codex app-server can pollute subsequent TUI session metadata (wrong cwd/source/originator)

Summary

After starting codex app-server, subsequent Codex TUI sessions launched from a project directory were recorded with incorrect session metadata.

The sessions were started from a CLI/TUI workflow in:

/data00/home/<user>/Work/team-docs

But multiple session records were written as if they came from Desktop / VS Code, and in the wrong working directory:

cwd=/data00/home/<user>
originator=Codex Desktop
source=vscode

The expected metadata should have been:

cwd=/data00/home/<user>/Work/team-docs
originator=codex-tui
source=cli

Environment

• OS: Linux 5.4.0 x86_64
• Affected session metadata was created with codex-cli 0.130.0
• Current local CLI after update: codex-cli 0.131.0
• Storage inspected:
• ~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl
• ~/.codex/state_5.sqlite

What happened

I normally launch Codex TUI from the repository directory. A previous normal session had metadata like:

{
  "cwd": "/data00/home/<user>/Work/team-docs",
  "originator": "codex-tui",
  "source": "cli"
}

After starting codex app-server, new sessions created from the same repository were indexed incorrectly.

A backup taken before manual repair showed the canonical DB rows in ~/.codex/state_5.sqlite had the wrong cwd/source for 6 sessions from the same day:

cwd=/data00/home/<user>
source=vscode
thread_source=user

The rollout JSONL session_meta first line also showed wrong metadata for most of those sessions:

cwd=/data00/home/<user>
originator=Codex Desktop
source=vscode
cli_version=0.130.0

One JSONL had already been manually corrected by the time the broader backup was taken, but the SQLite threads table still showed the same wrong cwd/source pattern for all 6 affected session rows.

Expected behavior

Starting codex app-server should not affect metadata for later CLI/TUI sessions.

A TUI session launched from a terminal in a repository should consistently write:

cwd=<actual project cwd>
originator=codex-tui
source=cli

This should be true in both:

• the first session_meta line of the rollout JSONL file
• the corresponding row in ~/.codex/state_5.sqlite.threads

Actual behavior

After codex app-server had been started, later TUI sessions were attributed to Desktop / VS Code and indexed under the parent home directory instead of the active project directory.

This caused repository-based session lookup to fail or return incomplete results, because the affected sessions no longer appeared to belong to the project they were actually launched from.

Impact

Tools and workflows that rely on session metadata break or become misleading:

• listing sessions for the current repository misses affected sessions
• session recall/search by cwd points to the wrong directory
• TUI sessions appear to have been created by Desktop / VS Code
• the JSONL session file and SQLite thread index can disagree during/after partial repair

Manual repair performed

I manually repaired:

• the first-line session_meta payload in affected ~/.codex/sessions/.../rollout-*.jsonl files
• the corresponding cwd and source fields in ~/.codex/state_5.sqlite.threads

After repair, all 6 affected sessions resolved correctly under:

/data00/home/<user>/Work/team-docs

with:

originator=codex-tui
source=cli

logs_2.sqlite still contains historical telemetry strings such as Codex_Desktop / source=vscode, but those appear to be log text rather than the canonical session metadata index.

Related issues

I found a few Desktop/session-history related issues, for example #20864 and #20741, but this report is specifically about codex app-server apparently leaking Desktop/VS Code attribution into later TUI session metadata and the SQLite thread index.