[andy-xu-db]

Follows #1187 (macOS, merged); this PR's diff is the Windows change only.

What

Extends the Codex desktop OTEL login service from the previous PR in this stack to Windows: a per-user logon task com.databricks.ug-codex-otel that needs no admin rights. It runs the venv's pythonw.exe -m ucode.cli otel-proxy, so no console window appears.

Notes

• Task Scheduler keeps its own copy of the task, so ug keeps the XML it registered in ~/.ucode to track ownership and the port. The file is UTF-16, the encoding schtasks reads, so write_text_file gains an encoding argument.
• Like macOS, Windows returns early from the shared functions, so the Linux and macOS code is untouched; the Linux unit is still byte-identical to main.
• A changed definition runs /End before /Create /F, which would otherwise leave the old proxy running. IgnoreNew keeps /Run from starting a second proxy next to a running one.

Validation

• A component test simulates schtasks and checks the task XML, the UTF-16 file, an unchanged launch, a workspace change, and removal. It passes in the Windows unit-test CI job.
• just lint passes; tests/test_agent_codex.py passes. The 7 full-suite failures (test_agents_init update prompts, test_e2e_user_agent) fail the same way on main.
• End to end on a GitHub windows-latest runner, with ug installed by uv tool install, the real Databricks CLI, and Codex's real codex app-server, against a local fake workspace:
  • ug configure writes the exporter and registers the task; the proxy listens within ~2s under windowless pythonw.exe.
  • App-server sessions export OTLP traces with the Databricks token, before and after a simulated logout/login (/End + /Run).
  • Disabling tracing removes the exporter and the task.
• A standard (non-admin) user registered the task as their own At logon time / Interactive only task, and removal worked.

Limits

• Marked shortcut: in code: a crashed proxy waits for the next logon or ug codex launch, and the task doesn't get the shell's DATABRICKS_* overrides.
• The non-admin run couldn't start the task because that test user had no desktop session; a real user configuring from their own session wasn't tested.
• Not run with a real workspace, a real reboot, or the Codex desktop app itself (only its app server).

This pull request and its description were written by Isaac.

[github-actions]

Polly AI Review

Blocking issues

• Cross-workspace trace leakage — src/ucode/agents/codex.py:717. Can we roll back the saved XML when /Create fails? Otherwise a later /Query succeeds against the old task, and /Run sends workspace B’s desktop traces to workspace A.

  The XML is updated before task registration succeeds. If registration fails while the previous task remains registered, subsequent runs consider B’s definition unchanged and never retry registration. The existing exporter still targets the same port.

  Extend tests/test_agent_codex.py::TestCodexManagedConfig::test_desktop_tracing_scheduled_task_lifecycle: fail /Create during an A→B change, retry, and assert B’s task is registered before /Run.

Security vulnerabilities

The blocker above can expose traces to the previously configured workspace. No additional security vulnerabilities were identified.

Non-blocking notes

None.

Approach

The per-platform service definitions fit the existing lifecycle. Preserve retryability by rolling back the saved definition after registration failure. _run_systemctl could also delegate to _run_service_command instead of duplicating its subprocess/error wrapper.

Summary

Diff size (computed): 6 files; +296 / -30 lines (326 changed text lines); 0 binary files.

Category	Files	Added	Deleted	Share of changed text lines
Tests and test support	2	130	2	40.5%
Documentation	2	12	7	5.8%
Dependencies and lockfiles	0	0	0	0.0%
Implementation / other	2	154	21	53.7%

Shares use additions + deletions, including generated text and lockfiles. Binary files have no line count. Tests include fixtures/helpers under test paths and colocated test/spec files; categories are path-based, not coverage measurements.

Changes

The diff enables persistent Codex desktop tracing through a macOS LaunchAgent and a Windows per-user scheduled task. Shared changes provide service environment construction, definition/port parsing, and UTF-16 file writing. Documentation describes the platform-specific setup and diagnostics.

The size is proportional to that outcome. Consolidating the duplicate subprocess wrappers is a concrete, small reduction; the platform-specific definitions otherwise serve distinct requirements.

Tests

Test-by-test assessment

Test / case	Behavior protected	Layer	Needed?	Action / rationale
tests/test_agent_codex.py::TestCodexManagedConfig::test_desktop_tracing_launch_agent_lifecycle	Plist contents and environment, stable port, unchanged launch, workspace replacement, and disable cleanup	Component with simulated launchctl	keep	Provides distinct coverage of the LaunchAgent lifecycle and plist port parsing.
tests/test_agent_codex.py::TestCodexManagedConfig::test_desktop_tracing_scheduled_task_lifecycle	UTF-16 task XML, command arguments and user, unchanged launch, replacement ordering, and removal	Component with simulated schtasks	keep	Protects Windows-specific serialization and lifecycle behavior. Failed replacement followed by retry is not covered.
tests/README.md — Codex desktop OTEL coverage paragraph	Documents simulated service coverage and native login/reboot limitations	Documentation	keep	Accurately distinguishes component assertions from native platform validation; introduces no executable cases.

Both added test methods are accounted for; no existing test cases were modified or removed.

Existing tests/test_agent_codex.py::TestCodexManagedConfig::test_desktop_tracing_lifecycle covers shared warning behavior, preservation of another exporter, and revert. Existing CLI/proxy tests cover workspace-specific proxy configuration and fixed-port behavior. These do not protect against a failed scheduled-task replacement being treated as successfully applied.

Component testing is the appropriate layer for the replacement/retry regression. Native validation uniquely establishes actual Task Scheduler registration, interactive logon, and windowless behavior. The PR describes platform exercises but leaves real non-admin desktop-session and reboot behavior unverified.

Tests were not executed during this review. Findings are based on the frozen diff and trusted-checkout context.

Scope

No unrelated changes were found. The macOS changes included in the full stacked diff, Windows task support, shared helpers, tests, and documentation all support persistent Codex desktop tracing. No unresolved scope questions were identified.

---

_{Automated review by Polly · workflow run}

[andy-xu-db]

/merge