Codex CLI quietly installs a self-updating background daemon

A user going by Yihua-Liu-1997 opened an issue on GitHub addressed to the developers of Codex CLI, OpenAI's console tool. Starting with version 0.157.0, simply opening an interactive session leads to unexpected consequences, and the author asks that the daemon_auto_start option be disabled by default, or at least that permission be requested once.

What happens on launch

As described, starting a session spins up a persistent background daemon (codex app-server --managed-daemon). It runs with no terminal, in its own session, and keeps living after all Codex windows are closed — the process gets reparented to PID 1 and stops only via a separate command or on reboot.

The daemon then copies the entire platform package — about 374 MB, including the binaries and the bundled bwrap, zsh and rg — into the ~/.codex/packages/ directory and runs from that copy from then on. At this point the backend's version becomes decoupled from the CLI version installed by the package manager.

A background updater starts up separately: it checks for updates five minutes after launch, then hourly, downloads new releases and restarts the backend. According to the author, such a restart can interrupt active tasks after a 60-second grace period.

There's also a side effect involving the environment: the daemon remembers the variables of whichever session spawned it. If Codex is launched through a wrapper that sets HTTPS_PROXY for each invocation, all outgoing traffic goes through the proxy of the first session regardless of the settings of any later ones.

What is being asked of the developers

The author argues that, for a CLI, the least surprising behavior is for the backend to live and die with the window, to run exactly the installed binary, and not to update itself on the sly. A shared self-updating daemon makes sense for a desktop application or a Remote Control mode, but not as a silent default. And if it is left enabled, he asks that at the very least the auto-started daemon be terminated when the last client disconnects, and that it not copy itself if the CLI was installed via npm, brew or pacman.

Along the way a bug surfaced: the command to stop the daemon doesn't kill the updater process, and it has to be terminated by hand.

The community's reaction

The discussion drew plenty of sympathizers. One participant wrote that the CLI is “unusable” until the problem is fixed. Others put it more bluntly: the tool's behavior, in their words, resembles the hallmarks of malware, and someone even doubted that it had arisen by accident. Judging by the comments, the developers have already prepared a commit that disables the daemon's auto-start by default.

Source: Hacker News