James Armstead 65cc86f45c Refresh MCP OAuth auth-profile tokens (#96120) ...

* Refresh MCP OAuth auth-profile tokens

* Rotate Codex MCP binding on bearer changes

* Preserve agent scope for MCP auth profiles

* Preserve Codex MCP tool filters

* Keep Codex MCP projection helper local-only

* Fix Codex projection package boundary artifacts

* Revert "Fix Codex projection package boundary artifacts"

This reverts commit 13bcaed3dafafa8238e9ab16bf201f56d300fae0.

* Revert "Keep Codex MCP projection helper local-only"

This reverts commit 19751f4922d072296376c3ec68d5660c7dfe4204.

* Trigger CI rerun for OAuth MCP PR

* Fail closed for remote Codex MCP bearer projection

* Fix MCP OAuth bearer token projection

* fix: project MCP-native OAuth credentials

* fix: align MCP SDK surface budget

* fix(mcp): keep agents available before OAuth login

---------

Co-authored-by: Josh Lehman <josh@martian.engineering>

2026-07-10 17:49:43 -07:00

..

protocol-generated/json

chore(codex): bump app-server to 0.143.0

2026-07-08 23:07:20 -07:00

sandbox-exec-server

fix(codex): defer sandbox cleanup until process close (#103617)

2026-07-10 11:02:56 +01:00

app-inventory-cache.test.ts

fix(codex): app inventory error diagnostics stay UTF-16 safe (#102414)

2026-07-09 07:31:18 +01:00

app-inventory-cache.ts

fix(codex): app inventory error diagnostics stay UTF-16 safe (#102414)

2026-07-09 07:31:18 +01:00

app-server-policy.test.ts

fix(codex): avoid guardian review for local models (#88630)

2026-06-09 21:38:22 -07:00

app-server-policy.ts

fix(codex): migrate retired approval policy

2026-07-08 23:07:20 -07:00

approval-bridge.test.ts

fix(codex): require human approval for app-server commands (#103457)

2026-07-10 08:07:18 +01:00

approval-bridge.ts

fix(codex): require human approval for app-server commands (#103457)

2026-07-10 08:07:18 +01:00

attempt-client-cleanup.test.ts

fix(codex): scope client fan-out to terminal liveness kills

2026-07-09 14:26:05 +05:30

attempt-client-cleanup.ts

fix(codex): scope client fan-out to terminal liveness kills

2026-07-09 14:26:05 +05:30

attempt-context.test.ts

feat(memory-wiki): isolate vaults per agent (#103349)

2026-07-10 05:19:13 +01:00

attempt-context.ts

feat(memory-wiki): isolate vaults per agent (#103349)

2026-07-10 05:19:13 +01:00

attempt-diagnostics.test.ts

Let owner-operated Codex agents use connected account apps (#100973)

2026-07-06 12:31:45 -07:00

attempt-diagnostics.ts

Let owner-operated Codex agents use connected account apps (#100973)

2026-07-06 12:31:45 -07:00

attempt-notification-state.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

attempt-notifications.test.ts

fix(codex): use truncateUtf16Safe for attempt notification text truncation (#101534)

2026-07-07 12:00:35 +01:00

attempt-notifications.ts

fix(codex): use truncateUtf16Safe for attempt notification text truncation (#101534)

2026-07-07 12:00:35 +01:00

attempt-results.test.ts

fix(codex): scope client fan-out to terminal liveness kills

2026-07-09 14:26:05 +05:30

attempt-results.ts

fix(codex): scope client fan-out to terminal liveness kills

2026-07-09 14:26:05 +05:30

attempt-startup.test.ts

chore(codex): bump app-server to 0.143.0

2026-07-08 23:07:20 -07:00

attempt-startup.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

attempt-steering.test.ts

docs: document large extension sources

2026-06-04 21:40:44 -04:00

attempt-steering.ts

docs: document codex attempt lifecycle helpers

2026-06-04 08:21:04 -04:00

attempt-timeouts.test.ts

fix(codex): derive terminal-idle watchdog from explicit run timeout (#85296)

2026-07-01 03:25:13 -07:00

attempt-timeouts.ts

fix(codex): derive terminal-idle watchdog from explicit run timeout (#85296)

2026-07-01 03:25:13 -07:00

attempt-turn-watches.test.ts

fix(codex): keep terminal idle backstop gated during in-flight app-server requests

2026-07-09 14:26:05 +05:30

attempt-turn-watches.ts

fix(codex): keep terminal idle backstop gated during in-flight app-server requests

2026-07-09 14:26:05 +05:30

auth-bridge.test.ts

feat(codex): share native threads across Codex clients (#99821)

2026-07-04 01:43:21 -07:00

auth-bridge.ts

feat(codex): share native threads across Codex clients (#99821)

2026-07-04 01:43:21 -07:00

auth-profile-runtime-contract.test.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

bounded-turn.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

capabilities.ts

feat(codex): share native threads across Codex clients (#99821)

2026-07-04 01:43:21 -07:00

client-runtime.test.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

client-runtime.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

client.test.ts

fix(codex): use truncateUtf16Safe in trajectory and client parse log truncation (#102576)

2026-07-09 10:53:25 +01:00

client.ts

fix(codex): use truncateUtf16Safe in trajectory and client parse log truncation (#102576)

2026-07-09 10:53:25 +01:00

compact.test.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

compact.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

computer-use.test.ts

fix(codex): prefer ChatGPT desktop resources (#103470)

2026-07-10 07:44:24 +01:00

computer-use.ts

fix(codex): prefer ChatGPT desktop resources (#103470)

2026-07-10 07:44:24 +01:00

config.test.ts

fix: harden exec auto-review approvals (#103430)

2026-07-10 06:44:03 +01:00

config.ts

fix: harden exec auto-review approvals (#103430)

2026-07-10 06:44:03 +01:00

context-engine-projection.test.ts

fix(text): keep context tails UTF-16 safe (#102599)

2026-07-09 12:37:07 +01:00

context-engine-projection.ts

fix(text): keep context tails UTF-16 safe (#102599)

2026-07-09 12:37:07 +01:00

delivery-no-reply-runtime-contract.test.ts

docs: document large extension sources

2026-06-04 21:40:44 -04:00

dynamic-tool-build.test.ts

fix(computer): prevent stale, replayed, and post-cancel desktop actions (#103422)

2026-07-10 06:47:56 +01:00

dynamic-tool-build.ts

fix(computer): prevent stale, replayed, and post-cancel desktop actions (#103422)

2026-07-10 06:47:56 +01:00

dynamic-tool-diagnostics.ts

feat: correlate native search outcomes in audit history (#98704)

2026-07-06 12:30:12 +01:00

dynamic-tool-execution.test.ts

fix(computer): prevent stale, replayed, and post-cancel desktop actions (#103422)

2026-07-10 06:47:56 +01:00

dynamic-tool-execution.ts

fix(computer): prevent stale, replayed, and post-cancel desktop actions (#103422)

2026-07-10 06:47:56 +01:00

dynamic-tool-profile.ts

feat(codex): support remote app-server plugins (#94203)

2026-06-17 13:52:34 -07:00

dynamic-tools.test.ts

fix(computer): prevent stale, replayed, and post-cancel desktop actions (#103422)

2026-07-10 06:47:56 +01:00

dynamic-tools.ts

fix(computer): prevent stale, replayed, and post-cancel desktop actions (#103422)

2026-07-10 06:47:56 +01:00

elicitation-bridge.test.ts

fix(codex): use UTF-16-safe truncation for approval display paths (#100177)

2026-07-07 11:46:50 +01:00

elicitation-bridge.ts

fix(codex): use UTF-16-safe truncation for approval display paths (#100177)

2026-07-07 11:46:50 +01:00

event-projector.test.ts

fix(webui): keep tool activity paired without model calls (#103821)

2026-07-10 18:21:08 +01:00

event-projector.ts

fix(webui): keep tool activity paired without model calls (#103821)

2026-07-10 18:21:08 +01:00

image-payload-sanitizer.test.ts

docs: document large extension sources

2026-06-04 21:40:44 -04:00

image-payload-sanitizer.ts

docs: document codex app-server helpers

2026-06-04 08:32:30 -04:00

local-runtime-attribution.ts

docs: document codex app-server helpers

2026-06-04 08:32:30 -04:00

managed-binary.test.ts

fix(codex): prefer ChatGPT desktop resources (#103470)

2026-07-10 07:44:24 +01:00

managed-binary.ts

fix(codex): prefer ChatGPT desktop resources (#103470)

2026-07-10 07:44:24 +01:00

models.test.ts

chore(codex): bump app-server to 0.143.0

2026-07-08 23:07:20 -07:00

models.ts

docs: document codex app-server helpers

2026-06-04 08:32:30 -04:00

native-execution-policy.test.ts

fix: honor bound agent exec host policy

2026-06-18 14:00:57 +10:00

native-execution-policy.ts

fix: honor bound agent exec host policy

2026-06-18 14:00:57 +10:00

native-hook-relay.test.ts

fix(codex): extend native hook relay timeout

2026-07-06 08:59:04 -07:00

native-hook-relay.ts

fix(codex): extend native hook relay timeout

2026-07-06 08:59:04 -07:00

native-subagent-monitor.test.ts

feat: support GPT-5.6 Ultra across OpenClaw and Codex runtimes (#98021)

2026-07-10 15:23:24 +01:00

native-subagent-monitor.ts

feat: support GPT-5.6 Ultra across OpenClaw and Codex runtimes (#98021)

2026-07-10 15:23:24 +01:00

native-subagent-notification.test.ts

fix(codex): preserve native subagent completion results (#91235)

2026-06-08 02:22:05 +00:00

native-subagent-notification.ts

fix(codex): preserve native subagent completion results (#91235)

2026-06-08 02:22:05 +00:00

native-subagent-task-ids.ts

docs: document codex native subagent helpers

2026-06-04 08:33:42 -04:00

native-subagent-task-mirror.test.ts

feat: support GPT-5.6 Ultra across OpenClaw and Codex runtimes (#98021)

2026-07-10 15:23:24 +01:00

native-subagent-task-mirror.ts

feat: support GPT-5.6 Ultra across OpenClaw and Codex runtimes (#98021)

2026-07-10 15:23:24 +01:00

notification-correlation.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

openclaw-owned-tool-runtime-contract.test.ts

fix(codex): respect lifecycle mismatch rotations

2026-06-17 10:30:45 +02:00

outcome-fallback-runtime-contract.test.ts

fix(agents): replace prose terminal classifiers (#93228)

2026-06-15 02:53:14 -07:00

plugin-activation.test.ts

fix(codex): keep plugin apps available when inventory is missing (#98042)

2026-06-30 00:44:28 -07:00

plugin-activation.ts

fix(codex): keep plugin apps available when inventory is missing (#98042)

2026-06-30 00:44:28 -07:00

plugin-app-cache-key.test.ts

feat(codex): support remote app-server plugins (#94203)

2026-06-17 13:52:34 -07:00

plugin-app-cache-key.ts

fix(codex): preserve per-app approval reviewer policy (#97327)

2026-06-29 02:35:13 -07:00

plugin-approval-roundtrip.ts

fix(codex): use UTF-16-safe truncation for approval display paths (#100177)

2026-07-07 11:46:50 +01:00

plugin-inventory.test.ts

fix(codex): keep plugin apps available when inventory is missing (#98042)

2026-06-30 00:44:28 -07:00

plugin-inventory.ts

fix(codex): keep plugin apps available when inventory is missing (#98042)

2026-06-30 00:44:28 -07:00

plugin-thread-config.test.ts

Let owner-operated Codex agents use connected account apps (#100973)

2026-07-06 12:31:45 -07:00

plugin-thread-config.ts

Let owner-operated Codex agents use connected account apps (#100973)

2026-07-06 12:31:45 -07:00

profiler-flag.test.ts

docs: document large extension sources

2026-06-04 21:40:44 -04:00

profiler-flag.ts

docs: document codex app-server utilities

2026-06-04 08:35:15 -04:00

protocol-validators.test.ts

chore(codex): bump app-server to 0.143.0

2026-07-08 23:07:20 -07:00

protocol-validators.ts

refactor(codex): raise app-server floor to 0.142, drop range compat, fix deferred spawn_agent steering (#101221)

2026-07-07 05:48:53 +01:00

protocol.ts

fix(computer): prevent stale, replayed, and post-cancel desktop actions (#103422)

2026-07-10 06:47:56 +01:00

provider-capabilities.test.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

provider-capabilities.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

rate-limit-cache.test.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

rate-limit-cache.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

rate-limits.test.ts

fix(status): restore Codex synthetic usage line

2026-06-10 01:32:33 +09:00

rate-limits.ts

fix(status): restore Codex synthetic usage line

2026-06-10 01:32:33 +09:00

request.test.ts

feat(codex): share native threads across Codex clients (#99821)

2026-07-04 01:43:21 -07:00

request.ts

docs: document codex app-server utilities

2026-06-04 08:35:15 -04:00

run-attempt-test-harness.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

run-attempt-thread-cleanup.test.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

run-attempt.context-engine.test.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

run-attempt.dynamic-tools.test.ts

feat: correlate native search outcomes in audit history (#98704)

2026-07-06 12:30:12 +01:00

run-attempt.hooks.test.ts

refactor(codex): store app-server thread bindings in SQLite plugin state (#101210)

2026-07-07 03:03:44 +01:00

run-attempt.native-hook-relay.test.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

run-attempt.steering.test.ts

fix(telegram): restore active-run steering

2026-07-01 10:34:20 -07:00

run-attempt.test.ts

fix(computer): prevent stale, replayed, and post-cancel desktop actions (#103422)

2026-07-10 06:47:56 +01:00

run-attempt.ts

feat: support GPT-5.6 Ultra across OpenClaw and Codex runtimes (#98021)

2026-07-10 15:23:24 +01:00

run-attempt.turn-watches.test.ts

fix(codex): scope client fan-out to terminal liveness kills

2026-07-09 14:26:05 +05:30

run-attempt.usage-limits.test.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

run-attempt.vision-tools.test.ts

docs: document large extension sources

2026-06-04 21:40:44 -04:00

sandbox-exec-server.fs.test.ts

docs: document large extension sources

2026-06-04 21:40:44 -04:00

sandbox-exec-server.http.test.ts

fix(codex): guard sandbox http requests (#91752)

2026-06-09 13:54:24 -07:00

sandbox-exec-server.json-rpc.test.ts

docs: document large extension sources

2026-06-04 21:40:44 -04:00

sandbox-exec-server.lifecycle.test.ts

fix(codex): defer sandbox cleanup until process close (#103617)

2026-07-10 11:02:56 +01:00

sandbox-exec-server.test-helpers.ts

refactor(test-ui): remove dead utility code

2026-06-18 15:53:52 +08:00

sandbox-exec-server.test.ts

refactor(codex): raise app-server floor to 0.142, drop range compat, fix deferred spawn_agent steering (#101221)

2026-07-07 05:48:53 +01:00

sandbox-exec-server.ts

refactor(codex): raise app-server floor to 0.142, drop range compat, fix deferred spawn_agent steering (#101221)

2026-07-07 05:48:53 +01:00

sandbox-guard.ts

feat(codex): share native threads across Codex clients (#99821)

2026-07-04 01:43:21 -07:00

schema-normalization-runtime-contract.test.ts

refactor(codex): raise app-server floor to 0.142, drop range compat, fix deferred spawn_agent steering (#101221)

2026-07-07 05:48:53 +01:00

session-binding-meta.ts

refactor(codex): store app-server thread bindings in SQLite plugin state (#101210)

2026-07-07 03:03:44 +01:00

session-binding-store.ts

refactor(codex): store app-server thread bindings in SQLite plugin state (#101210)

2026-07-07 03:03:44 +01:00

session-binding.test-helpers.ts

refactor(codex): store app-server thread bindings in SQLite plugin state (#101210)

2026-07-07 03:03:44 +01:00

session-binding.test.ts

fix(codex): migrate retired approval policy

2026-07-08 23:07:20 -07:00

session-binding.ts

fix(codex): prevent startup hangs after binding migration (#103281)

2026-07-10 10:38:35 +01:00

session-history.test.ts

fix(codex): ignore missing mirrored session history (#100484)

2026-07-05 16:04:34 -07:00

session-history.ts

fix(codex): ignore missing mirrored session history (#100484)

2026-07-05 16:04:34 -07:00

shared-client.test.ts

test(codex): align shared-client version fixtures with the 0.143.0 floor

2026-07-09 14:26:05 +05:30

shared-client.ts

fix(codex): fail detached-but-leased clients on suspect retirement

2026-07-09 14:26:05 +05:30

side-question.test.ts

fix(computer): prevent stale, replayed, and post-cancel desktop actions (#103422)

2026-07-10 06:47:56 +01:00

side-question.ts

fix(codex): require human approval for app-server commands (#103457)

2026-07-10 08:07:18 +01:00

startup-binding.test.ts

refactor(codex): store app-server thread bindings in SQLite plugin state (#101210)

2026-07-07 03:03:44 +01:00

startup-binding.ts

refactor(codex): store app-server thread bindings in SQLite plugin state (#101210)

2026-07-07 03:03:44 +01:00

test-support.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

thread-lifecycle.binding.test.ts

feat: support GPT-5.6 Ultra across OpenClaw and Codex runtimes (#98021)

2026-07-10 15:23:24 +01:00

thread-lifecycle.test.ts

feat: support GPT-5.6 Ultra across OpenClaw and Codex runtimes (#98021)

2026-07-10 15:23:24 +01:00

thread-lifecycle.ts

Refresh MCP OAuth auth-profile tokens (#96120)

2026-07-10 17:49:43 -07:00

thread-lifecycle.user-mcp-servers.test.ts

Refresh MCP OAuth auth-profile tokens (#96120)

2026-07-10 17:49:43 -07:00

thread-resume.test.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

thread-resume.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

timeout.ts

docs: document codex app-server small utilities

2026-06-04 08:42:50 -04:00

tool-abort-terminal-reason.ts

feat: correlate native search outcomes in audit history (#98704)

2026-07-06 12:30:12 +01:00

tool-progress-normalization.ts

docs: document codex trajectory progress helpers

2026-06-04 08:48:00 -04:00

trajectory.test.ts

fix(codex): use truncateUtf16Safe in trajectory and client parse log truncation (#102576)

2026-07-09 10:53:25 +01:00

trajectory.ts

fix(codex): use truncateUtf16Safe in trajectory and client parse log truncation (#102576)

2026-07-09 10:53:25 +01:00

transcript-mirror.test.ts

fix(ios): restore in-flight runs after reconnect (#100277)

2026-07-06 03:23:38 +01:00

transcript-mirror.ts

fix(ios): restore in-flight runs after reconnect (#100277)

2026-07-06 03:23:38 +01:00

transcript-repair-runtime-contract.test.ts

docs: document large extension sources

2026-06-04 21:40:44 -04:00

transport-stdio.test.ts

feat(qa-lab): add Codex Slack approval scenarios (#91519)

2026-07-05 22:47:18 +01:00

transport-stdio.ts

feat(qa-lab): add Codex Slack approval scenarios (#91519)

2026-07-05 22:47:18 +01:00

transport-websocket.test.ts

chore(codex): bump app-server to 0.143.0

2026-07-08 23:07:20 -07:00

transport-websocket.ts

docs: document codex app-server runtime utilities

2026-06-04 08:45:03 -04:00

transport.ts

docs: document codex app-server runtime utilities

2026-06-04 08:45:03 -04:00

turn-router.test.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

turn-router.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

usage-limit-error.ts

refactor(codex): keyed turn routing, client-scoped rate limits, and resume subscription safety (#101376)

2026-07-07 07:25:15 +01:00

user-input-bridge.test.ts

docs: document large extension sources

2026-06-04 21:40:44 -04:00

user-input-bridge.ts

feat(copilot): wire harness parity helpers

2026-06-23 15:48:27 +08:00

version.ts

chore(codex): update managed app-server to 0.144.1 (#103156)

2026-07-09 16:52:33 -07:00

vision-tools.ts

docs: document codex app-server small utilities

2026-06-04 08:42:50 -04:00

web-search.test.ts

feat: add Codex hosted web search (#93446)

2026-06-16 00:38:16 -06:00

web-search.ts

feat: add Codex hosted web search (#93446)

2026-06-16 00:38:16 -06:00