From f2a14cea600a25921beafaf2d511f09c69df846a Mon Sep 17 00:00:00 2001 From: pakrym-oai Date: Thu, 8 Jan 2026 11:58:59 -0800 Subject: [PATCH] oauth: invert macOS debug keyring env flag semantics Rename CODEX_MCP_OAUTH_KEYRING_DEBUG_ALLOW to CODEX_MCP_OAUTH_KEYRING_DEBUG_DISABLE and flip the logic so that setting CODEX_MCP_OAUTH_KEYRING_DEBUG_DISABLE=1 disables keyring access in debug builds on macOS. Update the error message accordingly. --- codex-rs/rmcp-client/src/oauth.rs | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/codex-rs/rmcp-client/src/oauth.rs b/codex-rs/rmcp-client/src/oauth.rs index 37aac64d1d..823ff753db 100644 --- a/codex-rs/rmcp-client/src/oauth.rs +++ b/codex-rs/rmcp-client/src/oauth.rs @@ -50,7 +50,7 @@ use tokio::sync::Mutex; use crate::find_codex_home::find_codex_home; const KEYRING_SERVICE: &str = "Codex MCP Credentials"; -const MCP_OAUTH_KEYRING_DEBUG_ALLOW_ENV_VAR: &str = "CODEX_MCP_OAUTH_KEYRING_DEBUG_ALLOW"; +const MCP_OAUTH_KEYRING_DEBUG_DISABLE_ENV_VAR: &str = "CODEX_MCP_OAUTH_KEYRING_DEBUG_DISABLE"; const REFRESH_SKEW_MILLIS: u64 = 30_000; #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)] @@ -97,12 +97,9 @@ pub(crate) fn load_oauth_tokens( store_mode: OAuthCredentialsStoreMode, ) -> Result> { if keyring_load_disabled_in_debug() { - if store_mode == OAuthCredentialsStoreMode::Keyring { - return Err(anyhow::anyhow!( - "MCP OAuth keyring access is disabled in debug builds on macOS; set {MCP_OAUTH_KEYRING_DEBUG_ALLOW_ENV_VAR}=1 to enable." - )); - } - return load_oauth_tokens_from_file(server_name, url); + return Err(anyhow::anyhow!( + "MCP OAuth keyring access is disabled in debug because {MCP_OAUTH_KEYRING_DEBUG_DISABLE_ENV_VAR} is set." + )); } let keyring_store = DefaultKeyringStore; @@ -129,7 +126,7 @@ pub(crate) fn has_oauth_tokens( fn keyring_load_disabled_in_debug() -> bool { cfg!(debug_assertions) && cfg!(target_os = "macos") - && std::env::var_os(MCP_OAUTH_KEYRING_DEBUG_ALLOW_ENV_VAR).is_none() + && std::env::var_os(MCP_OAUTH_KEYRING_DEBUG_DISABLE_ENV_VAR).is_some_and(|v| v == "1") } fn refresh_expires_in_from_timestamp(tokens: &mut StoredOAuthTokens) {