Upgrading Docker Sandbox from 0.31.3 to 0.35.0 causes codex_apps authentication to fail (401 token_expired)

[eshref]

After upgrading Docker Sandbox from v0.31.3 to v0.35.0, all of my existing sandboxes stopped working because the codex_apps MCP client fails to authenticate.

The following error appears on startup:

MCP client for `codex_apps` failed to start: MCP startup failed: handshaking with MCP server failed:

Send message error Transport
[rmcp::transport::worker::WorkerTransport<...>]
error: unexpected server response: HTTP 401:

{
  "error": {
    "message": "Provided authentication token is expired. Please try signing in again.",
    "code": "token_expired"
  },
  "status": 401
}

MCP startup incomplete (failed: codex_apps)

What I tried
Logged out and logged in again.
Restarted the sandbox.
Downgraded back to v0.31.3.

Unfortunately, none of these steps resolved the issue. Even after logging in again, I continue to receive the same 401 token_expired error. Downgrading to v0.31.3 does not restore functionality either—the same error persists.

Expected behavior
After logging in again, the authentication token should be refreshed and the codex_apps MCP client should start successfully.

Actual behavior
The MCP client continues to fail with 401 token_expired, making codex_apps unusable.

[eshref]

I did some additional debugging and found something that may help narrow this down.

codex login successfully refreshes ~/.codex/auth.json, and the access token stored there is valid (not expired).

However, when Codex is started normally inside Docker Sandbox, codex_apps fails with 401 token_expired.

If I start Codex without the Docker Sandbox proxy environment variables:

env -u HTTP_PROXY -u HTTPS_PROXY -u http_proxy -u https_proxy codex

then codex_apps starts successfully and its tools are available.

This suggests the issue may be related to how the Docker Sandbox proxy (gateway.docker.internal:3128) handles authentication, rather than the locally stored Codex credentials.