[codex] Tighten auth flows and unify live canary coverage - #2367

Merged

nickpismenkov merged 95 commits into

codex/auth-oauth-canary-unification

Apr 22, 2026

Commits on Apr 12, 2026

ci: add live canary regression lanes
serrrfirat
committed
8b37eeb
test: tighten live zizmor canary prompt
serrrfirat
committed
d6f5ec5
feat(auth): harden extension auth and unify canary lanes
ilblackdragon
committed
78750c1
merge: integrate upstream live canary lanes
ilblackdragon
committed
d25a4b3
refactor(canary): unify auth live canary framework
ilblackdragon
committed
87b6e50
fix(mcp): share stdio runtime state across user views
ilblackdragon
committed
7b96690
Merge remote-tracking branch 'origin/staging' into codex/auth-oauth-canary-unification
ilblackdragon
committed
442877a
fix(ci): mark root crate unpublished
ilblackdragon
committed
793d021
merge: sync origin/staging
ilblackdragon
committed
19da65c

Commits on Apr 14, 2026

fix(auth): address oauth canary review findings
serrrfirat
committed
d59426e

Commits on Apr 17, 2026

Merge remote-tracking branch 'origin/staging' into codex/auth-oauth-canary-unification
ilblackdragon
committed
bb78a0e
refactor: unify canary runners, restore post-merge user-isolation regressions

ilblackdragon
and
claude
committed
f4015be
Merge origin/codex/auth-oauth-canary-unification
ilblackdragon
committed
65e78d9
fix: resolve unbound variable error in live-canary dispatcher

nickpismenkov
and
claude
committed
0f0aaec
ci: enable live-canary workflow on PRs

nickpismenkov
and
claude
committed
86e8c0b

Commits on Apr 18, 2026

Commits on Apr 19, 2026

fix: deterministic replay
nickpismenkov
committed
fe6ffeb
Merge branch 'staging' into codex/auth-oauth-canary-unification
nickpismenkov
committed
468d8a6
ci: remove mission test from deterministic-replay lane

nickpismenkov
and
claude
committed
7c21b70
ci: remove persona tests from deterministic-replay lane

nickpismenkov
and
claude
committed
162160e
ci: temporarily enable public-smoke on PRs for testing

nickpismenkov
and
claude
committed
459f3bc
ci: use existing ANTHROPIC_API_KEY secret for live canary

nickpismenkov
and
claude
committed
d0a345f
Merge remote-tracking branch 'origin/staging' into codex/auth-oauth-canary-unification
nickpismenkov
committed
0269008

Commits on Apr 20, 2026

fix: codestyle
nickpismenkov
committed
68c6bba
Merge remote-tracking branch 'origin/staging' into codex/auth-oauth-canary-unification
nickpismenkov
committed
2410ad2
style: apply cargo fmt

nickpismenkov
and
claude
committed
56d2e9e
fix(e2e): update assertion to match new mock MCP response format

nickpismenkov
and
claude
committed
d51c317
fix(e2e): accept response content as proof zizmor ran

nickpismenkov
and
claude
committed
b4688da
Merge remote-tracking branch 'origin/staging' into codex/auth-oauth-canary-unification
nickpismenkov
committed
4da8331
fix: update auth_manager path in chat test helper

nickpismenkov
and
claude
committed
d10822c
Merge remote-tracking branch 'origin/staging' into codex/auth-oauth-canary-unification
nickpismenkov
committed
2679640
ci: temporarily enable auth-live-seeded on PRs for testing

nickpismenkov
and
claude
committed
cff7c6a
ci: use repo-level secrets for auth-live-seeded

nickpismenkov
and
claude
committed
016fa73
fix(e2e): print mock LLM port before modifying app state

nickpismenkov
and
claude
committed
dcc670f
fix(e2e): fall back to default scopes when env var is empty

nickpismenkov
and
claude
committed
4430181
feat(e2e): auth-live-seeded uses real OAuth flow instead of DB seeding

nickpismenkov
and
claude
committed
7dbfcac
fix(e2e): complete OAuth flow for all Google extensions, not just Gmail

nickpismenkov
and
claude
committed
387a2c8
feat(e2e): support Notion MCP DCR credentials in auth-live-seeded

nickpismenkov
and
claude
committed
c8bbd79
Merge branch 'staging' into codex/auth-oauth-canary-unification
nickpismenkov
committed
dcc817d
fix(e2e): preflight-refresh Google access token before auth-live-seeded

nickpismenkov
and
claude
committed
53ad644
fix(e2e): case-insensitive expected_text matching in auth-live-seeded

nickpismenkov
and
claude
committed
dffb7bd
fix(e2e): add Gmail canned response + move non-sensitive vars from secrets

nickpismenkov
and
claude
committed
c83856f
ci: remove short-value secrets that corrupt CI logs

nickpismenkov
and
claude
committed
8ae8cf3
ci: add Notion DCR client secrets to auth-live-seeded workflow

nickpismenkov
and
claude
committed
c684d78
fix(e2e): add Notion preflight token refresh with proper User-Agent

nickpismenkov
and
claude
committed
f6178ce
fix(e2e): use tool name as expected_text instead of canned response strings

nickpismenkov
and
claude
committed
3b7c38e
ci: temporarily enable all canary lanes on PRs for testing

nickpismenkov
and
claude
committed
cff7ee7
ci: disable auth-browser-consent and private-oauth on PRs

nickpismenkov
and
claude
committed
7baa2a5
fix(ci): read LIVE_OPENAI_COMPATIBLE_BASE_URL from vars not secrets

nickpismenkov
and
claude
committed
99686e2
fix variable
nickpismenkov
committed
de1fa2e
feat(e2e): add lifecycle canary tests for Gmail, Calendar, and Notion

nickpismenkov
and
claude
committed
c3fc1be
fix(e2e): relax persona keyword checks + pre-install zizmor in CI

nickpismenkov
and
claude
committed
8831659
ci: remove temporary PR triggers from all live canary lanes

nickpismenkov
and
claude
committed
5e9ebda
Merge remote-tracking branch 'origin/staging' into codex/auth-oauth-canary-unification
nickpismenkov
committed
aa67f42
fix(e2e): use tool_name_matches for negative recovery-loop assertions

nickpismenkov
and
claude
committed
974fe0e
Merge branch 'staging' into codex/auth-oauth-canary-unification
nickpismenkov
committed
fe0dea0
Merge remote-tracking branch 'origin/staging' into codex/auth-oauth-canary-unification
nickpismenkov
committed
b1443a1
fix(e2e): correct bearer token prefix in multi-user MCP assertion
nickpismenkov
committed
39c3ac3
fix(mcp): resolve per-user client at tool-call time to stop cross-tenant leak

nickpismenkov
and
claude
committed
d93243b
infra(runner): add Railway-hosted self-hosted runner for private-oauth lane

nickpismenkov
and
claude
committed
ab6bb11

Commits on Apr 21, 2026

fix(mcp): partition Mcp-Session-Id by (user_id, server_name)

nickpismenkov
and
claude
committed
dca10fe
fix(mcp): close activate-vs-remove TOCTOU on shared MCP servers

nickpismenkov
and
claude
committed
edeed74
fix(canary): materialise sensitive auth secrets to files, out of job env

nickpismenkov
and
claude
committed
ec5c2a7
fix(oauth): make token-body parser content-type-aware + validate token

nickpismenkov
and
claude
committed
e618848
Merge branch 'staging' into codex/auth-oauth-canary-unification
nickpismenkov
committed
127f6ba
fix(runner): install libicu + kerberos + lttng deps for actions/runner

nickpismenkov
and
claude
committed
bf770c0
feat(runner): RUNNER_FORCE_REREGISTER env for re-registration recovery

nickpismenkov
and
claude
committed
09c738e
feat(runner): IRONCLAW_DB_B64 env for one-shot libsql DB bootstrap

nickpismenkov
and
claude
committed
a49cbb9
feat(runner): IRONCLAW_DB_URL fallback when base64 env exceeds plan limit

nickpismenkov
and
claude
committed
d23983b
infra(runner): add seed-runner-db.sh for one-shot DB transfer

nickpismenkov
and
claude
committed
32228d8
fix(runner): install python3 + python3-dev for pyo3 build

nickpismenkov
and
claude
committed
5d50c1f
Merge remote-tracking branch 'origin/staging' into codex/auth-oauth-canary-unification
nickpismenkov
committed
f0d8b29
fix(app): remove dead MCP_MAX_SESSIONS env-var parsing

nickpismenkov
and
claude
committed
16fb498
fix(extensions): clean up MCP client on tool-wrapper-construction failure

nickpismenkov
and
claude
committed
db36e3c
style: apply cargo fmt
nickpismenkov
committed
0aa54dd
fix(oauth): route all error-response body reads through a single truncating helper

nickpismenkov
and
claude
committed
f4834d2

Commits on Apr 22, 2026