codex - 💡(How to fix) Fix Codex iOS app: "Network connection was lost" repeatedly when connecting to remote SSH host (codex-cli 0.130 on Debian 12)

What version of the Codex App are you using (From "About Codex" dialog)?

Codex iOS app — latest from App Store as of May 15, 2026.

What subscription do you have?

Pro

What platform is your computer?

• Codex iOS app: iPhone, iOS 18.x
• Codex desktop app (used as control case): Darwin 25.4.0 arm64 arm

What issue are you seeing?

The Codex iOS app's Add SSH Host flow consistently fails with Network connection was lost (repeating indefinitely) when targeting a remote Linux VM, while the Codex desktop app on macOS connects successfully to the exact same host with equivalent credentials.

Remote host:

• codex-cli 0.130.0 installed at /usr/bin/codex (via npm i -g @openai/codex)
• codex login status → Logged in using ChatGPT
• Debian 12 (bookworm), x86_64, Linux kernel 6.1
• bubblewrap installed at /usr/bin/bwrap
• Reachable via private VPN (Tailscale); both iOS and macOS clients on the same tailnet
• SSH password auth enabled; key auth also available

Observed on the VM during iOS connection attempts:

• sshd auth log: multiple Accepted password for <user> from <iOS Tailscale IP> entries — SSH layer succeeds.
• pgrep -af codex shows codex app-server --listen unix:// running, started by iOS's SSH session.
• ~/.codex/app-server-control/app-server-control.sock exists; held by codex (verified with lsof).
• ~/.codex/app-server-control/app-server.log is empty after cleanup — no error logged when iOS attempts.
• iOS SSH session disconnects within ~5s after each attempt; app retries; loops with Network connection was lost.

Control case (works): Codex macOS desktop app, same VM, same SSH config alias. Threads launch normally; codex app-server bridges over SSH; everything works.

Looks adjacent to / possibly same root cause as:

• #22823 — Remote SSH to (DevPod) devcontainer fails with app server did not become ready on .../app-server-control.sock. Same control-socket failure pattern, different platform.
• #12236 — iOS URLSessionWebSocketTask rejecting Sec-WebSocket-Extensions: permessage-deflate. The workaround in that issue applies to --listen ws:// setups, not the Unix-socket auto-launch flow the Codex iOS app uses.

What steps can reproduce the bug?

1. Provision a Linux VM (Debian 12, x86_64).
2. Install Node 20 and npm i -g @openai/codex → codex-cli 0.130.0.
3. Run codex login on the VM and authenticate via ChatGPT.
4. Make the VM reachable from an iOS device (in my setup, via Tailscale; password SSH auth enabled on the VM).
5. Open Codex iOS app → Add SSH Host → enter the VM's IP, port 22, username, password → Save.
6. Tap the host to connect / start a thread.

Expected: iOS app connects and starts a Codex thread on the VM, matching the Codex desktop app behavior on macOS against the same host.

Actual: iOS app spins indefinitely showing Network connection was lost. SSH layer authenticates (visible in journalctl -u ssh); codex app-server process starts; but the iOS client never establishes a working session.

What is the expected behavior?

The iOS app should connect and start a Codex thread on the remote VM successfully, matching the Codex macOS desktop's behavior against the same host.

Additional information

• Codex desktop on macOS connects to the same VM via the same SSH alias and works correctly — both can't connect simultaneously due to the `app-server-control.sock` lock, but each works in isolation... except iOS never does.
• When iOS attempts to connect, no error is logged in `~/.codex/app-server-control/app-server.log` on the remote host. The failure is silent server-side and surfaces only as `Network connection was lost` on the client.
• Happy to provide additional diagnostics (sshd debug logs, codex-cli trace, packet capture from the VM side) if useful.