Codex via codex-cli used to be pretty about knowing whether it was in powershell. Think they might have changed the system prompt or something because it’s usually generating powershell on the first attempt.

Sometimes it tries to use shell stuff (especially for redirection), but that’s way less common rn.