From b8e47f9d303318536c893595eafb29a653c6faf1 Mon Sep 17 00:00:00 2001
From: Casey Chow <caseychow@openai.com>
Date: Fri, 6 Mar 2026 10:14:12 -0500
Subject: [PATCH] fix(core): isolate apps mcp cookie store per thread

---
 codex-rs/core/src/thread_manager.rs | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/codex-rs/core/src/thread_manager.rs b/codex-rs/core/src/thread_manager.rs
index 0e0a530a27..b736be0d43 100644
--- a/codex-rs/core/src/thread_manager.rs
+++ b/codex-rs/core/src/thread_manager.rs
@@ -608,7 +608,7 @@ impl ThreadManagerState {
         } = Codex::spawn(
             config,
             auth_manager,
-            Arc::clone(&self.apps_mcp_cookie_store),
+            Arc::new(AppsMcpCookieStore::default()),
             Arc::clone(&self.models_manager),
             Arc::clone(&self.skills_manager),
             Arc::clone(&self.plugins_manager),
@@ -681,6 +681,7 @@ fn truncate_before_nth_user_message(history: InitialHistory, n: usize) -> Initia
 mod tests {
     use super::*;
     use crate::codex::make_session_and_context;
+    use crate::config::test_config;
     use assert_matches::assert_matches;
     use codex_protocol::models::ContentItem;
     use codex_protocol::models::ReasoningItemReasoningSummary;
@@ -791,4 +792,26 @@ mod tests {
             serde_json::to_value(&expected).unwrap()
         );
     }
+
+    #[tokio::test]
+    async fn spawned_threads_use_session_local_apps_mcp_cookie_stores() {
+        let auth = CodexAuth::from_api_key("Test API Key");
+        let manager = ThreadManager::with_models_provider_for_tests(
+            auth,
+            ModelProviderInfo::create_openai_provider(),
+        );
+
+        let thread = manager
+            .start_thread(test_config())
+            .await
+            .expect("spawn test thread");
+
+        assert!(
+            !Arc::ptr_eq(
+                &manager.state.apps_mcp_cookie_store,
+                &thread.thread.codex.session.services.apps_mcp_cookie_store,
+            ),
+            "live sessions should not share the app/list cookie store",
+        );
+    }
 }