Codex Desktop should provide safe local thread/sidebar recovery and avoid pin-state hiding active project chats

What version of the Codex App are you using?

Codex Desktop 26.506.31421 build 2620 on macOS 26.5, Apple Silicon.

What issue are you seeing?

Codex Desktop local chat/thread history can enter a state where active local threads still exist in ~/.codex/state_5.sqlite, ~/.codex/session_index.jsonl, and rollout logs, but the Desktop sidebar does not reliably show all non-archived project chats.

In this incident, attempts to work around the sidebar problem by patching the packaged Electron app.asar created a second, worse failure: Codex began crashing at startup because the signed macOS app bundle was modified. Restoring the original signed app.asar fixed the launch crash; repairing the local sidebar state then restored the expected local thread index.

This report is not asking Codex to support patched app bundles. The opposite: Desktop needs a first-party, support-safe recovery path so users do not have to patch app.asar or manually edit local state.

Evidence from local recovery

Crash symptom:

• macOS crash report showed EXC_BREAKPOINT (SIGTRAP) in Electron/Node/V8 bootstrap on the main thread.
• codesign --verify --deep --strict /Applications/Codex.app reported invalid signature (code or signature have been modified) while the patched ASAR/extra backup existed inside the bundle.
• Restoring the original app.asar and removing the extra unsigned in-bundle backup made codesign and spctl pass again.

Sidebar/thread state after recovery:

SQLite threads total: 389
Active unarchived interactive user threads: 150
session_index.jsonl entries: 150
Unique sidebar thread IDs in global state: 150
Missing session_index entries: 0
Timestamp rows to repair: 0
Global state pending changes after final repair: False
session_index pending changes after final repair: False

Relevant local state files:

~/.codex/state_5.sqlite
~/.codex/state_5.sqlite-wal
~/.codex/state_5.sqlite-shm
~/.codex/session_index.jsonl
~/.codex/.codex-global-state.json
~/.codex/sessions/**/rollout-*.jsonl

Reproduction shape

This is the shape of the failure, based on the recovered machine:

1. Use Codex Desktop long enough to accumulate many local project chats.
2. Local SQLite/session/rollout files still contain active, non-archived user threads.
3. Sidebar project groups or recent-chat views stop showing the expected non-archived chats.
4. Manual state changes or pin-based hydration workarounds can make things worse:

• setting pinned-thread-ids to many/all restored thread IDs can hide those threads from normal project groups if the projects are not also pinned.
• project groups can appear as No chats even though the project thread IDs exist in global state and SQLite.

1. If the user patches app.asar to work around the renderer/sidebar behavior, the macOS bundle signature is invalidated and Codex can crash at startup.

Expected behavior

• If local thread data exists and is active/unarchived, Codex Desktop should be able to rebuild a sidebar-visible index without ASAR patching.
• The app should not require users to manipulate pinned-thread-ids or project sidebar state manually to hydrate existing local chats.
• Pinned-thread filtering should not make valid project groups appear empty.
• Hidden recent-thread hydration limits should not prevent project sidebar groups from showing their known thread IDs.
• If signed app resources are invalid, Desktop should show a clear repair/reinstall message rather than crashing during Electron bootstrap.

Suggested upstream fixes

1. Add a first-party app-server/local command to reconcile:

• state_5.sqlite
• session_index.jsonl
• .codex-global-state.json
• rollout file metadata

1. On startup, validate and repair:

• active user threads missing from session_index.jsonl
• stale or missing thread-workspace-root-hints
• invalid top-level rollout title events
• timestamp drift caused by rollout file mtimes
• stale pinned-thread-ids/pinned-project-ids

1. Make project-sidebar hydration load all thread IDs referenced by sidebar-project-thread-orders, not only the initial recent conversation page.
2. Ensure pinned-thread exclusion does not remove threads from normal project groups unless the pinned project group will actually show them.
3. Add a Desktop UI recovery action such as “Rebuild local chat index”.
4. Detect modified signed bundle resources and surface a clear recovery message.

Workaround that resolved the local machine

1. Restore the original signed app.asar.
2. Move any unsigned app.asar.* backup files out of /Applications/Codex.app.
3. Verify:

``bash
codesign --verify --deep --strict --verbose=2 /Applications/Codex.app
spctl -a -vv /Applications/Codex.app
``

1. Quit Codex completely.
2. Back up:

``text
~/.codex/state_5.sqlite*
~/.codex/session_index.jsonl
~/.codex/.codex-global-state.json*
``

1. Rebuild sidebar global state and session_index.jsonl from active, unarchived, interactive user threads.
2. Keep pinned-thread-ids and pinned-project-ids empty unless they represent true user pins.
3. Relaunch Codex and verify no new crash report appears.

Why this matters

When the sidebar hides threads that still exist locally, users think their chat history has been deleted. That pushes users toward risky manual recovery, including editing SQLite/global-state files or patching the Desktop app bundle. A built-in repair path would reduce data-loss fear and prevent broken signed bundles.