From 8a593862736e5a3dc701b05838b682299551c36b Mon Sep 17 00:00:00 2001
From: Alex Daley <adaley@openai.com>
Date: Wed, 4 Mar 2026 11:41:54 -0500
Subject: [PATCH 1/2] add new scopes to login (#12383)

Validated login + refresh flows. Removing scopes from the refresh
request until we have upgrade flow in place. Confirmed that tokens
refresh with existing scopes.
---
 codex-rs/core/src/auth.rs    | 2 --
 codex-rs/login/src/server.rs | 3 ++-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/codex-rs/core/src/auth.rs b/codex-rs/core/src/auth.rs
index cca57d5c0f76..546d53b79f68 100644
--- a/codex-rs/core/src/auth.rs
+++ b/codex-rs/core/src/auth.rs
@@ -626,7 +626,6 @@ async fn request_chatgpt_token_refresh(
         client_id: CLIENT_ID,
         grant_type: "refresh_token",
         refresh_token,
-        scope: "openid profile email",
     };
 
     let endpoint = refresh_token_endpoint();
@@ -722,7 +721,6 @@ struct RefreshRequest {
     client_id: &'static str,
     grant_type: &'static str,
     refresh_token: String,
-    scope: &'static str,
 }
 
 #[derive(Deserialize, Clone)]
diff --git a/codex-rs/login/src/server.rs b/codex-rs/login/src/server.rs
index 53b4ad360129..73d6b1e154e5 100644
--- a/codex-rs/login/src/server.rs
+++ b/codex-rs/login/src/server.rs
@@ -431,7 +431,8 @@ fn build_authorize_url(
         ("redirect_uri".to_string(), redirect_uri.to_string()),
         (
             "scope".to_string(),
-            "openid profile email offline_access".to_string(),
+            "openid profile email offline_access api.connectors.read api.connectors.invoke"
+                .to_string(),
         ),
         (
             "code_challenge".to_string(),

From 4c818d29d3c89396834333c464bef210d310f89a Mon Sep 17 00:00:00 2001
From: Michel Osswald <michel-osswald@live.de>
Date: Wed, 4 Mar 2026 17:49:10 +0100
Subject: [PATCH 2/2] fix(ci): skip upstream npm staging on fork sync PRs

---
 .github/workflows/ci.yml | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6132d62f99e7..a0b0214ac838 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,12 +32,20 @@ jobs:
 
       - name: Stage npm package
         id: stage_npm_package
+        if: ${{ github.repository_owner == 'openai' && github.ref_name != 'kontext-dev' }}
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          # Use a rust-release version that includes all native binaries.
-          CODEX_VERSION=0.74.0
+          CODEX_VERSION=$(python3 - <<'PY'
+          import pathlib
+          import tomllib
+
+          cargo_toml = pathlib.Path("codex-rs/Cargo.toml").read_text()
+          data = tomllib.loads(cargo_toml)
+          print(data["workspace"]["package"]["version"])
+          PY
+          )
           OUTPUT_DIR="${RUNNER_TEMP}"
           python3 ./scripts/stage_npm_packages.py \
             --release-version "$CODEX_VERSION" \
@@ -47,6 +55,7 @@ jobs:
           echo "pack_output=$PACK_OUTPUT" >> "$GITHUB_OUTPUT"
 
       - name: Upload staged npm package artifact
+        if: ${{ github.repository_owner == 'openai' && github.ref_name != 'kontext-dev' }}
         uses: actions/upload-artifact@v6
         with:
           name: codex-npm-staging