Automation follow-up clears apps_instructions and removes codex_apps tools

Summary

A standalone Codex Desktop scheduled task can use Gmail and Google Calendar successfully on its initial turn, but the first user follow-up in the same automation chat applies apps_instructions:false and removes the entire mcp__codex_apps__* tool namespace.

The Google authorization remains valid. Fresh and ordinary resumed contexts on the same machine retain the connectors and can call read-only profile tools successfully.

Environment

• ChatGPT/Codex Desktop for Windows x64: 26.721.4979.0
• Embedded Codex CLI: 0.146.0-alpha.3.1
• Windows 11 Pro 25H2, build 26200.8875
• Scheduled task: standalone local/projectless cron
• Connected apps: Gmail and Google Calendar

Reproduction

1. Connect Gmail and Google Calendar.
2. Create a standalone scheduled task that reads both apps.
3. Let the scheduled run complete successfully.
4. In that same automation chat, send a user follow-up asking it to check Gmail again.
5. Observe that Gmail and Calendar are no longer discoverable or callable.

Actual behavior

The captured session shows:

• Initial world state: apps_instructions:true
• Gmail and Calendar tools are discoverable.
• Gmail and Calendar profile/search calls succeed.
• First user follow-up starts.
• World-state delta becomes exactly {"apps_instructions":false}.
• A direct Gmail call then fails with:

TypeError: tools.mcp__codex_apps__gmail_get_profile is not a function

• Filtering the active tool registry for Gmail returns [].
• Broad discovery for Gmail, Calendar, Drive, and Slack returns no mcp__codex_apps__* tools.

Expected behavior

A user follow-up to a scheduled-task chat should preserve or rehydrate the connected-app tool registry unless the user or workspace explicitly disables apps.

Codex should not accept the follow-up turn with a silently reduced connector catalog.

Controls

• A fresh normal task retains Gmail, Calendar, and Drive across follow-up turns.
• Gmail and Calendar profile calls succeed in those resumed normal contexts.
• Restarting or refreshing the environment restores the same existing authorizations.
• No OAuth reconnect is required.
• Plugin permission broadening does not help because the tools are removed before permission evaluation.

Impact

Integration-backed scheduled-task follow-ups can silently lose all live app access and may produce incomplete or stale answers unless the prompt explicitly fails closed.

Related issues

• #21995 covers scheduled automation connector startup failure on the initial run.
• #35298 covers a similar codex_apps hydration loss after Android Remote reconnect.

This report has a different trigger: the first user follow-up to an otherwise successful standalone automation chat.

Suggested regression test

1. Start a thread with thread_source=automation and hydrated app tools.
2. Complete the first turn.
3. Resume the same thread with a user follow-up.
4. Assert the resumed state does not set apps_instructions:false without an explicit disable.
5. Assert the same app tool families remain registered and read-only profile calls succeed.

Raw session logs are not attached because they contain mailbox context.