Adam Perry @ OpenAI 4de7a2b9d8 fix(rmcp): refresh expired OAuth tokens before startup (#26482) ...

## Why

Codex persists OAuth expiry as an absolute `expires_at`, then
reconstructs RMCP’s relative `expires_in` when credentials are loaded.
For an already-expired token, Codex reconstructed `expires_in` as
missing.

[RMCP 0.15 treated a missing `expires_in` as zero when a refresh token
was
present](9cfc905a9e/crates/rmcp/src/transport/auth.rs (L704-L723)),
so this still triggered a refresh. [RMCP 1.7 treats missing expiry
information as unknown and uses the access token
as-is](3529c3675f/crates/rmcp/src/transport/auth.rs (L1233-L1265)),
causing the stale token to be sent during `initialize`.

## What changed

- Represent a known-expired persisted token as `expires_in = 0`,
preserving `None` for genuinely unknown expiry.
- Add Streamable HTTP coverage requiring the token to refresh before the
startup handshake.

## Validation

- The new regression test fails on RMCP 1.7 before the fix and passes
afterward.
- The same scenario passes on the commit immediately before the RMCP 1.7
update, using RMCP 0.15.
- `just test -p codex-rmcp-client` (63 passed).

2026-06-05 02:31:06 +00:00

2.4 KiB

Raw Permalink Blame History

View Raw