[ChatGPT Work / iOS][COROS] Accepted authentication immediately returns UNAUTHORIZED and requests reauthentication again

What issue are you seeing?

The COROS plugin's read-only device query cannot return data in a hosted ChatGPT Work conversation accessed from the iOS app. Authentication is reported as requested and accepted, but the instructed retry immediately requires reauthentication again.

Observed tool call:

mcp__codex_apps__coros_querydevices({})

First result:

{
  "content": [{
    "text": "Authentication for COROS was requested and accepted. Retry this tool call now.",
    "type": "text"
  }],
  "isError": true
}

The same call was retried once. Result:

{
  "content": [{
    "text": "This app connection requires reauthentication before other actions on this app can succeed.",
    "type": "text"
  }],
  "isError": true,
  "structuredContent": {
    "error": "This app connection requires reauthentication before other actions on this app can succeed.",
    "error_code": "UNAUTHORIZED",
    "error_data": {
      "action": "TRIGGER_REAUTHENTICATION",
      "detail": "Reauthentication required",
      "reason": "www_authenticate_reauth"
    }
  }
}

The user saw repeated authorization requests and no COROS data. Following the retry instruction does not recover the connection.

What steps can reproduce the bug?

Observed on 2026-09-10 in the affected connection:

1. Open a ChatGPT Work conversation with the COROS plugin available.
2. Request a read-only COROS device query, using the tool above.
3. Complete the requested authorization.
4. Receive the tool response stating authentication was accepted and instructing a retry.
5. Retry the exact same query.
6. Receive UNAUTHORIZED / TRIGGER_REAUTHENTICATION instead of device data.

This is a reproduction on the affected account, not a claim that all accounts are affected. Further retries were stopped to avoid repeatedly prompting the user.

What is the expected behavior?

After successful authorization, the next tool call should use that authorization and return COROS data. If authorization is not actually usable, the client should expose an actionable error rather than reporting acceptance and repeatedly requesting the same login.

Additional information

• Affected surface: hosted ChatGPT Work, accessed from the native iOS app. This was not a local Codex CLI reproduction.
• COROS tool discovery succeeds: its tools are present in the session.
• Control test: the GitHub connector's read-only profile query succeeded in the same session. Profile values are omitted.
• Cross-client comparison reported by the user: COROS works quickly and reliably in Claude on both phone and computer, with no errors encountered. In ChatGPT Work, the COROS calls tested here return no data and repeatedly request authorization even after reporting that authorization was accepted. The Claude behavior is the user's direct experience, not an independently instrumented test; the failing ChatGPT tool responses are reproduced below.
• Exact current mobile app/build and OS versions were not independently verified for this reproduction.
• No access tokens, cookies, health records, device identifiers, or private conversation contents are included.
• The tool responses do not establish whether the cause is token storage, forwarding, refresh, provider rejection, or another part of the connector flow.
• Related: #37219 reports a similar accepted-authentication loop for Linear in Codex CLI. This report adds a different provider and the hosted Work/iOS surface; a shared root cause has not been established.

Please triage or route to the hosted connector authentication team if ownership is outside this repository.

Follow-up controlled reproduction on 2026-09-10

With the user's explicit agreement to complete authorization prompts, the same read-only mcp__codex_apps__coros_querydevices({}) call was made three times sequentially. Wall-clock duration was measured around each tool invocation:

All three returned the exact message:

Authentication for COROS was requested and accepted. Retry this tool call now.

No device data was returned. Durations include any time spent waiting for the user's authorization and should not be interpreted as server processing latency.

This test confirms repeated accepted-authentication/retry responses across three consecutive calls. Each invocation returned the auth-related error within the measured period. Testing stopped after the third identical response to avoid an unbounded reauthentication loop.

Start with the reported mcp__codex_apps__coros_querydevices({}) flow and compare the three repeated responses with related issue #37219. Trace the hosted ChatGPT Work/iOS connector authentication path if it is present in this repository; done means identifying why accepted authorization is not reused, or routing the issue to the hosted connector authentication team if the implementation is elsewhere.