jif b215961a56 Support OAuth for HTTP MCP servers from selected executor plugins (#28529) ...

## Why

#28522 routes selected-plugin HTTP MCP traffic through the owning
executor, but OAuth bootstrap and refresh still used host-local clients.
Executor-only servers therefore cannot complete discovery or login
through the same network boundary as the MCP connection.

## What changed

- adapt `codex_exec_server::HttpClient` to RMCP 1.8's `OAuthHttpClient`
contract
- let RMCP own discovery, dynamic registration, PKCE, token exchange,
and refresh
- route auth status, persisted-token startup, and app-server login
through the server runtime while preserving the existing local discovery
path
- add optional `threadId` to `mcpServer/oauth/login` and echo it in the
completion notification
- implement RMCP's redirect policy and 1 MiB OAuth response limit over
executor HTTP
- cover selected-thread OAuth discovery and login through an
executor-only route

Depends on #28522.

b215961a56 · 2026-06-25 10:31:17 +01:00

History

..

src

Support OAuth for HTTP MCP servers from selected executor plugins (#28529)

2026-06-25 10:31:17 +01:00

BUILD.bazel

protocol: separate app and exec RPC ownership (#29714)

2026-06-23 22:37:31 +00:00

Cargo.toml

protocol: separate app and exec RPC ownership (#29714)

2026-06-23 22:37:31 +00:00