fix(windows): avoid PowerShell WindowStyle argv under Bun

[Ingwannu]

Summary

• remove the redundant PowerShell CLI pair -WindowStyle Hidden from direct Bun/Node PowerShell child invocations used by identity, ACL principal, process inspection, config PID validation, tray, and update paths
• retain windowsHide: true, hidden VBS/.NET launch behavior, trusted System32 PowerShell resolution, non-interactive flags, and existing timeouts
• keep inner Start-Process -WindowStyle Hidden calls unchanged because the reported failure is specific to the direct PowerShell CLI argv under Bun
• document the Windows launch boundary and add regressions that prevent the incompatible argv pair from returning

Fixes #1589.

Verification

• focused Windows/config/update suite — 280 passed, 1 Windows-only integration test skipped on Linux, 0 failed
• bun x tsc --noEmit — passed
• bun run privacy:scan — passed
• git diff --check — passed
• source scan confirms remaining WindowStyle uses are only inner Start-Process, .NET ProcessStartInfo, PowerShell script, or VBS window-style controls

Platform note

The affected Bun 1.3.14 + Windows 11 execution path cannot be reproduced on this Linux host. Exact-head Windows CI and a reporter/maintainer Windows smoke test are required before merge.

Scope

Windows bug fix and architecture documentation only. No GUI direction or unrelated text change.

Summary by CodeRabbit

• Bug Fixes

  • Improved Windows compatibility by preventing PowerShell window-style arguments from causing failures on Windows 11.
  • Background commands, updates, tray actions, and identity lookups continue running without displaying unwanted console windows.
  • Preserved non-interactive execution and existing process-hiding behavior.

• Documentation

  • Clarified the recommended approach for launching hidden PowerShell processes on Windows.

• Tests

  • Added and updated coverage to verify hidden execution and command compatibility.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e68e3547-efe8-45c5-a9b0-f691539ad40c

📥 Commits

Reviewing files that changed from the base of the PR and between c6688c7 and 6b01b95.

📒 Files selected for processing (12)

• src/codex/app-server-processes.ts
• src/codex/user-identity.ts
• src/config.ts
• src/lib/windows-user-principal.ts
• src/tray/windows.ts
• src/update/job.ts
• structure/02_config-and-codex-home.md
• tests/codex-app-server-processes.test.ts
• tests/windows-deploy-close-regressions.test.ts
• tests/windows-popup-fix.test.ts
• tests/windows-tray.test.ts
• tests/windows-user-principal.test.ts

💤 Files with no reviewable changes (3)

• src/config.ts
• src/tray/windows.ts
• src/lib/windows-user-principal.ts

---

📝 Walkthrough

Walkthrough

Removed -WindowStyle Hidden from direct Windows PowerShell invocations. Process spawning continues to use windowsHide: true. Tests and documentation now enforce and describe this behavior across identity, process, tray, configuration, and update paths.

Changes

Windows PowerShell process handling

Layer / File(s)	Summary
Direct PowerShell command paths src/codex/user-identity.ts, src/lib/windows-user-principal.ts, src/config.ts, src/codex/app-server-processes.ts	Identity, principal, configuration, and process lookups no longer pass -WindowStyle Hidden. Existing windowsHide: true and non-interactive options remain in place. Comments in src/codex/user-identity.ts:106-108 document the Bun 1.3.14 compatibility issue.
Tray and update process paths src/tray/windows.ts, src/update/job.ts	Tray command builders and update-related Start-Process invocations at src/update/job.ts:581 and src/update/job.ts:1389 remove the explicit PowerShell window-style argument.
Regression contracts and documentation tests/*, structure/02_config-and-codex-home.md	Tests verify hidden process spawning, trusted and non-interactive PowerShell arguments, and removal of -WindowStyle Hidden. Documentation records the direct-invocation rule and distinguishes it from Start-Process -WindowStyle Hidden.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🟡 Moderate · up to 6b01b

This change removes incompatible PowerShell command-line arguments from several Windows paths, but merge should wait for Windows CI and a Windows 11 smoke test because the affected Bun-on-Windows behavior cannot be validated on Linux.

Possibly related PRs

• lidge-jun/opencodex#838: Modifies Windows PowerShell update-worker process behavior.
• lidge-jun/opencodex#1279: Modifies Windows PowerShell process and identity lookup paths.
• lidge-jun/opencodex#1347: Modifies the same Windows PowerShell lookup sites and window suppression behavior.

Suggested labels: review-ready

Suggested reviewers: lidge-jun, wibias

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the Windows fix: avoiding PowerShell WindowStyle arguments when Bun launches processes.
Linked Issues check	✅ Passed	The changes satisfy issue #1589 by removing direct WindowStyle arguments, retaining windowsHide, preserving Start-Process usage, and adding regression tests.
Out of Scope Changes check	✅ Passed	The changes remain within issue #1589 scope and cover affected Windows call sites, documentation, and regression tests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/1589-windows-powershell-windowstyle

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[lidge-jun]

[Repository bug audit · 2026-08-14]

The change is internally consistent: direct PowerShell child argv drops -WindowStyle Hidden, process-level hiding remains in place, the trusted executable/timeouts are preserved, and the regression coverage prevents the incompatible pair from returning. Cross-platform CI and React Doctor are green on this exact head.

Recommended merge order: land this before #1678 and rebase #1678 afterward, because both touch windowsIdentityPowerShellCommand; the localized-path fix must retain its deterministic Base64/UTF-16 output while inheriting this PR's argv contract.

[lidge-jun]

Cherry-picked onto dev as part of the bug resolution campaign (commit-and-merge loop). Changes verified with typecheck and focused tests.