codex

mirror of https://github.com/openai/codex.git synced 2026-09-03 14:59:03 +00:00

Files

stevenlee-oai 9be8d6e1c3 Harden MCP OAuth callback handling (#40691 )

## Why

MCP servers can share an OAuth callback URL. Without a validated issuer or a
server-specific callback path, an authorization response could be associated
with the wrong server.

## What changed

- Use stable callbacks when authorization metadata advertises issuer-bound
  responses, and validate the returned issuer before exchanging the code.
- Retain server-specific callback IDs for providers without issuer support,
  including fallback to the global or default callback for legacy registered
  clients.
- Persist registered callback URLs for MCP servers and plugins, and insert the
  active listener port into portless loopback redirects.

## Testing

Add coverage for issuer validation, callback-mode discovery, registered and
legacy clients, plugin OAuth, CLI persistence, and loopback listener ports.

GitOrigin-RevId: 2878c92e237fc17fd3def0bd2e1cce3e104a3db8

2026-08-25 20:26:23 +00:00

app_server.rs

Allow session configuration with codex agents (#39870 )

2026-08-21 06:08:26 +00:00

cloud_config.rs

Respect config layers when removing plugin marketplaces (#40683 )

2026-08-25 19:38:39 +00:00

debug_clear_memories.rs

Honor the configured SQLite home across state consumers (#34994 )

2026-07-23 19:19:35 +00:00

debug_models.rs

Add codex debug models to show model catalog (#18625 )