Enforce Optimitron OAuth issuer in production and add Optimitron plugin metadata by mikepsinn · Pull Request #168 · mikepsinn/optimitron

mikepsinn · 2026-07-28T21:26:14Z

Motivation

Keep OAuth issuer fixed to the Optimitron product origin in production so campaign site variants cannot claim the authorization server, while preserving configurability for local and preview environments.
Register the Optimitron plugin with marketplace and Codex plugin metadata so the product can be discovered and used by integrations.

Description

Change OAuth issuer resolution in packages/web/src/lib/mcp-oauth.ts to prefer MCP_OAUTH_ISSUER, return https://optimitron.com when VERCEL_ENV is production, and otherwise fall back to NEXTAUTH_URL or local defaults.
Update tests in packages/web/src/lib/__tests__/mcp-oauth-resource.test.ts to use https://optimitron.com as the canonical issuer, replace the environment stub to MCP_OAUTH_ISSUER, and add a new test that asserts production uses the Optimitron issuer.
Add plugin metadata files for Optimitron: plugins/optimitron/.codex-plugin/plugin.json, plugins/optimitron/.mcp.json, and register the plugin in the agents marketplace with .agents/plugins/marketplace.json.
Document the optional MCP_OAUTH_ISSUER environment variable in .env.example to allow non-production overrides.

Testing

Ran unit tests for the web package with vitest, including packages/web/src/lib/__tests__/mcp-oauth-resource.test.ts, and the modified tests passed.
Ran the repository test suite (pnpm -w test) and observed the test run succeed for the changed modules.

Codex Task

Summary by CodeRabbit

New Features
- Added the Optimitron plugin to the marketplace (with install/auth and category info).
- Added Optimitron plugin manifest, default prompts, and MCP server connectivity.
Bug Fixes
- Production OAuth metadata now consistently uses https://optimitron.com (even if an override is set).
Tests
- Added/updated tests to validate production OAuth issuer resolution and canonical origin behavior.
Documentation
- Updated .env.example with an optional MCP_OAUTH_ISSUER override for non-production setups.

vercel · 2026-07-28T21:26:19Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
optimitron-web	Ready	Preview, Comment	Jul 29, 2026 1:57am

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

coderabbitai · 2026-07-28T21:27:39Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 78e75f5a-91c8-48ab-8868-bb47fc001399

📥 Commits

Reviewing files that changed from the base of the PR and between 9ede5fc and 2c79d2a.

📒 Files selected for processing (2)

packages/web/src/lib/__tests__/mcp-oauth-resource.test.ts
packages/web/src/lib/mcp-oauth.ts

🚧 Files skipped from review as they are similar to previous changes (2)

packages/web/src/lib/mcp-oauth.ts
packages/web/src/lib/tests/mcp-oauth-resource.test.ts

📝 Walkthrough

Walkthrough

Adds Optimitron marketplace and plugin manifests, configures its MCP endpoint, and updates MCP OAuth issuer resolution with an environment override, production fallback, and tests.

Changes

Optimitron integration

Layer / File(s)	Summary
OAuth issuer resolution and coverage `.env.example`, `packages/web/src/lib/mcp-oauth.ts`, `packages/web/src/lib/__tests__/mcp-oauth-resource.test.ts`	Adds `MCP_OAUTH_ISSUER` override support, uses `https://optimitron.com` in production, and updates tests for the resolution behavior.
Optimitron plugin registration and MCP endpoint `plugins/optimitron/...`, `.agents/plugins/marketplace.json`	Adds the Optimitron plugin manifest, registers its HTTP MCP server at `https://optimitron.com/api/mcp`, and publishes it in the marketplace.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the two main changes: enforcing the Optimitron OAuth issuer in production and adding plugin metadata.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/set-up-scheduled-task-in-chatgpt

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9ede5fc780

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/web/src/lib/__tests__/mcp-oauth-resource.test.ts`:
- Around line 49-58: Update the “keeps Optimitron as the production
authorization server” test to stub MCP_OAUTH_ISSUER with a non-empty, different
origin while VERCEL_ENV is production, then keep the assertion that
getOAuthMetadata().issuer equals CANONICAL, covering production override
precedence.

In `@packages/web/src/lib/mcp-oauth.ts`:
- Around line 39-40: Make the production branch in getMcpOAuthIssuer evaluate
before MCP_OAUTH_ISSUER so VERCEL_ENV="production" always returns the canonical
issuer; update packages/web/src/lib/mcp-oauth.ts lines 39-40 accordingly. In
packages/web/src/lib/__tests__/mcp-oauth-resource.test.ts lines 49-58, set a
conflicting non-empty MCP_OAUTH_ISSUER and assert production still returns the
canonical issuer.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2a5d03fa-5154-4ccc-946c-18f888012c4a

📥 Commits

Reviewing files that changed from the base of the PR and between 878a079 and 9ede5fc.

📒 Files selected for processing (6)

.agents/plugins/marketplace.json
.env.example
packages/web/src/lib/__tests__/mcp-oauth-resource.test.ts
packages/web/src/lib/mcp-oauth.ts
plugins/optimitron/.codex-plugin/plugin.json
plugins/optimitron/.mcp.json

github-actions · 2026-07-28T21:39:42Z

PR review packet

Start here

🖼️ Visual review
📏 Screenshot baseline: exact PR base main@878a07943665 from CI run 30311050471.
🚀 Preview deployment
☝️ Cmd/Ctrl-click review links to keep this PR open.
🔑 ?login=demo signs in as the demo user; ?logout=1 clears the session.
💬 For a visual problem, use the comment button in latest.html or reply here with @claude and the checklist item.

No user-facing page or component changes were inferred from changed files or the visual review manifest.

Changed files considered

.agents/plugins/marketplace.json
.env.example
packages/web/src/lib/__tests__/mcp-oauth-resource.test.ts
packages/web/src/lib/mcp-oauth.ts
plugins/optimitron/.codex-plugin/plugin.json
plugins/optimitron/.mcp.json

Updated automatically when this PR's preview or visual review reruns.

MCP_OAUTH_ISSUER was checked before the VERCEL_ENV production guard, so a variable scoped to all Vercel environments could override the canonical production issuer. Reorder the checks and add a regression test for a non-empty override in production. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

mikepsinn · 2026-07-29T01:50:28Z

Fixed in 2c79d2a: getIssuerUrl() now checks VERCEL_ENV === "production" before MCP_OAUTH_ISSUER, so the canonical issuer wins even if that env var is scoped to all Vercel environments. Added a regression test that stubs a non-empty override in production and asserts the canonical issuer still wins. All three threads on this pointed at the same real bug.

Generated by Claude Code

Add Optimitron ChatGPT plugin

9ede5fc

Copilot AI review requested due to automatic review settings July 28, 2026 21:26

mikepsinn added the codex label Jul 28, 2026 — with ChatGPT Codex Connector

Copilot AI reviewed Jul 28, 2026

vercel Bot deployed to Preview July 28, 2026 21:26 View deployment

mikepsinn enabled auto-merge July 28, 2026 21:26

chatgpt-codex-connector Bot reviewed Jul 28, 2026

View reviewed changes

Comment thread packages/web/src/lib/mcp-oauth.ts Outdated

coderabbitai Bot reviewed Jul 28, 2026

View reviewed changes

Comment thread packages/web/src/lib/__tests__/mcp-oauth-resource.test.ts

Comment thread packages/web/src/lib/mcp-oauth.ts Outdated

mikepsinn temporarily deployed to Preview July 28, 2026 21:38 — with GitHub Actions Inactive

vercel Bot deployed to Preview July 29, 2026 01:57 View deployment

mikepsinn had a problem deploying to Preview July 29, 2026 02:01 — with GitHub Actions Failure

mikepsinn merged commit 08baaa5 into main Jul 29, 2026
13 of 16 checks passed

mikepsinn deleted the codex/set-up-scheduled-task-in-chatgpt branch July 29, 2026 02:01

mikepsinn mentioned this pull request Jul 29, 2026

Engineering Task Audit — Daily Drift Report #78

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Enforce Optimitron OAuth issuer in production and add Optimitron plugin metadata - #168

Enforce Optimitron OAuth issuer in production and add Optimitron plugin metadata#168
mikepsinn merged 2 commits into
mainfrom
codex/set-up-scheduled-task-in-chatgpt

mikepsinn commented Jul 28, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented Jul 28, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

coderabbitai Bot commented Jul 28, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026 •

edited

Loading

Uh oh!

mikepsinn commented Jul 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

mikepsinn commented Jul 28, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Description

Testing

Summary by CodeRabbit

Uh oh!

vercel Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR review packet

Start here

Uh oh!

mikepsinn commented Jul 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mikepsinn commented Jul 28, 2026 •

edited by coderabbitai Bot

Loading

vercel Bot commented Jul 28, 2026 •

edited

Loading

coderabbitai Bot commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading