Harden MCP OAuth discovery and Codex transports

[sethkarten]

Outcome

Complete provider transport hardening:

• preserve MCP tool schemas and standards-compliant OAuth discovery
• enforce SSRF-safe metadata and refresh binding
• make Codex discovery, streaming, cancellation, cleanup, and fallback behavior reliable
• support OAuth challenges delivered only through WWW-Authenticate

Preserve #1164 as design and validation history. Related reports include #1073, #766, and #639.

[kevinjosethomas]

Hi, thanks for taking the time to report this! Since open sourcing Prime Agent, we’ve received far more Issues than we can reliably triage and maintain. Rather than leave a large backlog that we cannot meaningfully work through, we’re closing the current Issue queue and moving to a discussion-first process.

We have established new contribution guidelines to help us continue iterating on Prime Agent and better manage contributions from the community. Going forward, GitHub Issues will be our maintainer work queue rather than the initial place for public reports and requests. Bug reports, feature requests, questions, and other feedback should begin in GitHub Discussions. Please read the full process documented in our contribution guidelines. Security vulnerabilities should continue to be reported privately according to our security policy.

While we’re closing this backlog, we’re still reviewing it at a high level to identify recurring bugs, useful ideas, and important problems that we should address ourselves. Thanks again for the time you put into this!