Codex automation resume loses MCP OAuth bearer auth

Summary

Codex app heartbeat automation appears to lose MCP OAuth/bearer auth when resuming an existing thread. The same MCP server can work after an interactive codex mcp login taskflow, but when the thread is later resumed by a recurring automation, the live automation-resumed MCP worker repeatedly fails authenticated MCP calls.

Environment / context

• Product surface: Codex app automations / recurring heartbeat thread wakeups
• Automation id: keep-working-heartbeat
• MCP server name: taskflow
• Auth mode: OAuth MCP auth
• Approx. observed date: 2026-06-25

Expected behavior

After codex mcp login taskflow succeeds, an automation-resumed Codex worker should either retain the existing MCP OAuth authorization or refresh it before calling the MCP server.

Actual behavior

TaskFlow MCP calls fail after the heartbeat automation resumes the thread, even though auth had been refreshed successfully earlier in the live thread.

Exact failing call observed repeatedly:

taskflow/whoami

Exact error text:

tool call error: tool call failed for `taskflow/whoami`

Caused by:
    Transport send error: Transport [rmcp::transport::worker::WorkerTransport<rmcp::transport::streamable_http_client::StreamableHttpClientWorker<rmcp::transport::auth::AuthClient<codex_rmcp_client::http_client_adapter::StreamableHttpClientAdapter>>>] error: Auth error: OAuth authorization required

The same error also occurred on TaskFlow write calls such as comment_on_task.

Impact

This blocks automation-only continuation of MCP-backed workflows. In this case Codex could still use local filesystem/GitHub tools, but could not:

• post TaskFlow progress or handoff notes
• attach review artifacts
• claim or update board tasks
• answer mentions on TaskFlow tasks

I avoided using a human TaskFlow credential and treated this as an automation auth regression once a narrow retry (whoami) failed.

Notes

This appears specific to the automation-resumed worker. The reported distinguishing behavior is:

• codex mcp login taskflow can succeed during an interactive/live thread
• later, the heartbeat automation resumes the same thread
• the live automation-resumed MCP worker still fails with Auth error: OAuth authorization required

No bearer tokens or secrets are included in this report.