Celia Chen 9915d34684 feat: use encrypted local secrets for MCP OAuth (#27541) ...

## Summary

- store MCP OAuth credentials in the configured auth credential backend
- support encrypted-local OAuth storage, including legacy keyring
migration
- propagate the credential backend through MCP refresh, session, CLI,
and app-server paths

## Stack

1. #27504 — config and feature flag
2. #27535 — auth-specific secret namespaces
3. #27539 — encrypted CLI auth storage
4. this PR — encrypted MCP OAuth storage

This is a parallel review stack; the original #17931 remains unchanged.

## Tests

- `just test -p codex-rmcp-client` (the transport round-trip test passed
after building the required `codex` binary and retrying)
- `just test -p codex-mcp`
- `just test -p codex-app-server
refresh_config_uses_latest_auth_keyring_backend`
- `just test -p codex-core
refresh_mcp_servers_is_deferred_until_next_turn`
- `just test -p codex-cli mcp`
- `just fix -p codex-rmcp-client -p codex-mcp -p codex-core -p codex-cli
-p codex-app-server -p codex-protocol`
- `just bazel-lock-check`

9915d34684 · 2026-06-12 22:03:51 +00:00

History

..

src

feat: use encrypted local secrets for MCP OAuth (#27541)

2026-06-12 22:03:51 +00:00

tests

[login] revoke existing auth before starting login (#27674)

2026-06-12 12:38:30 -07:00

BUILD.bazel

[codex] Move release platform rules into bazel package (#27321)

2026-06-10 19:45:29 +00:00

build.rs

Add WebRTC media transport to realtime TUI (#17058)

2026-04-08 10:26:55 -07:00

Cargo.toml

[login] revoke existing auth before starting login (#27674)

2026-06-12 12:38:30 -07:00