jif
6203846fb3
## Why Enterprise-managed MCP authentication previously required public OAuth clients at both the identity provider and the MCP authorization server, preventing use of registrations that require client secrets. ## What changed - Accept separate `client_secret` and `token_endpoint_auth_method` settings for the enterprise IdP and MCP server OAuth registration. Support `client_secret_basic` and `client_secret_post`, defaulting to Basic when a secret is configured. - Validate the registered method against server metadata and use it for enterprise login and both ID-JAG exchanges. - Require a configured `oauth.authorization_server_issuer` for confidential MCP registrations and reject empty secrets or authentication methods without secrets. - Require the account OAuth client to match the configured IdP client before reusing an account grant with a provisioned secret; otherwise use dedicated enterprise login. ## Testing Extend configuration, login, exchange, and app-server lifecycle tests to cover confidential registrations, separate IdP and resource credentials, authentication method validation, and exclusion of client secrets from authorization URLs, stored login grants, and logs. GitOrigin-RevId: b3be378c2b1bb67e6a3652c648e72fd2e21e956d
Codex MCP runtime
This crate manages Codex's MCP connections, tool calls, and their captured authority.
Sandbox request metadata
An MCP server advertises the experimental codex/sandbox-state capability to
receive sandbox metadata on tool calls. The deprecated capability name
codex/sandbox-state-meta opts into the same contract during migration.
Codex supplies these entries in the request's _meta object:
| Key | Value |
|---|---|
codex/sandbox-state |
Opaque policy to pass to codex sandbox --sandbox-state-json. |
codex/sandbox-state-meta |
An identical copy of that policy under the deprecated name. |
codex/sandbox-launcher |
When available, an object with an absolute codexExecutable path to a verified full Codex CLI on the MCP server's host. |
Use the launcher path to invoke sandbox --sandbox-state-json with the entire
state value serialized as one argument, followed by -- and the command to run.
The state contains neither launcher discovery data nor deprecation messages.
Preserve unknown policy fields by forwarding the original value rather than
deserializing and reconstructing it. The two state names are aliases, not separate
policies; new consumers should prefer codex/sandbox-state.
Launcher metadata is currently available only for local stdio servers. An HTTP endpoint, including loopback, or a remote executor does not establish a shared filesystem with the harness. Codex omits the launcher when its path is unknown, not representable as UTF-8, or fails the cached capability probe. Absence does not authorize a PATH search or unsandboxed fallback. Servers that require a launcher must fail closed or require an explicit operator opt-out.
The state and launcher describe the issuing call. Retain both when starting a
long-lived subprocess or caching policy-bound results; reject changed authority
before reusing them. Tool arguments supplied by the model are not authority.
See sandbox_metadata.rs for the wire types and
binding.rs for execution-environment selection.