Support Desktop using the managed local App Server for direct mobile SSH/Tailscale control #31991

Summary

I wanted to control Codex Desktop from the ChatGPT mobile app over my own private network, using Tailscale and SSH, instead of using the hosted Remote Control relay.

The hosted relay is significantly slower in my network environment. Direct SSH over Tailscale has much lower latency, but I still want the native Codex Desktop experience: threads, approvals, plugins, diffs, and project context.

I found a working configuration where Codex Desktop and the ChatGPT mobile SSH client connect to the same managed App Server process.

Working setup

Environment:

• macOS
• Codex standalone CLI 0.144.1
• ChatGPT/Codex Desktop
• ChatGPT mobile Codex SSH connection
• Tailscale as the private network
• Same macOS user and CODEX_HOME

Install the standalone Codex package:

curl -fsSL https://chatgpt.com/codex/install.sh | sh

Start the managed App Server:

~/.local/bin/codex app-server daemon bootstrap

Enable the existing Desktop local-daemon path:

launchctl setenv CODEX_APP_SERVER_USE_LOCAL_DAEMON 1

After completely restarting ChatGPT/Codex Desktop, the Desktop app connects to:

~/.codex/app-server-control/app-server-control.sock

The ChatGPT mobile SSH connection automatically runs:

~/.local/bin/codex app-server proxy

That proxy connects to the same Unix socket.

Verified process topology

Codex Desktop ───────────────┐
                             ├─ managed codex app-server
ChatGPT mobile → SSH → proxy ┘

The managed server was:

~/.codex/packages/standalone/current/codex app-server --listen unix://

I verified with lsof that:

• Codex Desktop had one connection to the App Server Unix socket.
• The mobile SSH proxy had another connection to the same socket.
• Both connections terminated at the same App Server PID.
• Messages sent from mobile appeared in the same live Desktop thread.

No public WebSocket port was exposed. Tailscale provided private network reachability, SSH provided authentication and transport, and the App Server remained bound to its user-private Unix socket.

Important installation detail

The Homebrew single-binary Codex installation was not sufficient for this Desktop configuration because it did not include codex-code-mode-host.

The official standalone installation provided both:

~/.codex/packages/standalone/current/bin/codex
~/.codex/packages/standalone/current/bin/codex-code-mode-host

Request

Could this workflow become a supported and documented option?

Ideally, Codex Desktop would provide a setting such as:

Use managed local App Server

This would avoid relying on the undocumented CODEX_APP_SERVER_USE_LOCAL_DAEMON=1 environment variable.

It would let users:

• Use ChatGPT mobile's native Codex UI.
• Connect directly through SSH over Tailscale or WireGuard.
• Avoid the hosted Remote Control relay when direct private connectivity is available.
• Keep execution, files, credentials, permissions, and project context on the Mac.
• Preserve the native Codex Desktop experience.
• Avoid exposing an App Server WebSocket port.

A documented persistent macOS configuration would also be useful because launchctl setenv may not survive logout or reboot.

Related discussions

• Codex Remote Control #9224 — Codex Remote Control
• Expose app-server over network transport for remote/mobile session attach #11166 — Expose App Server over network transport
• App Server: peer-client co-presence with the live TUI thread (RFC) #21551 / Live peer-client co-presence on Codex App Server: per-instance sync, or shared multi-listener? #21558 — Live peer-client co-presence
• ChatGPT iOS Codex SSH connection works on linux, but the bootstrap/proxy flow is fragile and hardcoded #23102 — Mobile SSH App Server proxy flow
• macOS remote control stalls: host app-server responsive but remote manager stays disconnected #23482 — Hosted relay stalls while Tailscale connectivity remains responsive