fix(plugins): fall back to Codex CLI MCP login

- Detect missing MCP servers through nested causes
- Close unused OAuth windows and document Codex sign-in behavior

Author: zortos293

apps/server/src/plugins/McpOAuthRuntime.test.ts

@@ -1,13 +1,42 @@
 import { assert, it } from "@effect/vitest";
 
 import {
+  codexMcpLoginArgs,
   findClaudeMcpAuthorizationUrl,
+  isCodexMcpServerMissingError,
   parseClaudeMcpStatusOutput,
   parseCodexMcpStatusOutput,
   parseCursorMcpStatusOutput,
   validateMcpOAuthCallback,
 } from "./McpOAuthRuntime.ts";
 
+it("detects Codex missing-server errors through the cause chain", () => {
+  assert.strictEqual(
+    isCodexMcpServerMissingError(new Error("No MCP server named 'figma' found.")),
+    true,
+  );
+  assert.strictEqual(
+    isCodexMcpServerMissingError(
+      new Error("Codex is unavailable for MCP start.", {
+        cause: new Error("No MCP server named 'figma' found."),
+      }),
+    ),
+    true,
+  );
+  assert.strictEqual(isCodexMcpServerMissingError(new Error("authentication failed")), false);
+});
+
+it("seeds Codex CLI login with the listed MCP URL when app-server cannot see the server", () => {
+  assert.deepStrictEqual(codexMcpLoginArgs("figma"), ["mcp", "login", "figma"]);
+  assert.deepStrictEqual(codexMcpLoginArgs("figma", "https://mcp.figma.com/mcp"), [
+    "-c",
+    'mcp_servers.figma.url="https://mcp.figma.com/mcp"',
+    "mcp",
+    "login",
+    "figma",
+  ]);
+});
+
 it("selects Claude OAuth URLs instead of unrelated output links", () => {
   const authorizationUrl =
     "https://accounts.example.com/authorize?response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A43123%2Fcallback";

apps/server/src/plugins/McpOAuthRuntime.ts

@@ -192,6 +192,16 @@ const CodexMcpServer = Schema.Struct({
 const decodeCodexMcpServers = Schema.decodeUnknownOption(
   Schema.fromJsonString(Schema.Array(CodexMcpServer)),
 );
+const CodexMcpServerUrl = Schema.Struct({
+  transport: Schema.optional(
+    Schema.Struct({
+      url: Schema.optional(Schema.String),
+    }),
+  ),
+});
+const decodeCodexMcpServerUrl = Schema.decodeUnknownOption(
+  Schema.fromJsonString(CodexMcpServerUrl),
+);
 
 function cleanedCliLine(value: string): string {
   return (
@@ -210,6 +220,35 @@ function findHttpUrl(value: string): string | null {
   return match?.replace(/[),.;]+$/u, "") ?? null;
 }
 
+export function isCodexMcpServerMissingError(error: unknown): boolean {
+  const seen = new Set<unknown>();
+  let current: unknown = error;
+  while (current && !seen.has(current)) {
+    seen.add(current);
+    const message =
+      current instanceof Error
+        ? current.message
+        : typeof current === "object" && current !== null && "message" in current
+          ? String(Reflect.get(current, "message"))
+          : String(current);
+    if (/no mcp server named/iu.test(message)) return true;
+    current =
+      current instanceof Error
+        ? current.cause
+        : typeof current === "object" && current !== null && "cause" in current
+          ? Reflect.get(current, "cause")
+          : undefined;
+  }
+  return false;
+}
+
+export function codexMcpLoginArgs(name: string, url?: string | null): ReadonlyArray<string> {
+  const trimmedUrl = url?.trim();
+  return trimmedUrl
+    ? ["-c", `mcp_servers.${name}.url=${JSON.stringify(trimmedUrl)}`, "mcp", "login", name]
+    : ["mcp", "login", name];
+}
+
 export function findClaudeMcpAuthorizationUrl(value: string): string | null {
   // eslint-disable-next-line no-control-regex -- URLs end before terminal control sequences.
   for (const match of value.matchAll(/https?:\/\/[^\s\u0007\u001B]+/gu)) {
@@ -437,7 +476,7 @@ export const make = (options: McpOAuthRuntimeOptions = {}) =>
         return next;
       });
 
-    const runCodexSession = (key: string, session: ActiveSession) =>
+    const runCodexAppServerLogin = (session: ActiveSession) =>
       Effect.scoped(
         Effect.gen(function* () {
           const configured = yield* commandFor("codex", "codex");
@@ -484,6 +523,7 @@ export const make = (options: McpOAuthRuntimeOptions = {}) =>
             capabilities: { experimentalApi: true },
           });
           yield* client.notify("initialized", undefined);
+          yield* client.request("config/mcpServer/reload", undefined).pipe(Effect.ignore);
           const response = yield* client.request("mcpServer/oauth/login", {
             name: session.name,
             timeoutSecs: 600,
@@ -539,7 +579,87 @@ export const make = (options: McpOAuthRuntimeOptions = {}) =>
             });
           }
         }),
-      ).pipe(
+      );
+
+    const runCodexCliLogin = (session: ActiveSession) =>
+      Effect.scoped(
+        Effect.gen(function* () {
+          const configured = yield* commandFor("codex", "codex");
+          if (!configured) {
+            return yield* new McpOAuthProviderUnavailableError({
+              operation: "start",
+              harness: "codex",
+              serverName: session.name,
+            });
+          }
+          const listed = yield* processRunner
+            .run({
+              command: configured.command,
+              args: ["mcp", "get", session.name, "--json"],
+              cwd,
+              env: configured.env,
+              timeout: "30 seconds",
+              maxOutputBytes: 512 * 1024,
+              outputMode: "truncate",
+            })
+            .pipe(Effect.option);
+          const listedUrl =
+            Option.isSome(listed) && listed.value.code === 0
+              ? Option.match(decodeCodexMcpServerUrl(listed.value.stdout), {
+                  onNone: () => null,
+                  onSome: (server) => server.transport?.url?.trim() || null,
+                })
+              : null;
+          const environment = configured.env;
+          const spawnCommand = yield* resolveSpawnCommand(
+            configured.command,
+            [...codexMcpLoginArgs(session.name, listedUrl)],
+            {
+              env: environment,
+              extendEnv: true,
+            },
+          );
+          const child = yield* spawner.spawn(
+            ChildProcess.make(spawnCommand.command, spawnCommand.args, {
+              cwd,
+              env: environment,
+              extendEnv: true,
+              shell: spawnCommand.shell,
+              forceKillAfter: "2 seconds",
+            }),
+          );
+          yield* Deferred.succeed(session.started, {
+            authorizationUrl: "",
+            callbackRequired: false,
+          });
+          const exitCode = yield* Effect.raceFirst(
+            child.exitCode,
+            Deferred.await(session.cancelled).pipe(
+              Effect.flatMap(() =>
+                Effect.fail(
+                  new McpOAuthAuthenticationCancelledError({
+                    operation: "start",
+                    harness: "codex",
+                    serverName: session.name,
+                  }),
+                ),
+              ),
+            ),
+          );
+          if (exitCode !== 0) {
+            return yield* new McpOAuthAuthenticationFailedError({
+              operation: "start",
+              harness: "codex",
+              serverName: session.name,
+              exitCode,
+            });
+          }
+        }),
+      );
+
+    const runCodexSession = (key: string, session: ActiveSession) =>
+      runCodexAppServerLogin(session).pipe(
+        Effect.catchIf(isCodexMcpServerMissingError, () => runCodexCliLogin(session)),
         Effect.mapError((cause) =>
           isMcpOAuthRuntimeError(cause)
             ? cause

apps/web/src/components/settings/pluginMarketplace/PluginDetail.tsx

@@ -415,6 +415,8 @@ function McpAuthentication({ plugin }: { readonly plugin: PluginMarketplaceDetai
           } else if (window.desktopBridge) {
             await openAuthorizationUrl(result.authorizationUrl);
           }
+        } else {
+          reservedWindow?.close();
         }
         toastManager.add({
           type: "success",

docs/user/plugins.md

@@ -33,8 +33,9 @@ that plugin's enabled skills with the turn, including in an existing thread. Sta
 changing MCP servers or apps so the harness can refresh those longer-lived connections.
 
 Remote HTTP MCP servers that require OAuth have an **MCP authentication** section after
-installation. Select **Connect** to open the provider's authorization page. Codex completes the
-loopback flow in the browser. Claude Code may ask you to paste the full callback URL back into the
+installation. Select **Connect** to open the provider's authorization page. Codex usually
+completes the loopback flow in the browser; if it opens its own sign-in window instead, finish
+there and return to T3 Code. Claude Code may ask you to paste the full callback URL back into the
 plugin page when the environment is remote. Connection status and **Disconnect** use each
 harness's native credential store, so T3 Code never keeps a separate copy of the access or refresh
 token. Cursor connections continue in Cursor's own settings. Local standard-input MCP servers do