[BUG] Windows: Grep tool leaks rg.exe + conhost.exe processes (~2000 zombies / 14 GB RAM in long sessions)

Summary

On Windows, the Grep tool leaks rg.exe (ripgrep) child processes and their paired conhost.exe console hosts. They accumulate across the session — and across multiple concurrent Claude Code windows — until the host machine runs out of RAM. Observed today on a developer workstation: 1062 rg.exe + 1088 conhost.exe consuming ~14 GB of RAM, with only 3 active Claude Code windows.

Different shape from #61617 (single runaway Grep on a massive file) and #20369 / #43944 (macOS/Linux orphan patterns). This one is the accumulation pattern — thousands of small completed subprocesses that never get reaped, specific to Windows because of the mandatory conhost.exe pairing on every console child.

Environment

• Platform: Windows 11 Pro 26200 (10.0)
• Claude Code: desktop app + CLI (3 windows open over ~8 hours)
• Shell: PowerShell 7
• 32 GB RAM (system hit 79% used, Task Manager became unresponsive)

Measured state at the leak point

Name        Count   TotalMemMB
----        -----   ----------
conhost     1088    7,594
rg          1062    7,016
claude      12      2,092   (legit, 3 windows x 4 procs each)

After Stop-Process -Name rg,conhost -Force: RAM 79% to 67% (freed ~3.8 GB resident immediately, more after working-set settle). Active terminals re-spawned their conhost.exe on the next prompt with no ill effect.

Why I think it happens

1. The Grep tool spawns rg.exe for every search.
2. On Windows, every console-mode subprocess gets a conhost.exe automatically attached by the OS — so every Grep = 1 rg + 1 conhost.
3. Node's child_process.spawn does not by default put children in a Windows Job Object. Without that, children survive their parent and are never auto-reaped when the parent exits (no Unix-style PID-1 re-parent + wait).
4. Likely trigger paths for accumulation:

• Grep aborted / timed out — child not killed.
• Window force-closed (Task Manager) — children detached.
• System sleep/resume mid-search — handles stranded.
• Long-running session — even a small per-Grep leak rate adds up to thousands across hours.

Suggested fix

Spawn rg.exe (and other tool subprocesses) inside a Windows Job Object with JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE. When the parent Claude Code process exits — cleanly or via Task-Manager kill — the OS tears down every child in the job. This is the canonical Windows equivalent of Unix process groups and is what #61617's proposed fix sketches generically; calling out the Windows path explicitly here because the conhost-coupling makes the symptom 2x worse than on other platforms.

Workaround

Periodic cleanup:

Stop-Process -Name rg -Force -ErrorAction SilentlyContinue
Stop-Process -Name conhost -Force -ErrorAction SilentlyContinue

Active terminals re-spawn their own conhost on demand. Can be scheduled via Task Scheduler.

Related

• #61617 — single Grep runaway (different shape, same root cause)
• #54130 — session zombies corrupting session files
• #20369 — macOS subagent orphan (different platform)
• #43944 — Bash tool background process orphan (different tool)