[Bug]: Created Codex provider profiles continuously lose authentication every few minutes (Could not check Codex right now) #23853

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

Provider / Codex

Steps to reproduce

1. Add one or more secondary/custom Codex provider instances (e.g. codex2, codex3) alongside the main Codex instance.
2. Complete authentication for the secondary instance via ChatGPT OAuth in provider settings until it is marked as authenticated and ready.
3. Wait several minutes (or perform tasks/delegated requests with the profile).
4. Observe that after a few minutes, a toast notification appears:

   ChatGPT - provider status
   Could not check Codex right now. Retry, or reconnect in provider settings.
   [Open provider setup]

5. Clicking Retry or allowing automatic retries fails repeatedly (retries ~5 times and fails to reconnect).
6. Opening provider setup requires signing in through the browser multiple times to re-establish the connection.
7. Once successfully re-authenticated, the exact same scenario repeats after a few minutes.

Expected behavior

• Secondary/created Codex profiles should maintain their session via automatic background token refresh without dropping authentication every few minutes.
• If a transient network glitch or token refresh timeout occurs during the periodic health snapshot check (applySnapshot / refreshSnapshot), it should gracefully retry with exponential backoff rather than immediately marking the provider as unavailable or purging credentials.
• Behavior should match the primary Codex instance, which reconnects smoothly without forcing the user into repeated manual browser re-authentication loops.

Actual behavior

• The primary/main Codex profile (connected directly via local daemon / ~/.codex) recovers automatically even if it blips.
• However, created Codex profiles (which run with isolated shadowHomePath and independent secret storage codex-chatgpt:<instanceId>) fail their token renewal during background health polling.
• The UI triggers:
  Could not check Codex right now. Retry, or reconnect in provider settings.
• Retrying fails up to 5 times. The user must manually re-authenticate via browser OAuth repeatedly, only for the session to invalidate again minutes later.

Impact

Critical: Blocks sustained use of secondary Codex accounts or multi-profile load balancing, as accounts get disconnected every few minutes.

Version or commit

• App Version: 0.1.1-nightly.20261017.3238

Environment

• OS: Windows 11 (NT 10.0.26200)

Logs or stack traces

Captured from server.trace.ndjson:

{
  "type": "effect-span",
  "name": "POST",
  "attributes": {
    "http.request.method": "POST",
    "url.full": "https://auth.openai.com/api/accounts/oauth/token",
    "server.address": "auth.openai.com",
    "server.port": 443
  },
  "exit": {
    "_tag": "Failure",
    "cause": "HttpClientError: Transport error (POST https://auth.openai.com/api/accounts/oauth/token)\n    at catch (binCli-DslDRLSw.mjs:45511:21)\n    at Effect-CJk1pQBd.mjs:9449:38\n    at POST\n    at CodexChatGptAuth.exchange (binCli-DslDRLSw.mjs:229968:25)\n    at CodexChatGptAuth.exchange (definition) (binCli-DslDRLSw.mjs:229744:19)\n    at applySnapshot (binCli-DslDRLSw.mjs:174757:83)\n    at refreshSnapshot (binCli-DslDRLSw.mjs:174790:459)\n    at makeManagedServerProvider (binCli-DslDRLSw.mjs:230330:26)\n    at makeManagedCodexProvider (binCli-DslDRLSw.mjs:230614:53) {\n  [cause]: TypeError: fetch failed {\n    [cause]: ConnectTimeoutError: Connect Timeout Error (attempted addresses: 104.18.41.241:443, 172.64.146.15:443, timeout: 10000ms)\n        at onConnectTimeout (node:internal/deps/undici/undici:1991:23)\n        at Immediate._onImmediate (node:internal/deps/undici/undici:1957:35)\n  }\n}"
  }
}

Followed by:

ProviderSetupError: ChatGPT sign-in is temporarily unavailable. Try again.
    at failure (binCli-DslDRLSw.mjs:229618:41)
    at CodexChatGptAuth.exchange
    at applySnapshot / refreshSnapshot

And in makeManagedCodexProvider, the status catch block reports:

message: "Could not check Codex right now. Retry, or reconnect in provider settings."

Screenshots, recordings, or supporting files

• Error notification banner:
  ChatGPT - codex3 provider status
Could not check Codex right now. Retry, or reconnect in provider settings.
[Open provider setup]

Additional Context / Root Cause Clues

1. Periodic Refresh Loop: Background health checks (DEFAULT_PROVIDER_HEALTH_REFRESH_INTERVAL) periodically trigger refreshSnapshot() -> runtime.auth.controller.withAccess(runtime.resolve) -> auth.access.
2. Aggressive Token Invalidation / Short Expiry: CodexChatGptAuth.access checks record.expiresAt - now > 6e4. When within 60s, it calls exchange with grant_type: "refresh_token".
3. Transient Network or Re-use Failure: If the refresh call times out (10s connect timeout) or receives OAuth errors like invalid_grant / refresh_token_expired, exchange executes yield* remove;, wiping stored tokens and forcing full browser re-authentication.