mirror of
https://github.com/openai/codex.git
synced 2026-10-18 17:18:52 +00:00
Nick Steele
4994306e9f
## Why The app server previously rejected OAuth login for enterprise-managed MCP servers. These servers need an explicit sign-in flow that ties saved authorization to the active Codex user and workspace and prevents canceled or superseded attempts from saving credentials. ## What changed - Enable enterprise sign-in through `mcpServer/oauth/login` for configured servers with a connected thread, trusted IdP registration, and `features.use_xaa` enabled. Scope shared enterprise credentials by user, workspace, issuer, and client ID. - Add `loginId` to MCP OAuth login responses and completion notifications, preserving compatibility with older servers that omit it. - Support enterprise login replacement and `account/login/cancel`, wait for callback listener shutdown before replacement, and recheck account and configuration before saving grants. Fence stale attempts across processes and account changes. - Remove shared enterprise authorization during account logout and `codex mcp logout`, including when the feature is disabled. Continue account logout if enterprise cleanup fails, and invalidate MCP runtimes on account changes. Start a fresh session after successful enterprise sign-in to use the saved grant. ## Testing Add regression coverage for login replacement and cancellation, callback port reuse, account changes during setup, cross-process logout invalidation, persisted workspace policy selection, cleanup failures, and responses from older servers without `loginId`. GitOrigin-RevId: 7ed4caaab4659ed1e67064262cf5cee48e3a26ac