codex mcp list` panics on macOS (system-configuration NULL object)

What version of Codex is running?

codex-cli 0.79.0

What subscription do you have?

NOV

Which model were you using?

GPT-5.1-dex-Max

What platform is your computer?

Darwin 24.6.0 arm64 arm

What issue are you seeing?

Title: codex mcp list panics on macOS (system-configuration NULL object)

Environment:

• codex-cli 0.79.0
• macOS (see stack trace below)
• Config path: ~/.codex/config.toml

What steps can reproduce the bug?

Steps to reproduce:
1) Run codex mcp list (also tried -c 'mcp_servers={}').
2) Panic occurs.

Observed output:
thread 'main' panicked at /Users/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/system-configuration-0.6.1/src/dynamic_store.rs:154:1:
Attempted to create a NULL object.
stack backtrace:
0: __mh_execute_header
1: __mh_execute_header
2: __mh_execute_header
...
20: __mh_execute_header
21: __mh_execute_header

Notes:

• codex mcp get cupcakemcp --json works.
• Panic still happens with empty config override (-c 'mcp_servers={}').
• RUST_BACKTRACE=full shows the same NULL object panic in system-configuration.

What is the expected behavior?

Expected:
codex mcp list should list configured MCP servers without crashing.

Additional information

_No response_