[macOS App] Restored tasks fan out plugin MCP servers (~30x) and crash/reload the renderer #32942

What version of the Codex App are you using (From “About Codex” dialog)?

26.707.71524 (build 5263)

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Darwin 25.5.0 arm64 arm (macOS 26.5.1, Apple silicon, 64 GiB RAM)

What issue are you seeing?

Status correction, July 13: The Xcode-specific workaround described in the original report did not fix the issue. Another renderer crash occurred after that gate was installed. This issue remains open and reproducible, and the evidence now shows a broader restored-task plugin/MCP lifecycle defect.

Codex Desktop appears to create a full set of plugin MCP/tool helper processes for every restored task context. Those helpers accumulate under the long-lived app-server instead of being shared, started lazily, or reaped at a bounded task lifecycle. The Chromium renderer then crashes and is recreated while the outer application and app-server remain alive. The visible result is that the window blanks, disappears, and reloads as if freshly opened.

At the latest live snapshot, approximately 30 restored task contexts produced 30 copies of each helper family:

The app-server used about 3.5-3.9 GiB RSS. Its 153 direct children used about 6.1 GiB, and the full Codex process tree used about 16.6 GiB.

The latest renderer crash was correlated precisely:

• Renderer Crashpad sidecar: 30d3568e-b947-4812-8565-ce474defa2fc_sidecar.json
• Created: 2026-07-13 21:02:45 PDT (2026-07-14 04:02:45 UTC)
• Sidecar contents: {"osarch":"arm64","ptype":"renderer"}
• Replacement renderer started at 21:02:46 PDT
• React-root render requested at 21:02:48.294 PDT
• Routes remounted at 21:02:48.802 PDT
• Desktop and app-server PIDs did not change
• Replacement renderer grew from about 2.21 to 2.30 GiB RSS in ten seconds and continued showing high CPU use

This event was not a system-wide OOM. The machine has 64 GiB RAM, memory_pressure reported about 89% available, and swap usage was zero. The failure instead coincided with a large per-restored-task helper baseline plus an actively growing renderer and app-server.

Xcode was one leaked family, not the complete defect

The initial investigation found many restored tasks launching:

npm exec xcodebuildmcp@latest mcp

That command continued to launch despite all relevant controls resolving disabled:

[mcp_servers.xcode]
command = "xcrun"
args = ["mcpbridge"]
enabled = false

[plugins."build-ios-apps@openai-curated-remote"]
enabled = false

[plugins."build-ios-apps@openai-curated-remote".mcp_servers.xcodebuildmcp]
enabled = false

[features]
remote_plugin = false

The similarly named local marketplace plugin, build-ios-apps@openai-curated, was also removed. Verified clean starts still launched 13 and then 11 XcodeBuildMCP npm processes for restored tasks.

An initial $HOME/.local/bin/npx gate appeared to contain that exact command in short delayed samples. It was not a fix:

1. A nested codex exec inherited a PATH with Homebrew before $HOME/.local/bin, bypassing the gate.
2. Another renderer crash occurred 21 minutes after the gate was installed.
3. At that crash, only one XcodeBuildMCP launcher/worker pair remained (about 142 MiB) and no new mcpbridge crash coincided with the renderer failure.
4. The dominant load was the 30x fan-out of four other plugin MCP servers plus Node REPL.

Updating Xcode did not fix the behavior. It reproduced on Xcode 26.5 and continued after upgrading to Xcode 26.6 (17F113).

What steps can reproduce the bug?

1. Use Codex Desktop with multiple tasks restorable across several workspaces and several MCP-bearing plugins available.
2. Fully quit and reopen Codex so those task contexts restore.
3. Inspect the app-server's child process tree and each generic Node server's working directory.
4. Observe one copy per restored task of plugin servers such as Codex Security, Data Analytics widgets, Sites design picker, OpenAI API-key confirmation, and Node REPL.
5. Continue ordinary work while the helper population and renderer/app-server memory grow.
6. Observe the renderer blank/reload event without a clean desktop or app-server exit.

The Xcode policy-bypass variant is independently reproducible:

1. Make build-ios-apps@openai-curated-remote available to restored tasks.

2. Disable the exact remote plugin and its xcodebuildmcp server, set remote_plugin = false, and remove the local build-ios-apps@openai-curated copy.

3. Fully quit Codex, verify new desktop/app-server PIDs after reopening, and wait several minutes.

4. Run:

   pgrep -af 'xcodebuildmcp@latest mcp'
   

Actual result: restored tasks can still launch XcodeBuildMCP even though the current plugin registry, install state, exact plugin/MCP overrides, and remote-plugin feature all resolve disabled.

What is the expected behavior?

• Restored tasks must re-resolve current plugin and MCP policy before starting helpers.
• A plugin, app, or MCP with enabled = false must never launch from persisted task state.
• MCP servers should start lazily only for tasks that need them.
• Identical safe servers should be shared where appropriate, or otherwise have a bounded per-task lifecycle.
• Closing, archiving, restoring, interrupting, reloading, or shutting down a task must reliably reap its subprocess tree.
• Renderer reconstruction must not replay stale tool state in a way that multiplies helpers again.
• The desktop should warn or trip a circuit breaker before process or memory growth crashes the renderer.
• Diagnostics should identify each MCP process's owning task, plugin identity/source, configuration layer, uptime, RSS, and restart count.

Additional information

Current local posture — tool catalog restored; Xcode-only containment remains

The broad plugin/app circuit breaker was rolled back because it disabled core functionality that Codex documents as part of its intended parallel, tool-rich workflow—and it did not prevent another renderer failure.

At 2026-07-13 22:08:59 PDT, Crashpad wrote another renderer sidecar, fb55976b-b3bb-486b-8e9f-a331a6ff30fd_sidecar.json, while plugins = false and apps = false were still configured. The app had already rewritten node_repl to enabled = true, and 12 Node REPL processes were present. The outer desktop and app-server remained the same long-lived processes.

At approximately 22:12 PDT, all non-Xcode tool layers were restored:

[features]
plugins = true
apps = true
remote_plugin = true

[mcp_servers.node_repl]
enabled = true

The Codex Security, Data Analytics, Sites, and OpenAI developer plugin MCP identities also resolve enabled again. The supported CLI now reports plugins, apps, remote plugins, Node REPL, and those four plugin MCPs enabled.

Only the known Xcode-specific launch paths remain contained:

• native xcrun mcpbridge: disabled
• build-ios-apps@openai-curated-remote: disabled
• its xcodebuildmcp MCP: disabled
• exact npx -y xcodebuildmcp@latest mcp command: routed through the project allow-list from both observed PATH positions

The still-running pre-change backend began loading the restored tool set immediately. A live sample showed 3 Codex Security MCPs, 6 Data Analytics MCPs, 7 Sites MCPs, 8 OpenAI developer MCPs, 12 Node REPLs, and zero XcodeBuildMCP processes. The backend used about 4.3 GiB RSS; its 44 direct children used about 1.8 GiB. This is not a clean-start capacity measurement.

The earlier broad disablement is retained only as historical diagnostic evidence. It is not the current configuration and did not fix the renderer crash. The upstream restored-task lifecycle and policy-enforcement defect remains unresolved.

Earlier observed impact

• 25 renderer Crashpad sidecars on July 13 before the latest recurrence
• 38 mcpbridge diagnostic reports
• 27 simultaneous XcodeBuildMCP npm launchers using about 1.9 GiB RSS in one snapshot
• 55 XcodeBuildMCP node workers using about 4.1 GiB RSS in an earlier snapshot
• Earlier backend peak around 4.1 GiB with hundreds of direct children and about 12.7 GiB swap in use

Related issues

• Subagents leak stdio MCP helper trees in Codex App; xcodebuildmcp and chrome-devtools-mcp accumulate indefinitely #17574 — subagents leak XcodeBuildMCP and Chrome DevTools MCP trees
• Remote curated plugins ignore per-plugin enabled=false config #28443 — remote curated plugins ignore per-plugin enabled = false
• [macOS] 1,360 Node processes consume 41 GB and hang WindowServer within 20 minutes of restart #31946 — macOS Node process explosion and system-wide memory failure
• Repeated macOS Codex Desktop 26.609 crashes: CrBrowserMain EXC_BREAKPOINT, Renderer SIGABRT, stale app-server helpers #27880 — renderer/browser crashes with stale app-server helpers
• macOS ChatGPT desktop: app-server leaks a full MCP server stack per conversation (545 procs / 28 GB in ~10h) #32339 and [Windows 26.707] Codex Desktop retains five MCP/Node process batches (147 node.exe, 13.9 GiB) #32797 — flagged by the duplicate-detection action as potentially related

Project names, prompts, and private local paths are intentionally omitted. Sanitized process samples, configuration snapshots, and crash metadata can be provided if needed.