[Windows] ocx service install refuses: effective-account SID lookup times out on cold PowerShell start #7544

Client or integration

Other

Area

Service lifecycle

Summary

On the main push Service lifecycle workflow (run 39812199456, attempt 1, job windows-schtasks), ocx service install failed with CodexUserIdentityRefusal: Windows effective-account lookup timed out. before it reached Task Scheduler. The attempt 2 rerun of the same commit passed.

The SID for the Windows service mutation lock path is resolved by spawning powershell.exe to evaluate [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value. That child already has a 30s budget (widened in #2914), and the step still spent ~35s and hit it. A cold PowerShell start on a loaded runner is the whole cost: the value itself is a constant of the process token.

Expected: resolving the current process SID should not depend on PowerShell startup time on Windows x64, where the same module already reads LocalAppData in-process through bun:ffi (src/codex/windows-local-appdata.ts). A lookup that genuinely fails must still refuse (fail closed).

Reproduction

Intermittent; observed on a GitHub-hosted windows-latest runner.

1. Fresh runner, write %USERPROFILE%\.opencodex\config.json.
2. bun run src/cli/index.ts service install
3. The first PowerShell child spawned by the process (the SID lookup) exceeds the 30s timeout and the install refuses.

Version

83ec4f7

Operating system

GitHub Actions windows-latest (Windows Server, x64), Bun 1.4.2

Provider and model

No response

Logs or error output

CodexUserIdentityRefusal: Windows effective-account lookup timed out.
 code: "CODEX_USER_IDENTITY_REFUSED"
      at refuse (src\codex\user-identity.ts:101:9)
      at powershellValue (src\codex\user-identity.ts:254:34)
      at resolveWindowsSid (src\codex\user-identity.ts:263:15)
      at resolveEffectiveUserIdentity (src\codex\user-identity.ts:281:38)
      at windowsServiceMutationLockPath (src\lib\windows-service-mutation-lock.ts:57:20)
      at withWindowsServiceMutationLock (src\lib\windows-service-mutation-lock.ts:82:37)
      at serviceCommand (src\service\cli.ts:526:11)
Bun v1.4.2 (Windows x64)

Screenshots and supporting files

No response

Redacted configuration

{"port":10199,"providers":{}}

Checks

• I searched existing issues and documentation.
• I removed secrets, tokens, account details, request credentials, and personal data.