Serialize MCP OAuth credential refreshes - #32229
Merged
copyberry[bot] merged 1 commit intoJul 10, 2026
Merged
Conversation
## Why Concurrent Codex processes can otherwise refresh the same rotating token, and a cancelled or partially persisted refresh can leave durable and in-memory MCP credentials out of sync. ## What changed - Serialize each credential's read-refresh-write transaction across processes, reread the authoritative store after locking, and adopt credentials refreshed by another process. - Keep refresh persistence running after caller cancellation, bound lock and provider waits independently, and preserve omitted refresh tokens and scopes. - Fail MCP startup and operations when refresh or persistence fails instead of continuing with stale credentials, while requiring reauthorization for missing, unusable, or rejected refresh tokens. - Exclude OAuth refresh time from the MCP initialization timeout. ## Testing Add coverage for lock contention, concurrent refreshes, rejected and missing credentials, storage failures, caller cancellation, and provider timeouts. GitOrigin-RevId: 4d29b879bec646d2ceb922b526dc793b1a1f5423
copyberry
Bot
force-pushed
the
copyberry/codex-internal-to-codex-oss/4d29b879bec646d2ceb922b526dc793b1a1f5423
branch
from
July 10, 2026 18:00
61930b8 to
6962a2e
Compare
copyberry
Bot
deleted the
copyberry/codex-internal-to-codex-oss/4d29b879bec646d2ceb922b526dc793b1a1f5423
branch
July 10, 2026 18:02
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Serialize MCP OAuth credential refreshes
Why
Concurrent Codex processes can otherwise refresh the same rotating token, and a
cancelled or partially persisted refresh can leave durable and in-memory MCP
credentials out of sync.
What changed
reread the authoritative store after locking, and adopt credentials refreshed
by another process.
provider waits independently, and preserve omitted refresh tokens and scopes.
continuing with stale credentials, while requiring reauthorization for
missing, unusable, or rejected refresh tokens.
Testing
Add coverage for lock contention, concurrent refreshes, rejected and missing
credentials, storage failures, caller cancellation, and provider timeouts.