Anton Panasenko bd5a836567 Refresh remote exec-server credentials after unauthorized responses (#55987) ...

## Why

Remote registry requests need to recover when credentials are rejected or rotated while `exec-server` is running. Concurrent requests should reuse refreshed credentials rather than refresh the replacement token again.

## What changed

- Add an `AuthProvider` recovery hook and retry registry registration, connection, and harness-key validation once after a `401` when the provider supplies replacement credentials.
- Use live ChatGPT authentication for remote `exec-server` and guard proactive and unauthorized refreshes so concurrent callers share the completed refresh.
- Allow executor credentials to retry when the parent has already supplied a valid replacement.
- Keep connection authentication, refresh, and retry within the original connection deadline.

## Testing

Add coverage for concurrent refreshes, stored and parent-supplied credential rotation, refresh failures, retry limits, and connection deadlines, plus a CLI integration test for refresh and credential reload in a running executor.

GitOrigin-RevId: 9ed533e410762c7ac8b7c0c30bb93fd20d96778b

2026-10-21 21:05:08 +00:00

..

app_server_daemon

Isolate daemon package tests to reduce disk contention (#53897)

2026-10-14 07:13:22 +00:00

exec_server

Refresh remote exec-server credentials after unauthorized responses (#55987)

2026-10-21 21:05:08 +00:00

snapshots

Defer folder trust checks until starting a task from agents overview (#54048)

2026-10-14 17:35:13 +00:00

app_server_daemon_windows.rs

Support daemon installation from Windows WinGet packages (#53811)

2026-10-14 00:49:27 +00:00

app_server_daemon.rs

Isolate daemon package tests to reduce disk contention (#53897)

2026-10-14 07:13:22 +00:00

app_server.rs

Route SQLite logs to an explicitly configured log_dir (#55978)

2026-10-21 19:53:00 +00:00

cloud_auth.rs

Restrict cloud task credentials to trusted origins (#41403)

2026-08-28 19:44:50 +00:00

cloud_config.rs

Add one-shot app-server startup configuration discovery (#55300)

2026-10-19 15:13:44 +00:00

daemon_startup.rs

Check daemon feature overrides and prompt for mismatch recovery (#55442)

2026-10-20 03:11:07 +00:00

daemon_telemetry.rs

Honor custom OTLP metrics exporters when analytics is disabled (#52278)

2026-10-08 21:18:24 +00:00

debug_clear_memories.rs

Add macOS voice runtime projection (#42204)

2026-09-02 04:52:32 +00:00

debug_models.rs

Add codex debug models to show model catalog (#18625)

2026-04-20 05:42:22 +00:00

delete.rs

Add session delete commands in CLI and TUI (#27476)

2026-06-10 18:04:02 -07:00

doctor_enterprise_network.rs

Report managed filesystem policy in codex doctor (#42821)

2026-09-04 18:23:10 +00:00

doctor_path_safety.rs

Route SQLite logs to an explicitly configured log_dir (#55978)

2026-10-21 19:53:00 +00:00

exec_server_websocket_auth.rs

Support bearer tokens for app-server executor connections (#47648)

2026-09-23 20:05:37 +00:00

exec_server.rs

Refresh remote exec-server credentials after unauthorized responses (#55987)

2026-10-21 21:05:08 +00:00

execpolicy.rs

feat: add justification arg to prefix_rule() in *.rules (#8751)

2026-01-05 21:24:48 +00:00

features.rs

Reject unknown TUI keys in strict config validation (#50525)

2026-10-03 05:16:04 +00:00

login.rs

Route SQLite logs to an explicitly configured log_dir (#55978)

2026-10-21 19:53:00 +00:00

marketplace_add.rs

Clean up failed and abandoned marketplace staging directories (#55689)

2026-10-20 22:25:54 +00:00

marketplace_remove.rs

Respect config layers when removing plugin marketplaces (#40683)

2026-08-25 19:38:39 +00:00

marketplace_upgrade.rs

Clean up failed and abandoned marketplace staging directories (#55689)

2026-10-20 22:25:54 +00:00

mcp_add_remove.rs

Support client secrets for pre-registered MCP OAuth clients (#47891)

2026-09-24 17:26:18 +00:00

mcp_list.rs

Add dynamic HTTP header helpers for MCP servers (#38245)

2026-08-12 20:36:32 +00:00

mcp_login.rs

Prefer resource-specific scopes during MCP OAuth discovery (#54653)

2026-10-16 16:23:55 +00:00

plugin_cli.rs

Handle broken pipes gracefully in plugin list output (#53109)

2026-10-11 12:38:29 +00:00

queue.rs

Add thread ID exclusions to thread/list (#51595)

2026-10-07 06:07:47 +00:00

sandbox_cloud_config.rs

Load cloud-managed profiles for codex sandbox (#35685)

2026-07-27 23:16:37 +00:00

sandbox_network_proxy.rs

Upgrade rmcp to 3.5.1 and harden lifecycle tests (#52972)

2026-10-10 19:43:24 +00:00

sandbox_tty.rs

Support close-on-exec attachments without changing PTY semantics (#47797)

2026-09-24 09:25:19 +00:00

sandbox_uninstall.rs

Add a CLI command to uninstall the legacy Windows sandbox (#50437)

2026-10-02 21:51:46 +00:00

update.rs

Add codex update command (#19933)

2026-04-27 23:33:59 -07:00

worktree.rs

Check daemon feature overrides and prompt for mismatch recovery (#55442)

2026-10-20 03:11:07 +00:00