soyeon-oai ae357e7250 Attach verified access context to eligible plugin MCP calls (#41005) ...

## What changed

- Fetch ChatGPT account access and attach `cyber_trusted_access` under
  `openai/entitlementContext` when an installed or selected plugin explicitly
  requests it from a local, read-only stdio tool with no arguments.
- Reject caller-supplied entitlement context on direct MCP calls, and fall back
  to an `unknown` status when access cannot be verified or the account changes
  during the lookup.
- Count entitlement lookup time against the MCP tool-call timeout.

## Testing

- Cover eligible calls plus unowned, remote, HTTP, mutable, argument-bearing,
  API-key, undeclared, direct, and account-switch cases in core and app-server
  integration tests.

GitOrigin-RevId: 303b61585ef4530276c373d914a2d0ccef1f4ac2

2026-08-27 00:02:26 +00:00

..

src

Attach verified access context to eligible plugin MCP calls (#41005)

2026-08-27 00:02:26 +00:00

BUILD.bazel

Extract MCP into codex-mcp crate (#15919)

2026-04-01 19:03:26 -07:00

Cargo.toml

Reconnect MCP servers when authentication mode changes (#40634)

2026-08-25 16:14:26 +00:00