Mobile device list exposes Desktop-managed SSH remotes as Codex Desktop devices and can break mobile remote connections

[ttbhbb]

Summary

Codex mobile shows SSH remotes that were added/connected from Codex Desktop as if they were normal Codex Desktop devices. After a Mac Codex Desktop connects to an SSH remote (devbox), iPad/iPhone/Android ChatGPT/Codex all show that SSH remote in the account-level connection list alongside real desktop machines. In this state, other mobile clients can see the devices but fail to connect remotely.

This is confusing because the SSH remote is not independently added from mobile and is not necessarily a standalone logged-in Codex Desktop device. It appears to be a Desktop-managed SSH-backed app-server/proxy being synced into the same mobile device list as real desktops.

Environment

• Local desktop: Codex Desktop on macOS
• Codex Desktop version observed: 26.513.31313
• Codex CLI/app-server version observed: 0.131.0-alpha.9
• Mobile clients: iPad, iPhone, Android ChatGPT/Codex
• Remote SSH host: Linux server, anonymized here as devbox
• Additional real desktop devices: MacBook Air, macmini, Windows machine

What happened

1. On iPad, add/connect real desktop devices such as MacBook Air and macmini.
2. On MacBook Air Codex Desktop, connect to an SSH remote host (devbox).
3. The iPad connection sheet now shows three entries at the same level:
   • Codex Desktop / macmini.local
   • Codex Desktop / MacBook-Air.local
   • Codex Desktop / devbox
4. iPhone and Android ChatGPT/Codex also see the same device list without separately adding SSH connections.
5. Other mobile clients can see these entries but remote connection fails or becomes unreliable.

Observed local state

On the MacBook Air, Codex Desktop persists the SSH remote as a managed remote connection:

"codex-managed-remote-connections": [
  {
    "hostId": "remote-ssh-discovered:<ssh-host>",
    "displayName": "<ssh-host>",
    "source": "discovered"
  }
],
"remote-connection-auto-connect-by-host-id": {
  "remote-ssh-discovered:<ssh-host>": true
}

When connected, the Mac also maintains an SSH command that launches a remote app-server proxy, and the remote host runs processes like:

codex app-server --listen unix://
codex app-server proxy

The remote host did not necessarily have a standalone remote_control_enrollments entry, so this appears to be a Desktop-managed SSH/proxy remote rather than a first-class independently enrolled desktop device.

Expected behavior

One of the following should happen:

• Mobile should not expose Desktop-managed SSH remotes as account-level Codex Desktop devices unless they are intentionally supported from mobile; or
• Mobile should clearly label them as SSH/proxy remotes managed by a specific desktop, e.g. SSH remote via MacBook Air; and
• There should be a clear way to remove/forget such SSH-backed devices from the account/mobile connection list; and
• Their presence should not prevent iPhone/Android from connecting to real desktop devices.

Actual behavior

The SSH remote appears in mobile as a normal Codex Desktop device (devbox) alongside real desktop machines. This makes it unclear which entries are real independent devices vs. Desktop-managed SSH remotes, and it appears to break or interfere with mobile remote connections on other clients.

Impact

• Device list becomes misleading across iPad/iPhone/Android.
• Users cannot tell whether a host is independently enrolled or only reachable through another desktop's SSH proxy.
• Removing the SSH remote locally is unclear and may not reliably clean up the account-level/mobile list.
• Other mobile clients may fail to connect after the SSH remote appears.

Notes

Hostnames and account identifiers are anonymized here. I can provide more specific logs or request IDs privately if needed.

[github-actions]

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• Mobile Remote Control does not discover SSH remote project threads despite documented remote development environment support #23062
• Codex mobile : Stale codex mobile connections #22902

Powered by Codex Action

[ttbhbb]

Correction / additional clarification: this did not recover.

Current state:

• iPhone, iPad, and Android all show the same three entries in the mobile connection list.
• The devbox entry cannot be removed from mobile.
• None of the mobile clients can successfully connect while this stale/misclassified entry is present.
• The important distinction is that devbox is not a real independently enrolled Remote Control device. It was only an SSH-backed remote that was connected from Codex Desktop on the MacBook Air.

So the core bug is more specific:

1. User pairs/connects real desktop devices from mobile, e.g. MacBook Air and macmini.
2. On MacBook Air, Codex Desktop connects to an SSH remote (devbox).
3. Mobile clients then show devbox as another account-level Codex Desktop device, even though it is just an SSH-backed Desktop-managed remote.
4. Mobile has no way to remove/forget this SSH-backed entry.
5. With this ghost/misclassified devbox entry present, iPhone/iPad/Android all see the devices but remote connection fails.

This is closer to #22902 in that stale/ghost mobile connection records cannot be removed, but the additional failure mode here is that a Desktop-managed SSH remote is promoted into the same mobile device list as real Remote Control devices and appears to poison/break mobile remote connection for the account.