codex mcp login: missing 'resource' parameter in OAuth authorize request

Bug Description

codex mcp login <server> correctly discovers the OAuth protected resource metadata via /.well-known/oauth-protected-resource, but when constructing the authorization URL, it does not include the resource parameter. This causes the authorization server to issue a token with aud set to the client_id instead of the resource URL, which the resource server then rejects.

Steps to Reproduce

1. Configure a remote MCP server with OAuth:

``bash
codex mcp add my-server --url "https://my-resource-server.example.com/mcp"
``

1. The resource server correctly implements MCP auth spec:

• GET /.well-known/oauth-protected-resource returns:

``json
{
"resource": "https://my-resource-server.example.com",
"authorization_servers": ["https://my-auth-server.example.com"],
"bearer_methods_supported": ["header"]
}
``

• Unauthenticated requests return 401 with:

``
WWW-Authenticate: Bearer resource_metadata="https://my-resource-server.example.com/.well-known/oauth-protected-resource"
``

1. Run codex mcp login my-server — the browser opens with:

``
https://my-auth-server.example.com/authorize?response_type=code&client_id=codex_xxx&code_challenge=xxx&code_challenge_method=S256&redirect_uri=http://127.0.0.1:PORT/callback
`
**Note: no resource` parameter.**

1. Login succeeds, but starting Codex fails:

``
⚠ MCP startup incomplete (failed: my-server)
``

Expected Behavior

Per RFC 9728 and the MCP Authorization Spec, the authorize URL should include:

&resource=https://my-resource-server.example.com

This ensures the authorization server issues a token with the correct audience (aud: ["https://my-resource-server.example.com"]), which the resource server can validate.

Actual Behavior

• The resource parameter is omitted from the authorize request
• The issued token has aud: ["codex_xxx"] (the client_id)
• The resource server rejects the token with 401 Unauthorized

Workaround

Manually perform the OAuth flow with the resource parameter and pass the token via --bearer-token-env-var:

codex mcp add my-server --url "https://my-resource-server.example.com/mcp" --bearer-token-env-var MY_TOKEN

Environment

• Codex CLI version: 0.130.0
• OS: macOS 14.x (also affects Linux)