mirror of
https://github.com/openai/codex.git
synced 2026-09-20 12:47:38 +00:00
## Why When silent OAuth refresh cannot recover a rejected MCP tool call, the caller needs the server's authentication challenge to initiate interactive login. The rejected call must not be replayed automatically after refresh has failed. ## What changed - Convert `401 Unauthorized` responses with `WWW-Authenticate` headers into an MCP tool error containing `mcp/www_authenticate` metadata. - Preserve multiple authentication challenges by combining all `WWW-Authenticate` header values. - Keep successful silent refresh behavior while avoiding replay when refresh fails. ## Testing Added coverage for successful and failed refresh, multiple authentication headers, propagation through agent tool-call events, and no-replay behavior. GitOrigin-RevId: c560cff6286d7ab09b1f5c6cf3618d4650cde47d