Codex 0.129.0+ rejects fresh ChatGPT token for Models and codex_apps; 0.128.0 works

What version of Codex CLI is running?

The installed version is 0.147.0.

I isolated the regression boundary:

• 0.128.0: the Models request is authenticated, codex_apps starts without an authentication error, and a core request returns OK.
• 0.129.0: Models and codex_apps return HTTP 401 token_expired, while the core Responses request still returns OK.
• Sampled releases from 0.130.0 through 0.147.0 show the same 401 behavior.

What subscription do you have?

ChatGPT authentication. The plan was not verified during this test.

What platform is your computer?

Headless ARM64 Linux devbox:

Linux 6.1.155 aarch64

What issue are you seeing?

A fresh ChatGPT login is accepted by the core Responses service, but it is rejected by Models discovery and the built-in codex_apps MCP service.

codex login status reports:

Logged in using ChatGPT

On 0.129.0+, Models discovery returns:

HTTP 401 Unauthorized: Provided authentication token is expired.
url: https://chatgpt.com/backend-api/codex/models?client_version=...
auth error code: token_expired

The codex_apps initialize request returns the same token_expired response.

The token is fresh. Its JWT issue and expiry times are valid, the system clock is correct, CODEX_ACCESS_TOKEN is unset, and no proxy variables are configured. The OpenAI issuer /userinfo endpoint accepts the token. The ChatGPT Models and Apps services reject it. Core Codex requests still work with the same login.

After repeated 401 handling, 0.147.0 can also report:

refresh_token_reused
Your refresh token has already been used to generate a new access token.

Disabling Apps is a temporary workaround:

codex --disable apps

This lets 0.147.0 complete core requests, but Models discovery still returns 401.

What steps can reproduce the bug?

After a fresh ChatGPT login, run these from the same directory and account:

npx --yes @openai/codex@0.128.0 exec \
  --ignore-user-config \
  --ephemeral \
  --skip-git-repo-check \
  --sandbox read-only \
  "Reply with only OK."

npx --yes @openai/codex@0.129.0 exec \
  --ignore-user-config \
  --ephemeral \
  --skip-git-repo-check \
  --sandbox read-only \
  "Reply with only OK."

Observed result:

• 0.128.0 receives the model list. It cannot parse the newer max reasoning value, then falls back and returns OK. No Apps authentication error appears.
• 0.129.0 receives 401 token_expired from Models and codex_apps, then the core request returns OK.

The failure reproduces with --ignore-user-config, so it does not depend on config.toml.

What is the expected behavior?

A fresh ChatGPT token that works with the core Responses service should also work with Models discovery and codex_apps. Codex 0.129.0+ should behave like 0.128.0 for the same account, machine, network, and token.

Additional information

Diagnostic logs and the doctor report were uploaded through /feedback.

Uploaded thread: 01a002de-bd2e-7041-b2ff-01fb19666c78

The 0.129.0 release includes changes related to Codex Apps authentication and plugin authentication refresh. A different report, #24511, also identifies 0.128.0 as working and 0.129.0+ as failing, though that report has a different network-level symptom.

Start by comparing the Codex 0.129.0 authentication changes with 0.128.0, focusing on the Models discovery and codex_apps paths. Reproduce with the two npx commands after a fresh ChatGPT login and inspect the uploaded diagnostic logs if available. Done means a fresh token works for Models, codex_apps, and the core request without token_expired or refresh_token_reused errors.