mcp-server does not set residency header, causing 401 for non-US users

Version

0.0.0 (built from main at 1525bbd; also affects 0.117.0 and 0.118.0)

Subscription

Enterprise (ChatGPT Team/Enterprise workspace)

Model

gpt-5.4

Platform

Darwin 25.3.0 arm64 arm

Terminal

Ghostty 1.3.1 (via Claude Code MCP)

What issue are you seeing?

codex mcp-server returns 401 Unauthorized: Workspace is not authorized in this region for users outside the US, even when enforce_residency = "us" is configured in /etc/codex/requirements.toml. The Cloudflare PoP in the response confirms requests are routed to the local region (e.g. cf-ray: ...-GRU for Brazil) instead of the US.

The codex exec and codex (TUI) subcommands work correctly with the same config because they call set_default_client_residency_requirement(), which sets the residency: us header on outgoing HTTP requests. The mcp-server subcommand does not make this call.

Steps to reproduce

1. Be outside the US (or route traffic through a non-US IP)
2. Configure residency: echo 'enforce_residency = "us"' | sudo tee /etc/codex/requirements.toml
3. Start codex mcp-server and send a request via an MCP client
4. Observe: 401 Unauthorized: Workspace is not authorized in this region

Expected behavior

codex mcp-server should respect enforce_residency and send the residency: us header, routing requests to the US - the same behavior as codex exec and the TUI.

Additional information

The fix is a one-liner in codex-rs/mcp-server/src/lib.rs. After config loading (~line 74), add:

use codex_login::default_client::set_default_client_residency_requirement;

set_default_client_residency_requirement(config.enforce_residency.value());

This matches what exec/src/lib.rs:378 and tui/src/lib.rs:810 already do. Tested and confirmed working.