From dfd2d8133c516778f72fea24e3d47c9a5f34e49b Mon Sep 17 00:00:00 2001
From: chess <chess@openai.com>
Date: Tue, 21 Jul 2026 20:47:57 +0000
Subject: [PATCH] Detach non-interactive subprocesses from stdin (#34612)

## What changed

Redirect stdin to null when launching:

- `codex doctor --json` for uploaded diagnostic reports
- Git commands used by `codex doctor`
- ripgrep searches over rollout files
- the Windows sandbox setup refresh helper

This keeps these non-interactive subprocesses from reading Codex's inherited
input stream.

GitOrigin-RevId: 063d191b0b1b849d74b55a7d6ff2f0b3d5212c86
---
 .../src/request_processors/feedback_doctor_report.rs         | 2 ++
 codex-rs/cli/src/doctor/git.rs                               | 2 ++
 codex-rs/rollout/src/search.rs                               | 2 ++
 codex-rs/tui/src/tui.rs                                      | 2 +-
 codex-rs/windows-sandbox-rs/src/setup.rs                     | 5 ++++-
 5 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/codex-rs/app-server/src/request_processors/feedback_doctor_report.rs b/codex-rs/app-server/src/request_processors/feedback_doctor_report.rs
index 3bd9c9fd9b..2c157b556f 100644
--- a/codex-rs/app-server/src/request_processors/feedback_doctor_report.rs
+++ b/codex-rs/app-server/src/request_processors/feedback_doctor_report.rs
@@ -8,6 +8,7 @@
 //! attaching exactly the same JSON a user could copy from the CLI.
 
 use std::collections::BTreeMap;
+use std::process::Stdio;
 use std::time::Duration;
 
 use codex_core::config::Config;
@@ -42,6 +43,7 @@ pub(crate) async fn doctor_feedback_report(config: &Config) -> Option<DoctorFeed
 
     let mut command = Command::new(&executable);
     command.arg("doctor").arg("--json");
+    command.stdin(Stdio::null());
     command.kill_on_drop(/*kill_on_drop*/ true);
     let output = match timeout(DOCTOR_FEEDBACK_REPORT_TIMEOUT, command.output()).await {
         Ok(Ok(output)) => output,
diff --git a/codex-rs/cli/src/doctor/git.rs b/codex-rs/cli/src/doctor/git.rs
index 390a624f6f..6556893fba 100644
--- a/codex-rs/cli/src/doctor/git.rs
+++ b/codex-rs/cli/src/doctor/git.rs
@@ -2,6 +2,7 @@ use std::collections::BTreeSet;
 use std::path::Path;
 use std::path::PathBuf;
 use std::process::Output;
+use std::process::Stdio;
 use std::time::Duration;
 
 use codex_git_utils::get_git_repo_root;
@@ -195,6 +196,7 @@ async fn git_output(git_path: &Path, cwd: &Path, args: &[&str]) -> Option<String
         .env("GIT_OPTIONAL_LOCKS", "0")
         .args(args)
         .current_dir(cwd)
+        .stdin(Stdio::null())
         .kill_on_drop(true);
     let output = timeout(GIT_COMMAND_TIMEOUT, command.output())
         .await
diff --git a/codex-rs/rollout/src/search.rs b/codex-rs/rollout/src/search.rs
index 67a2723b49..dc11ff0bc0 100644
--- a/codex-rs/rollout/src/search.rs
+++ b/codex-rs/rollout/src/search.rs
@@ -3,6 +3,7 @@ use std::collections::HashSet;
 use std::io;
 use std::path::Path;
 use std::path::PathBuf;
+use std::process::Stdio;
 
 use codex_protocol::models::ContentItem;
 use codex_protocol::models::ResponseItem;
@@ -80,6 +81,7 @@ async fn ripgrep_rollout_paths(
         .arg("--")
         .arg(search_term)
         .arg(root)
+        .stdin(Stdio::null())
         .output()
         .await
     {
diff --git a/codex-rs/tui/src/tui.rs b/codex-rs/tui/src/tui.rs
index 4a96a8cc4f..76fb9b9c00 100644
--- a/codex-rs/tui/src/tui.rs
+++ b/codex-rs/tui/src/tui.rs
@@ -313,7 +313,7 @@ pub(super) fn reapply_raw_mode_after_resume() -> Result<()> {
 
 /// Restore the terminal after Codex is exiting.
 ///
-/// Uses a stronger keyboard reset than [`restore`] so the parent shell recovers even if a
+/// Uses a stronger keyboard reset than `restore` so the parent shell recovers even if a
 /// terminal missed the stack pop that normally pairs with [`set_modes`].
 pub fn restore_after_exit() -> Result<()> {
     let mut first_error =
diff --git a/codex-rs/windows-sandbox-rs/src/setup.rs b/codex-rs/windows-sandbox-rs/src/setup.rs
index 1044c10cee..66d203bd74 100644
--- a/codex-rs/windows-sandbox-rs/src/setup.rs
+++ b/codex-rs/windows-sandbox-rs/src/setup.rs
@@ -345,7 +345,10 @@ fn run_setup_refresh_payload(b64: &str, codex_home: &Path) -> Result<()> {
     };
     // Refresh should never request elevation; ensure verb isn't set and we don't trigger UAC.
     let mut cmd = Command::new(&exe);
-    cmd.arg(b64).stdout(Stdio::null()).stderr(Stdio::null());
+    cmd.arg(b64)
+        .stdin(Stdio::null())
+        .stdout(Stdio::null())
+        .stderr(Stdio::null());
     let cwd = std::env::current_dir().unwrap_or_else(|_| codex_home.to_path_buf());
     log_note(
         &format!(