[codex] Fix MCP OAuth and OpenAPI JSON parsing

[RhysSullivan]

Summary

• surface whether an MCP server that requires OAuth supports dynamic client registration
• when MCP OAuth cannot use DCR, avoid trapping the add-source form in OAuth-only mode so PAT/header auth and deferred source saves remain available
• preserve the backend start error in OAuth UI flows
• parse JSON-shaped OpenAPI specs with JSON.parse first, falling back to YAML for YAML/flow-style YAML documents

Root Cause

• GitHub Copilot MCP advertises OAuth protected-resource metadata, but the advertised GitHub authorization server does not publish RFC 8414 metadata or dynamic client registration. Treating this as a DCR-capable OAuth flow produced a vague start failure, and the first UI fix still left the form stuck in an unusable OAuth-only state.
• The GitHub REST OpenAPI description is valid JSON, but Cloudflare Workers hit resource limits when the 12.5 MB document is parsed through the YAML parser. A deployed Wrangler probe confirmed fetch, buffering, and JSON.parse succeed while YAML.parse returns Cloudflare 1102.

Validation

• bun run --cwd packages/react test -- src/api/error-reporting.test.ts src/api/oauth-popup.test.ts
• bun run --cwd packages/plugins/mcp test -- src/api/handlers.test.ts src/sdk/plugin.test.ts
• bun run --cwd packages/core/sdk test -- src/oauth-discovery.test.ts
• bun run --cwd packages/plugins/openapi test -- src/sdk/parse.test.ts src/sdk/real-specs.test.ts
• bun run --cwd packages/react typecheck
• bun run --cwd packages/plugins/mcp typecheck
• bun run --cwd packages/plugins/openapi typecheck
• bun run --cwd packages/core/sdk typecheck
• ./node_modules/.bin/oxfmt --check packages/plugins/mcp/src/api/group.ts packages/plugins/mcp/src/sdk/plugin.ts packages/plugins/mcp/src/react/AddMcpSource.tsx packages/react/src/plugins/oauth-sign-in.tsx packages/plugins/openapi/src/sdk/parse.ts packages/plugins/openapi/src/sdk/parse.test.ts

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	4e60892	Commit Preview URL Branch Preview URL	May 08 2026, 10:57 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	4e60892	May 08 2026, 10:57 PM

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@731

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@731

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@731

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@731

@executor-js/storage-core

npm i https://pkg.pr.new/@executor-js/storage-core@731

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@731

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@731

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@731

@executor-js/plugin-google-discovery

npm i https://pkg.pr.new/@executor-js/plugin-google-discovery@731

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@731

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@731

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@731

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@731

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@731

executor

npm i https://pkg.pr.new/executor@731

commit: 6f51ee4