Codex App should not auto-select or probe SSH config hosts without explicit opt-in

What version of the Codex App are you using (From "About Codex" dialog)?

Windows app package: OpenAI.Codex_26.429.2026.0_x64__2p2nqsd0c76g0

Bundled CLI shown in PowerShell:

codex-cli 0.128.0

What subscription do you have?

ChatGPT paid subscription

What platform is your computer?

Windows x64

What issue are you seeing?

Codex App automatically discovers SSH hosts from ~/.ssh/config, selects a discovered host, and checks connection state during startup without an explicit user action to enable/use that remote host.

In my case, C:\Users\<user>\.ssh\config contained a stale LAN host:

Host 192.168.1.181
  HostName 192.168.1.181
  User <user>

No current device was using that address, and it was not reachable. Even so, Codex Desktop repeatedly discovered it and persisted it as:

selected-remote-host-id = remote-ssh-discovered:192.168.1.181

The app logs also showed it checking state for all discovered SSH hosts on startup:

[remote-connections/discovery] discovery_started entrypointPath=C:\Users\<user>\.ssh\config savedRemoteConnectionAliasCount=0
[remote-connections/discovery] discovery_completed collectedAliasCount=6 collectedAliases=["192.168.1.33","192.168.1.181", ...] resolvedConnectionCount=6
[remote-connections/selection] persisted_selection_reconciled availableConnectionCount=6 persistedSelectedRemoteHostId=undefined selectedConnectionState=selected selectedRemoteHostId=remote-ssh-discovered:192.168.1.181
remote_connections.manager_state_set hostId=remote-ssh-discovered:192.168.1.181 nextState=disconnected source=bootstrap_connection_state_fetch

This caused slower startup while Codex was apparently dealing with a stale SSH target that I had not explicitly asked it to connect to. Removing/commenting the stale Host 192.168.1.181 block from ~/.ssh/config made startup noticeably faster.

This is surprising because an SSH config entry is not the same thing as granting Codex permission to use/probe that host. I would expect Codex to list possible remotes, but not auto-select or connection-check/probe them until I explicitly choose to connect.

What steps can reproduce the bug?

1. On Windows, add a stale or unreachable LAN host to C:\Users\<user>\.ssh\config, for example:

``sshconfig
Host 192.168.1.181
HostName 192.168.1.181
User <user>
``

1. Start Codex App.
2. Observe the desktop logs under:

``text
C:\Users\<user>\AppData\Local\Packages\OpenAI.Codex_*\LocalCache\Local\Codex\Logs\
``

1. Codex discovers the SSH config entry and reconciles/selects it as a remote host.
2. Codex checks connection state for the discovered host even though the user did not explicitly connect to it.
3. Startup is slower if the host is stale or unreachable.
4. Comment out or remove the stale Host block and restart Codex. Startup improves and the stale host is no longer discovered.

What is the expected behavior?

Codex App should not auto-select or probe SSH hosts discovered from ~/.ssh/config without explicit user intent.

Expected behavior:

• Reading ~/.ssh/config to populate a possible remote list is fine.
• Do not select a discovered SSH host automatically unless the user previously selected it and it still exists.
• Do not connect/probe/check state for discovered SSH hosts until the user explicitly chooses to use remote SSH.
• Provide a setting to disable SSH host discovery entirely.
• Treat ~/.ssh/config entries as candidates, not as permission to access remote hosts.

Additional information

This is related to, but distinct from, stale discovered-host crash behavior reported in #18974. That issue covers failure after a discovered host is removed. This report is only about SSH discovery/selection/probing behavior: Codex Desktop should not auto-select or probe SSH config hosts unless the user explicitly opts in.

The practical workaround is to remove or comment out stale entries from ~/.ssh/config, but that is not obvious because users may reasonably keep old SSH host aliases for reference or manual use outside Codex.