Codex triggers Git/SSH activity on app focus in SSH-backed repos, causing 1Password SSH key prompts without an explicit user action

What version of the Codex App are you using (From “About Codex” dialog)?

26.409.20454

What subscription do you have?

Plus

What platform is your computer?

macOS: 26.4 (25E246)

What issue are you seeing?

When I open a project in the Codex desktop app, Codex appears to perform project-open refresh activity that correlates with internal Git worker activity. If the repository remote uses SSH, this causes my SSH agent/password manager to prompt for key access even though I did not explicitly run a remote Git command.

If I switch the exact same repository remote from SSH to HTTPS, the prompt goes away.

Environment

Codex desktop app version: 26.409.20454
macOS: 26.4 (25E246)
SSH agent: external agent/password manager integrated through ~/.ssh/config
Relevant SSH config

Host *
IdentityAgent "/path/to/ssh-agent.sock"
Repro steps

Set the repository remote to SSH:
git remote set-url origin git@github.com:OWNER/REPO.git
Launch Codex.
Open the project in Codex.
Wait for project-open initialization/refresh.
An SSH credential/key prompt appears.
Control test

Set the same repository remote to HTTPS:
git remote set-url origin https://github.com/OWNER/REPO.git
Launch Codex.
Open the same project in Codex.
No SSH credential/key prompt appears.

Expected behavior

Opening a project should not trigger SSH authentication or any remote Git check unless I explicitly initiate an action that requires it.

Actual behavior

When the project remote uses SSH, opening the project in Codex triggers behavior that surfaces an SSH credential/key prompt. When the same project uses HTTPS, the prompt does not appear.

Frequency

Reproduces consistently with SSH remote
Does not reproduce with HTTPS remote
What I checked

I could not find a user-facing Codex setting that explains or disables this behavior.
Shell startup files are not the cause.
Repository hooks are not the cause.
The issue reproduces after a full reboot.
The issue depends on the repository remote protocol: SSH reproduces, HTTPS does not.
Relevant evidence

Codex logs show focus/app lifecycle activity and internal Git worker activity around project open/focus. I did not find an explicit git fetch line in the accessible logs, so the exact remote Git operation is still unconfirmed.

Short log slice

2026-04-13T14:28:42.960Z app.activate
2026-04-13T14:28:42.982Z window.focus
2026-04-13T14:28:45.755Z git_worker_invocations_total=249
2026-04-13T14:28:45.755Z git_worker_invocations_last_30s=50
Additional note

This appears to be tied to Codex project-open refresh behavior rather than a separately installed Git integration. From the user perspective, it looks like opening a project in an SSH-backed repository can trigger SSH key usage without explicit intent. I believe this is fetching marketplace and plugin updates

What steps can reproduce the bug?

Set the repository remote to SSH:
git remote set-url origin git@github.com:OWNER/REPO.git
Launch Codex.
Open the project in Codex.
Wait for project-open initialization/refresh.
An SSH credential/key prompt appears.
Control test

Set the same repository remote to HTTPS:
git remote set-url origin https://github.com/OWNER/REPO.git
Launch Codex.
Open the same project in Codex.
No SSH credential/key prompt appears.

What is the expected behavior?

_No response_

Additional information

_No response_