macOS: Codex Security scan can leave a thread inaccessible with React error #185

What version of the Codex App are you using?

• ChatGPT/Codex desktop: 26.721.81911 (build 5973)
• Bundle ID: com.openai.codex
• Codex Security plugin: 0.1.14

What platform is your computer?

• macOS 26.5.2 (25F84)
• Apple Silicon (arm64)

What issue are you seeing?

A specific Codex desktop thread became inaccessible while a Codex Security diff scan was running. Opening the affected thread now shows the full-page localized equivalent of:

Oops, an error occurred Update ChatGPT / Try again

The affected thread cannot currently be opened from the desktop app.

The correlation with Codex Security is strong because this occurred during its multi-phase scan (threat model, parallel file review, validation worker status updates), but I cannot yet prove that the plugin is the unique root cause. This may instead be a desktop thread-state synchronization bug exposed by concurrent plugin/worker events.

Steps to reproduce

The issue is intermittent, but the observed sequence was:

1. Open a local Codex desktop thread.
2. Start a codex-security:security-diff-scan for the current working-tree diff.
3. Allow the scan to proceed through threat modeling, parallel file review, and validation worker updates.
4. During or after the concurrent worker updates, reopen or navigate back to the scan thread.
5. The affected conversation page falls into the full-page error boundary and remains inaccessible.

Expected behavior

• A security scan and its parallel workers should not make the owning thread unopenable.
• Out-of-order, duplicate, or stale worker/turn events should be ignored or reconciled safely.
• A malformed thread view should be isolated and recoverable without asking the user to update or restart the entire app.

Actual behavior

• The owning thread becomes inaccessible.
• The app shows only Update ChatGPT and Try again.
• The visible error gives no correlation/feedback ID and does not explain that the failure is isolated to one thread.

Sanitized local log evidence

At 2026-07-30T18:18:17.243Z (the screenshot was taken at 2026-07-31 02:18 China Standard Time), the desktop log records:

error boundary
name=AppRoutes
errorName=Error
errorMessage="Minified React error #185"
componentStack includes local-conversation-thread and local-conversation-page

Nearby log patterns include:

Received turn/started for unknown conversation
Received turn/completed for unknown conversation
Conversation state not found
Item not found in turn state
ResizeObserver loop completed with undelivered notifications

After recovery/reload activity, the same log also records:

app routes mounted after 302120ms
websocket_reconnect_marked_threads_needing_resume
app_server_restart_recovery_done

These patterns suggest that concurrent or replayed turn/tool events may leave renderer state inconsistent, eventually triggering React error #185 (maximum update depth exceeded) in local-conversation-page.

Privacy note

I intentionally excluded the full thread ID, local usernames/paths, repository names, prompts, conversation content, raw logs, and the original desktop screenshot because they contain unrelated personal workspace details. A sanitized screenshot or narrowly scoped log excerpt can be provided if maintainers request it.

Related report

This looks related to #23032 because both involve LocalConversationPage plus unknown conversation events, but this report is on macOS, current build 26.721.81911, and appears during a Codex Security plugin scan with concurrent workers.