Desktop app (macOS): logged out after every conversation — "Missing valid access token or actor biscuit", no token refresh attempted

Environment

• macOS 15 (Darwin 25.5.0), Apple Silicon (Mac mini)
• ChatGPT/Codex desktop app build 26.818.21641 (preview channel)
• codex-cli 0.148.0-alpha.21 (same machine, same account)
• ChatGPT Plus subscription, ChatGPT-account OAuth login
• Network note: system HTTP(S) proxy in use; the codex CLI on the same machine/network works flawlessly for days with zero logouts (relevant control group)

Symptom

The desktop app logs me out after almost every conversation. Finishing a chat, or clicking any history conversation, kicks me back to the sign-in screen. Re-login succeeds but the cycle repeats. ~100% reproducible.

Key log evidence (from ~/Library/Logs/com.openai.codex/)

1. Seconds after a model response completes:

   desktop_fetch_auth_401 hadToken=true skipRetryReason=null
     target="GET https://chatgpt.com/backend-api/accounts/:param/settings" tokenSource=cached willRetry=true
   

2. Immediately followed by:

   sa_server_request_failed attachAuth=true attachIntegrityState=true
     errorMessage="Missing valid access token or actor biscuit"
   

3. All subsequent backend-api requests degrade to hadToken=false skipRetryReason=no_token_attached and retry ~1/min indefinitely.
4. After access-token expiry (~1h), no refresh attempt is ever made — auth.json stays untouched (verified with a file watcher).
5. On a previous occasion the app also logged Failed to refresh token: 401 ... "Your refresh token has been invalidated" (code token_revoked) during a concurrent re-login — but the current failures occur with a fresh, exclusive token.

Already ruled out

• Full data reset: quit app; archived ~/Library/Application Support/Codex, ~/Library/HTTPStorages/com.openai.codex* (incl. binarycookies), ~/Library/Caches/com.openai.codex, the notifications Group Container, and Preferences; fresh start + fresh device login → same 401 within minutes of the first conversation.
• Keychain: login keychain is writable (other Chromium-based apps maintain their "Safe Storage" entries fine), but this app never creates one; secd logs show zero denials — the app simply never writes.
• Token conflicts: ensured no other process shares the app's auth.json; the failure reproduces with an exclusive, freshly-issued token.
• Reinstall-equivalent (clean profile) does not help; app reports it is up to date.

Question

What causes actor-biscuit issuance/validation to fail persistently for this device? Is it tied to device registration or network/TLS fingerprint (proxy)? The CLI's auth on the same account/machine/network is rock-solid, so this appears specific to the desktop app's web-session path. Happy to provide full logs privately.

Start with the desktop app logs under ~/Library/Logs/com.openai.codex/ and compare the token lifecycle with auth.json, focusing on the 401, actor-biscuit error, and absence of refresh attempts. Use the clean-profile reproduction and the CLI as controls; done means identifying the desktop-specific failure and confirming that sessions no longer log out after token expiry.