[macOS][26.814–26.820] Opening an existing chat 401s with actor biscuit and kicks to sign-in; 26.810.52044 still works

What version of the Codex App are you using (From “About Codex” dialog)?

Broken builds on this machine:

• 26.814.41407 (build 6720)
• 26.814.41957 (build 6744)
• 26.818.31338 (build 6892)
• 26.820.60940 (build 7119)

Last known-good build on the same machine, same account, same ~/.codex data: 26.810.52044 (build 6662). Currently rolled back to that build so the app is usable.

Bundled CLI in the broken 26.820 app was codex-cli 0.148.0-alpha.9. Homebrew CLI on the same machine: codex-cli 0.145.0.

What subscription do you have?

ChatGPT personal account. Access-token claim chatgpt_plan_type is prolite. Single Personal org. Not a Team/Business/Enterprise workspace.

What platform is your computer?

Darwin 25.6.0 arm64 arm

macOS 26.6.2 (25G83), Apple silicon.

What issue are you seeing?

Opening an existing Codex chat or project in the ChatGPT/Codex desktop app shows the thread for a split second, then kicks back to the ChatGPT sign-in screen.

This is not a missing password or expired CLI login:

• codex login status still reports Logged in using ChatGPT after the desktop UI has already signed out.
• ~/.codex/auth.json still has a ChatGPT-mode OAuth access token that is not expired (access token exp ~10 days out).
• thread/list, thread/read, and thread/resume against the local app-server succeed. That is why the chat flashes on screen.
• The desktop shell then calls ChatGPT web backend-api, gets HTTP 401, discards the still-valid token, and treats the user as signed out.

Sanitized log sequence from 26.820.60940 tonight (app session 64b388d9-56a5-4e97-95f7-5cc5c69c02fb, times UTC). Account IDs redacted.

chatgpt-account-lookup ... authenticatedAccountPresent=true authMethod=chatgpt result=succeeded
devicecheck-attestation ... DeviceCheck attestation generated
thread/resume ... errorCode=null
desktop_fetch_auth_401 hadToken=true skipRetryReason=null
  target="GET https://chatgpt.com/backend-api/accounts/:param/settings"
  tokenSource=cached willRetry=true
app_server_connection.auth_status_result authMethod=chatgpt
  cacheWrite=null hasToken=false nullReason=auth_token_missing
  refreshToken=true tokenExpiryState=missing
chatgpt-account-lookup ... authenticatedAccountPresent=false
  failureType=account_info_token_unavailable result=failed
sa_server_request_failed attachAuth=true attachIntegrityState=true
  errorMessage="{\"detail\":\"Missing valid access token or actor biscuit\"}"
  routePattern=/accounts/{account_id}/settings status=401
desktop_fetch_auth_401 hadToken=false skipRetryReason=no_token_attached
  target="GET https://chatgpt.com/backend-api/wham/:param/:param"

Signing in again completes (account_login_completed success=true, authenticatedAccountPresent=true) and writes a new token to auth.json. ~6 seconds later the same 401 happens again. Observed 5 successful logins in one evening on 26.814, all immediately invalidated.

Subsequent backend-api calls keep 401ing with no token attached:

• GET /backend-api/wham/onboarding/context → {"detail":"Unauthorized"}
• GET /backend-api/wham/usage → Unauthorized
• GET /backend-api/wham/tasks/list → Unauthorized
• POST /backend-api/sentinel/heartbeat → Unauthorized

tokenExpiryState=missing is reported while auth.json still contains an unexpired access token. No refresh-token exchange is attempted after the 401. The desktop just drops hadToken to false.

Electron cookie jar for chatgpt.com has Cloudflare / device cookies (__cf_bm, _devicecheck, _puid, oai-sc) but no ChatGPT session cookie. Login appears to refresh the CLI OAuth token only, not mint a ChatGPT actor biscuit / web session.

Independent curl of the same OAuth access token against /backend-api/accounts/{account_id}/settings returned 401 {"detail":"Must use workspace account for this operation"}. The desktop surfaces the less specific biscuit error because it attaches via X-OpenAI-Attach-Auth + X-OpenAI-Attach-Integrity-State instead of Authorization: Bearer.

What steps can reproduce the bug?

1. Be on ChatGPT desktop 26.810.52044. Existing chats/projects open normally. CLI stays logged in.
2. Sparkle auto-update to 26.814.x, 26.818.x, or 26.820.60940.
3. Launch the app. Sidebar appears signed in.
4. Click any existing chat or project.
5. Thread resumes locally for a moment, then the app redirects to Log in to ChatGPT.
6. Sign in again. Cycle repeats within seconds.

A/B on this machine (no other variables changed):

Build	Result
26.810.52044	Usable. One session ran ~8 days with zero desktop_fetch_auth_401 / biscuit errors.
26.814.41407	Sign-out loop immediately.
26.814.41957	Same loop. Same 401.
26.818.31338	Same loop.
26.820.60940	Same loop tonight. First 401 ~21 minutes after launch when a thread was opened; after re-login, 401 in ~6s.

Rollback to the official signed/notarized 26.810.52044 zip restores normal use without touching ~/.codex, account, or network.

What is the expected behavior?

Opening an existing conversation should keep the authenticated account. A 401 on /accounts/{id}/settings should not discard a still-valid OAuth token, skip refresh, and force a full sign-out.

If the desktop now requires a ChatGPT actor biscuit / workspace session in addition to Codex CLI OAuth, login should mint that biscuit and persist it. If a personal/prolite account cannot use that endpoint, the UI should say so instead of bouncing to the login screen.

Additional information

Related open issues with the same failure signature:

• https://github.com/openai/codex/issues/39162 (macOS 26.814.41407, rollback to 26.810 works)
• https://github.com/openai/codex/issues/40143
• https://github.com/openai/codex/issues/40395
• https://github.com/openai/codex/issues/39695
• https://github.com/openai/codex/issues/39850
• https://github.com/openai/codex/issues/39189

Workarounds that did not help here: signing in again, installing later 26.814/26.818/26.820 builds. Workaround that did help: stay on 26.810.52044 and skip Sparkle updates.

Official zip used for rollback: https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.810.52044.zip

Logs: ~/Library/Logs/com.openai.codex/ (can provide sanitized excerpts). No tokens, emails, or account IDs included above.

Start with the sanitized logs in ~/Library/Logs/com.openai.codex/ and compare the authentication flow across builds 26.810.52044 and 26.820.60940. Inspect how auth.json, the desktop_fetch_auth_401 event, and the /backend-api/accounts/{account_id}/settings response are handled. Done means existing chats remain usable without repeated sign-in, while personal accounts receive a clear result if the endpoint is unsupported.