mirror of
https://github.com/openai/codex.git
synced 2026-10-19 17:28:46 +00:00
Nick Steele
4994306e9f
## Why The app server previously rejected OAuth login for enterprise-managed MCP servers. These servers need an explicit sign-in flow that ties saved authorization to the active Codex user and workspace and prevents canceled or superseded attempts from saving credentials. ## What changed - Enable enterprise sign-in through `mcpServer/oauth/login` for configured servers with a connected thread, trusted IdP registration, and `features.use_xaa` enabled. Scope shared enterprise credentials by user, workspace, issuer, and client ID. - Add `loginId` to MCP OAuth login responses and completion notifications, preserving compatibility with older servers that omit it. - Support enterprise login replacement and `account/login/cancel`, wait for callback listener shutdown before replacement, and recheck account and configuration before saving grants. Fence stale attempts across processes and account changes. - Remove shared enterprise authorization during account logout and `codex mcp logout`, including when the feature is disabled. Continue account logout if enterprise cleanup fails, and invalidate MCP runtimes on account changes. Start a fresh session after successful enterprise sign-in to use the saved grant. ## Testing Add regression coverage for login replacement and cancellation, callback port reuse, account changes during setup, cross-process logout invalidation, persisted workspace policy selection, cleanup failures, and responses from older servers without `loginId`. GitOrigin-RevId: 7ed4caaab4659ed1e67064262cf5cee48e3a26ac
162 lines
5.1 KiB
TOML
162 lines
5.1 KiB
TOML
[package]
|
|
name = "codex-app-server"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
|
|
[[bin]]
|
|
name = "codex-app-server"
|
|
path = "src/main.rs"
|
|
|
|
[[bin]]
|
|
name = "codex-app-server-test-notify-capture"
|
|
path = "src/bin/notify_capture.rs"
|
|
|
|
[[bin]]
|
|
name = "exec-server"
|
|
path = "src/bin/exec_server.rs"
|
|
|
|
[lib]
|
|
name = "codex_app_server"
|
|
path = "src/lib.rs"
|
|
doctest = false
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
codex-utils-process = { workspace = true }
|
|
anyhow = { workspace = true }
|
|
base64 = { workspace = true }
|
|
axum = { workspace = true, default-features = false, features = [
|
|
"http1",
|
|
"json",
|
|
"tokio",
|
|
"ws",
|
|
] }
|
|
codex-analytics = { workspace = true }
|
|
codex-agent-extension = { workspace = true }
|
|
codex-arg0 = { workspace = true }
|
|
codex-aws-auth = { workspace = true }
|
|
codex-cloud-config = { workspace = true }
|
|
codex-code-mode = { workspace = true }
|
|
codex-config = { workspace = true }
|
|
codex-network-proxy = { workspace = true }
|
|
codex-connectors = { workspace = true }
|
|
codex-core = { workspace = true }
|
|
codex-core-plugins = { workspace = true }
|
|
codex-diagnostics = { workspace = true }
|
|
codex-home = { workspace = true }
|
|
codex-exec-server = { workspace = true }
|
|
codex-extension-api = { workspace = true }
|
|
codex-external-agent-migration = { workspace = true }
|
|
codex-features = { workspace = true }
|
|
codex-goal-extension = { workspace = true }
|
|
codex-git-attribution = { workspace = true }
|
|
codex-guardian-v2 = { workspace = true }
|
|
codex-git-utils = { workspace = true }
|
|
codex-file-watcher = { workspace = true }
|
|
codex-hooks = { workspace = true }
|
|
codex-history-notes-extension = { workspace = true }
|
|
codex-http-client = { workspace = true }
|
|
codex-otel = { workspace = true }
|
|
codex-plugin = { workspace = true }
|
|
codex-shell-command = { workspace = true }
|
|
codex-skills = { workspace = true }
|
|
codex-skills-extension = { workspace = true }
|
|
codex-utils-cli = { workspace = true }
|
|
codex-user-verification = { workspace = true }
|
|
codex-utils-pty = { workspace = true }
|
|
codex-backend-client = { workspace = true }
|
|
codex-file-search = { workspace = true }
|
|
codex-chatgpt = { workspace = true }
|
|
codex-login = { workspace = true }
|
|
codex-image-generation-extension = { workspace = true }
|
|
codex-memories-extension = { workspace = true }
|
|
codex-web-search-extension = { workspace = true }
|
|
codex-websocket-auth = { workspace = true }
|
|
codex-memories-write = { workspace = true }
|
|
codex-mcp = { workspace = true }
|
|
codex-mcp-extension = { workspace = true }
|
|
codex-model-provider = { workspace = true }
|
|
codex-model-provider-info = { workspace = true }
|
|
codex-models-manager = { workspace = true }
|
|
codex-prompts = { workspace = true }
|
|
codex-protocol = { workspace = true }
|
|
codex-queue-extension = { workspace = true }
|
|
codex-app-server-protocol = { workspace = true }
|
|
codex-app-server-transport = { workspace = true }
|
|
codex-feedback = { workspace = true }
|
|
codex-rmcp-client = { workspace = true }
|
|
codex-rollout = { workspace = true }
|
|
codex-sandboxing = { workspace = true }
|
|
codex-state = { workspace = true }
|
|
codex-thread-store = { workspace = true }
|
|
codex-tools = { workspace = true }
|
|
codex-utils-absolute-path = { workspace = true }
|
|
codex-utils-json-to-toml = { workspace = true }
|
|
codex-utils-path-uri = { workspace = true }
|
|
chrono = { workspace = true }
|
|
clap = { workspace = true, features = ["derive"] }
|
|
futures = { workspace = true }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
time = { workspace = true }
|
|
toml = { workspace = true }
|
|
toml_edit = { workspace = true }
|
|
tokio = { workspace = true, features = [
|
|
"io-std",
|
|
"macros",
|
|
"process",
|
|
"rt-multi-thread",
|
|
"signal",
|
|
] }
|
|
tokio-util = { workspace = true }
|
|
tracing = { workspace = true, features = ["log"] }
|
|
tracing-subscriber = { workspace = true, features = ["env-filter", "fmt", "json"] }
|
|
url = { workspace = true }
|
|
uuid = { workspace = true, features = ["serde", "v7"] }
|
|
|
|
[target.'cfg(all(target_os = "linux", target_env = "musl", any(target_arch = "x86_64", target_arch = "aarch64")))'.dependencies]
|
|
tikv-jemallocator = { workspace = true }
|
|
|
|
[target.'cfg(windows)'.dependencies]
|
|
codex-windows-sandbox = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
codex-uds = { workspace = true }
|
|
app_test_support = { workspace = true }
|
|
axum = { workspace = true, default-features = false, features = [
|
|
"http1",
|
|
"json",
|
|
"tokio",
|
|
] }
|
|
base64 = { workspace = true }
|
|
codex-utils-cargo-bin = { workspace = true }
|
|
core_test_support = { workspace = true }
|
|
flate2 = { workspace = true }
|
|
hmac = { workspace = true }
|
|
http = { workspace = true }
|
|
keyring = { workspace = true }
|
|
opentelemetry = { workspace = true }
|
|
opentelemetry_sdk = { workspace = true }
|
|
pretty_assertions = { workspace = true }
|
|
rcgen = { workspace = true }
|
|
rmcp = { workspace = true, default-features = false, features = [
|
|
"elicitation",
|
|
"server",
|
|
"transport-streamable-http-server",
|
|
] }
|
|
serial_test = { workspace = true }
|
|
shlex = { workspace = true }
|
|
sqlx = { workspace = true }
|
|
tar = { workspace = true }
|
|
test-case = "3.3.1"
|
|
tokio-rustls = { workspace = true }
|
|
tokio-tungstenite = { workspace = true }
|
|
tracing-opentelemetry = { workspace = true }
|
|
wiremock = { workspace = true }
|