Codex Desktop remote-control keeps using revoked client when connecting Mac to Windows, no approval request appears #25532

What version of Codex App are you using?

Codex Desktop on macOS, updated on 2026-06-01. Bundled/standalone Codex CLI observed locally: 0.135.0.

What subscription do you have?

Not included.

What platform is your computer?

Local controller: macOS Codex Desktop on Apple Silicon Mac mini.
Remote target: Windows PC. Hostname intentionally redacted.

What issue are you seeing?

Mac Codex Desktop cannot connect to Windows Codex Desktop through the new remote-control system. The Windows side never receives an approval request. The Mac side repeatedly fails before approval with:

Remote-control client has been revoked

This is not the old SSH flow. The previous SSH config was disabled and the Mac remote-control daemon is running.

The issue persists after:

• deleting/recreating Windows-side permissions/access
• fully quitting/reopening Codex on both machines
• signing out/in attempts
• resetting Mac remote_control_enrollments in ~/.codex/state_5.sqlite and restarting the daemon
• confirming the Mac local daemon is running and has fresh enrollment rows
• renaming the Windows machine
• confirming the Windows PC is reachable by IP on the LAN

What steps can reproduce the bug?

1. Use one ChatGPT account/workspace on a Mac Codex Desktop and Windows Codex Desktop.
2. Previously authorize remote control, then revoke/delete access from the Windows side.
3. On the Mac, try to connect to the Windows machine through Settings > Connections > Control another device.
4. Observe that the Windows machine does not show an approval request.
5. Inspect Mac Codex Desktop logs.

Expected behavior

If an existing remote-control client enrollment has been revoked, Codex should invalidate that enrollment, remove the stale remote target, and force a fresh pairing/approval flow. The Windows target should receive a new approval request after the user re-enables remote control.

Actual behavior

Mac Codex Desktop repeatedly treats a revoked client as an existing enrollment and attempts to connect. The connection fails before the Windows approval prompt appears.

Representative sanitized log pattern:

[remote-control-websocket] remote_control_client_refresh_start_request hasExistingEnrollment=true localEnrollmentClientId=<redacted stale client id> ...
[AppServerConnection] app_server_connection.transport_connect_failed errorMessage="Remote-control client has been revoked" hostId=remote-control:<redacted env id> transport=websocket
[remote-connections/window-context] connect_from_config_apply_failed errorMessage="Remote-control client has been revoked" hostId=remote-control:<redacted env id>

During troubleshooting, multiple remote-control env IDs appeared over time, but all failed with the same revoked-client error. The Windows approval request never appeared.

Local diagnostics

Mac local enrollment rows were reset and recreated:

• codex app-server daemon version reports app-server running, managed version 0.135.0.
• remote_control_enrollments contains fresh Mac rows for the local macOS host.
• The log still reports hasExistingEnrollment=true for the same stale client ID and fails with Remote-control client has been revoked.

Network checks:

• Windows PC is reachable directly by IP; ping succeeds.
• A too-long Windows host name caused SMB/NetBIOS lookup issues, but the Codex failure is remote-control relay revocation, not a LAN connectivity failure.

Related issue

This looks related to #23339, which reports stale/revoked remote-control enrollment reuse, but this case is Mac Codex Desktop -> Windows Codex Desktop remote control where the Windows target never receives an approval prompt after access was deleted/recreated.

Suggested fixes

• When the relay returns Remote-control client has been revoked, clear the corresponding local enrollment and remote host mapping automatically.
• Do not keep using hasExistingEnrollment=true for a revoked client.
• Add a visible "Reset remote-control pairing / clear revoked enrollment" action in Codex Desktop Settings > Connections.
• Surface a clear UI error explaining that the stored remote-control client was revoked and needs fresh pairing.