MCP client reuses an invalid streamable HTTP session after OAuth login/restart

What version of Codex CLI is running?

codex-cli 0.153.4; Codex Desktop 26.908.9136.0

What subscription do you have?

Unknown (organization-managed account)

Which model were you using?

gpt-6-astra (not model-specific)

What platform is your computer?

Windows x64

What terminal emulator and version are you using (if applicable)?

Codex Desktop 26.908.9136.0; PowerShell 7 for CLI diagnostics

Codex doctor report

Diagnostics were uploaded through /feedback. See the uploaded thread ID in the reproduction field below.

What issue are you seeing?

An OAuth-backed, streamable HTTP MCP tool repeatedly fails with:

Transport send error: ... StreamableHttpClientWorker ... unexpected server response: HTTP 401: unknown session

codex mcp list reports the server as enabled with Auth = OAuth. Running codex mcp login <server> succeeds, but the active task continues sending a server-invalid MCP session ID. Restarting the visible app/process did not recover the task. This appears to be a transport-session recovery issue rather than an expired OAuth token.

What steps can reproduce the bug?

Uploaded thread: 01a0ae4f-1838-7073-92a4-37bafa25b998

What is the expected behavior?

On successful OAuth login—or when the server responds with 401: unknown session—Codex should discard the invalid transport session, perform a fresh MCP initialize handshake, and retry with a new session ID. Repeated login should not be required.

Additional information

The failing server name and internal repository context have been intentionally omitted. The failure was reproduced with github_get_me, so it does not depend on a specific repository operation. Other configured MCP servers remained callable.

Start by tracing the StreamableHttpClientWorker path involved in the reported HTTP 401 unknown session, then reproduce the failure with the github_get MCP operation after OAuth login or restart. Confirm that an unknown session causes the invalid transport session to be discarded, a fresh MCP initialize handshake to occur, and the operation to retry with a new session ID.