Add a non-destructive Remote Control identity repair command

Feature request

Add a supported, non-destructive way to repair or rotate the local Remote Control identity without deleting chats, sessions, projects, authentication, plugins, or SSH connection settings.

Possible interfaces:

codex remote-control reset-identity

or:

codex doctor --repair remote-control

Motivation

Related bug reports:

• #26193
• #32882
• #33830

In an independently reproduced Mac-to-Mac case, one Mac had been restored/cloned from the other. The two physical Macs retained the same authoritative ~/.codex/installation_id. Network reachability and SSH were working, but native Remote Control pairing failed with “Failed to update connection.”

Clearing only the following was insufficient:

• electron-remote-control-client-enrollments in ~/.codex/.codex-global-state.json
• stale remote-control: auto-connect entries
• rows in state_5.sqlite → remote_control_enrollments

After relaunch, Codex restored the same installation identity from ~/.codex/installation_id, so the collision persisted.

The successful recovery was:

1. Fully quit the desktop app.
2. Create timestamped backups of the global-state JSON, state_5.sqlite, and ~/.codex/installation_id.
3. Remove/rotate ~/.codex/installation_id on the cloned/controller Mac.
4. Remove only the dependent Remote Control identity/enrollment state.
5. Validate JSON and SQLite integrity.
6. Relaunch the app and re-pair the devices.

After relaunch, the two Macs had distinct installation and environment IDs, and native Remote Control pairing succeeded. Existing chats, sessions, projects, authentication, and SSH settings were preserved.

This is materially safer than deleting all Codex application data, which can remove locally stored chats and context.

Proposed behavior

A supported repair command or UI action should:

1. Detect whether the desktop app/app-server is still running and either stop safely or fail closed with clear instructions.
2. Back up every state file that will be modified.
3. Rotate the local installation_id.
4. Clear only Remote Control state derived from the old identity, including dependent global-state keys and the relevant enrollment rows.
5. Preserve unrelated data, especially:

• sessions/ and local chat history
• saved projects and worktrees
• authentication state
• plugins and MCP configuration
• SSH hosts and remote projects

1. Validate the global-state JSON and run SQLite integrity_check before and after the repair.
2. Confirm that a new installation identity was generated and print the next re-pairing step.
3. Be idempotent and provide a documented rollback path from the backup.

Optional diagnosis

codex doctor could also detect or explain likely cloned-installation identity problems when Remote Control pairing returns a host/environment that is subsequently filtered or reported as not found.

Acceptance criteria

• A cloned/restored Mac can obtain a distinct Remote Control identity without wiping unrelated Codex data.
• The original Mac remains enrolled and unaffected.
• Existing chats and project metadata remain available.
• The repair refuses to edit live state while the desktop app is still writing it.
• The command reports which categories of state were backed up, rotated, preserved, and validated, without printing raw credentials or full device identifiers.