[Bug]: Codex provider keeps a failed auth probe after signing in again until the next health interval #34295

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/server (packages/provider-core)

Summary

After a Codex instance's probe fails on auth, fixing the credential doesn't clear the error. The card keeps the failed probe result until the next health interval (5 minutes by default). Neither a settings reconcile nor a change to the background-activity interval runs a new probe.

Steps to reproduce

1. Use a Codex instance whose credential has become invalid (here, the Codex refresh token had been revoked). The provider probe reports the auth failure, and the card shows the error.
2. Sign in again, so that the instance's auth.json holds a valid credential.
3. Change any setting that isn't one of that provider's own settings, or change the background-activity interval.
4. Watch the provider card.

Expected behavior

The probe runs again soon after the credential changes, or at least when settings are applied, and the error clears.

Actual behavior

The card keeps the old probe error. It recovers only when the next health interval runs a probe.

Why, from the source

In managedProvider.ts @ afb4f91, the 0.1.8 bundle has the same logic:

• Settings changes go through applySnapshot(nextSettings) without forceRefresh (L381). If haveSettingsChanged is false for this provider, the cached snapshot is returned (L148).
• Interval changes win the race through Queue.take(refreshIntervalChanges).pipe(Effect.as(false)) (L395). That only restarts the sleep and does not refresh.
• Nothing in the server watches the instance's auth.json, so a new credential written outside T3 isn't noticed.

The card's Retry (refresh, forceRefresh: true) does probe again. So the gap is only in automatic recovery.

Impact

Minor bug or occasional failure. The provider looks broken for up to one interval after it has been fixed, which makes it easy to assume the fix didn't work.

Version or commit

0.1.8 (release). Same logic on main @ afb4f91.

Environment

macOS arm64 and Windows x64, Codex CLI 0.167.1.

Suggested fix

Run a forced probe when the instance's auth file changes, for example by watching <home>/auth.json or checking its mtime on the next status read. Optionally, a probe that ended in an auth error could also be retried sooner than the normal interval.

Workaround

Press Retry on the provider card, or wait for the next health interval.