Codex.app repeatedly opens Notion MCP OAuth tabs even after notion@openai-curated is disabled

Summary

Codex.app opened a burst of Notion MCP OAuth tabs in Chrome, around 15 tabs within roughly 2 seconds. This happened again after restarting Codex.app even though the Notion plugin was disabled in ~/.codex/config.toml.

This looks like Codex.app or its app-server can retain/reload stale plugin/MCP state and start the Notion MCP OAuth flow despite notion@openai-curated being disabled.

Environment

• Platform: macOS
• Codex.app version from config env: 26.611.62324
• Bundled app CLI: codex-cli 0.140.0-alpha.19
• Globally installed CLI also present: codex-cli 0.133.0
• Plugin involved: notion@openai-curated

What happened

Chrome rapidly opened many tabs to a Notion OAuth/install URL like:

https://app.notion.com/install-integration?...redirect_uri=http://localhost:9553/oauth/callback

The page was the Notion MCP OAuth/install flow, with the callback pointing at:

http://localhost:9553/oauth/callback

Local inspection showed mcp-remote https://mcp.notion.com/mcp processes spawned under Codex app-server, and a local listener on 127.0.0.1:9553 during the OAuth flow.

Configuration at the time

~/.codex/config.toml contained:

[plugins."notion@openai-curated"]
enabled = false

I also verified the config parsed correctly and returned:

{'enabled': False}

Despite that, after restarting Codex.app, the OAuth tab burst started again.

Expected behavior

When a plugin is disabled:

• Codex.app should not start that plugin's app/MCP server.
• Codex.app should not start mcp-remote https://mcp.notion.com/mcp.
• Codex.app should not open OAuth tabs for the disabled plugin.
• Restarting Codex.app should respect enabled = false and should not resurrect stale plugin state.

Actual behavior

• Codex.app opened many Notion OAuth tabs rapidly.
• Notion MCP remote processes were observed even though the plugin was disabled.
• Restarting Codex.app did not prevent recurrence.

Workaround used

To stop the tab storm, I had to do both of the following:

1. Keep the plugin disabled in config:

[plugins."notion@openai-curated"]
enabled = false

1. Physically move the plugin bundle out of the plugin cache path:

~/.codex/plugins/cache/openai-curated/notion

to a disabled/backup path such as:

~/.codex/plugins/cache/openai-curated/notion.disabled-<timestamp>

After that:

• the original plugin cache path was absent,
• no mcp-remote https://mcp.notion.com/mcp processes remained,
• no localhost:9553 listener remained.

Why this is severe

This creates an uncontrolled browser tab storm from a disabled plugin. It is disruptive and also scary from a trust/safety perspective because OAuth authorization pages are opened without an explicit user action and despite local config saying the plugin is disabled.

Related/possibly adjacent issues

I saw #20980 about Codex App starting a full local MCP process stack per opened chat/thread, but this issue is specifically about a disabled curated plugin still causing Notion MCP OAuth tabs to open after app restart.