@stigmer/cli 3.13.0 → 3.14.0-dev.20260910084630

package/src/resources/connect/connect.integration.test.ts

@@ -18,7 +18,11 @@ import { McpServerQueryController } from "@stigmer/protos/ai/stigmer/agentic/mcp
 import { McpServerAuthSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
 import type { Stigmer } from "@stigmer/sdk";
 import { createNodeClient, normalizeEndpoint } from "@stigmer/sdk/node";
-import { createServer as createHttp2Server, type Http2Server, type ServerHttp2Session } from "node:http2";
+import {
+  createServer as createHttp2Server,
+  type Http2Server,
+  type ServerHttp2Session,
+} from "node:http2";
 import type { AddressInfo } from "node:net";
 import { fileURLToPath } from "node:url";
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
@@ -26,7 +30,9 @@ import { UsageError } from "../../errors/index.js";
 import { connectMcpServer } from "./connect.js";
 import { renderConnectResult } from "./display.js";
 
-const FIXTURE = fileURLToPath(new URL("./__fixtures__/stdio-server.mjs", import.meta.url));
+const FIXTURE = fileURLToPath(
+  new URL("./__fixtures__/stdio-server.mjs", import.meta.url),
+);
 
 let backend: Http2Server;
 let client: Stigmer;
@@ -48,7 +54,10 @@ beforeEach(() => {
   servedSpec = create(McpServerSchema, {
     metadata: { id: "mcp_1", name: "github", slug: "github", org: "acme" },
     spec: {
-      serverType: { case: "stdio", value: { command: process.execPath, args: [FIXTURE] } },
+      serverType: {
+        case: "stdio",
+        value: { command: process.execPath, args: [FIXTURE] },
+      },
       env: { GITHUB_TOKEN: { isSecret: true } },
     },
   });
@@ -61,7 +70,9 @@ const updatedServer = create(McpServerSchema, {
   status: {
     discoveredCapabilities: {
       tools: [{ name: "search_issues", description: "search issues" }],
-      resourceTemplates: [{ name: "issue", uriTemplate: "github:///issues/{id}" }],
+      resourceTemplates: [
+        { name: "issue", uriTemplate: "github:///issues/{id}" },
+      ],
     },
   },
 });
@@ -71,16 +82,23 @@ beforeAll(async () => {
     router.service(McpServerQueryController, {
       getByReference: () => servedSpec,
       get: () => servedSpec,
-      getOAuthGrantStatus: () => create(GetOAuthGrantStatusOutputSchema, { connected: grantConnected }),
+      getOAuthGrantStatus: () =>
+        create(GetOAuthGrantStatusOutputSchema, { connected: grantConnected }),
     });
     router.service(McpServerCommandController, {
       // Mirror the backend's protovalidate rule (org min_len=1): reject an empty
       // org so a regression that drops org fails loudly here instead of silently
       // passing (the mock adapter does not run protovalidate on its own).
       connect: async (req) => {
-        if (req.org === "") throw new ConnectError("org – value length must be at least 1 characters", Code.InvalidArgument);
+        if (req.org === "")
+          throw new ConnectError(
+            "org – value length must be at least 1 characters",
+            Code.InvalidArgument,
+          );
         if (connectDelayMs > 0) {
-          await new Promise((resolve) => setTimeout(resolve, connectDelayMs).unref());
+          await new Promise((resolve) =>
+            setTimeout(resolve, connectDelayMs).unref(),
+          );
         }
         connectCalls.push(req);
         return updatedServer;
@@ -95,7 +113,9 @@ beforeAll(async () => {
   });
   await new Promise<void>((resolve) => backend.listen(0, "127.0.0.1", resolve));
   const port = (backend.address() as AddressInfo).port;
-  client = createNodeClient({ baseUrl: normalizeEndpoint(`127.0.0.1:${port}`) });
+  client = createNodeClient({
+    baseUrl: normalizeEndpoint(`127.0.0.1:${port}`),
+  });
 });
 
 afterAll(async () => {
@@ -111,7 +131,8 @@ describe("connect push path", () => {
       timeoutMs: 30_000,
       dryRun: false,
       envOverrides: ["GITHUB_TOKEN=ghp-override"],
-      backendType: "cloud",
+      consoleURL: "https://app.stigmer.ai",
+      probeLocalConsole: false,
       interactive: false,
     });
 
@@ -124,7 +145,9 @@ describe("connect push path", () => {
     expect(connectCalls[0].runtimeEnv.GITHUB_TOKEN.isSecret).toBe(true);
 
     expect(result.updated?.metadata?.id).toBe("mcp_1");
-    expect(result.capabilities?.tools.map((t) => t.name)).toEqual(["search_issues"]);
+    expect(result.capabilities?.tools.map((t) => t.name)).toEqual([
+      "search_issues",
+    ]);
   });
 });
 
@@ -139,10 +162,13 @@ describe("--timeout bounds the server-side connect (issue #239)", () => {
         pushTimeoutMs: 150,
         dryRun: false,
         envOverrides: ["GITHUB_TOKEN=ghp-x"],
-        backendType: "cloud",
+        consoleURL: "https://app.stigmer.ai",
+        probeLocalConsole: false,
         interactive: false,
       }),
-    ).rejects.toThrow(/Stopped waiting for the connect of MCP server 'github' after 0\.15s/);
+    ).rejects.toThrow(
+      /Stopped waiting for the connect of MCP server 'github' after 0\.15s/,
+    );
   });
 
   it("does not bound the wait when pushTimeoutMs is unset (default --timeout)", async () => {
@@ -157,7 +183,8 @@ describe("--timeout bounds the server-side connect (issue #239)", () => {
       timeoutMs: 100,
       dryRun: false,
       envOverrides: ["GITHUB_TOKEN=ghp-x"],
-      backendType: "cloud",
+      consoleURL: "https://app.stigmer.ai",
+      probeLocalConsole: false,
       interactive: false,
     });
     expect(result.updated?.metadata?.id).toBe("mcp_1");
@@ -166,7 +193,9 @@ describe("--timeout bounds the server-side connect (issue #239)", () => {
 
 describe("OAuth guidance gate", () => {
   beforeEach(() => {
-    servedSpec.spec!.auth = create(McpServerAuthSchema, { targetEnvVar: "GITHUB_TOKEN" });
+    servedSpec.spec!.auth = create(McpServerAuthSchema, {
+      targetEnvVar: "GITHUB_TOKEN",
+    });
   });
 
   it("stops with actionable guidance when auth is required off an interactive terminal", async () => {
@@ -177,7 +206,8 @@ describe("OAuth guidance gate", () => {
         timeoutMs: 30_000,
         dryRun: false,
         envOverrides: [],
-        backendType: "cloud",
+        consoleURL: "https://app.stigmer.ai",
+        probeLocalConsole: false,
         interactive: false,
       }),
     ).rejects.toThrow(UsageError);
@@ -192,7 +222,8 @@ describe("OAuth guidance gate", () => {
       timeoutMs: 30_000,
       dryRun: false,
       envOverrides: [],
-      backendType: "cloud",
+      consoleURL: "https://app.stigmer.ai",
+      probeLocalConsole: false,
       interactive: false,
     });
     expect(connectCalls).toHaveLength(1);
@@ -205,7 +236,8 @@ describe("OAuth guidance gate", () => {
       timeoutMs: 30_000,
       dryRun: false,
       envOverrides: ["GITHUB_TOKEN=ghp-x"],
-      backendType: "cloud",
+      consoleURL: "https://app.stigmer.ai",
+      probeLocalConsole: false,
       interactive: false,
     });
     expect(connectCalls).toHaveLength(1);
@@ -227,7 +259,8 @@ describe("oauth_only servers reject the manual-token routes", () => {
       timeoutMs: 30_000,
       dryRun: false,
       envOverrides: ["GITHUB_TOKEN=ghp-x"],
-      backendType: "cloud",
+      consoleURL: "https://app.stigmer.ai",
+      probeLocalConsole: false,
       interactive: false,
     }).catch((e: unknown) => e);
 
@@ -245,7 +278,8 @@ describe("oauth_only servers reject the manual-token routes", () => {
       timeoutMs: 30_000,
       dryRun: false,
       envOverrides: [],
-      backendType: "cloud",
+      consoleURL: "https://app.stigmer.ai",
+      probeLocalConsole: false,
       interactive: false,
     }).catch((e: unknown) => e);
 
@@ -261,7 +295,8 @@ describe("oauth_only servers reject the manual-token routes", () => {
       timeoutMs: 10_000,
       dryRun: true,
       envOverrides: [],
-      backendType: "cloud",
+      consoleURL: "https://app.stigmer.ai",
+      probeLocalConsole: false,
       interactive: false,
     }).catch((e: unknown) => e);
 
@@ -280,13 +315,17 @@ describe("dry-run path", () => {
       timeoutMs: 10_000,
       dryRun: true,
       envOverrides: [],
-      backendType: "cloud",
+      consoleURL: "https://app.stigmer.ai",
+      probeLocalConsole: false,
       interactive: false,
     });
 
     expect(connectCalls).toHaveLength(0);
     expect(result.updated).toBeUndefined();
-    expect(result.capabilities?.tools.map((t) => t.name)).toEqual(["echo", "noop"]);
+    expect(result.capabilities?.tools.map((t) => t.name)).toEqual([
+      "echo",
+      "noop",
+    ]);
 
     const lines: string[] = [];
     renderConnectResult(result, (l) => lines.push(l), false);
@@ -301,13 +340,26 @@ describe("dry-run path", () => {
     // Server references a declared env var in its args, but it is not set.
     delete process.env.NEEDED_DIR;
     servedSpec = create(McpServerSchema, {
-      metadata: { id: "mcp_1", name: "filesystem", slug: "filesystem", org: "acme" },
+      metadata: {
+        id: "mcp_1",
+        name: "filesystem",
+        slug: "filesystem",
+        org: "acme",
+      },
       spec: {
         serverType: {
           case: "stdio",
-          value: { command: process.execPath, args: [FIXTURE, "${NEEDED_DIR}"] },
+          value: {
+            command: process.execPath,
+            args: [FIXTURE, "${NEEDED_DIR}"],
+          },
+        },
+        env: {
+          NEEDED_DIR: {
+            isSecret: false,
+            description: "Root directory the server may access",
+          },
         },
-        env: { NEEDED_DIR: { isSecret: false, description: "Root directory the server may access" } },
       },
     });
 
@@ -317,7 +369,8 @@ describe("dry-run path", () => {
       timeoutMs: 10_000,
       dryRun: true,
       envOverrides: [],
-      backendType: "cloud",
+      consoleURL: "https://app.stigmer.ai",
+      probeLocalConsole: false,
       interactive: false,
     }).catch((e: unknown) => e);
 

package/src/resources/connect/connect.ts

@@ -14,12 +14,18 @@
 import { create } from "@bufbuild/protobuf";
 import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import type { ConnectInput } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
-import { ConnectInputSchema, GetOAuthGrantStatusInputSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
+import {
+  ConnectInputSchema,
+  GetOAuthGrantStatusInputSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
 import type { DiscoveredCapabilities } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/status_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { Stigmer } from "@stigmer/sdk";
-import { connectAndWait, ConnectStillRunningError, CONNECT_SETTLE_BOUND_MS } from "@stigmer/sdk";
-import type { BackendType } from "../../config/config.js";
+import {
+  connectAndWait,
+  ConnectStillRunningError,
+  CONNECT_SETTLE_BOUND_MS,
+} from "@stigmer/sdk";
 import { CliExitError, ExitCode, UsageError } from "../../errors/index.js";
 import { defaultRegistry } from "../../registry/index.js";
 import { PlaceholderResolutionError } from "../mcp/placeholder-resolver.js";
@@ -42,8 +48,10 @@ export interface ConnectOptions {
   readonly pushTimeoutMs?: number;
   readonly dryRun: boolean;
   readonly envOverrides: readonly string[];
-  /** Backend type, for resolving the OAuth web-console URL. */
-  readonly backendType: BackendType;
+  /** The web console origin for the OAuth flow (resolveConsoleURL). */
+  readonly consoleURL: string;
+  /** Probe the console before opening the browser (local daemon only). */
+  readonly probeLocalConsole: boolean;
   /** Whether an interactive terminal is available to run the OAuth flow. */
   readonly interactive: boolean;
 }
@@ -63,23 +71,34 @@ export interface ConnectResult {
 }
 
 /** Connect to an MCP server and discover its capabilities (push or dry-run). */
-export async function connectMcpServer(client: Stigmer, opts: ConnectOptions): Promise<ConnectResult> {
+export async function connectMcpServer(
+  client: Stigmer,
+  opts: ConnectOptions,
+): Promise<ConnectResult> {
   const server = await resolveMcpServer(client, opts.reference, opts.org);
 
   if (opts.dryRun) {
-    if (server.spec === undefined) throw new UsageError("MCP server has no spec; cannot discover capabilities");
+    if (server.spec === undefined)
+      throw new UsageError(
+        "MCP server has no spec; cannot discover capabilities",
+      );
     // An oauth_only endpoint rejects static tokens, and the OAuth token lives in
     // the backend's managed environment — never on the caller's machine. So local
     // discovery cannot authenticate it; say so plainly instead of failing on a 401.
     if (isOAuthOnly(server)) throw oauthOnlyDryRunError(server, opts.reference);
     try {
-      const capabilities = await localDiscover(server.spec, opts.envOverrides, opts.timeoutMs);
+      const capabilities = await localDiscover(
+        server.spec,
+        opts.envOverrides,
+        opts.timeoutMs,
+      );
       return { server, capabilities, updated: undefined };
     } catch (err) {
       // A ${VAR} placeholder that could not be resolved is a configuration
       // problem, not a discovery failure — surface it as actionable guidance
       // instead of a raw resolver error or a cryptic subprocess crash.
-      if (err instanceof PlaceholderResolutionError) throw unresolvedEnvError(server, err);
+      if (err instanceof PlaceholderResolutionError)
+        throw unresolvedEnvError(server, err);
       throw err;
     }
   }
@@ -150,18 +169,29 @@ async function serverSideConnect(
 
 // Resolve a reference (id, org/slug, or bare slug) to an McpServer. Mirrors Go's
 // GetFromBackend.
-async function resolveMcpServer(client: Stigmer, reference: string, org: string): Promise<McpServer> {
+async function resolveMcpServer(
+  client: Stigmer,
+  reference: string,
+  org: string,
+): Promise<McpServer> {
   const idPrefix = defaultRegistry().getByAlias("mcp-server")?.idPrefix ?? "";
   const parsed = parseReference(reference, org, idPrefix);
   if (parsed.kind === "id") return client.mcpServer.get(parsed.id);
-  return client.mcpServer.getByReference({ org: parsed.org, slug: parsed.slug });
+  return client.mcpServer.getByReference({
+    org: parsed.org,
+    slug: parsed.slug,
+  });
 }
 
 // Ensure an OAuth grant exists before connecting an auth-configured server that
 // was given no --env credentials. On an interactive terminal, run the browser
 // flow and wait for the grant; otherwise stop with actionable guidance so
 // scripted callers get a clean, stable failure instead of a 5-minute block.
-async function ensureOAuthSatisfied(client: Stigmer, server: McpServer, opts: ConnectOptions): Promise<void> {
+async function ensureOAuthSatisfied(
+  client: Stigmer,
+  server: McpServer,
+  opts: ConnectOptions,
+): Promise<void> {
   if (!oauthRequired(server)) return;
 
   const oauthOnly = isOAuthOnly(server);
@@ -183,18 +213,32 @@ async function ensureOAuthSatisfied(client: Stigmer, server: McpServer, opts: Co
   );
   if (status.connected) return;
 
-  if (!opts.interactive) throw oauthGuidanceError(server, opts.reference, oauthOnly);
+  if (!opts.interactive)
+    throw oauthGuidanceError(server, opts.reference, oauthOnly);
 
   const { runOAuthFlow } = await import("./oauth.js");
-  await runOAuthFlow({ client, server, org: opts.org, backendType: opts.backendType });
+  await runOAuthFlow({
+    client,
+    server,
+    org: opts.org,
+    consoleURL: opts.consoleURL,
+    probeLocalConsole: opts.probeLocalConsole,
+  });
 }
 
 // Turn a strict-resolution failure into actionable guidance. A declared-but-unset
 // variable is the user's to provide; an undeclared one is a bug in the server
 // definition. Both are far clearer than the cryptic subprocess crash (ENOENT on a
 // literal "${VAR}" path) that motivated issue #141.
-function unresolvedEnvError(server: McpServer, err: PlaceholderResolutionError): UsageError {
-  const slug = server.metadata?.slug ?? server.metadata?.name ?? server.metadata?.id ?? "this server";
+function unresolvedEnvError(
+  server: McpServer,
+  err: PlaceholderResolutionError,
+): UsageError {
+  const slug =
+    server.metadata?.slug ??
+    server.metadata?.name ??
+    server.metadata?.id ??
+    "this server";
   const decl = server.spec?.env?.[err.variableName];
   if (decl) {
     const hint = decl.description !== "" ? ` (${decl.description})` : "";
@@ -210,7 +254,11 @@ function unresolvedEnvError(server: McpServer, err: PlaceholderResolutionError):
   );
 }
 
-function oauthGuidanceError(server: McpServer, reference: string, oauthOnly: boolean): UsageError {
+function oauthGuidanceError(
+  server: McpServer,
+  reference: string,
+  oauthOnly: boolean,
+): UsageError {
   const slug = server.metadata?.slug ?? server.metadata?.name ?? reference;
   const choices = [
     "  - Re-run this command in an interactive terminal to complete OAuth in your browser",
@@ -218,7 +266,9 @@ function oauthGuidanceError(server: McpServer, reference: string, oauthOnly: boo
   // Only offer the manual-token route for servers that actually accept one.
   // Suggesting it for an oauth_only endpoint would send the user down a dead end.
   if (!oauthOnly) {
-    choices.push(`  - Provide credentials directly: stigmer connect mcp-server ${slug} --env TOKEN=...`);
+    choices.push(
+      `  - Provide credentials directly: stigmer connect mcp-server ${slug} --env TOKEN=...`,
+    );
   }
   return new UsageError(
     `MCP server '${slug}' requires OAuth authentication, which needs an interactive terminal.\n\n` +
@@ -241,7 +291,10 @@ function oauthOnlyEnvError(server: McpServer, reference: string): UsageError {
 // --dry-run discovers locally, but an oauth_only endpoint needs an OAuth token
 // that only the backend can obtain and store — there is nothing valid to send
 // from the caller's machine. Say so plainly instead of attempting a doomed 401.
-function oauthOnlyDryRunError(server: McpServer, reference: string): UsageError {
+function oauthOnlyDryRunError(
+  server: McpServer,
+  reference: string,
+): UsageError {
   const slug = server.metadata?.slug ?? server.metadata?.name ?? reference;
   return new UsageError(
     `MCP server '${slug}' requires OAuth, so --dry-run cannot discover it locally — its endpoint only accepts an OAuth token that the connected backend obtains for you.\n` +

package/src/resources/connect/oauth.test.ts

@@ -3,7 +3,12 @@ import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1
 import type { Stigmer } from "@stigmer/sdk";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { UsageError } from "../../errors/index.js";
-import { browserCommand, runOAuthFlow, waitForOAuthGrant, type OAuthFlowDeps } from "./oauth.js";
+import {
+  browserCommand,
+  runOAuthFlow,
+  waitForOAuthGrant,
+  type OAuthFlowDeps,
+} from "./oauth.js";
 
 const server = create(McpServerSchema, {
   metadata: { id: "mcp_1", slug: "github", name: "GitHub" },
@@ -11,7 +16,10 @@ const server = create(McpServerSchema, {
 
 // A fake client whose getOAuthGrantStatus reports `connected` once the call
 // count reaches `connectOnCall` (1 = first poll). Records the call count.
-function fakeClient(connectOnCall: number): { client: Stigmer; calls: () => number } {
+function fakeClient(connectOnCall: number): {
+  client: Stigmer;
+  calls: () => number;
+} {
   let calls = 0;
   const client = {
     mcpServer: {
@@ -28,9 +36,18 @@ const noopSleep = async (): Promise<void> => {};
 
 describe("browserCommand", () => {
   it("maps each supported platform to its opener", () => {
-    expect(browserCommand("darwin", "https://x")).toEqual(["open", ["https://x"]]);
-    expect(browserCommand("linux", "https://x")).toEqual(["xdg-open", ["https://x"]]);
-    expect(browserCommand("win32", "https://x")).toEqual(["rundll32", ["url.dll,FileProtocolHandler", "https://x"]]);
+    expect(browserCommand("darwin", "https://x")).toEqual([
+      "open",
+      ["https://x"],
+    ]);
+    expect(browserCommand("linux", "https://x")).toEqual([
+      "xdg-open",
+      ["https://x"],
+    ]);
+    expect(browserCommand("win32", "https://x")).toEqual([
+      "rundll32",
+      ["url.dll,FileProtocolHandler", "https://x"],
+    ]);
   });
 
   it("returns no command for unsupported platforms", () => {
@@ -45,7 +62,8 @@ describe("waitForOAuthGrant", () => {
       client,
       server,
       org: "acme",
-      backendType: "cloud",
+      consoleURL: "https://app.stigmer.ai",
+      probeLocalConsole: false,
       now: () => 0,
       sleep: noopSleep,
       log: () => {},
@@ -63,7 +81,8 @@ describe("waitForOAuthGrant", () => {
       client,
       server,
       org: "acme",
-      backendType: "cloud",
+      consoleURL: "https://app.stigmer.ai",
+      probeLocalConsole: false,
       now: () => clock.shift() ?? 10 * 60 * 1000,
       sleep: noopSleep,
       log: () => {},
@@ -85,13 +104,16 @@ describe("runOAuthFlow", () => {
       client,
       server,
       org: "acme",
-      backendType: "cloud",
+      consoleURL: "https://app.stigmer.ai",
+      probeLocalConsole: false,
       openBrowser,
       now: () => 0,
       sleep: noopSleep,
       log: () => {},
     });
-    expect(openBrowser).toHaveBeenCalledWith("https://app.stigmer.ai/acme/mcp-servers/github");
+    expect(openBrowser).toHaveBeenCalledWith(
+      "https://app.stigmer.ai/acme/mcp-servers/github",
+    );
   });
 
   it("aborts before opening the browser when the local console is unreachable", async () => {
@@ -102,7 +124,8 @@ describe("runOAuthFlow", () => {
         client,
         server,
         org: "acme",
-        backendType: "local",
+        consoleURL: "http://localhost:7234",
+        probeLocalConsole: true,
         probeConsole: async () => false,
         openBrowser,
         now: () => 0,
@@ -120,13 +143,16 @@ describe("runOAuthFlow", () => {
       client,
       server,
       org: "acme",
-      backendType: "local",
+      consoleURL: "http://localhost:7234",
+      probeLocalConsole: true,
       probeConsole: async () => true,
       openBrowser,
       now: () => 0,
       sleep: noopSleep,
       log: () => {},
     });
-    expect(openBrowser).toHaveBeenCalledWith("http://localhost:7234/acme/mcp-servers/github");
+    expect(openBrowser).toHaveBeenCalledWith(
+      "http://localhost:7234/acme/mcp-servers/github",
+    );
   });
 });

package/src/resources/connect/oauth.ts

@@ -15,8 +15,6 @@ import { create } from "@bufbuild/protobuf";
 import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import { GetOAuthGrantStatusInputSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
 import type { Stigmer } from "@stigmer/sdk";
-import type { BackendType } from "../../config/config.js";
-import { resolveConsoleURL } from "../../config/index.js";
 import { UsageError } from "../../errors/index.js";
 
 const POLL_INTERVAL_MS = 3000;
@@ -28,7 +26,11 @@ export interface OAuthFlowDeps {
   readonly client: Stigmer;
   readonly server: McpServer;
   readonly org: string;
-  readonly backendType: BackendType;
+  /** The web console origin (resolveConsoleURL over the caller's config). */
+  readonly consoleURL: string;
+  /** Probe the console before opening the browser (the local daemon's
+   * console may simply not be running; remote consoles answer or 404). */
+  readonly probeLocalConsole: boolean;
   /** Opens the page URL in the user's browser. Defaults to the OS opener. */
   readonly openBrowser?: (url: string) => Promise<void>;
   /** Probes whether the local web console is reachable. Defaults to a 2s GET. */
@@ -48,11 +50,12 @@ export interface OAuthFlowDeps {
  */
 export async function runOAuthFlow(deps: OAuthFlowDeps): Promise<void> {
   const log = deps.log ?? stderrLog;
-  const consoleURL = resolveConsoleURL(deps.backendType);
+  const consoleURL = deps.consoleURL;
 
-  if (deps.backendType === "local") {
+  if (deps.probeLocalConsole) {
     const probe = deps.probeConsole ?? probeWebConsole;
-    if (!(await probe(consoleURL))) throw consoleUnavailableError(deps.server.metadata?.slug ?? "<slug>");
+    if (!(await probe(consoleURL)))
+      throw consoleUnavailableError(deps.server.metadata?.slug ?? "<slug>");
   }
 
   const slug = deps.server.metadata?.slug ?? "";
@@ -67,7 +70,9 @@ export async function runOAuthFlow(deps: OAuthFlowDeps): Promise<void> {
   try {
     await open(pageURL);
   } catch {
-    log("  Could not open browser automatically. Please open the URL above in your browser.");
+    log(
+      "  Could not open browser automatically. Please open the URL above in your browser.",
+    );
   }
 
   await waitForOAuthGrant(deps);
@@ -89,7 +94,9 @@ export async function waitForOAuthGrant(deps: OAuthFlowDeps): Promise<void> {
   for (;;) {
     await sleep(POLL_INTERVAL_MS);
     if (now() >= deadline) {
-      throw new UsageError("timed out waiting for OAuth connection — please try again");
+      throw new UsageError(
+        "timed out waiting for OAuth connection — please try again",
+      );
     }
     if (await checkOAuthGrant(deps.client, serverId, deps.org)) {
       log("OAuth connection established.\n");
@@ -99,7 +106,11 @@ export async function waitForOAuthGrant(deps: OAuthFlowDeps): Promise<void> {
 }
 
 /** Query the backend for an existing/just-created OAuth grant. */
-export async function checkOAuthGrant(client: Stigmer, mcpServerId: string, org: string): Promise<boolean> {
+export async function checkOAuthGrant(
+  client: Stigmer,
+  mcpServerId: string,
+  org: string,
+): Promise<boolean> {
   const status = await client.mcpServer.getOAuthGrantStatus(
     create(GetOAuthGrantStatusInputSchema, { resourceId: mcpServerId, org }),
   );
@@ -110,7 +121,9 @@ export async function checkOAuthGrant(client: Stigmer, mcpServerId: string, org:
 // an error status) means it's serving; a network/timeout failure means it isn't.
 async function probeWebConsole(url: string): Promise<boolean> {
   try {
-    const response = await fetch(url, { signal: AbortSignal.timeout(CONSOLE_PROBE_TIMEOUT_MS) });
+    const response = await fetch(url, {
+      signal: AbortSignal.timeout(CONSOLE_PROBE_TIMEOUT_MS),
+    });
     // Drain the body so the socket can close promptly.
     await response.body?.cancel();
     return true;
@@ -153,7 +166,10 @@ function openInBrowser(url: string): Promise<void> {
 }
 
 /** The OS-specific command + args to open a URL. Exported for tests. */
-export function browserCommand(platform: NodeJS.Platform, url: string): [string | undefined, string[]] {
+export function browserCommand(
+  platform: NodeJS.Platform,
+  url: string,
+): [string | undefined, string[]] {
   switch (platform) {
     case "darwin":
       return ["open", [url]];