[BUG] Windows: claude agents spawn visible reg.exe console windows during background session startup

[kigenst]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

When using claude agents on native Windows, Claude Code spawns visible reg.exe console windows.

This happens when starting claude agents itself and again when submitting a task from the agent dashboard. It does not reproduce in regular interactive Claude Code sessions.

The visible popup title captured by a Win32 top-level-window watcher is:

C:\WINDOWS\System32\reg.exe

WMI process creation tracing shows the reg.exe processes are spawned directly by claude.exe, not by repo hooks, user scripts, VS Code, WSL, or the active shell.

The issue is shell-independent: it reproduces from PowerShell, Git Bash, and cmd. The machine is configured for Windows Console Host, and the issue also reproduces when using Windows Terminal.

What Should Happen?

Claude Code’s internal registry probes during claude agents / background-session startup should not create visible console windows.

They should use CREATE_NO_WINDOW / windowsHide: true where applicable, or preferably native Windows registry APIs such as RegGetValue instead of spawning reg.exe.

Error Messages/Logs

[11:37:44] reg.exe PID=53464 CMD=C:\WINDOWS\System32\reg.exe query HKLM\SOFTWARE\Policies\ClaudeCode /v Settings
  parent:      claude.exe --bg-pty-host \\.\pipe\cc-daemon-... -- claude.exe --session-id ... --agent claude --permission-mode bypassPermissions -- "<prompt>"
  grandparent: claude.exe daemon run --json-path C:\Users\<user>\.claude\daemon.json ... --spawned-by "{\"label\":\"claude agents\", ...}"

[11:39:25] reg.exe PID=36576 CMD=<already exited>
  parent:      claude.exe --bg-pty-host ... (same shape as above)
  grandparent: claude.exe daemon run ... "claude agents"

[11:40:16] reg.exe PID=52704 CMD=C:\Windows\System32\reg.exe query HKEY_CURRENT_USER\Software\Classes\claude-cli\shell\open\command /ve
  parent:      claude.exe --session-id ... --agent claude --permission-mode bypassPermissions
  grandparent: claude.exe --bg-pty-host ... (same session)

Steps to Reproduce

1. On native Windows, open PowerShell, Git Bash, or cmd.
2. Run claude agents.
3. Observe brief reg.exe console windows flashing.
4. Submit a task from the agent dashboard.
5. Observe additional reg.exe console windows, often in rapid groups.

To attribute the popups:

• Use a Win32 EnumWindows watcher to capture the visible window title.
• Use WMI Win32_Process creation events to capture process parentage.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

Unknown

Claude Code Version

2.1.165 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

Native Windows install at:

C:\Users\<user>\.local\bin\claude.exe

Not WSL, not VS Code-embedded.

Trace attribution:

• HKLM\SOFTWARE\Policies\ClaudeCode /v Settings is parented by the --bg-pty-host wrapper process.
• HKEY_CURRENT_USER\Software\Classes\claude-cli\shell\open\command /ve is parented by the inner --session-id ... --agent claude process.
• Both originate from the claude.exe daemon run process used by claude agents.

Confirmed with:

• Win32 EnumWindows watcher for visible windows
• WMI Win32_Process creation events for process parentage

[github-actions]

Found 3 possible duplicate issues:

1. [Windows] Option to suppress console windows for child processes spawned by the CLI (Bash tool, npm/npx, plugins) #65171
2. Windows: MCP server spawning causes brief console window flash (missing CREATE_NO_WINDOW flag) #63623
3. [Windows] Visible console window flashes on every tool use in v2.1.143 #61051

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[kigenst]

The issue here is not npm/npx/plugin subprocesses generally (#65171), not MCP server startup (#63623), and not regular tool execution / hooks (#61051).

This reproduces specifically with claude agents / background agent sessions, while regular interactive Claude Code sessions do not reproduce it.

[Trojaner]

I can confirm this.
It happens with Windows Terminal and Claude Code v2.1.168

"claude agents" immediately pops up two reg.exe windows that exit with 1.
Opening new sessions from agents view triggers more reg.exe instances.