An unofficial, fail-closed containment guard for a Codex Desktop for Windows failure mode where ChatGPT.exe repeatedly launches taskkill.exe /t /f, accumulates conhost.exe processes, overloads WMI, and can make the whole machine—including Task Manager—unresponsive.
Related upstream reports: #33776, #34260, #34579, #34730.
This project is a temporary community workaround, not an upstream fix and not an OpenAI product. The upstream tracking issue is openai/codex#34260.
- Uses native Windows process snapshots instead of WMI.
- Watches only the official Codex package family
OpenAI.Codex_2p2nqsd0c76g0. - Requires the package-relative parent path
app\ChatGPT.exe. - Requires the exact helper path
%SystemRoot%\System32\taskkill.exe. - Identifies processes by PID plus creation time and verifies direct parentage.
- Latches after two consecutive samples with at least two direct
taskkill.exechildren. - Temporarily isolates the storm by retaining no cleanup helpers.
- Runs the guard above normal and lowers only the exact offending Codex parent below normal.
- Releases isolation after ten continuously quiet seconds.
- Fails closed if any package, path, identity, or parent check is uncertain.
It does not terminate Codex, terminate conhost.exe directly, restart Codex, edit the signed MSIX package, disable Defender, or reconfigure WMI.
In one repeatable 30-second Windows workload:
| Metric | Before | With guard |
|---|---|---|
Peak taskkill.exe |
26 | 5 |
Peak conhost.exe |
39 | 17 |
| WMI CPU share | ~14.4% | ~1.83% |
| Guard CPU share | — | ~1.5% |
These are measurements from one affected machine, not a universal benchmark.
- Windows 10 or 11 x64
- Microsoft Store/MSIX Codex Desktop package
- PowerShell 7 (
pwsh) - Windows Python with an adjacent
pythonw.exe
The guard follows Store updates as long as the package family and app\ChatGPT.exe contract remain unchanged.
Open PowerShell in the repository root:
pwsh -NoProfile -File .\scripts\codex-desktop-recovery.ps1 -InstallGuardInstallation is transactional. It validates the staged configuration, registers the per-user scheduled task CodexDesktopTaskkillGuard, starts it immediately, and requires a healthy matching heartbeat. A failed update restores the previous runtime and task definition.
Installed state is stored under:
%LOCALAPPDATA%\CodexTaskkillGuard
pwsh -NoProfile -File .\scripts\codex-desktop-recovery.ps1 -GuardStatusA healthy result includes:
{
"task_registered": true,
"config_valid": true,
"heartbeat_present": true,
"heartbeat_stale": false,
"package_family_mismatch": false
}The local audit log is %LOCALAPPDATA%\CodexTaskkillGuard\guard.jsonl.
pwsh -NoProfile -File .\scripts\codex-desktop-recovery.ps1 -UninstallGuardUninstall requests a graceful stop, removes only the named scheduled task and installed runtime/configuration, and retains audit logs.
Every termination still requires a live handle whose creation time and exact image path match the previously observed process. The parent must still have the expected Codex package family and executable suffix.
During an active storm, Codex cleanup helpers are intentionally prevented from completing. This preserves machine responsiveness but can leave an individual tool child running. The guard never broadens its target set to compensate. Fully exit Codex if you need to clear such leftover child processes.
python -m unittest scripts.tests.test_codex_taskkill_guard scripts.tests.test_codex_desktop_recovery
pwsh -NoProfile -File .\scripts\tests\codex-desktop-recovery.Tests.ps1The current suite contains 34 Python tests plus PowerShell installation, rollback, task-definition, and status fixtures.
The launcher also contains older -Analyze, -Apply, and -RestoreLatest modes for a separately documented exact-build app.asar hotfix. They are not needed for the taskkill guard and remain version/hash gated. See the legacy design note.
Reproductions should include the Codex package version, bounded process counts, direct parent evidence, and guard status. Do not upload raw Codex logs, prompts, credentials, usernames, private paths, or repository contents.