Codex 0.162.1 Still Auto-Starts a Daemon. It Keeps the First Environment.

npm's latest @openai/codex is 0.162.1, uploaded 9 October 2026 at 19:50 UTC. On tag rust-v0.162.1 the feature daemon_auto_start is stable and default_enabled is true. Commit 92caad782887 on main, 22:44 UTC on 12 October, still has that default. An eligible interactive session starts the managed app-server. The daemon README on that tag says later clients keep the environment from when the daemon started.

Hacker News led with that default tonight. US X trends at 22:06 UTC were politics, a celebrity death, football, and the Muse Wonder launch. Trade press was a bring-your-own-agent essay, a SonicWall appliance flaw, and a Claude-assisted intrusion set. None of those is this control. The control is the flag that is still on.

Medium Medium because the failure is a shared process environment and a self-updating managed copy, not a CVE and not a remote listener. remote_control_enabled defaults to false.

The flag is still the default.#

rust-v0.157.0 was published 25 September at 02:31 UTC. npm 0.157.0 followed at 02:35 UTC. The release note's sentence is: enabled automatic background-server startup for eligible interactive sessions, with recovery choices when server settings are incompatible. Issue 48195 opened at 20:04 UTC that day and asks for the flag to be opt-in. It is still open. The labels are enhancement, CLI, and app-server.

On rust-v0.162.1, commit 092d3acd, the TUI starts the daemon when daemon_auto_start is enabled, the command is not --no-daemon, the session is not the agents overview, and the target is not a remote workspace. The call is start_with_features. If a server is already absent, start runs prepare_install and then launches the managed binary. The missing-package path does not use the confirmation callback. That callback is the replace path. The first auto-start logs that it is installing a daemon from the CLI version and copies a complete package under packages/app-server-daemon.

A CLI tree with no package manifest fails that prepare step. The error text tells the operator to install a packaged CLI or rerun with --no-daemon. That is the distro-package break, not a separate vulnerability.

The package clock and the impact clock.#

The package clock is the version npm calls latest, and the source on that tag.

0.162.1 is that version. The GitHub release was published 9 October at 19:44 UTC. The updater constants in the same tag are INITIAL_UPDATE_DELAY of five minutes and DEFAULT_UPDATE_INTERVAL_MINUTES of 60. default_auto_update_enabled returns true. After the app-server starts, ensure_managed_updater runs. It starts the loop only when auto-update is on and the managed package is a stable standalone release: a three-part numeric version directory under the daemon releases folder. An install that fails that check does not get the hourly loop. A stable standalone layout does.

stop stops the app-server backend and waits the shutdown grace, default 60 seconds. It does not call the updater's stop. The updater is a second pid. Turning auto-update off is what makes a later ensure step stop that loop. stop alone leaves it.

The impact clock is every client that attaches after the daemon is up. The README sentence is the vendor text: shared clients use the environment inherited when the daemon started, and opening a new terminal or clearing variables there does not clear the running daemon's environment. Per-client isolation is not provided. A comment on issue 48195 at 22:43 UTC on 12 October reports a later session seeing the first directory's token variable. That is a report on an open issue. It matches the README. It is not a capture from this desk.

1. 2026-09-25
   rust-v0.157.0 at 02:31 UTC. npm 0.157.0 at 02:35 UTC. Issue 48195 opened at 20:04 UTC. The flag defaulted on.
2. 2026-10-09
   rust-v0.162.1 at 19:44 UTC. npm latest 0.162.1 at 19:50 UTC. The flag is still stable and on. The README states the shared environment.
3. 2026-10-12
   main 92caad782887 at 22:44 UTC still defaults the flag on. Hacker News is the opt-in request. No CVE.

What a later session inherits.#

The daemon process is the one that holds the environment. A second terminal, a second directory, and a cleared variable in that new shell do not rebuild it. Provider tokens, proxy variables, and anything else that was set when the first eligible session started are the environment the shared server keeps until that process is replaced.

The managed copy is a second split. prepare_install puts a complete CLI package under the daemon package root, and the server runs from that copy. The binary you invoked and the binary that serves the next turn are not required to be the same file. On a stable standalone release the updater can replace that copy after five minutes and then on the hourly interval. shutdownGraceSeconds defaults to 60. A restart can interrupt a turn that is still running. The README says a stopped daemon stays stopped across an explicit update. Do not read that as stop killing the updater. Those are different processes.

There is no fixed version to upgrade to. 0.162.1 is the latest npm published, and main tonight has the same default. Waiting for a newer tag does nothing until the release note says the default flipped.

What to change before the next launch.#

Turn daemon_auto_start off if this machine should not keep a background server, and use --no-daemon on the session you are about to open. Then stop the app-server that is already running. After that, confirm the updater process is gone. daemon stop does not stop it. If this host should not take a later stable release on its own, set the daemon updater's auto-update preference off before the next fresh start, because a successful start calls ensure_managed_updater and will bring the loop back when the package is a stable standalone release.

If the shell that started the current daemon held a long-lived token, rotate that token after the process is gone. The README already says the new terminal will not clear it. Do not treat a quiet session as evidence the token stayed unused.

Leave remote control off unless you meant to enable it. Auto-start did not turn it on. The crate's own header still calls the lifecycle experimental. The flag that starts it is marked stable.