[MCP][Regression] Linear OAuth fails pre-flow with “No authorization support detected” on Codex CLI 0.144.4 and 0.144.6

Summary

codex mcp login linear fails immediately with:

Error: No authorization support detected

The failure reproduces on fresh installations of stable Codex CLI 0.144.4 and 0.144.6 in an isolated headless Linux container. No authorization URL is produced, no callback listener is started, and the OAuth flow never begins.

This appears to be a regression of the failure reported in #11585, which was closed after a maintainer said the fix would ship in 0.100.0. The same error is now reproducible on 0.144.4 and 0.144.6.

Environment

• Codex CLI: @openai/codex 0.144.4 and 0.144.6, tested separately as fresh installs
• 0.144.6 provenance: official npm registry; install integrity enforced; codex --version returned codex-cli 0.144.6
• Platform: headless Linux container based on node:22-bookworm-slim
• User: non-root, uid 1000
• Network: outbound HTTPS available
• OpenAI authentication: codex login status returned Logged in using ChatGPT
• MCP server: https://mcp.linear.app/mcp using Streamable HTTP

Exact non-secret configuration

cli_auth_credentials_store = "file"
mcp_oauth_credentials_store = "file"
mcp_oauth_callback_port = 1455

[features]
experimental_use_rmcp_client = true

[mcp_servers.linear]
url = "https://mcp.linear.app/mcp"

Minimal reproduction

npm install -g @openai/codex@0.144.6
codex --version
codex login status
codex mcp list
codex mcp get linear
codex mcp login linear

Representative output:

$ codex --version
codex-cli 0.144.6

$ codex login status
Logged in using ChatGPT

$ codex mcp list
Name    Url                         Bearer Token Env Var  Status   Auth
linear  https://mcp.linear.app/mcp  -                     enabled  Unsupported

$ codex mcp login linear
Error: No authorization support detected

Passing -c features.experimental_use_rmcp_client=true explicitly produces the same result. RUST_LOG=debug adds no diagnostic output for this subcommand.

Expected behavior

The current OpenAI Codex documentation says the Linear MCP can be configured at https://mcp.linear.app/mcp and authenticated with codex mcp login linear. The login command should initiate the OAuth flow. In a headless environment it should, at minimum, provide a usable authorization URL or documented remote-callback procedure instead of failing capability detection before the flow starts.

Actual behavior

• Immediate nonzero exit with Error: No authorization support detected
• No authorization URL
• No browser launch
• No callback listener
• No OAuth grant or token write
• No Linear tool call

Server discovery appears healthy

Unauthenticated probes from the same container returned:

• GET https://mcp.linear.app/.well-known/oauth-protected-resource → 200
• GET https://mcp.linear.app/.well-known/oauth-authorization-server → 200
• GET https://mcp.linear.app/mcp → 401 with a WWW-Authenticate response containing resource_metadata="https://mcp.linear.app/.well-known/oauth-protected-resource/mcp"

The server therefore appears to advertise OAuth discovery metadata, while the CLI reports that authorization support is unavailable before attempting the flow.

Documentation mismatch

• OpenAI's current Linear setup instructions describe adding the Linear URL and running codex mcp login linear; they do not state that a legacy feature flag is required.
• Linear's Codex integration page currently uses rmcp_client = true.
• Linear's general MCP documentation currently uses experimental_use_rmcp_client = true.

Both tested Codex versions silently accept the latter configuration. Codex also silently accepts an intentionally bogus feature key, so configuration parsing does not reveal whether either rmcp key is recognized.

Impact

This blocks connecting a headless Codex agent to a shared Linear work queue. Until the connection works, a human must manually transfer work and results between agents.

Request

What exact supported configuration and stable Codex CLI build should be used to initiate Linear's authenticated Streamable HTTP MCP OAuth flow in an isolated/headless Linux environment?

Specifically:

1. Is the MCP OAuth authorization provider compiled and enabled in the official npm Linux binary for 0.144.6?
2. Which feature key is correct for 0.144.6: rmcp_client, experimental_use_rmcp_client, or neither?
3. Should codex mcp login linear print an authorization URL when no browser is available, or is another documented callback/headless setting required?
4. What sanitized diagnostic output would help identify why capability detection returns Auth: Unsupported?