Support MCP OAuth callbacks in WebIDE/code-server

What variant of Codex are you using?

CLI/Extension

What feature would you like to see?

Currently Codex can advertise a non-localhost MCP OAuth callback URL via mcp_oauth_callback_url, which is needed when running Codex in a remote environment such as codeserver/WebIDE.

However, WebIDE/code-server exposes forwarded ports through a path prefix, while Codex receives the forwarded callback without that prefix. For example, Codex may advertise:

https://example.domain/proxy/43119/callback/<callback_id>

but receive:

/callback/<callback_id>

Codex currently requires the received callback path to exactly match the advertised path, so this callback is rejected.

This means it is impossible to authenticate oauth protected mcp servers when running codex on WebIDE/codeserver

Additional information

This issue can be easily solved by adding a new mcp_oauth_callback_path_mode parameter with the following options.

mcp_oauth_callback_path_mode = "exact"  # default
mcp_oauth_callback_path_mode = "suffix"

exact preserves the current behavior. suffix allows the received callback path to be a suffix of the advertised path, so WebIDE/code-server proxy callbacks work while still requiring the callback id to match.

I would like to open a PR. Is that possible @etraut-openai ?