macOS 27: Remote Control WebSocket returns 503 through GRU on home network and cellular hotspot

What version of the Codex App are you using?

• ChatGPT/Codex desktop: 26.903.61454, bundle build 8378
• Bundled Codex CLI/app-server: 0.153.4
• macOS 27.0, Apple Silicon arm64
• Authentication: ChatGPT account. Subscription tier omitted.

What issue are you seeing?

Codex Remote cannot connect from the phone because the Mac repeatedly fails to establish its Remote Control WebSocket. Enrollment already exists (has_enrollment=true).

This matches #44313, #44316, and #44326. This report adds a reproduction on macOS 27.0, two access networks, IPv4/IPv6 checks, and a comparison against the same unauthenticated probe from a separate server reaching a different Cloudflare location.

The authenticated desktop transport repeatedly reports:

failed to connect to app-server remote control websocket
websocket_url=wss://chatgpt.com/backend-api/wham/remote/control/server
HTTP error: 503 Service Unavailable
upstream connect error or disconnect/reset before headers.
reset reason: connection termination
has_enrollment=true

Still reproduced at 2026-09-10 01:00 UTC, corresponding to September 9, 22:00 UTC-3. An authenticated desktop failure at 01:00:30 UTC had cf-ray: a38a7f0148b3f177-GRU. A separate unauthenticated probe at 01:00:50 UTC returned HTTP 503 with cf-ray: a38a7f80ca4b2829-GRU.

What steps can reproduce the bug?

1. Keep the desktop app running with Remote Control already enrolled.
2. Attempt to connect from the phone.
3. Observe repeated Remote Control WebSocket failures in the desktop transport logs.
4. Switch the Mac from its original connection to a cellular hotspot. The same 503 persists.
5. Independently reproduce the failure without credentials using:

curl -4 --http1.1 --max-time 12 -sS -D - -o /dev/null \
  -H 'Connection: Upgrade' \
  -H 'Upgrade: websocket' \
  -H 'Sec-WebSocket-Version: 13' \
  -H 'Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==' \
  https://chatgpt.com/backend-api/wham/remote/control/server

Changing -4 to -6 also returned HTTP 503 on the original connection. Both responses identified Cloudflare GRU.

Isolation and comparison

• macOS system HTTP/HTTPS/SOCKS proxy settings were not enabled.
• The configured FortiClient VPN was disconnected.
• The Mac's original connection and cellular hotspot both returned HTTP 503 through GRU.
• The same unauthenticated WebSocket probe from a separate server returned HTTP 400 through EWR, instead of the GRU upstream 503. No desktop credentials or enrollment material were sent to that server.
• The EWR 400 is only a control result from an incomplete, unauthenticated handshake. It does not prove that authenticated Remote Control works there.
• No local enrollment was deleted, no authentication files were modified, and no routing configuration was changed during this investigation.

These observations support a routing/upstream hypothesis, but do not establish the exact failing component.

What is the expected behavior?

An enrolled Mac should establish the persistent Remote Control connection and be reachable from the phone. If the service is unavailable, the UI should distinguish that condition from a pairing/configuration problem.

Separate concurrent symptom, not established as the same root cause

A local image-heavy task also returned HTTP 400 from POST /backend-api/codex/responses, with only {"detail":"Bad Request"} in the body. Five failures were observed from 00:38:46 to 00:44:20 UTC on September 10.

Its request size reached approximately 7.6 MB before compression. The persisted history contained 30 inline images totaling approximately 6.9 MB of data URLs. Saving a checkpoint and renewing the task's model context reduced requests to approximately 0.6 MB. There were 13 consecutive HTTP 200 responses between 00:47:02 and 00:50:05 UTC, and further successful requests through 01:00:41 UTC. The task resumed its work.

This resembles reports #41338 and #43711, but the server supplied no rejection reason, so neither a specific payload limit nor a causal link to the Remote 503 is established. Remote continued to fail while the local task was succeeding.

Please investigate the GRU Remote Control WebSocket failures and advise on a supported recovery path. Hostnames, account identifiers, enrollment identifiers, local paths, and credentials have been omitted.

The issue names no repository files or tests. Start with the provided unauthenticated WebSocket curl probe, comparing the GRU 503 with the EWR 400 and the authenticated desktop transport logs; done means identifying the failing service component or documenting a supported recovery path.