Route MCP OAuth recovery through Codex by stevenlee-oai · Pull Request #30294 · openai/codex

stevenlee-oai · 2026-06-26T21:18:31Z

Codex Thread 019edd6d-6f14-74e2-853c-345d1803d4a6

Stack

Review and merge in order. Every layer is independently correct and documents its safe stopping point.

openai/codex#30292 — aggregate File/Secrets store locking
openai/codex#30293 — resolve and lifecycle-pin the exact OAuth store
openai/codex#30416 — serialized authoritative refresh transaction
openai/codex#30294 — Codex-owned transport refresh and one-shot 401 recovery
openai/codex#30295 — login/logout transaction serialization
openai/codex#30296 — diagnostic-only Auto store drift reporting

This PR is layer 4.

Why

Serializing preflight refresh is not enough if RMCP can refresh independently or if RMCP-owned HTTP traffic bypasses Codex recovery. SSE reconnect GETs, session DELETEs, and responses to server-initiated requests need the same Codex-owned policy as public MCP operations.

What this PR does

Gives RMCP request-only credentials: no refresh token or expiry metadata is exposed outside Codex's credential transaction.
Wraps RMCP's Streamable HTTP client so Codex applies proactive refresh and at most one 401 recovery to RMCP-owned GET/reconnect, DELETE, and server-response POST traffic.
Keeps client-originated POST recovery in the outer RmcpClient, where caller deadlines and replay decisions are known.
Captures the access token actually sent with a rejected request. A delayed 401 for A after another request installs B adopts and retries B instead of refreshing B again.
Bounds a caller's wait for 401 recovery by that operation's remaining deadline. Timing out the wait does not cancel the already-owned refresh transaction; it may still persist B for the next request.
Reuses the lifecycle-pinned recipe across initialization retries and transport reconstruction.
Preserves the rejected token only for first-401 attribution; if the one allowed retry is also rejected, converts it to the established authentication-required result.
Composes one OAuth recovery and one session recovery in either arrival order, without allowing either retry to loop.
Keeps static bearer-token 401 challenges on the existing authentication-required path; rejected-token attribution is enabled only for a Codex-owned OAuth lifecycle.
Preserves authentication-required and token-expired markers across the RMCP-owned transport wrapper.

Explicit decisions

RMCP remains the transport and bearer-injection layer; Codex exclusively owns refresh policy.
A refresh transaction may complete after a caller deadline, but a request is retried only if that caller still has time remaining.
Every transport path gets at most one 401 retry; non-auth failures keep their existing behavior.

Safe stopping point

After this PR, Codex owns refresh and one-shot 401 recovery for every Streamable HTTP path. Login and logout can still race with refresh until layer 5.

Validation

just test -p codex-rmcp-client (112 passed; expected environment skips)
End-to-end delayed concurrent 401 and internal GET/POST/DELETE recovery coverage
Startup, public-operation, and RMCP-owned-transport coverage for a rejected post-refresh retry
Session-expiry-then-401 composition and static-bearer authentication-required coverage
Caller-timeout coverage proving the owned transaction can finish for the next request

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e4527fd978

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

stevenlee-oai · 2026-06-26T22:39:41Z

@codex review

chatgpt-codex-connector · 2026-06-26T22:44:16Z

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 5eaa4d4506

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

stevenlee-oai · 2026-06-26T22:57:37Z

@codex review

chatgpt-codex-connector · 2026-06-26T23:02:30Z

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: d5b91df49e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

stevenlee-oai · 2026-06-27T18:15:14Z

@codex review

[from Codex] Test-only follow-up: the timeout test now explicitly accepts the two valid request-count outcomes around completion of the owned refresh task, while retaining exact one-provider-refresh and refreshed-token expectations.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8d9e34b357

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…on' into dev/stevenlee/mcp-oauth-independent-3-transport-recovery # Conflicts: # codex-rs/rmcp-client/src/oauth.rs # codex-rs/rmcp-client/src/oauth/refresh_transaction.rs # codex-rs/rmcp-client/src/rmcp_client.rs # codex-rs/rmcp-client/src/streamable_http_retry.rs

stevenlee-oai · 2026-06-28T07:10:59Z

@codex review

— Codex

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a0c55f29f1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…on' into dev/stevenlee/mcp-oauth-independent-3-transport-recovery

stevenlee-oai · 2026-06-28T07:34:14Z

@codex review

— Codex

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 73e4bbcd7c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

stevenlee-oai · 2026-06-28T08:05:16Z

@codex review

— Codex

chatgpt-codex-connector · 2026-06-28T08:11:42Z

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 4d735e681a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

This was referenced Jun 26, 2026

Serialize shared MCP OAuth credential stores #30292

Open

Resolve and pin MCP OAuth credential stores #30293

Open

Serialize MCP OAuth login and logout #30295

Open

Report MCP OAuth Auto store drift #30296

Open

chatgpt-codex-connector Bot reviewed Jun 26, 2026

View reviewed changes

Comment thread codex-rs/rmcp-client/src/rmcp_client.rs Outdated

stevenlee-oai force-pushed the dev/stevenlee/mcp-oauth-independent-2-refresh-transaction branch from c432fcd to 38b9e10 Compare June 26, 2026 21:30

stevenlee-oai force-pushed the dev/stevenlee/mcp-oauth-independent-3-transport-recovery branch from e4527fd to 0135226 Compare June 26, 2026 21:30

stevenlee-oai force-pushed the dev/stevenlee/mcp-oauth-independent-2-refresh-transaction branch from 38b9e10 to c003752 Compare June 26, 2026 21:48

stevenlee-oai force-pushed the dev/stevenlee/mcp-oauth-independent-3-transport-recovery branch from 0135226 to fc3ba8b Compare June 26, 2026 21:48

Route MCP OAuth recovery through Codex

5eaa4d4

stevenlee-oai force-pushed the dev/stevenlee/mcp-oauth-independent-2-refresh-transaction branch from c003752 to c93f236 Compare June 26, 2026 22:25

stevenlee-oai force-pushed the dev/stevenlee/mcp-oauth-independent-3-transport-recovery branch from fc3ba8b to 5eaa4d4 Compare June 26, 2026 22:25

Merge OAuth store lock fallback fix

d5b91df

stevenlee-oai added 2 commits June 27, 2026 17:53

Merge MCP OAuth store lock naming cleanup

c1689c2

Stabilize MCP OAuth timeout race test

8d9e34b

chatgpt-codex-connector Bot reviewed Jun 27, 2026

View reviewed changes

Comment thread codex-rs/rmcp-client/src/http_client_adapter.rs Outdated

github-actions Bot mentioned this pull request Jun 28, 2026

📊 AI CLI 工具社区动态日报 2026-06-28 96loveslife/big_model_radar#68

Open

github-actions Bot mentioned this pull request Jun 28, 2026

📊 AI CLI 工具社区动态日报 2026-06-28 litang9/big_model_radar#134

Open

stevenlee-oai mentioned this pull request Jun 28, 2026

Serialize authoritative MCP OAuth refresh transactions #30416

Open

stevenlee-oai changed the base branch from dev/stevenlee/mcp-oauth-independent-2-refresh-transaction to dev/stevenlee/mcp-oauth-independent-3-refresh-transaction June 28, 2026 07:10

chatgpt-codex-connector Bot reviewed Jun 28, 2026

View reviewed changes

Comment thread codex-rs/rmcp-client/src/streamable_http_retry.rs

Comment thread codex-rs/rmcp-client/src/http_client_adapter.rs Outdated

stevenlee-oai added 2 commits June 28, 2026 07:26

Merge branch 'dev/stevenlee/mcp-oauth-independent-3-refresh-transacti…

587ae37

…on' into dev/stevenlee/mcp-oauth-independent-3-transport-recovery

Require reauthentication after rejected OAuth retry

73e4bbc

chatgpt-codex-connector Bot reviewed Jun 28, 2026

View reviewed changes

Comment thread codex-rs/rmcp-client/src/rmcp_client.rs Outdated

Comment thread codex-rs/rmcp-client/src/oauth_transport.rs

Comment thread codex-rs/rmcp-client/src/http_client_adapter.rs Outdated

Compose MCP transport recovery boundaries

4d735e6

Uh oh!

Conversation

stevenlee-oai commented Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Stack

Why

What this PR does

Explicit decisions

Safe stopping point

Validation

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

stevenlee-oai commented Jun 26, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jun 26, 2026

Uh oh!

stevenlee-oai commented Jun 26, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jun 26, 2026

Uh oh!

stevenlee-oai commented Jun 27, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

stevenlee-oai commented Jun 28, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

stevenlee-oai commented Jun 28, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

stevenlee-oai commented Jun 28, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jun 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

stevenlee-oai commented Jun 26, 2026 •

edited

Loading