From GitHub · Yihua-Liu-1997 · · 1m 20s
CLI: make daemon_auto_start opt-in for Codex
Codex CLI should require user permission to auto-start background daemon.
In brief
Codex CLI should require user permission to auto-start background daemon. Codex CLI should default to not auto-starting a persistent background daemon to prevent unintended system processes. Originally reported by GitHub.
Codex CLI issue
User reports Codex CLI 0.157.0 auto-starts a persistent background daemon without permission.
“CLI: make daemon_auto_start opt-in, a persistent, self-updating background daemon shouldn't be the default”
Background daemon behavior
Daemon runs in its own session with no TTY, keeps running after window closes, copies platform packages, and updates itself hourly.
“Starts a persistent background daemon (codex app-server, managed-daemon). It runs in its own session with no TTY and keeps running after every Codex window is closed (reparented to PID 1) until codex app-server daemon stop or a reboot.”
User impact
Users experience unintended system processes, proxy issues, and broken terminal hooks when daemon runs without permission.
“Pins the environment of whichever session happened to start it. I launch Codex through a wrapper that sets HTTPS_PROXY per invocation; the daemon keeps the first session's proxy variables and its outbound connections go through that proxy, whatever later sessions are launched with.”
Current default
Codex CLI 0.157.0 starts persistent background daemon by default without user confirmation.
“Since 0.157.0, just opening an interactive codex session: Starts a persistent background daemon (codex app-server, managed-daemon).”
User workaround
Users disable daemon_auto_start via config.toml to prevent unintended background processes.
“Setting daemon_auto_start = false in config.toml resolves the issue”
Security concerns
Background daemon creates security risks by running with elevated privileges and copying entire platform packages.
“Copies the whole platform package (~374 MB: codex, codex-code-mode-host, bundled bwrap / zsh / rg ) into ~/.codex/packages/app-server-daemon/releases/<version>/”
Update mechanism
Daemon runs hourly update loop that can kill active turns and restarts backend without user input.
“Starts a detached updater (codex app-server daemon pid-update-loop) that checks for updates 5 minutes after start and then hourly, downloads new releases and restarts the backend”
User complaints
Multiple users report CLI unusable due to background daemon causing input issues.
“This is terrible. I can't input anything on the CLI at all. You should fix this problem as soon as possible and give us 100 banked reset!”
Proposed fix
Make daemon_auto_start opt-in (default false) to require user permission before starting background daemon.
“Please make daemon_auto_start opt-in (default false ) for the CLI, or at least ask once before turning it on”
Related issues
Multiple related issues reported including proxy conflicts and daemon update problems.
“Related: #40969, #41188, #46468, #48050, #42457, #37537”
Fix implemented
Codex CLI 0.160.1 released with sandbox patch for nix-user-chroot to address daemon issues.
“Update codex to 0.160.1 with a sandbox patch for nix-user-chroot”
The main idea
Codex CLI should default to not auto-starting a persistent background daemon to prevent unintended system processes.
