From 09358089b0dd2cc5aa7c6c37ad4c834e9066561c Mon Sep 17 00:00:00 2001
From: bkotsopoulos <bradk@openai.com>
Date: Thu, 5 Nov 2026 22:07:24 +0000
Subject: [PATCH] Configure the Opus Bazel patch and isolate auth tests
 (#59752)

## What changed

- Configure Bazel to apply `opusic_sys_install_headers.patch` to `opusic-sys` with `-p1`.
- Run the cloud-managed MCP OAuth test with `--no-browser` and keep stdin open until the child exits so EOF cannot race the HTTP callback.
- Serialize the cancelled-refresh test with other auth environment tests and temporarily clear the access-token environment variable.

GitOrigin-RevId: ad76b72ae98320bd0e3ff3231e1ed874332ce38c
---
 MODULE.bazel                          |  2 ++
 codex-rs/cli/tests/cloud_config.rs    | 12 ++++++++++--
 codex-rs/login/src/auth/auth_tests.rs |  2 ++
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/MODULE.bazel b/MODULE.bazel
index 2311b30683..e248f79ee6 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -671,6 +671,8 @@ crate.annotation(
         "@rules_foreign_cc//toolchains:current_ninja_toolchain",
     ],
     crate = "opusic-sys",
+    patch_args = ["-p1"],
+    patches = ["//patches:opusic_sys_install_headers.patch"],
 )
 
 # The musl CLI's allocator needs declared native tools and consistent header flags.
diff --git a/codex-rs/cli/tests/cloud_config.rs b/codex-rs/cli/tests/cloud_config.rs
index a347297725..41ce93b756 100644
--- a/codex-rs/cli/tests/cloud_config.rs
+++ b/codex-rs/cli/tests/cloud_config.rs
@@ -258,9 +258,17 @@ async fn login_and_logout_persist_only_cloud_managed_mcp_oauth_credentials() ->
         .mount(&fixture.server)
         .await;
 
-    let mut command = fixture.command(&["mcp", "login", MANAGED_SERVER_NAME])?;
-    command.stdout(Stdio::piped()).stderr(Stdio::inherit());
+    let mut command = fixture.command(&["mcp", "login", MANAGED_SERVER_NAME, "--no-browser"])?;
+    command
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::inherit());
     let mut child = command.spawn()?;
+    // Keep input open through child.wait() so the HTTP callback cannot race EOF.
+    let _stdin = child
+        .stdin
+        .take()
+        .context("MCP login did not provide stdin")?;
     let stdout = child
         .stdout
         .take()
diff --git a/codex-rs/login/src/auth/auth_tests.rs b/codex-rs/login/src/auth/auth_tests.rs
index 14c05028a4..3b286c6b48 100644
--- a/codex-rs/login/src/auth/auth_tests.rs
+++ b/codex-rs/login/src/auth/auth_tests.rs
@@ -60,7 +60,9 @@ fn header_auth_exposes_a_valid_chatgpt_account_id() {
 }
 
 #[tokio::test]
+#[serial(codex_auth_env)]
 async fn cancelled_refresh_marks_only_started_exchanges_as_unsettled() -> anyhow::Result<()> {
+    let _access_token_guard = remove_access_token_env_var();
     let home = tempdir()?;
     write_auth_file(
         AuthFileParams {