[0.160] Backport remaining Windows console fix to frozen alpha.6 (#49386)

Backport #49308 onto the frozen 0.160.0-alpha.6 content commit
c248f6d48b for the Windows console
flashing issue #48074. That base already contains #49164, so only the
missing patch is included. This does not advance the baked candidate to
current main or publish stable 0.160.

The cherry-pick applied cleanly and its stable patch ID matches
upstream. `git diff --check` passes. Native Windows validation on this
exact candidate is still pending. Keep this PR in draft pending review,
required checks, and focused unelevated-sandbox smoke evidence for
external processes (whoami.exe, cmd.exe, Git, nested PowerShell),
alongside built-ins, with and without the managed daemon. Record exact
candidate SHA, CLI/daemon versions, CODEX_HOME, configuration, command
output, exit codes, duration and visible console observations.

The unresolved hang report at
https://github.com/openai/codex/issues/48074#issuecomment-5898123863 is
not proof these changes caused a regression, but requires investigation
before treating the candidate as validated.

Co-authored-by: Eric Traut <etraut@openai.com>

codex-rs/windows-sandbox-rs/src/lib.rs

@@ -764,7 +764,7 @@ mod windows_impl {
                 &env_map,
                 logs_base_dir,
                 Some((in_r, out_w, err_w)),
-                ConsoleMode::Inherit,
+                ConsoleMode::NoWindow,
                 desktop,
             )
         });

codex-rs/windows-sandbox-rs/src/unified_exec/backends/legacy.rs

@@ -115,7 +115,7 @@ fn spawn_legacy_process(
                 StdinMode::Closed
             },
             StderrMode::Separate,
-            ConsoleMode::Inherit,
+            ConsoleMode::NoWindow,
             launch_desktop,
             logs_base_dir,
         )?;

codex-rs/windows-sandbox-rs/src/unified_exec/tests.rs

@@ -50,6 +50,8 @@ use windows_sys::Win32::System::Threading::WaitForSingleObject;
 static TEST_HOME_COUNTER: AtomicU64 = AtomicU64::new(0);
 static LEGACY_PROCESS_TEST_LOCK: Mutex<()> = Mutex::new(());
 
+const ASSERT_NO_CONSOLE: &str = r#"Add-Type -ErrorAction Stop 'using System; using System.Runtime.InteropServices; public class ConsoleProbe { [DllImport("kernel32.dll")] public static extern IntPtr GetConsoleWindow(); }'; if ([ConsoleProbe]::GetConsoleWindow() -ne [IntPtr]::Zero) { throw 'piped sandbox process unexpectedly has a console' };"#;
+
 fn legacy_process_test_guard() -> MutexGuard<'static, ()> {
     LEGACY_PROCESS_TEST_LOCK
         .lock()
@@ -460,7 +462,7 @@ fn legacy_non_tty_powershell_interrupt_terminates_process() {
                 pwsh.display().to_string(),
                 "-NoProfile".to_string(),
                 "-Command".to_string(),
-                "Write-Output LEGACY-NONTTY-DIRECT; [System.Threading.ManualResetEvent]::new($false).WaitOne()".to_string(),
+                format!("{ASSERT_NO_CONSOLE} Write-Output LEGACY-NONTTY-DIRECT; [System.Threading.ManualResetEvent]::new($false).WaitOne()"),
             ],
             cwd.as_path(),
             HashMap::new(),
@@ -681,7 +683,7 @@ fn legacy_capture_emits_output_and_preserves_descendant_after_normal_exit() {
         powershell_literal(&ready_marker),
     );
     let parent_command = format!(
-        "Write-Output LEGACY-CAPTURE-DIRECT; {}",
+        "{ASSERT_NO_CONSOLE} Write-Output LEGACY-CAPTURE-DIRECT; {}",
         start_powershell_child(&pwsh, codex_home.path(), &descendant_command, &parent_tail,),
     );
     let permission_profile = PermissionProfile::workspace_write();