{"url":"https://api.github.com/repos/openai/codex/pulls/39615","id":4320260392,"node_id":"PR_kwDOOYsS4c8AAAABAYHxKA","html_url":"https://github.com/openai/codex/pull/39615","diff_url":"https://github.com/openai/codex/pull/39615.diff","patch_url":"https://github.com/openai/codex/pull/39615.patch","issue_url":"https://api.github.com/repos/openai/codex/issues/39615","commits_url":"https://api.github.com/repos/openai/codex/pulls/39615/commits","review_comments_url":"https://api.github.com/repos/openai/codex/pulls/39615/comments","review_comment_url":"https://api.github.com/repos/openai/codex/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openai/codex/issues/39615/comments","statuses_url":"https://api.github.com/repos/openai/codex/statuses/250b5ea2bff83edb151b29ca93248856c970126c","number":39615,"state":"closed","locked":true,"title":"Bind MCP OAuth refresh tokens to their issuer","user":{"login":"copyberry[bot]","id":240088373,"node_id":"BOT_kgDODk91NQ","avatar_url":"https://avatars.githubusercontent.com/in/2173631?v=4","gravatar_id":"","url":"https://api.github.com/users/copyberry%5Bbot%5D","html_url":"https://github.com/apps/copyberry","followers_url":"https://api.github.com/users/copyberry%5Bbot%5D/followers","following_url":"https://api.github.com/users/copyberry%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/copyberry%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/copyberry%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/copyberry%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/copyberry%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/copyberry%5Bbot%5D/repos","events_url":"https://api.github.com/users/copyberry%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/copyberry%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"body":"Bind MCP OAuth refresh tokens to their issuer\n\n## Why\n\nAn authorization server discovered for an MCP server can change. A stored refresh token must not be sent to a different issuer than the one that originally granted it.\n\n## What changed\n\n- Persist the discovered authorization server issuer with new OAuth credentials and preserve it across refreshes.\n- Validate that issuer against a single pinned metadata snapshot before refreshing or adopting stored refresh credentials.\n- Require reauthentication when refresh credentials have no issuer or the issuer changed. An unexpired access token can still be used without exposing its refresh token.\n\n## Testing\n\nAdd coverage for issuer persistence, missing and changed issuers, metadata changes during startup, and refresh-token preservation.\n\n<!-- copyberry-projection-id: a1aa312585901c231caff95c4025013a98053022683786386d2702d0ce38c3eb -->","labels":[],"milestone":null,"active_lock_reason":null,"created_at":"2026-08-20T06:25:20Z","updated_at":"2026-08-20T06:27:48Z","closed_at":"2026-08-20T06:27:36Z","merged_at":"2026-08-20T06:27:36Z","merge_commit_sha":"250b5ea2bff83edb151b29ca93248856c970126c","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"head":{"label":"openai:copyberry/codex-internal-to-codex-oss/07e48ba892f627428a28bbed5cca4ad703e2a5fd","ref":"copyberry/codex-internal-to-codex-oss/07e48ba892f627428a28bbed5cca4ad703e2a5fd","repo":{"id":965415649,"node_id":"R_kgDOOYsS4Q","name":"codex","full_name":"openai/codex","owner":{"login":"openai","id":14957082,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE0OTU3MDgy","avatar_url":"https://avatars.githubusercontent.com/u/14957082?v=4","gravatar_id":"","url":"https://api.github.com/users/openai","html_url":"https://github.com/openai","followers_url":"https://api.github.com/users/openai/followers","following_url":"https://api.github.com/users/openai/following{/other_user}","gists_url":"https://api.github.com/users/openai/gists{/gist_id}","starred_url":"https://api.github.com/users/openai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openai/subscriptions","organizations_url":"https://api.github.com/users/openai/orgs","repos_url":"https://api.github.com/users/openai/repos","events_url":"https://api.github.com/users/openai/events{/privacy}","received_events_url":"https://api.github.com/users/openai/received_events","type":"Organization","user_view_type":"public","site_admin":false},"private":false,"fork":false,"archived":false,"disabled":false,"description":"Lightweight coding agent that runs in your terminal","homepage":"","language":"Rust","visibility":"public","is_template":false,"topics":[],"forks_count":20097,"forks":20097,"stargazers_count":128278,"watchers_count":128278,"watchers":128278,"open_issues_count":21316,"open_issues":21316,"size":671190,"default_branch":"main","has_issues":true,"has_projects":false,"has_wiki":false,"has_pages":false,"has_downloads":false,"has_discussions":true,"has_pull_requests":true,"pushed_at":"2026-10-08T06:32:11Z","created_at":"2025-04-13T05:37:54Z","updated_at":"2026-10-08T06:40:15Z","allow_forking":true,"web_commit_signoff_required":false,"pull_request_creation_policy":"collaborators_only","license":{"key":"apache-2.0","name":"Apache License 2.0","url":"https://api.github.com/licenses/apache-2.0","spdx_id":"Apache-2.0","node_id":"MDc6TGljZW5zZTI="},"url":"https://api.github.com/repos/openai/codex","html_url":"https://github.com/openai/codex","archive_url":"https://api.github.com/repos/openai/codex/{archive_format}{/ref}","assignees_url":"https://api.github.com/repos/openai/codex/assignees{/user}","blobs_url":"https://api.github.com/repos/openai/codex/git/blobs{/sha}","branches_url":"https://api.github.com/repos/openai/codex/branches{/branch}","collaborators_url":"https://api.github.com/repos/openai/codex/collaborators{/collaborator}","comments_url":"https://api.github.com/repos/openai/codex/comments{/number}","commits_url":"https://api.github.com/repos/openai/codex/commits{/sha}","compare_url":"https://api.github.com/repos/openai/codex/compare/{base}...{head}","contents_url":"https://api.github.com/repos/openai/codex/contents/{+path}","contributors_url":"https://api.github.com/repos/openai/codex/contributors","deployments_url":"https://api.github.com/repos/openai/codex/deployments","downloads_url":"https://api.github.com/repos/openai/codex/downloads","events_url":"https://api.github.com/repos/openai/codex/events","forks_url":"https://api.github.com/repos/openai/codex/forks","git_commits_url":"https://api.github.com/repos/openai/codex/git/commits{/sha}","git_refs_url":"https://api.github.com/repos/openai/codex/git/refs{/sha}","git_tags_url":"https://api.github.com/repos/openai/codex/git/tags{/sha}","git_url":"git://github.com/openai/codex.git","issue_comment_url":"https://api.github.com/repos/openai/codex/issues/comments{/number}","issue_events_url":"https://api.github.com/repos/openai/codex/issues/events{/number}","issues_url":"https://api.github.com/repos/openai/codex/issues{/number}","keys_url":"https://api.github.com/repos/openai/codex/keys{/key_id}","labels_url":"https://api.github.com/repos/openai/codex/labels{/name}","languages_url":"https://api.github.com/repos/openai/codex/languages","merges_url":"https://api.github.com/repos/openai/codex/merges","milestones_url":"https://api.github.com/repos/openai/codex/milestones{/number}","notifications_url":"https://api.github.com/repos/openai/codex/notifications{?since,all,participating}","pulls_url":"https://api.github.com/repos/openai/codex/pulls{/number}","releases_url":"https://api.github.com/repos/openai/codex/releases{/id}","ssh_url":"org-14957082@github.com:openai/codex.git","stargazers_url":"https://api.github.com/repos/openai/codex/stargazers","statuses_url":"https://api.github.com/repos/openai/codex/statuses/{sha}","subscribers_url":"https://api.github.com/repos/openai/codex/subscribers","subscription_url":"https://api.github.com/repos/openai/codex/subscription","tags_url":"https://api.github.com/repos/openai/codex/tags","teams_url":"https://api.github.com/repos/openai/codex/teams","trees_url":"https://api.github.com/repos/openai/codex/git/trees{/sha}","clone_url":"https://github.com/openai/codex.git","mirror_url":null,"hooks_url":"https://api.github.com/repos/openai/codex/hooks","svn_url":"https://github.com/openai/codex"},"sha":"250b5ea2bff83edb151b29ca93248856c970126c","user":{"login":"openai","id":14957082,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE0OTU3MDgy","avatar_url":"https://avatars.githubusercontent.com/u/14957082?v=4","gravatar_id":"","url":"https://api.github.com/users/openai","html_url":"https://github.com/openai","followers_url":"https://api.github.com/users/openai/followers","following_url":"https://api.github.com/users/openai/following{/other_user}","gists_url":"https://api.github.com/users/openai/gists{/gist_id}","starred_url":"https://api.github.com/users/openai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openai/subscriptions","organizations_url":"https://api.github.com/users/openai/orgs","repos_url":"https://api.github.com/users/openai/repos","events_url":"https://api.github.com/users/openai/events{/privacy}","received_events_url":"https://api.github.com/users/openai/received_events","type":"Organization","user_view_type":"public","site_admin":false}},"base":{"label":"openai:main","ref":"main","repo":{"id":965415649,"node_id":"R_kgDOOYsS4Q","name":"codex","full_name":"openai/codex","owner":{"login":"openai","id":14957082,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE0OTU3MDgy","avatar_url":"https://avatars.githubusercontent.com/u/14957082?v=4","gravatar_id":"","url":"https://api.github.com/users/openai","html_url":"https://github.com/openai","followers_url":"https://api.github.com/users/openai/followers","following_url":"https://api.github.com/users/openai/following{/other_user}","gists_url":"https://api.github.com/users/openai/gists{/gist_id}","starred_url":"https://api.github.com/users/openai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openai/subscriptions","organizations_url":"https://api.github.com/users/openai/orgs","repos_url":"https://api.github.com/users/openai/repos","events_url":"https://api.github.com/users/openai/events{/privacy}","received_events_url":"https://api.github.com/users/openai/received_events","type":"Organization","user_view_type":"public","site_admin":false},"private":false,"fork":false,"archived":false,"disabled":false,"description":"Lightweight coding agent that runs in your terminal","homepage":"","language":"Rust","visibility":"public","is_template":false,"topics":[],"forks_count":20097,"forks":20097,"stargazers_count":128278,"watchers_count":128278,"watchers":128278,"open_issues_count":21316,"open_issues":21316,"size":671190,"default_branch":"main","has_issues":true,"has_projects":false,"has_wiki":false,"has_pages":false,"has_downloads":false,"has_discussions":true,"has_pull_requests":true,"pushed_at":"2026-10-08T06:32:11Z","created_at":"2025-04-13T05:37:54Z","updated_at":"2026-10-08T06:40:15Z","allow_forking":true,"web_commit_signoff_required":false,"pull_request_creation_policy":"collaborators_only","license":{"key":"apache-2.0","name":"Apache License 2.0","url":"https://api.github.com/licenses/apache-2.0","spdx_id":"Apache-2.0","node_id":"MDc6TGljZW5zZTI="},"url":"https://api.github.com/repos/openai/codex","html_url":"https://github.com/openai/codex","archive_url":"https://api.github.com/repos/openai/codex/{archive_format}{/ref}","assignees_url":"https://api.github.com/repos/openai/codex/assignees{/user}","blobs_url":"https://api.github.com/repos/openai/codex/git/blobs{/sha}","branches_url":"https://api.github.com/repos/openai/codex/branches{/branch}","collaborators_url":"https://api.github.com/repos/openai/codex/collaborators{/collaborator}","comments_url":"https://api.github.com/repos/openai/codex/comments{/number}","commits_url":"https://api.github.com/repos/openai/codex/commits{/sha}","compare_url":"https://api.github.com/repos/openai/codex/compare/{base}...{head}","contents_url":"https://api.github.com/repos/openai/codex/contents/{+path}","contributors_url":"https://api.github.com/repos/openai/codex/contributors","deployments_url":"https://api.github.com/repos/openai/codex/deployments","downloads_url":"https://api.github.com/repos/openai/codex/downloads","events_url":"https://api.github.com/repos/openai/codex/events","forks_url":"https://api.github.com/repos/openai/codex/forks","git_commits_url":"https://api.github.com/repos/openai/codex/git/commits{/sha}","git_refs_url":"https://api.github.com/repos/openai/codex/git/refs{/sha}","git_tags_url":"https://api.github.com/repos/openai/codex/git/tags{/sha}","git_url":"git://github.com/openai/codex.git","issue_comment_url":"https://api.github.com/repos/openai/codex/issues/comments{/number}","issue_events_url":"https://api.github.com/repos/openai/codex/issues/events{/number}","issues_url":"https://api.github.com/repos/openai/codex/issues{/number}","keys_url":"https://api.github.com/repos/openai/codex/keys{/key_id}","labels_url":"https://api.github.com/repos/openai/codex/labels{/name}","languages_url":"https://api.github.com/repos/openai/codex/languages","merges_url":"https://api.github.com/repos/openai/codex/merges","milestones_url":"https://api.github.com/repos/openai/codex/milestones{/number}","notifications_url":"https://api.github.com/repos/openai/codex/notifications{?since,all,participating}","pulls_url":"https://api.github.com/repos/openai/codex/pulls{/number}","releases_url":"https://api.github.com/repos/openai/codex/releases{/id}","ssh_url":"org-14957082@github.com:openai/codex.git","stargazers_url":"https://api.github.com/repos/openai/codex/stargazers","statuses_url":"https://api.github.com/repos/openai/codex/statuses/{sha}","subscribers_url":"https://api.github.com/repos/openai/codex/subscribers","subscription_url":"https://api.github.com/repos/openai/codex/subscription","tags_url":"https://api.github.com/repos/openai/codex/tags","teams_url":"https://api.github.com/repos/openai/codex/teams","trees_url":"https://api.github.com/repos/openai/codex/git/trees{/sha}","clone_url":"https://github.com/openai/codex.git","mirror_url":null,"hooks_url":"https://api.github.com/repos/openai/codex/hooks","svn_url":"https://github.com/openai/codex"},"sha":"530c1aed58b88060cfe851005c9dae3a89f44ad0","user":{"login":"openai","id":14957082,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE0OTU3MDgy","avatar_url":"https://avatars.githubusercontent.com/u/14957082?v=4","gravatar_id":"","url":"https://api.github.com/users/openai","html_url":"https://github.com/openai","followers_url":"https://api.github.com/users/openai/followers","following_url":"https://api.github.com/users/openai/following{/other_user}","gists_url":"https://api.github.com/users/openai/gists{/gist_id}","starred_url":"https://api.github.com/users/openai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openai/subscriptions","organizations_url":"https://api.github.com/users/openai/orgs","repos_url":"https://api.github.com/users/openai/repos","events_url":"https://api.github.com/users/openai/events{/privacy}","received_events_url":"https://api.github.com/users/openai/received_events","type":"Organization","user_view_type":"public","site_admin":false}},"_links":{"comments":{"href":"https://api.github.com/repos/openai/codex/issues/39615/comments"},"commits":{"href":"https://api.github.com/repos/openai/codex/pulls/39615/commits"},"statuses":{"href":"https://api.github.com/repos/openai/codex/statuses/250b5ea2bff83edb151b29ca93248856c970126c"},"html":{"href":"https://github.com/openai/codex/pull/39615"},"issue":{"href":"https://api.github.com/repos/openai/codex/issues/39615"},"review_comments":{"href":"https://api.github.com/repos/openai/codex/pulls/39615/comments"},"review_comment":{"href":"https://api.github.com/repos/openai/codex/pulls/comments{/number}"},"self":{"href":"https://api.github.com/repos/openai/codex/pulls/39615"}},"author_association":"NONE","auto_merge":null,"draft":false,"merged":true,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":{"login":"copyberry[bot]","id":240088373,"node_id":"BOT_kgDODk91NQ","avatar_url":"https://avatars.githubusercontent.com/in/2173631?v=4","gravatar_id":"","url":"https://api.github.com/users/copyberry%5Bbot%5D","html_url":"https://github.com/apps/copyberry","followers_url":"https://api.github.com/users/copyberry%5Bbot%5D/followers","following_url":"https://api.github.com/users/copyberry%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/copyberry%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/copyberry%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/copyberry%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/copyberry%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/copyberry%5Bbot%5D/repos","events_url":"https://api.github.com/users/copyberry%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/copyberry%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"comments":0,"review_comments":0,"maintainer_can_modify":false,"commits":1,"additions":722,"deletions":110,"changed_files":16}