jif 6b13dffc5e Reuse Codex account grants for enterprise MCP authentication (#55698) ...

## What changed

- Prefer stored enterprise credentials when available; otherwise use a validated Codex account OAuth grant whose issuer matches the enterprise MCP configuration.
- Pin each connection to its credential source and OAuth client, reject stale account grants, and hold the account refresh lease only during the IdP exchange.
- Report actionable sign-in and issuer configuration errors, and classify token failures by credential source.

GitOrigin-RevId: 26673f276a31e4ca5290f6b120f0ac44c77d7239

2026-10-20 23:27:33 +00:00

..

bin

Honor MCP tool-list changes within a turn (#54656)

2026-10-16 16:40:17 +00:00

oauth

Refine enterprise MCP auth errors and request authority checks (#55691)

2026-10-20 22:33:14 +00:00

auth_status.rs

Prefer resource-specific scopes during MCP OAuth discovery (#54653)

2026-10-16 16:23:55 +00:00

bounded_stdio_transport.rs

Fix relative MCP server spawning on macOS (#42117)

2026-09-01 18:53:06 +00:00

elicitation_client_service.rs

Upgrade rmcp to 3.5.1 and harden lifecycle tests (#52972)

2026-10-10 19:43:24 +00:00

ema_auth_policy_tests.rs

Add enterprise IdP identity resolution for MCP OAuth (#40739)

2026-08-25 23:51:57 +00:00

ema_auth_policy.rs

Refine enterprise MCP auth errors and request authority checks (#55691)

2026-10-20 22:33:14 +00:00

ema_auth_tests.rs

Add account credential support to EMA token exchange helpers (#55685)

2026-10-20 22:00:42 +00:00

ema_auth.rs

Add account credential support to EMA token exchange helpers (#55685)

2026-10-20 22:00:42 +00:00

ema_claims.rs

Add account credential support to EMA token exchange helpers (#55685)

2026-10-20 22:00:42 +00:00

ema_exchange_tests.rs

Refine enterprise MCP auth errors and request authority checks (#55691)

2026-10-20 22:33:14 +00:00

ema_exchange.rs

Refine enterprise MCP auth errors and request authority checks (#55691)

2026-10-20 22:33:14 +00:00

ema_http_client_regression_tests.rs

Refine enterprise MCP auth errors and request authority checks (#55691)

2026-10-20 22:33:14 +00:00

ema_http_client_tests.rs

Recheck EMA request authority at HTTP boundaries (#55288)

2026-10-19 14:08:49 +00:00

ema_http_client.rs

Preserve enterprise MCP authorization across runtime refreshes (#55696)

2026-10-20 23:03:56 +00:00

ema_identity_tests.rs

Add renewable EMA HTTP authentication and credential versioning (#49987)

2026-10-01 13:57:48 +00:00

ema_identity.rs

Reuse Codex account grants for enterprise MCP authentication (#55698)

2026-10-20 23:27:33 +00:00

ema_resource.rs

Discover and validate MCP authorization servers before ID-JAG exchange (#49478)

2026-09-30 04:30:01 +00:00

enterprise_oauth_login_tests.rs

Prevent recursive Tokio tracing in telemetry and SQLite logs (#51775)

2026-10-07 17:28:32 +00:00

enterprise_oauth_login.rs

Add renewable EMA HTTP authentication and credential versioning (#49987)

2026-10-01 13:57:48 +00:00

enterprise_oauth_logout_tests.rs

Add renewable EMA HTTP authentication and credential versioning (#49987)

2026-10-01 13:57:48 +00:00

event_notification_transport.rs

Add app-server MCP event streaming (#39761)

2026-08-20 17:49:35 +00:00

executor_process_transport_tests.rs

Complete MCP 2026 client support (#35725)

2026-07-28 06:06:58 +00:00

executor_process_transport.rs

Share byte buffers across exec-server output chunks (#49972)

2026-10-01 12:41:39 +00:00

http_client_adapter_tests.rs

Resolve HTTP MCP bearer tokens in executor environments (#39926)

2026-08-21 12:50:15 +00:00

http_client_adapter.rs

Propagate authentication header failures before sending requests (#55607)

2026-10-20 15:43:19 +00:00

http_client_redirect_tests.rs

Resolve HTTP MCP bearer tokens in executor environments (#39926)

2026-08-21 12:50:15 +00:00

http_client_redirect.rs

Resolve HTTP MCP bearer tokens in executor environments (#39926)

2026-08-21 12:50:15 +00:00

http_headers_tests.rs

Wait for helper completion in HTTP header cancellation tests (#51689)

2026-10-07 13:17:08 +00:00

http_headers.rs

Use macOS member fallback in shared process-group termination helpers (#46521)

2026-09-18 23:59:18 +00:00

in_process_transport.rs

…

lib.rs

Refine enterprise MCP auth errors and request authority checks (#55691)

2026-10-20 22:33:14 +00:00

local_stdio_transport.rs

Make local child process launch settings explicit (#46660)

2026-09-19 15:14:22 +00:00

logging_client_handler.rs

Upgrade rmcp to 3.5.1 and harden lifecycle tests (#52972)

2026-10-10 19:43:24 +00:00

oauth_callback_input_tests.rs

Add manual callback input to MCP OAuth login (#44629)

2026-09-10 19:51:52 +00:00

oauth_callback_input.rs

Support client secrets for pre-registered MCP OAuth clients (#47891)

2026-09-24 17:26:18 +00:00

oauth_callback_tests.rs

Harden MCP OAuth callback handling (#40691)

2026-08-25 20:26:23 +00:00

oauth_callback.rs

Harden MCP OAuth callback handling (#40691)

2026-08-25 20:26:23 +00:00

oauth_client_credentials.rs

Support client secrets for pre-registered MCP OAuth clients (#47891)

2026-09-24 17:26:18 +00:00

oauth_client_registration_tests.rs

Replace the Figma OAuth exception with Mercado Pago (#50189)

2026-10-02 05:25:51 +00:00

oauth_client_registration.rs

Harden MCP OAuth callback handling (#40691)

2026-08-25 20:26:23 +00:00

oauth_http_client_security_tests.rs

Enable enterprise MCP sign-in and account-scoped grant cleanup (#49276)

2026-09-29 14:46:33 +00:00

oauth_http_client.rs

Recover OAuth metadata discovery from 503 responses via OIDC (#44636)

2026-09-10 20:50:10 +00:00

oauth_refresh_mode.rs

Prepare MCP connections for coordinated OAuth refresh (#42128)

2026-09-01 20:26:57 +00:00

oauth.rs

Retire rejected MCP OAuth refresh tokens (#54079)

2026-10-14 20:00:52 +00:00

perform_oauth_login.rs

Add attributed MCP OAuth credential storage telemetry (#49392)

2026-09-29 23:01:46 +00:00

program_resolver.rs

Centralize executable fixture creation to avoid Linux ETXTBSY races (#48727)

2026-09-27 15:25:13 +00:00

protocol_mode.rs

Add MCP 2026-07-28 discovery support (#35724)

2026-07-28 05:52:12 +00:00

rmcp_client.rs

Preserve MCP tool-list metadata in server status (#54686)

2026-10-16 19:26:46 +00:00

service_error_tests.rs

Preserve specific MCP failure codes in metrics and spans (#54094)

2026-10-14 20:53:59 +00:00

service_error.rs

Preserve specific MCP failure codes in metrics and spans (#54094)

2026-10-14 20:53:59 +00:00

startup_error.rs

Refine enterprise MCP auth errors and request authority checks (#55691)

2026-10-20 22:33:14 +00:00

stdio_server_launcher.rs

Fix Windows environment handling for remote MCP servers (#54069)

2026-10-14 18:56:46 +00:00

streamable_http_retry_tests.rs

Refine enterprise MCP auth errors and request authority checks (#55691)

2026-10-20 22:33:14 +00:00

streamable_http_retry.rs

Propagate authentication header failures before sending requests (#55607)

2026-10-20 15:43:19 +00:00

tool_input_tests.rs

Upgrade rmcp to 3.5.1 and harden lifecycle tests (#52972)

2026-10-10 19:43:24 +00:00

tool_input.rs

Support native verification in MCP tool continuations (#44346)

2026-09-10 00:14:43 +00:00

tool_list_changes.rs

Honor MCP tool-list changes within a turn (#54656)

2026-10-16 16:40:17 +00:00

trace_context_tests.rs

Preserve MCP request trace context across transport workers (#47212)

2026-09-22 06:47:07 +00:00

trace_context.rs

Preserve MCP request trace context across transport workers (#47212)

2026-09-22 06:47:07 +00:00

user_verification_cancellation_tests.rs

Upgrade rmcp to 3.5.1 and harden lifecycle tests (#52972)

2026-10-10 19:43:24 +00:00

user_verification_dispatch_tests.rs

Upgrade rmcp to 3.5.1 and harden lifecycle tests (#52972)

2026-10-10 19:43:24 +00:00

user_verification_tests.rs

Preserve diagnostic reasons for MCP user verification failures (#51808)

2026-10-07 19:28:14 +00:00

user_verification.rs

Preserve diagnostic reasons for MCP user verification failures (#51808)

2026-10-07 19:28:14 +00:00

utils.rs

Isolate MCP resource headers during OAuth requests (#39019)

2026-08-17 16:29:47 +00:00

www_authenticate_tests.rs

Refresh MCP HTTP helper headers after authorization failures (#41400)

2026-08-28 19:29:51 +00:00

www_authenticate.rs

Refresh MCP HTTP helper headers after authorization failures (#41400)

2026-08-28 19:29:51 +00:00