From 41900e9d0ff338f05571ab71e59b9bb023cac907 Mon Sep 17 00:00:00 2001
From: Gabriel Peal <gpeal@users.noreply.github.com>
Date: Fri, 17 Oct 2025 15:16:22 -0700
Subject: [PATCH] [MCP] When MCP auth expires, prompt the user to log in again.
 (#5300)

Similar to https://github.com/openai/codex/pull/5193 but catches a case
where the user _has_ authenticated but the auth expired or was revoked.

Before:
<img width="2976" height="632" alt="CleanShot 2025-10-17 at 14 28 11"
src="https://github.com/user-attachments/assets/7c1bd11d-c075-46cb-9298-48891eaa77fe"
/>

After:
<img width="591" height="283" alt="image"
src="https://github.com/user-attachments/assets/fc14e08c-1a33-4077-8757-ff4ed3f00f8f"
/>
---
 codex-rs/core/src/codex.rs | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/codex-rs/core/src/codex.rs b/codex-rs/core/src/codex.rs
index 23751d1b..2eb80cfa 100644
--- a/codex-rs/core/src/codex.rs
+++ b/codex-rs/core/src/codex.rs
@@ -426,13 +426,16 @@ impl Session {
         // Surface individual client start-up failures to the user.
         if !failed_clients.is_empty() {
             for (server_name, err) in failed_clients {
+                let auth_status = auth_statuses.get(&server_name);
+                let requires_login = match auth_status {
+                    Some(McpAuthStatus::NotLoggedIn) => true,
+                    Some(McpAuthStatus::OAuth) => is_mcp_client_auth_required_error(&err),
+                    _ => false,
+                };
                 let log_message =
                     format!("MCP client for `{server_name}` failed to start: {err:#}");
                 error!("{log_message}");
-                let display_message = if matches!(
-                    auth_statuses.get(&server_name),
-                    Some(McpAuthStatus::NotLoggedIn)
-                ) {
+                let display_message = if requires_login {
                     format!(
                         "The {server_name} MCP server is not logged in. Run `codex mcp login {server_name}` to log in."
                     )
@@ -2524,6 +2527,11 @@ pub(crate) async fn exit_review_mode(
         .await;
 }
 
+fn is_mcp_client_auth_required_error(error: &anyhow::Error) -> bool {
+    // StreamableHttpError::AuthRequired from the MCP SDK.
+    error.to_string().contains("Auth required")
+}
+
 use crate::executor::errors::ExecError;
 use crate::executor::linkers::PreparedExec;
 use crate::tools::context::ApplyPatchCommandContext;