[codex] surface auth tool failures

[RhysSullivan]

Summary

• add a shared auth tool-failure envelope with recovery guidance for secrets and OAuth
• return structured auth failures from OpenAPI, GraphQL, and MCP tool invocation instead of opaque internal tool errors
• add local and cloud boundary tests that invoke an unauthenticated source through the app execution APIs and assert model-visible auth guidance
• cover missing credential bindings, missing secrets, OAuth reauth/missing connection, upstream 401/403 auth rejection, and MCP per-user isolation paths

Validation

• bun run lint
• bun run format:check
• bun run typecheck in packages/core/sdk
• bun run typecheck in packages/plugins/openapi
• bun run typecheck in packages/plugins/graphql
• bun run typecheck in packages/plugins/mcp
• bun run typecheck in apps/local
• bun run typecheck in apps/cloud
• bun run test src/sdk/plugin.test.ts src/sdk/multi-scope-bearer.test.ts src/sdk/oauth-refresh.test.ts src/sdk/upstream-failures.test.ts in packages/plugins/openapi
• bun run test src/sdk/plugin.test.ts in packages/plugins/graphql
• bun run test src/sdk/per-user-auth-isolation.test.ts in packages/plugins/mcp
• bun run test src/server/auth-tool-failures.test.ts in apps/local
• bun run test:node src/services/auth-tool-failures.node.test.ts in apps/cloud
• git diff --check

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	2c03418	Commit Preview URL Branch Preview URL	May 20 2026, 05:20 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	2c03418	May 20 2026, 05:21 PM

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@850

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@850

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@850

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@850

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@850

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@850

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@850

@executor-js/plugin-google-discovery

npm i https://pkg.pr.new/@executor-js/plugin-google-discovery@850

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@850

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@850

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@850

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@850

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@850

executor

npm i https://pkg.pr.new/executor@850

commit: 2c03418