Auth token not resynced to external CLI configs after Editor restart, causing persistent 401s

[Daliys]

Summary

External MCP clients (Codex, Claude Code, Gemini) intermittently get HTTP 401 Unauthorized from the local Nexus Unity bridge on every call (get_state, scene graph, dependency inspection, etc.), even though the bridge process is running and was previously linked successfully. From the agent's side this is indistinguishable from "bridge not installed."

Root cause

• The server auth token is generated per Unity Editor process, not persisted to disk: EnsureAuthToken() creates a new random token and stores it only in SessionState, which survives domain reloads but is reset every time the Editor process closes and reopens.
  • Editor/MCPServer.cs:93-105
• External CLI integrations get that token baked into their own config at the moment "link/install" is run in the Nexus Editor window. For Codex specifically, the token is written into a global, machine-wide file (~/.codex/config.toml), not project-scoped and never live-synced afterward.
  • Editor/MCPCliInstaller.Codex.cs:37
• The server's auth check is correct and intentional (added in 9c1f662, "require auth for local MCP API") — it rejects any mismatched token with 401.
  • Editor/MCPServer.Networking.cs:223-236
• The codebase already detects staleness and offers a manual fix: the Integrations tab shows an "Outdated" status and a Refresh flow (902f52d, "Detect stale MCP bridge integrations"), and even instructs "Restart <client> sessions to use the redeployed bridge." But nothing pushes the new token to already-configured external agents automatically, and nothing restarts the CLI process for them.
  • Editor/MCPServerWindow.Integrations.cs

Repro

1. Link Nexus Unity to an external CLI (e.g. Codex) via the Integrations tab. Token X gets baked into that CLI's config.
2. Close and reopen the Unity Editor. A new token Y is generated (SessionState resets on process restart).
3. From the external CLI/agent, call any Nexus Unity tool. Server has token Y, CLI config still has token X → 401 on every request.
4. The only recovery path is a human opening the Nexus Editor window, re-running "link/refresh" for that specific CLI, and then manually restarting the CLI's session/process (since the token is read from an env var at process start, e.g. Editor/nexus_bridge/_transport.py:52).

Impact

Any long-running external agent session survives a Unity Editor restart in a broken, silently-unauthenticated state with no self-service recovery — it can detect the 401 but cannot resolve it without a human in the Unity Editor UI.

Notes for the fix (not doing it now)

• Consider persisting the token (or a stable machine/user-scoped secret) across Editor restarts instead of rotating it every process start, or
• Auto-detect and re-write already-linked external configs on Editor startup, or
• At minimum, expose a way for the bridge/agent to detect "token stale, needs relink" distinctly from "server unreachable" so agents don't have to guess.