Codex Desktop stays permanently running when chat_processes.json is corrupted

Component

Codex Desktop App for Windows (Electron frontend / chat process state tracking)

The public openai/codex repository contains the CLI, SDK, and App Server, but not the complete Desktop UI source. I am reporting this here because the official Codex troubleshooting documentation directs Codex app bug reports to this issue tracker.

Version

• Codex Desktop: OpenAI.Codex 26.721.11231.0
• Platform: Windows
• Affected thread: 019fab74-1219-7850-9137-fcb598b63247

Description

A completed turn remained permanently in the “running” state. The final answer was already visible, but the composer continued showing the stop button. Cancelling had no effect, and no further message could be sent.

Restarting the app only appeared to fix the problem temporarily. The stuck state returned because the invalid persistent state file remained on disk.

Confirmed cause

%USERPROFILE%\.codex\process_manager\chat_processes.json contained exactly 30,925 NUL bytes and no valid JSON.

The Desktop bundle repeatedly logged:

Failed to register chat process notification
Unexpected token '\^@' ... is not valid JSON

Stack location in the packaged Desktop bundle:

src-BPbHdvxe.js:497
nX -> tX.loadRecords()

The failure was observed for both item/started and item/completed notifications.

loadRecords() handles ENOENT, but rethrows JSON.parse() errors. This leaves the frontend process-notification state inconsistent with the App Server thread state: the backend reports the thread as idle, while the composer remains locked in the running state.

The exact event that originally replaced the file contents with NUL bytes could not be established from the available logs. The confirmed defect is that one invalid state file permanently breaks completion tracking instead of being recovered or quarantined.

Steps to reproduce

1. Put invalid JSON, or an all-NUL payload, in %USERPROFILE%\.codex\process_manager\chat_processes.json.
2. Start Codex Desktop and run a task.
3. Let the model finish and display its final answer.
4. Observe that the composer can remain in the running/stop state even though the App Server reports the thread as idle.
5. Attempt to cancel; the composer remains blocked.
6. Restart the app; the problem can return when the same corrupted file is read again.

Recovery performed and validation

The corrupted file was preserved as a backup and replaced with valid JSON ([]). The running Codex process then rewrote it with valid process records.

After the repair:

• 89 new Desktop events were observed;
• zero notification JSON parsing errors occurred;
• the state file contained no NUL bytes;
• the affected thread reported idle again.

Suggested fix

1. Treat JSON parse and schema failures in loadRecords() as recoverable state corruption.
2. Quarantine the invalid file and initialize an empty record list.
3. Write chat_processes.json atomically using a temporary file followed by rename.
4. Add regression tests for malformed JSON, truncated JSON, and an all-NUL file.
5. Reconcile the composer state with the authoritative App Server thread status after recovery.

codex-chat-processes-corrupt-20260730.zip