[Windows][26.818.3698.0] Desktop App Infinite OAuth Invalidation Loop, Renderer Deadlock & Black Screen under High Subagent Concurrency

# 🚨 [BUG REPORT] Windows Desktop App (Codex / ChatGPT): Infinite OAuth Loop, Renderer Deadlock & Black Screen under Concurrent Subagent / Goal Workloads

• Target Repository: openai/codex / openai/chatgpt-desktop
• Report Date: 2026-08-22 01:35 KST
• Reporter: \jyongchul\ (Charles Lee)
• Severity: High / Blocker for Autonomous Agent & High-Concurrency Goal Workflows
• Platform: Windows 11 x64 (MSIX/UWP Package \OpenAI.Codex_26.818.3698.0_x64__2p2nqsd0c76g0\)

---

📌 Executive Summary

When running long-running autonomous Goal mode sessions with high subagent concurrency (50+ concurrent background agents across multiple active threads), the Windows ChatGPT / Codex Desktop App enters a catastrophic failure state characterized by:

1. Endless Re-Authentication / Login Boot Loop (Token Refresh Race Condition).
2. Main Renderer Thread Deadlock / Infinite Splash Spinner when parsing large local thread databases (\ hread_history_1.sqlite\ > 250MB).
3. GPU Hardware Acceleration Crash / Total Black Screen on Electron WebContents.
4. Shell Protocol Handler Failure (\chatgpt://\ / \openai://\) preventing default browser authentication callback delivery.

---

🔍 System & Environment Diagnostics

| Component | Specification / Version |
| :--- | :--- |
| Operating System | Windows 11 Pro 64-bit |
| Application Package | \OpenAI.Codex_26.818.3698.0_x64__2p2nqsd0c76g0\ |
| Executable Path | \C:\Program Files\WindowsApps\OpenAI.Codex_26.818.3698.0_x64__2p2nqsd0c76g0\app\ChatGPT.exe\ |
| Local SQLite State | \C:\Users\Charles Lee\.codex\thread_history_1.sqlite\ (251.2 MB) + \state_5.sqlite\ (22.3 MB) |
| Cache Storage | \%APPDATA%\Codex\ (\Local Storage\, \Session Storage\, \Network\, \web\) |
| Concurrency Load | 2 Concurrent Goal Threads (\NorthernStar\, \편한손\), 52 Total Active Subagents (\29 working\ + \23 working\) |

---

💥 Detailed Symptoms & Error Manifestation

1. The Endless OAuth Token Invalidation Loop (Login -> Auto-Logout within seconds)

• Symptom: User logs in via browser -> Desktop app briefly displays active thread list -> Subagents begin dispatching API requests -> App immediately gets logged out and displays "Continue signing in with your browser / Cancel sign-in".
• Root Cause: OpenAI Auth employs Refresh Token Rotation (RTR). When 50+ background subagents and the Electron main app concurrently attempt to refresh an expiring OAuth access token, the auth server detects concurrent refresh token reuse (race condition) and revokes the entire token family, forcing immediate client logout.

2. Monolithic SQLite Deserialization Freeze (Infinite Splash Spinner)

• Symptom: Selecting a heavy legacy thread ("NorthernStar", "Read Codex goal objective") shows the central rotating flower spinner indefinitely (1~3+ minutes) while pinning high CPU and RAM (800MB+ WorkingSet).
• Root Cause: The client-side Electron renderer attempts to deserialize and render the monolithic history stream from \ hread_history_1.sqlite\ (251MB) on the UI thread without virtualized chunking/pagination, causing DOM layout freeze.

3. GPU Buffer Swapchain Failure (Solid Black Screen)

• Symptom: After completing OAuth redirect, the app window becomes completely black (\#000000\), rendering no HTML/CSS elements while sub-processes continue to run in Task Manager.
• Root Cause: ANGLE / Direct3D 11 GPU process crashes due to shader cache mismatch in \%LOCALAPPDATA%\Codex\GPUCache\ and \%APPDATA%\Codex\GPUCache\. Electron fails to trigger auto-recovery/software fallback.

4. Windows Shell External Browser Invocation Failure

• Symptom: Clicking "Continue to sign in" fails to bring the default browser (Chrome/Edge) to the foreground if background browser instances (headless/subprocesses) already exist.
• Root Cause: Desktop app calls \shell.openExternal()\ without passing foreground focus flags or registering a robust local fallback HTTP server port (e.g., \http://127.0.0.1:port/callback\).

---

🛠️ Workarounds & Mitigations Identified

1. Bypass Electron App via Web Interface (\https://chatgpt.com\):

• The Web interface uses HTTP-Only session cookies with persistent WebSockets, completely bypassing the desktop Electron RTR race condition and GPU crash.

1. Purge Corrupted Electron Cache:

powershell
# Kill hung processes
taskkill /F /IM ChatGPT.exe
# Clean broken cache & staging locks
Remove-Item "$env:APPDATA\Codex\Local Storage", "$env:APPDATA\Codex\Session Storage", "$env:APPDATA\Codex\Network", "$env:APPDATA\Codex\web" -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item "$env:LOCALAPPDATA\OpenAI\Codex\cli\.failed", "$env:LOCALAPPDATA\OpenAI\Codex\cli\.staging" -Recurse -Force -ErrorAction SilentlyContinue


1. Hard Reload to force DWM/ANGLE Repaint:

• Focus on black window and press \Ctrl + Shift + R\ or \F11\ x 2.

---

🚀 Recommended Fixes for the OpenAI Development Team

1. Centralized Token Leasing Mechanism:

• Subagents running under the same local daemon should request access tokens from a single synchronized token broker/lease holder instead of each subagent independently querying Auth0 refresh endpoints.

1. Asynchronous Paginated Thread Hydration:

• Enforce server-side / SQLite paginated loading (\LIMIT 50\ events) for thread histories instead of loading the entire 250MB+ rollout into memory at once.

1. Automatic GPU Recovery / Software Fallback:

• Detect Electron \gpu-process-crashed\ / \ ender-process-gone\ events and automatically restart the renderer with \--disable-gpu\ / \--disable-software-rasterizer\ fallback.

1. Direct In-App Embedded OAuth Fallback:

• Provide an in-app embedded WebView login or manual copy-paste auth code fallback when external browser deep-linking fails to activate.

---

Authored & Maintained in \Coding Manifesto/CHATGPT_DESKTOP_AUTH_LOOP_BUG_REPORT.md\ for multi-session tracking.