Files
codex/codex-rs/rmcp-client/tests
Alex Kotliarskyi 0650d6d1ca Preserve MCP authentication challenges on tool calls (#42552)
## Why

When silent OAuth refresh cannot recover a rejected MCP tool call, the caller
needs the server's authentication challenge to initiate interactive login. The
rejected call must not be replayed automatically after refresh has failed.

## What changed

- Convert `401 Unauthorized` responses with `WWW-Authenticate` headers into an
  MCP tool error containing `mcp/www_authenticate` metadata.
- Preserve multiple authentication challenges by combining all
  `WWW-Authenticate` header values.
- Keep successful silent refresh behavior while avoiding replay when refresh
  fails.

## Testing

Added coverage for successful and failed refresh, multiple authentication
headers, propagation through agent tool-call events, and no-replay behavior.

GitOrigin-RevId: c560cff6286d7ab09b1f5c6cf3618d4650cde47d
2026-09-03 15:12:02 +00:00
..
2026-08-17 23:04:09 +00:00