[Bug][Windows Desktop 26.820.9563.0 / Codex CLI] Chronic Auth De-sync, Infinite Login Loop, and Off-screen Bounds

Summary

We are reporting a critical set of chronic bugs affecting the Windows ChatGPT Desktop App (UWP/Electron package: OpenAI.Codex_26.820.9563.0_x64__2p2nqsd0c76g0) and Codex CLI (v0.150.0-alpha.8) on Windows 10/11 environments.

These issues lead to severe user frustration, frequent de-authentications, unrecoverable OAuth loading loops ("Continue signing in with your browser"), and window rendering failures where the window is placed at off-screen negative coordinates.

Environment

• Operating System: Windows 11 / Windows 10 (x64) + WSL2
• ChatGPT Desktop App Version: OpenAI.Codex_26.820.9563.0_x64__2p2nqsd0c76g0
• Codex CLI Version: v0.150.0-alpha.8 (Codex App Tools bundled: server.mjs)
• Browser: Google Chrome / Microsoft Edge (Default)

Key Issues & Root Cause Analysis

1. Chronic De-authentication & Infinite "Continue signing in with your browser" Loop

• Symptom:
  • The desktop app randomly drops active user sessions and resets to the landing screen ("Sign in to ChatGPT").
  • Clicking "Continue to sign in" transitions the app into "Continue signing in with your browser" with a single [Cancel sign-in] button.
  • The local OAuth server spawns on http://localhost:1455 (or dynamic ports), but if the browser does not automatically navigate to the generated OAuth URL or if the protocol handler callback (codex:// or http://localhost:1455/auth/callback) is blocked/delayed by Windows sandbox restrictions, the app deadlocks indefinitely.
• Root Cause:
  • The UWP AppContainer isolation (%LOCALAPPDATA%\Packages\OpenAI.Codex_2p2nqsd0c76g0\LocalCache\Roaming\Codex\web\Codex) fails to reliably sync token state with %APPDATA%\Codex\auth.json and ~/.codex/auth.json.
  • Even when --device-auth succeeds in CLI, the desktop Electron webview does not listen for file changes or re-read tokens without a manual process teardown.

2. Window Bounds Rendered Off-Screen at Negative Coordinates (-1920, -1040)

• Symptom:
  • The app process (ChatGPT.exe) runs with high CPU/memory in Task Manager and reports MainWindowTitle: ChatGPT, but no window appears on any connected display.
  • MainWindowHandle frequently evaluates to 0 or points to an off-screen viewport.
• Root Cause:
  • In .codex-global-state.json, electron-main-window-bounds is frequently written with negative coordinates, e.g.:

    "electron-main-window-bounds": {
      "x": -1920,
      "y": -1040,
      "width": 1918,
      "height": 2076,
      "isMaximized": false
    }
    

  • The app lacks bounds sanitization/clamping against current active virtual screen bounds during startup.

3. UTF-8 BOM JSON Parsing Crash on Startup

• Symptom:
  • The app silently terminates immediately after launch without opening any window or UI.
• Root Cause:
  • If .codex-global-state.json contains a UTF-8 Byte Order Mark (\xef\xbb\xbf), Electron's JSON.parse() throws a fatal syntax error before window creation.

Reproduction Steps

1. Install OpenAI.Codex_26.820.9563.0 on Windows 11 with WSL2 enabled.
2. Sign in using the default browser OAuth flow.
3. Work across multiple sessions or restart the computer / close the app.
4. Observe that:
   • The app randomly returns to "Sign in to ChatGPT" / "Continue signing in with your browser".
   • The window occasionally vanishes due to negative coordinates written to .codex-global-state.json.

Suggested Fixes & Recommendations

1. OAuth UI Fallback: Provide an interactive Device Code entry (auth.openai.com/codex/device) directly within the desktop UI instead of relying solely on localhost port callbacks.
2. Window Bounds Sanitization: On startup, validate electron-main-window-bounds and reset (x, y) to primary monitor center if coordinates fall outside visible display geometry.
3. Robust JSON Parsing: Strip BOM automatically before parsing state JSON files (content.replace(/^\uFEFF/, '')).
4. Unified Token Sync: Ensure UWP AppContainer and Win32 CLI share a unified, persistent credential cache.

Start by reproducing the three reported failures and inspect .codex-global-state.json, %APPDATA%\Codex\auth.json, and ~/.codex/auth.json; server.mjs and the localhost:1455 callback are also named entry points. Done means the app recovers from stale authentication, restores visible window bounds, and starts when the state JSON contains a UTF-8 BOM, with tests or reproducible checks for each case.