Codex CLI TUI erases MCP OAuth device code before opening GitHub device-login page

What version of Codex CLI is running?

codex-cli 0.144.1

What platform are you using?

Linux, Codex terminal UI.

MCP setup

A GitHub MCP server is configured over stdio and launched through Docker using the official GitHub MCP server image:

[mcp_servers.github]
command = "/home/<user>/.local/bin/github-mcp-codex"

The launcher starts ghcr.io/github/github-mcp-server:latest with stdin attached.

What issue are you seeing?

When a GitHub MCP tool triggers the OAuth device flow, Codex briefly renders the device code in the terminal one step before opening the browser. The TUI then redraws/updates the tool-call status and the device code disappears from the visible transcript.

Codex opens:

https://github.com/login/device

but the GitHub page has empty code inputs, so the user no longer has the code needed to complete authorization.

The persistent terminal output only shows messages similar to:

• Calling github.get_me({})
• Opened https://github.com/login/device in your browser.

Finish in Browser
Complete the requested action in the browser window that just opened.
Then return here and select "I finished".

The device code is not retained anywhere visible in that final state.

Steps to reproduce

1. Configure an OAuth-capable GitHub MCP server as a stdio MCP in Codex CLI.
2. Start a new Codex session without a completed GitHub OAuth authorization for that MCP server.
3. Invoke a GitHub MCP tool such as github.get_me.
4. Watch the terminal immediately before Codex opens https://github.com/login/device.
5. The device code appears transiently, then is erased/overwritten when the TUI advances to the browser-authentication step.
6. The browser opens the generic GitHub device-login page with no code prefilled.

Expected behavior

The OAuth device code should remain visible for the entire authorization flow, ideally inside the persistent Finish in Browser panel. It could also be copied to the clipboard or repeated after the browser opens.

Actual behavior

The code is rendered transiently and then lost due to a TUI refresh/state transition, leaving the user on GitHub's device-login page without the code.

Impact

First-time MCP OAuth authorization can become impossible unless the user notices and memorizes/copies the briefly displayed code before the TUI redraws.

Additional information

This looks like a Codex TUI rendering/state-retention issue between the MCP OAuth/device-code event and the subsequent Opened ... in your browser / Finish in Browser state. No credentials or private repository details are included in this report.