Windows: Background subprocesses (git, gh, docker) spawn visible conhost.exe windows that steal focus from fullscreen apps

[Eth4ck1e]

Summary

On Windows, Warp's periodic background subprocesses (git status polling, PR link checks via gh, Docker stats) spawn visible conhost.exe console windows that briefly flash on screen and steal focus from fullscreen applications every few minutes.

Problem

Warp periodically spawns powershell.exe, git.exe, gh.exe, and docker.exe as child processes for features like PR link badges, git branch detection, and Docker container stats. On Windows, these console-based subprocesses each create a conhost.exe window. Because the processes appear to be launched without the CREATE_NO_WINDOW or DETACHED_PROCESS creation flags, the console windows are briefly visible and steal focus from whatever application is in the foreground.

This is especially disruptive for users running fullscreen applications (games, presentations, video calls), as the flashing windows pull them out of fullscreen every few minutes.

On macOS and Linux, forked processes do not create visible windows by default, so this issue is Windows-specific.

Expected behavior

All background subprocesses spawned by Warp for internal features (git polling, PR status, Docker stats, etc.) should be invisible to the user — launched with CREATE_NO_WINDOW or equivalent flags so no console window appears and no focus is stolen.

Actual behavior

Every few minutes, one or two console windows flash on screen for a split second. When the user is in a fullscreen application, this causes the application to lose focus and minimize/alt-tab. A WMI process creation watcher captured the following recurring processes all spawning in bursts with associated conhost.exe windows:

• powershell.exe -NoProfile -c "..." — Warp spawns many instances (one per open tab in a git repo) running a script that calls git rev-parse, git symbolic-ref, git remote get-url origin, and gh pr view --json url --jq .url to check PR status.
• docker.exe stats --all --no-trunc --no-stream --format "{{ json .}}" — Multiple instances spawned for Docker container stats polling.
• git.exe — Branch detection and worktree checks.
• gh.exe pr view --json url --jq .url — GitHub CLI PR status checks.
• conhost.exe — One instance per console subprocess above, each creating a visible window.

A single burst captured ~15+ powershell.exe instances, ~15+ docker.exe instances, and corresponding conhost.exe windows, all within the same second.

Reproduction steps

1. Open Warp on Windows with multiple tabs, each in a different git repository backed by GitHub.
2. Have Docker Desktop running.
3. Switch to a fullscreen application (e.g., a game or fullscreen browser window).
4. Wait a few minutes.
5. Observe console windows flashing on screen and the fullscreen application losing focus.

Artifacts

None attached.

Warp version

v0.2026.05.06.15.42.stable_05

Operating system

Windows 11 (NT 10.0.26200.0)

Possible source references

• The subprocess creation path on Windows likely needs CREATE_NO_WINDOW (0x08000000) passed to CreateProcess for all background/internal child processes (git, gh, powershell, docker CLI invocations).
• The PR link polling logic that spawns powershell.exe -NoProfile -c "..." scripts containing gh pr view runs per-tab and scales with the number of open tabs.

[oz-for-oss]

@Eth4ck1e

Here's what I found while triaging this issue:

Thanks for the detailed WMI observations. This looks Windows-specific and tied to Warp background Git/PR context updates rather than the command you are actively running.

I have a few follow-up questions before I can narrow this down:

1. Can you attach a short screen recording or the WMI/process-creation log for one burst, including parent process IDs and full command lines for the conhost.exe and subprocesses involved?
2. If you remove the GitHub Pull Request prompt chip or switch to a prompt without it, do the powershell.exe/gh.exe bursts and fullscreen focus steals stop?

Reply in-thread with those details and the triage workflow will automatically re-evaluate the issue and update the diagnosis, labels, and next steps.

Maintainer details

I concluded that windows background Git/PR/Docker subprocess polling appears to spawn visible console windows that steal focus from fullscreen apps..

Triage summary

This is a Windows-specific bug report about background subprocesses spawned by Warp, not a foreground terminal command. The reported symptoms are visible conhost.exe flashes and fullscreen focus loss during periodic Git/PR/Docker-related polling.

Evidence reviewed

• The report includes Warp v0.2026.05.06.15.42.stable_05, Windows 11 NT 10.0.26200.0, concrete reproduction steps, and WMI-observed process names.
• The GitHub PR prompt chip path runs a PowerShell script that checks whether the current repo is on GitHub and then calls gh pr view; Git prompt chips refresh on a 30-second interval.
• Local prompt generator commands run through LocalCommandExecutor, and the shared command wrappers already attempt to set CREATE_NO_WINDOW on Windows for async and blocking subprocesses.
• Because the current wrappers already include this mitigation, the remaining investigation is to identify whether the reported stable build predates a fix, whether a specific path bypasses the wrapper, or whether a shell child process is creating a visible console despite the parent process flags.

Duplicate check

I scanned all open non-PR issues plus recently closed issues for the same conhost/background-subprocess/focus-stealing symptoms. I did not find enough matching issues to mark this as a duplicate.

Suggested next step

Route to the Windows/local command execution and prompt/context-chip owners. The highest-value confirmation is a process tree for one burst showing parent PIDs and full command lines for powershell.exe/cmd.exe, git.exe, gh.exe, docker.exe, and conhost.exe.

Question reasoning

1. Can you attach a short screen recording or the WMI/process-creation log for one burst, including parent process IDs and full command lines for the conhost.exe and subprocesses involved? — The current code intends to hide internal Windows subprocesses, so the process tree is needed to identify which exact parent/child launch path is still creating a visible console window.
2. If you remove the GitHub Pull Request prompt chip or switch to a prompt without it, do the powershell.exe/gh.exe bursts and fullscreen focus steals stop? — The PR prompt chip is one inspected path that periodically runs gh pr view; this answer would separate PR-chip polling from Docker or other background subprocess sources.

This is my automated analysis and may be incorrect. A maintainer will verify the details.

Powered by Oz

[Eth4ck1e]

1. Process tree for one burst (with parent PIDs)

Here is a WMI-captured process creation log for a single burst at 13:06:08. Warp main process is PID 15828 (warp.exe).

PR polling chain: warp.exe → powershell.exe → gh.exe / git.exe

All PR-polling powershell.exe instances are direct children of warp.exe (PID 15828). Each spawns a conhost.exe:

warp.exe (15828)
 └─ powershell.exe (444660)  PPID=15828  -NoProfile -c "git rev-parse ... gh pr view ..."
     ├─ conhost.exe (429232)  PPID=444660
     ├─ gh.exe (429916)       PPID=444660  pr view --json url --jq .url
     │   └─ git.exe (443172)  PPID=429916
     └─ git.exe (...)

 └─ powershell.exe (434736)  PPID=15828  [same PR-check script]
     ├─ conhost.exe (440324)  PPID=434736
     └─ gh.exe (441396)       PPID=434736

 └─ powershell.exe (441188)  PPID=15828  [same PR-check script]
     ├─ conhost.exe (441684)  PPID=441188
     └─ git.exe (414588)      PPID=441188

 └─ powershell.exe (435160)  PPID=15828
     ├─ conhost.exe (435328)  PPID=435160
     └─ gh.exe (438852)       PPID=435160

 └─ powershell.exe (418144)  PPID=15828
     ├─ conhost.exe (47592)   PPID=418144
     └─ gh.exe (433744)       PPID=418144

 └─ powershell.exe (435544)  PPID=15828
     ├─ conhost.exe (445368)  PPID=435544
     └─ gh.exe (435264)       PPID=435544
         └─ git.exe (437736)  PPID=435264

 └─ powershell.exe (443856)  PPID=15828
     ├─ conhost.exe (429852)  PPID=443856
     └─ git.exe (442316)      PPID=443856

 └─ powershell.exe (444300)  PPID=15828
     ├─ conhost.exe (437608)  PPID=444300
     └─ gh.exe (428088)       PPID=444300
         └─ git.exe (443508)  PPID=428088

 └─ powershell.exe (444160)  PPID=15828
     ├─ conhost.exe (435836)  PPID=444160
     └─ gh.exe (442976)       PPID=444160
         └─ git.exe (441756)  PPID=442976

 └─ powershell.exe (434256)  PPID=15828
     ├─ conhost.exe (437332)  PPID=434256
     └─ gh.exe (438104)       PPID=434256

 └─ powershell.exe (441912)  PPID=15828
     ├─ conhost.exe (441768)  PPID=441912
     └─ gh.exe (442812)       PPID=441912
         └─ git.exe (444268)  PPID=442812

 └─ powershell.exe (429780)  PPID=15828
     ├─ conhost.exe (429320)  PPID=429780
     ├─ git.exe (428860)      PPID=429780
     │   └─ git.exe (429680)  PPID=428860
     └─ [gh.exe chain]

 └─ powershell.exe (429068)  PPID=15828
     └─ conhost.exe (424132)  PPID=429068

 └─ powershell.exe (438756)  PPID=15828
     ├─ conhost.exe (443668)  PPID=438756
     └─ gh.exe (429108)       PPID=438756

 └─ powershell.exe (442612)  PPID=15828
     ├─ conhost.exe (415220)  PPID=442612
     └─ gh.exe (441660)       PPID=442612

 └─ powershell.exe (429248)  PPID=15828
     ├─ conhost.exe (201624)  PPID=429248
     └─ gh.exe (433932)       PPID=429248
         └─ git.exe (443260)  PPID=433932

 └─ powershell.exe (440340)  PPID=15828
     └─ conhost.exe (435008)  PPID=440340

 └─ powershell.exe (442988)  PPID=15828
     ├─ conhost.exe (444220)  PPID=442988
     └─ gh.exe (444904)       PPID=442988

 └─ powershell.exe (442848)  PPID=15828
     └─ conhost.exe (238852)  PPID=442848

 └─ powershell.exe (441740)  PPID=15828
     ├─ conhost.exe (432512)  PPID=441740
     └─ gh.exe (435836)       PPID=441740

Also git branch detection (separate from PR polling):

warp.exe (15828)
 └─ powershell.exe (420320)  PPID=15828  -NoProfile -c "git symbolic-ref --short HEAD ..."
     ├─ conhost.exe (441236)  PPID=420320
     └─ git.exe (442944)      PPID=420320

 └─ powershell.exe (440456)  PPID=15828  -NoProfile -c "git diff --shortstat HEAD"
     ├─ conhost.exe (204616)  PPID=440456
     └─ git.exe (240144)      PPID=440456

Total in one burst: ~18 powershell.exe instances, each with a conhost.exe, plus child gh.exe and git.exe processes.

Docker stats (NOT from Warp)

Docker processes are children of PID 22036 (not warp.exe). This is Docker Desktop's own polling:

PID 22036 (Docker Desktop)
 └─ docker.exe (421256)  PPID=22036  stats --all --no-trunc --no-stream
     └─ conhost.exe (428868)
 └─ docker.exe (444932)  PPID=22036
     └─ conhost.exe (444768)
 └─ docker.exe (207924)  PPID=22036
     └─ conhost.exe (443696)
 [... ~15 more docker.exe instances, all PPID=22036]

Correction from original report: The docker.exe stats polling is from Docker Desktop itself, not Warp. The Warp-originated flashing is exclusively from the powershell.exe → gh.exe/git.exe PR-polling and branch-detection chains.

Timing

• Main burst at 13:06:08 — ~18 PR-poll powershell instances + branch detection
• Straggler at 13:06:23 — 1 more PR-poll powershell instance
• Next burst at 13:09:24 — PR-poll cycle starts again (~3 min interval)

2. PR prompt chip removal test

I have not yet tested removing the PR prompt chip. Could you point me to where that setting lives? I'll test and follow up with results.

[oz-for-oss]

@Eth4ck1e

Here's what I found while triaging this issue:

Thanks for the WMI trace — it narrows the Warp-originated processes to the GitHub PR prompt chip and git metadata commands; the Docker stats polling appears to be Docker Desktop, not Warp. To test the PR chip workaround, right-click the Warp prompt, choose Edit prompt → Warp Prompt, and remove the GitHub Pull Request/PR chip; if you use expanded vertical tabs, also turn off PR link in the vertical-tabs settings popup.

I have a few follow-up questions before I can narrow this down:

1. After removing the GitHub Pull Request/PR chip and disabling the vertical-tabs PR link, do the powershell.exe/conhost.exe bursts and fullscreen focus loss stop with the same tabs open?

Reply in-thread with those details and the triage workflow will automatically re-evaluate the issue and update the diagnosis, labels, and next steps.

Maintainer details

I concluded that windows background prompt/context-chip commands for Git/GitHub PR metadata can spawn visible console hosts that steal focus, with current evidence narrowed to Warp-launched PowerShell -> git/gh chains rather than Docker Desktop..

Triage summary

The follow-up WMI trace significantly narrows the Warp-originated portion of this bug. The repeated burst appears to come from prompt/context-chip background commands launched by warp.exe, particularly the GitHub PR prompt chip and git branch/diff metadata paths that execute PowerShell commands which then call git and gh pr view. The Docker stats processes in the follow-up trace are children of Docker Desktop rather than Warp, so they should be treated as separate noise unless later evidence shows a Warp parent PID.

Relevant code paths:

• app/src/context_chips/mod.rs defines GIT_REFRESH_CONFIG at a 30-second interval and wires the ShellGitBranch, GitDiffStats, and feature-flagged GithubPullRequest chips.
• app/src/context_chips/builtins.rs defines the PowerShell git branch/diff generators and the GitHub PR generator.
• app/src/context_chips/scripts/github_pull_request_prompt_chip.ps1 runs git rev-parse, git symbolic-ref, git remote get-url origin, and gh pr view --json url --jq .url.
• app/src/context_chips/current_prompt.rs runs shell generators through Session::execute_command, with fingerprinting that can avoid some repeated PR-chip fetches but still runs per session/context when the fingerprint changes or needs initial validation.
• app/src/terminal/model/session/command_executor/local_command_executor.rs builds the local shell process used for these generator commands.
• crates/command/src/async.rs and crates/command/src/blocking.rs are the intended Windows subprocess wrappers and already attempt to set CREATE_NO_WINDOW; this means the exact bug is likely either a stable-build gap/regression in the background-generator path, an interaction with new_with_process_group/PowerShell child processes, or a console allocation by descendants despite the parent wrapper flags.
• app/src/code_review/git_status_update.rs and app/src/util/git.rs are relevant for the newer local git metadata model and direct git helpers.

Suggested next step is to have the reporter remove or disable the GitHub Pull Request prompt/PR-link display and re-run the same WMI watcher. If the bursts stop, ownership is likely the PR prompt chip/polling path; if branch/diff powershell.exe launches remain, focus should shift to the generic local command executor and Windows command wrapper behavior.

Question reasoning

1. After removing the GitHub Pull Request/PR chip and disabling the vertical-tabs PR link, do the powershell.exe/conhost.exe bursts and fullscreen focus loss stop with the same tabs open? — This directly tests whether the narrowed PR-chip polling path is the source of the visible console windows, or whether the remaining git branch/diff generator path also needs investigation.

This is my automated analysis and may be incorrect. A maintainer will verify the details.

Powered by Oz

[oz-for-oss]

This issue has been labeled ready-to-implement and is open for contributions involving code changes. If you'd like to tackle it, feel free to open a pull request against this issue. You can also comment @oz-agent on this issue to have the bot draft an implementation PR automatically.

[acarl005]

@Eth4ck1e Thank you for reporting the issue. I believe I observed this on my own machine with Warp running in the background. I did manage to capture the flicker of a window when doing something else. It's pretty annoying.

Recording.2026-05-02.203454.mp4

We definitely need to fix this.