app-server fails with "access token could not be refreshed" after logout/login while `codex exec` works

Summary

After codex logout && codex login, the codex app-server mode (used by codex-companion.mjs for task and adversarial-review) consistently fails with:

[codex] Codex error: Your access token could not be refreshed because you have since logged out or signed in to another account. Please sign in again.

Direct codex exec with the same ~/.codex/auth.json works correctly. Only app-server-mediated flows fail.

Reproduction

1. Authenticate fresh: codex logout && codex login (ChatGPT account auth_mode).
2. Verify CLI works: codex exec --skip-git-repo-check "say hello" → returns "Hello" successfully.
3. Try via companion: node ~/.claude/plugins/cache/openai-codex/codex/1.0.4/scripts/codex-companion.mjs task --fresh "say hello" → fails with the access-token-refresh error.

Same failure for codex-companion.mjs adversarial-review.

Diagnostic state

• ~/.codex/auth.json: auth_mode = "chatgpt", last_refresh is current (matches the most recent login).
• ~/.codex/log/codex-login.log: confirms successful OAuth token exchange at the login time.
• ~/.codex/sessions/* cleared — no effect.
• No background codex processes running.

Direct codex exec and codex app-server appear to use different token caches; the app-server's cache survives codex login and references an invalidated session.

Environment

• codex-cli: 0.125.0
• @openai/codex-plugin-cc: 1.0.4
• Auth mode: ChatGPT account (with codex credits)
• Model: gpt-5.3-codex (verified available — codex exec works with this model)
• macOS, zsh

Expected behavior

codex app-server should either re-read ~/.codex/auth.json on each invocation, or invalidate its token cache when auth.json's last_refresh advances past the cached timestamp. A successful codex login should leave the companion functional without further manual intervention.

Workaround

Bypass the companion: invoke codex exec directly. Companion-mediated flows (including the /pr-review adversarial-review integration) remain broken until app-server picks up the new auth.

Start with scripts/codex-companion.mjs and compare how its app-server flow obtains authentication with the direct codex exec path. Inspect ~/.codex/auth.json, the app-server token cache, and the login timestamp behavior. Done means a fresh codex logout && codex login allows both companion commands to work without manual cache removal.