.160.0 版本。

So codex is a virus at this point? Won’t be surprised if they use it to create a botnet of those sweet residential IPs for web scrapping

所以 codex 现在是病毒了吗？如果他们利用它建立一个由那些优质住宅 IP 组成的僵尸网络来进行网页抓取，我一点也不会感到惊讶。

Maybe worth a new issue, but I also found that it leaks the environment variables of the first directory from which you run codex. Start it in one directory and set some env var (I use direnv and envrc files). Then start it in another directory with different values for the same env vars. If you ask the agent to do anything with those env vars, it uses the ones from the first directory. This breaks workflows that use common env var names (GH_TOKEN, etc).

也许值得开一个新的议题，但我还发现它会泄露你首次运行 codex 时所在目录的环境变量。在一个目录中启动它并设置一些环境变量（我使用 direnv 和 envrc 文件）。然后在另一个目录中启动它，并为相同的环境变量设置不同的值。如果你要求代理使用这些环境变量执行任何操作，它会使用第一个目录中的值。这会破坏使用通用环境变量名（如 GH_TOKEN 等）的工作流程。

The supported opt-out is still invisible in the official config reference. I fetched the complete page today: it has zero daemon_auto_start rows while documenting the CLI’s own check_for_update_on_startup. The 0.157.0 release note still gives the change one sentence — “Enabled automatic background-server startup for eligible interactive sessions, with recovery choices when server settings are incompatible” — without naming the persistent process, the managed package copy, or the hourly updater. #40969 is still open on the updater’s 60-second drain followed by SIGKILL.

官方配置参考中仍然看不到支持的退出选项。我今天抓取了完整页面：它记录了 CLI 自身的 check_for_update_on_startup，但关于 daemon_auto_start 的条目为零。0.157.0 的发布说明中仅用一句话描述了这一变更——“为符合条件的交互式会话启用了后台服务器自动启动，并在服务器设置不兼容时提供恢复选项”——却未提及持久化进程、受管理的包副本或每小时运行的更新程序。#40969 议题仍处于开启状态，涉及更新程序 60 秒的清理过程及随后的 SIGKILL 信号。

@aetherxeg-source’s execution-receipt proposal is the useful boundary here: client version, daemon binary digest/generation, updater state, and inherited-environment generation. @alexklibisz’s fresh environment report makes the last field concrete. I traced those current docs and source threads rather than running the daemon; source trail: https://bokonon.ai/notes/2026-10-12-codex-omits-daemon-auto-start/

@aetherxeg-source 提出的执行凭证建议是此处的关键界限：客户端版本、守护进程二进制摘要/代次、更新程序状态以及继承的环境代次。@alexklibisz 关于新环境的报告使最后一个字段变得具体。我追踪了当前的文档和源代码线程，而不是运行该守护进程；来源路径：https://bokonon.ai/notes/2026-10-12-codex-omits-daemon-auto-start/