[Windows][Desktop 26.901.5280.0] unbounded per-file `git diff --no-index` fan-out exhausts commit and crashes Windows

Summary

Codex Desktop on Windows can catastrophically exhaust system commit when a Git workspace contains thousands of untracked files.

On a clean NVMe test copy with ~4,771 untracked files, the Codex app-server (codex.exe) directly spawned one git diff --no-index operation per untracked file with no effective fan-out cap. The observed git.exe count went from 0 to 168 in 4 seconds, with a measured peak creation rate of 99 git processes/second. The storm continued after the sampler stopped, eventually reaching 4,969 total processes and 91.39 / 91.39 GB committed memory (100%), causing unrelated Windows processes to crash and the machine to restart.

This reproduces on NVMe with core.fsmonitor=false, so it is not dependent on a slow USB disk or fsmonitor.

This appears closely related to #30345 (closed as completed), #34005, #26812, and #20933, but this report adds a current Windows build, direct PPID evidence, a no-task/idle trigger, and a full system commit-exhaustion failure mode.

Environment

• OS: Windows 11 Home, build 26200, x64
• Codex Desktop MSIX: OpenAI.Codex_26.901.5280.0_x64__2p2nqsd0c76g0
• RAM: 32 GB
• Test workspace: local NVMe SSD
• Git for Windows installed under C:\Program Files\Git
• core.fsmonitor=false
• Workspace contained approximately 4,771 untracked files

Trigger

No substantive task or Git command was required.

Timeline from the reproduced session:

19:58:46  ChatGPT.exe launched
19:58:54  codex.exe app-server launched
19:59:45  user message was only "."
20:01:15  git process storm began

The session contained no relevant model/sandbox Git command before the storm. The Git processes were spawned directly by codex.exe, not through PowerShell or a shell tool invocation.

Direct process-tree evidence

First observed pair:

ChatGPT.exe
  -> codex.exe (PID 5348)
      -> C:\Program Files\Git\cmd\git.exe (PID 11788)
          -> C:\Program Files\Git\mingw64\bin\git.exe (PID 28044)

At the abort snapshot:

85  git.exe children directly parented by codex.exe
83  inner git.exe children parented by those Git-for-Windows shim processes
168 git.exe total

The command pattern was per-file untracked diff generation using git diff --no-index.

Process growth

Independent 1 Hz sampling captured:

20:01:14  total processes=311   git.exe=0
20:01:15  total processes=318   git.exe=2
20:01:16  total processes=333   git.exe=17
20:01:17  total processes=343   git.exe=32
20:01:18  total processes=479   git.exe=168

New git.exe creations by second:

20:01:15   2
20:01:16  19
20:01:17  80
20:01:18  99

The sampler intentionally aborted at git.exe > 100, but it did not terminate Codex or its children, so the storm continued.

System-level impact

Windows Resource Exhaustion Detector / system events later recorded:

20:01:52  Processes=4,635   Commit=91.36/91.39 GB
20:07:02  Processes=4,969   Commit=91.39/91.39 GB (100%)

After commit exhaustion, unrelated processes failed, including Chrome, audio services, ChatGPT, Google Drive, and Windows error-reporting components. One visible failure was:

remoting_host.exe: 0xc000012d (STATUS_COMMITMENT_LIMIT)

Windows ultimately restarted.

Why this looks like app-server behavior rather than model/tool execution

• The user message was only ..
• No meaningful task had been issued.
• No corresponding sandbox shell commands existed in the relevant time window.
• The parent process was directly codex.exe.
• codex-command-runner count was 0 during the captured storm.
• The issue reproduced on NVMe and with fsmonitor disabled.

This strongly suggests background workspace diff calculation in the app-server rather than a prompt, skill, or shell command.

Expected behavior

Codex Desktop should never launch an unbounded number of per-file Git subprocesses for untracked files.

Suggested guardrails:

1. Put a strict concurrency cap on per-file untracked diffs (for example 8–32 concurrent operations).
2. Prefer batching instead of one process per file where possible.
3. Add a hard untracked-file count / byte budget before materializing diffs.
4. For very large untracked sets, return a summary/omitted-files marker rather than diffing every file.
5. Cancel pending work immediately when the workspace changes, the request is obsolete, or resource thresholds are exceeded.
6. Avoid doing the expensive untracked diff path merely from opening/restoring a workspace or idle background metadata refresh.

Workaround

Reducing the number of visible untracked files via appropriate ignore rules appears likely to reduce exposure, but this is only a workaround. A normal dirty repository should not be able to trigger thousands of subprocesses and system-wide commit exhaustion.

Related issues

• #30345 — source-level report identifying uncapped per-file git diff --no-index fan-out; closed as completed
• #34005 — macOS report of per-file untracked diff spawning while idle
• #26812 — Windows high-rate git.exe / conhost.exe spawning
• #20933 — Windows project/chat opening triggers heavy Git subprocesses

I have sanitized process snapshots, 1 Hz system/process samples, and Windows Resource Exhaustion event evidence available if maintainers need them. Local usernames, repository names, and private conversation contents are intentionally omitted.

Start at the Codex app-server's background workspace diff path and trace how untracked files become per-file git diff --no-index subprocesses. Reproduce with a workspace containing thousands of untracked files and confirm that opening or idling does not create an unbounded process storm. Done means concurrency and workload are bounded, obsolete work is cancelled, and large untracked sets produce a safe summary rather than exhausting system resources.