godot-cli 0.16.2 → 0.17.1

package/dist/lib/install-server.d.ts

@@ -0,0 +1,25 @@
+import type { InstallServerOptions, InstallServerResult } from './types.js';
+/** Relative path of the CLI-managed server dir inside a project (design 06: "the CLI's managed directory"). */
+export declare const MANAGED_SERVER_REL_DIR: string;
+/** Absolute path of the CLI-managed server directory for a project. */
+export declare function getManagedServerDir(projectPath: string): string;
+/** Absolute path of the managed server executable for a project (the file the `configure` proxy spawns). */
+export declare function getManagedServerExecutablePath(projectPath: string, platform?: NodeJS.Platform): string;
+/**
+ * Install the shared `gamedev-mcp-server` binary into the CLI-managed directory
+ * `<project>/.ai-game-dev/server/` — the `install-plugin --with-server` flow (D12).
+ *
+ *  1. Download path (default): resolve the host RID, download the RID-matched
+ *     `gamedev-mcp-server-<rid>.zip` from github.com only (fail-closed host
+ *     trust), download the release `SHA256SUMS`, and VERIFY the zip's SHA256
+ *     against the manifest BEFORE extraction (fail-closed — any non-`verified`
+ *     verdict aborts and leaves the project untouched). Then extract + swap.
+ *  2. Local path (`--server-source`): copy a trusted local server dir / `.zip`
+ *     into the managed dir with no network + no checksum (the local artifact is
+ *     trusted). Offline / dev / CI.
+ *
+ * Library-safe: no stdout noise, no `process.exit`, no throws past the boundary;
+ * returns a `{ kind }` union. Materializes into a temp sibling and swaps only on
+ * full success, so a partial download/extract is rolled back.
+ */
+export declare function installServer(opts: InstallServerOptions): Promise<InstallServerResult>;

package/dist/lib/install-server.js

@@ -0,0 +1,234 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { DEFAULT_SERVER_VERSION, detectHostRid, serverDownloadUrl, serverAssetName, serverExecutableFileName, sha256SumsUrl, assertTrustedServerUrl, verifyZipChecksum, checksumFailureReason, sha256Hex, } from '../utils/server-source.js';
+import { parseZip } from '../utils/unzip.js';
+import { emitProgress } from './progress.js';
+/** Relative path of the CLI-managed server dir inside a project (design 06: "the CLI's managed directory"). */
+export const MANAGED_SERVER_REL_DIR = path.join('.ai-game-dev', 'server');
+/** Absolute path of the CLI-managed server directory for a project. */
+export function getManagedServerDir(projectPath) {
+    return path.join(projectPath, MANAGED_SERVER_REL_DIR);
+}
+/** Absolute path of the managed server executable for a project (the file the `configure` proxy spawns). */
+export function getManagedServerExecutablePath(projectPath, platform = process.platform) {
+    return path.join(getManagedServerDir(projectPath), serverExecutableFileName(platform));
+}
+/**
+ * Install the shared `gamedev-mcp-server` binary into the CLI-managed directory
+ * `<project>/.ai-game-dev/server/` — the `install-plugin --with-server` flow (D12).
+ *
+ *  1. Download path (default): resolve the host RID, download the RID-matched
+ *     `gamedev-mcp-server-<rid>.zip` from github.com only (fail-closed host
+ *     trust), download the release `SHA256SUMS`, and VERIFY the zip's SHA256
+ *     against the manifest BEFORE extraction (fail-closed — any non-`verified`
+ *     verdict aborts and leaves the project untouched). Then extract + swap.
+ *  2. Local path (`--server-source`): copy a trusted local server dir / `.zip`
+ *     into the managed dir with no network + no checksum (the local artifact is
+ *     trusted). Offline / dev / CI.
+ *
+ * Library-safe: no stdout noise, no `process.exit`, no throws past the boundary;
+ * returns a `{ kind }` union. Materializes into a temp sibling and swaps only on
+ * full success, so a partial download/extract is rolled back.
+ */
+export async function installServer(opts) {
+    const warnings = [];
+    const platform = process.platform;
+    try {
+        const projectPath = path.resolve(opts.godotProjectPath);
+        if (!fs.existsSync(projectPath)) {
+            throw new Error(`Project path does not exist: ${projectPath}`);
+        }
+        const serverDir = getManagedServerDir(projectPath);
+        if (opts.source !== undefined && opts.source !== '') {
+            return installFromLocal(projectPath, serverDir, opts.source, platform, warnings, opts.onProgress);
+        }
+        return await installFromDownload(projectPath, serverDir, platform, warnings, opts);
+    }
+    catch (err) {
+        return {
+            kind: 'failure',
+            success: false,
+            warnings,
+            error: err instanceof Error ? err : new Error(String(err)),
+        };
+    }
+}
+async function installFromDownload(projectPath, serverDir, platform, warnings, opts) {
+    const rid = (opts.rid ?? detectHostRid()).trim();
+    if (rid.includes('unknown')) {
+        throw new Error(`Cannot detect a supported host RID (got "${rid}"). Use --server-source <path> to install a server binary manually.`);
+    }
+    const version = (opts.version ?? DEFAULT_SERVER_VERSION).trim();
+    if (version === '') {
+        throw new Error('No server version to download. Pass --server-version <x.y.z> or --server-source <path>.');
+    }
+    const url = serverDownloadUrl(version, rid);
+    assertTrustedServerUrl(url);
+    const assetName = serverAssetName(rid);
+    const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    emitProgress(opts.onProgress, {
+        phase: 'server-downloading',
+        message: `Downloading ${assetName} (${version}) from ${url}`,
+        url,
+    });
+    const zipResponse = await fetchImpl(url);
+    if (!zipResponse.ok) {
+        throw new Error(`Failed to download server ${version} for ${rid}: HTTP ${zipResponse.status} ${zipResponse.statusText} from ${url}. ` +
+            `Verify the release v${version} exists with a ${assetName} asset, or use --server-source <path>.`);
+    }
+    const archive = Buffer.from(await zipResponse.arrayBuffer());
+    // Fail-closed integrity: download SHA256SUMS + verify BEFORE extraction.
+    const sumsUrl = sha256SumsUrl(version);
+    assertTrustedServerUrl(sumsUrl);
+    emitProgress(opts.onProgress, { phase: 'server-verifying', message: `Verifying against ${sumsUrl}` });
+    const sumsResponse = await fetchImpl(sumsUrl);
+    if (!sumsResponse.ok) {
+        throw new Error(`Refusing to install an unverified server: could not download ${sumsUrl} (HTTP ${sumsResponse.status}). ` +
+            `The release must publish a SHA256SUMS manifest.`);
+    }
+    const sumsText = await sumsResponse.text();
+    const actualDigest = sha256Hex(archive);
+    const verdict = verifyZipChecksum(sumsText, assetName, actualDigest);
+    if (verdict !== 'verified') {
+        throw new Error(`Refusing to install server ${version} for ${rid}: ${checksumFailureReason(verdict, assetName)} (fail-closed).`);
+    }
+    emitProgress(opts.onProgress, { phase: 'server-extracting', message: 'Extracting verified server zip' });
+    const entries = parseZip(archive);
+    stageThenSwap(projectPath, serverDir, (staging) => extractServerEntries(entries, staging));
+    const executablePath = resolveExecutable(serverDir, platform);
+    if (executablePath === null) {
+        throw new Error(`Server zip extracted but no ${serverExecutableFileName(platform)} was found under ${serverDir} — the archive is not a valid server release.`);
+    }
+    makeExecutable(executablePath, platform);
+    emitProgress(opts.onProgress, {
+        phase: 'server-materialized',
+        message: `Downloaded + verified server to ${serverDir}`,
+        serverDir,
+        source: 'download',
+    });
+    return {
+        kind: 'success',
+        success: true,
+        source: 'download',
+        rid,
+        version,
+        serverDir,
+        executablePath,
+        downloadUrl: url,
+        warnings,
+    };
+}
+function installFromLocal(projectPath, serverDir, source, platform, warnings, onProgress) {
+    const resolved = path.resolve(source);
+    if (!fs.existsSync(resolved)) {
+        throw new Error(`--server-source ${resolved} does not exist.`);
+    }
+    emitProgress(onProgress, { phase: 'server-extracting', message: `Installing server from ${resolved}` });
+    const stat = fs.statSync(resolved);
+    if (stat.isFile() && resolved.toLowerCase().endsWith('.zip')) {
+        const entries = parseZip(fs.readFileSync(resolved));
+        stageThenSwap(projectPath, serverDir, (staging) => extractServerEntries(entries, staging));
+    }
+    else if (stat.isDirectory()) {
+        stageThenSwap(projectPath, serverDir, (staging) => {
+            fs.cpSync(resolved, staging, { recursive: true });
+        });
+    }
+    else {
+        throw new Error(`--server-source ${resolved} must be a directory or a .zip archive.`);
+    }
+    const executablePath = resolveExecutable(serverDir, platform);
+    if (executablePath === null) {
+        throw new Error(`--server-source ${resolved} did not yield a ${serverExecutableFileName(platform)} under ${serverDir}.`);
+    }
+    makeExecutable(executablePath, platform);
+    emitProgress(onProgress, {
+        phase: 'server-materialized',
+        message: `Copied server from ${resolved}`,
+        serverDir,
+        source: 'local',
+    });
+    return {
+        kind: 'success',
+        success: true,
+        source: 'local',
+        rid: detectHostRid(),
+        version: '',
+        serverDir,
+        executablePath,
+        warnings,
+    };
+}
+/**
+ * Write every zip entry into `staging` (no `addons/` prefix stripping — the
+ * server zip expands to the binary + deps at the archive root). Path-safety:
+ * reject zip-slip `../` traversal escaping the staging dir.
+ */
+function extractServerEntries(entries, staging) {
+    for (const entry of entries) {
+        if (entry.path === '')
+            continue;
+        const target = path.resolve(staging, entry.path);
+        if (target !== staging && !target.startsWith(staging + path.sep)) {
+            throw new Error(`Refusing to extract entry escaping the server dir: ${entry.path}`);
+        }
+        if (entry.isDirectory) {
+            fs.mkdirSync(target, { recursive: true });
+            continue;
+        }
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+        fs.writeFileSync(target, entry.bytes);
+    }
+}
+/** Locate the server executable at the managed-dir root, else one level down. Null when absent. */
+function resolveExecutable(serverDir, platform) {
+    const exeName = serverExecutableFileName(platform);
+    const atRoot = path.join(serverDir, exeName);
+    if (fs.existsSync(atRoot))
+        return atRoot;
+    // Self-contained builds sometimes nest under a single top dir; search one level.
+    let children;
+    try {
+        children = fs.readdirSync(serverDir);
+    }
+    catch {
+        return null;
+    }
+    for (const child of children) {
+        const candidate = path.join(serverDir, child, exeName);
+        if (fs.existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}
+/** Mark the executable runnable on POSIX (no-op on Windows). Best-effort. */
+function makeExecutable(executablePath, platform) {
+    if (platform === 'win32')
+        return;
+    try {
+        fs.chmodSync(executablePath, 0o755);
+    }
+    catch {
+        // Best-effort; never fail the install over a chmod.
+    }
+}
+/**
+ * Fill a fresh staging sibling, then atomically swap it into `serverDir`. A mid-
+ * fill failure discards staging and leaves any existing managed server untouched.
+ */
+function stageThenSwap(projectPath, serverDir, fill) {
+    const serverReal = path.resolve(serverDir);
+    const staging = path.resolve(projectPath, `.gamedev-server-staging-${process.pid}-${Date.now()}`);
+    fs.rmSync(staging, { recursive: true, force: true });
+    fs.mkdirSync(staging, { recursive: true });
+    try {
+        fill(staging);
+        fs.rmSync(serverReal, { recursive: true, force: true });
+        fs.mkdirSync(path.dirname(serverReal), { recursive: true });
+        fs.renameSync(staging, serverReal);
+    }
+    finally {
+        fs.rmSync(staging, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=install-server.js.map

package/dist/lib/install-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-server.js","sourceRoot":"","sources":["../../src/lib/install-server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,EACrB,SAAS,GACV,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAiB,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,+GAA+G;AAC/G,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;AAE1E,uEAAuE;AACvE,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;AACxD,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,8BAA8B,CAC5C,WAAmB,EACnB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,OAAO,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAA0B;IAC5D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,gCAAgC,WAAW,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEnD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACpD,OAAO,gBAAgB,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACpG,CAAC;QAED,OAAO,MAAM,mBAAmB,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,KAAK;YACd,QAAQ;YACR,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;SAC3D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,WAAmB,EACnB,SAAiB,EACjB,QAAyB,EACzB,QAAkB,EAClB,IAA0B;IAE1B,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,4CAA4C,GAAG,qEAAqE,CACrH,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,sBAAsB,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC5C,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAEvC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAErD,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE;QAC5B,KAAK,EAAE,oBAAoB;QAC3B,OAAO,EAAE,eAAe,SAAS,KAAK,OAAO,UAAU,GAAG,EAAE;QAC5D,GAAG;KACJ,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,6BAA6B,OAAO,QAAQ,GAAG,UAAU,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,UAAU,SAAS,GAAG,IAAI;YACnH,uBAAuB,OAAO,kBAAkB,SAAS,wCAAwC,CACpG,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;IAE7D,yEAAyE;IACzE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACvC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,qBAAqB,OAAO,EAAE,EAAE,CAAC,CAAC;IACtG,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,gEAAgE,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK;YACvG,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACrE,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,8BAA8B,OAAO,QAAQ,GAAG,KAAK,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,iBAAiB,CAChH,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAE3F,MAAM,cAAc,GAAG,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9D,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,+BAA+B,wBAAwB,CAAC,QAAQ,CAAC,oBAAoB,SAAS,+CAA+C,CAC9I,CAAC;IACJ,CAAC;IACD,cAAc,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IAEzC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE;QAC5B,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EAAE,mCAAmC,SAAS,EAAE;QACvD,SAAS;QACT,MAAM,EAAE,UAAU;KACnB,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,UAAU;QAClB,GAAG;QACH,OAAO;QACP,SAAS;QACT,cAAc;QACd,WAAW,EAAE,GAAG;QAChB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,WAAmB,EACnB,SAAiB,EACjB,MAAc,EACd,QAAyB,EACzB,QAAkB,EAClB,UAA6B;IAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,kBAAkB,CAAC,CAAC;IACjE,CAAC;IAED,YAAY,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,0BAA0B,QAAQ,EAAE,EAAE,CAAC,CAAC;IAExG,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpD,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9B,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;YAChD,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,yCAAyC,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,cAAc,GAAG,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9D,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,oBAAoB,wBAAwB,CAAC,QAAQ,CAAC,UAAU,SAAS,GAAG,CACxG,CAAC;IACJ,CAAC;IACD,cAAc,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IAEzC,YAAY,CAAC,UAAU,EAAE;QACvB,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EAAE,sBAAsB,QAAQ,EAAE;QACzC,SAAS;QACT,MAAM,EAAE,OAAO;KAChB,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,OAAO;QACf,GAAG,EAAE,aAAa,EAAE;QACpB,OAAO,EAAE,EAAE;QACX,SAAS;QACT,cAAc;QACd,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,OAAmB,EAAE,OAAe;IAChE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE;YAAE,SAAS;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,sDAAsD,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,SAAS,iBAAiB,CAAC,SAAiB,EAAE,QAAyB;IACrE,MAAM,OAAO,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACzC,iFAAiF;IACjF,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAC7E,SAAS,cAAc,CAAC,cAAsB,EAAE,QAAyB;IACvE,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO;IACjC,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,WAAmB,EAAE,SAAiB,EAAE,IAA+B;IAC5F,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,2BAA2B,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAClG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,CAAC;QACd,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;AACH,CAAC"}

package/dist/lib/setup-mcp.d.ts

@@ -1,5 +1,33 @@
 import { CLOUD_MCP_URL, DEFAULT_CUSTOM_HOST } from '../utils/connection.js';
 import type { SetupMcpOptions, SetupMcpResult } from './types.js';
+/**
+ * Decide whether `setup-mcp` writes a static `Authorization: Bearer` header for a
+ * given agent + credential (design decision D11 / auth Flow A & C, mirroring the
+ * shared b6 configurators' `SupportsOAuth` policy).
+ *
+ * OAuth-capable interactive clients (Claude Code, Cursor, Codex, Copilot, …)
+ * perform native RFC 9728 discovery + OAuth against the hosted endpoint (Flow A).
+ * A static Bearer header BOTH fails there (the hosted AS rejects the token with
+ * 401) AND suppresses the client's own OAuth handshake ("OAuth fallback is
+ * disabled when headers.Authorization is set"), so it must be omitted — the
+ * config stays URL-only `{type,url}`.
+ *
+ * A header is written ONLY for the Flow C fallback:
+ *   - `supportsOAuth === false` — a client that cannot OAuth and needs a static
+ *     token against a required-auth (typically self-hosted) endpoint; OR
+ *   - an EXPLICIT PAT opt-in — the caller passed the token explicitly (`--token`
+ *     / the library `token` arg), a deliberate Flow C request.
+ *
+ * A token that is only present ambiently (the `GODOT_MCP_TOKEN` env a prior
+ * `login` set) is NOT an opt-in: for an OAuth-capable client it is ignored so the
+ * native handshake runs. This is the flagship g1 fix — `login` + `setup-mcp
+ * claude-code .` must no longer emit a header.
+ */
+export declare function shouldWriteAuthHeader(input: {
+    hasToken: boolean;
+    explicitToken: boolean;
+    supportsOAuth: boolean;
+}): boolean;
 /**
  * Write MCP configuration for the given AI agent so it can talk to a Godot-MCP
  * server. Library-safe: no stdout noise, no process.exit, no throws past the

package/dist/lib/setup-mcp.js

@@ -33,6 +33,41 @@ function resolveMcpClientUrl(optUrl) {
         return trimmed;
     return trimmed + MCP_HUB_PATH;
 }
+/**
+ * Decide whether `setup-mcp` writes a static `Authorization: Bearer` header for a
+ * given agent + credential (design decision D11 / auth Flow A & C, mirroring the
+ * shared b6 configurators' `SupportsOAuth` policy).
+ *
+ * OAuth-capable interactive clients (Claude Code, Cursor, Codex, Copilot, …)
+ * perform native RFC 9728 discovery + OAuth against the hosted endpoint (Flow A).
+ * A static Bearer header BOTH fails there (the hosted AS rejects the token with
+ * 401) AND suppresses the client's own OAuth handshake ("OAuth fallback is
+ * disabled when headers.Authorization is set"), so it must be omitted — the
+ * config stays URL-only `{type,url}`.
+ *
+ * A header is written ONLY for the Flow C fallback:
+ *   - `supportsOAuth === false` — a client that cannot OAuth and needs a static
+ *     token against a required-auth (typically self-hosted) endpoint; OR
+ *   - an EXPLICIT PAT opt-in — the caller passed the token explicitly (`--token`
+ *     / the library `token` arg), a deliberate Flow C request.
+ *
+ * A token that is only present ambiently (the `GODOT_MCP_TOKEN` env a prior
+ * `login` set) is NOT an opt-in: for an OAuth-capable client it is ignored so the
+ * native handshake runs. This is the flagship g1 fix — `login` + `setup-mcp
+ * claude-code .` must no longer emit a header.
+ */
+export function shouldWriteAuthHeader(input) {
+    if (!input.hasToken)
+        return false;
+    if (input.supportsOAuth === false)
+        return true;
+    return input.explicitToken;
+}
+/** True when `configPath` resolves inside `projectPath` (a project-scoped, likely VCS-tracked file). */
+function isInsideProject(projectPath, configPath) {
+    const rel = path.relative(projectPath, configPath);
+    return rel.length > 0 && !rel.startsWith('..') && !path.isAbsolute(rel);
+}
 /**
  * Write MCP configuration for the given AI agent so it can talk to a Godot-MCP
  * server. Library-safe: no stdout noise, no process.exit, no throws past the
@@ -80,10 +115,35 @@ export async function setupMcp(opts) {
             message: `Configuring ${agent.name} for ${projectPath}`,
         });
         const serverUrl = resolveMcpClientUrl(opts.url);
+        // A token supplied EXPLICITLY by the caller (`--token` / the library `token`
+        // arg) is a deliberate Flow C PAT opt-in; a token that is only present in the
+        // ambient `GODOT_MCP_TOKEN` env (e.g. one a prior `login` set) is NOT.
+        const explicitToken = typeof opts.token === 'string' && opts.token.length > 0;
         const token = opts.token ?? normalizeEnv(process.env[ENV_TOKEN]) ?? '';
-        const authRequired = token.length > 0;
+        // OAuth-aware header gate (design D11 / auth Flow A & C): OAuth-capable clients
+        // get a credential-free, URL-only config so their native RFC 9728 OAuth runs;
+        // a static Authorization header is written only for a non-OAuth client or an
+        // explicit PAT opt-in. See `shouldWriteAuthHeader`.
+        const authRequired = shouldWriteAuthHeader({
+            hasToken: token.length > 0,
+            explicitToken,
+            supportsOAuth: agent.supportsOAuth,
+        });
         const configPath = agent.getConfigPath(projectPath);
         const props = agent.getHttpProps(serverUrl, token, authRequired);
+        // Flow C safety: a static PAT written into a project-scoped config file is a
+        // VCS leak risk — warn so the user prefers an env var / user-scoped config (or
+        // relies on native OAuth by omitting the token). Gate on whether a static
+        // header was ACTUALLY emitted into `props`, not merely on `authRequired`:
+        // agents whose `getHttpProps` ignore the token (e.g. Codex / Antigravity)
+        // write no `headers`, so an explicit `--token` there must NOT raise a "leaked
+        // credential" warning about a header that was never written to the file.
+        const wroteAuthHeader = Boolean(props.headers);
+        if (wroteAuthHeader && isInsideProject(projectPath, configPath)) {
+            warnings.push(`Wrote a static Authorization (PAT) header into the project-scoped config ${configPath}. ` +
+                `Committing this file would leak the credential — prefer setting ${ENV_TOKEN} in your ` +
+                `environment or a user-scoped config, or omit the token to use the client's native OAuth.`);
+        }
         if (agent.configFormat === 'toml') {
             writeTomlAgentConfig(configPath, agent.bodyPath, MCP_SERVER_NAME, props, agent.httpRemoveKeys);
         }

package/dist/lib/setup-mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-mcp.js","sourceRoot":"","sources":["../../src/lib/setup-mcp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,QAAQ,EACR,SAAS,EACT,YAAY,GACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAGtD;;;GAGG;AACH,SAAS,YAAY,CAAC,GAAuB;IAC3C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,MAA0B;IACrD,MAAM,IAAI,GAAG,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,aAAa,CAAC;IAEhC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,OAAO,CAAC;IACjE,OAAO,OAAO,GAAG,YAAY,CAAC;AAChC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAqB;IAClD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,CAAC;QACH,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3E,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,KAAK;gBACd,QAAQ;gBACR,KAAK,EAAE,IAAI,KAAK,CAAC,6CAA6C,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;aAC1F,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,KAAK;gBACd,QAAQ;gBACR,KAAK,EAAE,IAAI,KAAK,CACd,mBAAmB,IAAI,CAAC,OAAO,2BAA2B,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrF;aACF,CAAC;QACJ,CAAC;QAED,+EAA+E;QAC/E,IAAI,WAAmB,CAAC;QACxB,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC7D,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;YAC/E,CAAC;YACD,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE;YAC5B,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,eAAe,KAAK,CAAC,IAAI,QAAQ,WAAW,EAAE;SACxD,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAEtC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAEjE,IAAI,KAAK,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YAClC,oBAAoB,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACjG,CAAC;aAAM,CAAC;YACN,oBAAoB,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACjG,CAAC;QAED,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE;YAC5B,KAAK,EAAE,kBAAkB;YACzB,OAAO,EAAE,SAAS,UAAU,EAAE;YAC9B,YAAY,EAAE,UAAU;SACzB,CAAC,CAAC;QAEH,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,2BAA2B,EAAE,CAAC,CAAC;QAEpG,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,UAAU;YACV,SAAS;YACT,QAAQ;SACT,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,KAAK;YACd,QAAQ;YACR,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;SAC3D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,YAAY;IAC1B,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC;AAED,kFAAkF;AAClF,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC"}
+{"version":3,"file":"setup-mcp.js","sourceRoot":"","sources":["../../src/lib/setup-mcp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,QAAQ,EACR,SAAS,EACT,YAAY,GACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAGtD;;;GAGG;AACH,SAAS,YAAY,CAAC,GAAuB;IAC3C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,MAA0B;IACrD,MAAM,IAAI,GAAG,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,aAAa,CAAC;IAEhC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,OAAO,CAAC;IACjE,OAAO,OAAO,GAAG,YAAY,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAIrC;IACC,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,KAAK,CAAC,aAAa,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,KAAK,CAAC,aAAa,CAAC;AAC7B,CAAC;AAED,wGAAwG;AACxG,SAAS,eAAe,CAAC,WAAmB,EAAE,UAAkB;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACnD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAqB;IAClD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,CAAC;QACH,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3E,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,KAAK;gBACd,QAAQ;gBACR,KAAK,EAAE,IAAI,KAAK,CAAC,6CAA6C,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;aAC1F,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,KAAK;gBACd,QAAQ;gBACR,KAAK,EAAE,IAAI,KAAK,CACd,mBAAmB,IAAI,CAAC,OAAO,2BAA2B,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrF;aACF,CAAC;QACJ,CAAC;QAED,+EAA+E;QAC/E,IAAI,WAAmB,CAAC;QACxB,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC7D,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;YAC/E,CAAC;YACD,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE;YAC5B,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,eAAe,KAAK,CAAC,IAAI,QAAQ,WAAW,EAAE;SACxD,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,6EAA6E;QAC7E,8EAA8E;QAC9E,uEAAuE;QACvE,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QACvE,gFAAgF;QAChF,8EAA8E;QAC9E,6EAA6E;QAC7E,oDAAoD;QACpD,MAAM,YAAY,GAAG,qBAAqB,CAAC;YACzC,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC;YAC1B,aAAa;YACb,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAEjE,6EAA6E;QAC7E,+EAA+E;QAC/E,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,8EAA8E;QAC9E,yEAAyE;QACzE,MAAM,eAAe,GAAG,OAAO,CAAE,KAA+B,CAAC,OAAO,CAAC,CAAC;QAC1E,IAAI,eAAe,IAAI,eAAe,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC;YAChE,QAAQ,CAAC,IAAI,CACX,4EAA4E,UAAU,IAAI;gBACxF,mEAAmE,SAAS,WAAW;gBACvF,0FAA0F,CAC7F,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YAClC,oBAAoB,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACjG,CAAC;aAAM,CAAC;YACN,oBAAoB,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACjG,CAAC;QAED,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE;YAC5B,KAAK,EAAE,kBAAkB;YACzB,OAAO,EAAE,SAAS,UAAU,EAAE;YAC9B,YAAY,EAAE,UAAU;SACzB,CAAC,CAAC;QAEH,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,2BAA2B,EAAE,CAAC,CAAC;QAEpG,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,UAAU;YACV,SAAS;YACT,QAAQ;SACT,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,KAAK;YACd,QAAQ;YACR,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;SAC3D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,YAAY;IAC1B,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC;AAED,kFAAkF;AAClF,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/lib/types.d.ts

@@ -26,6 +26,28 @@ export type ProgressEvent = {
     phase: 'csproj-patched';
     message: string;
     csprojPath: string;
+} | {
+    phase: 'server-downloading';
+    message: string;
+    url: string;
+} | {
+    phase: 'server-verifying';
+    message: string;
+} | {
+    phase: 'server-extracting';
+    message: string;
+} | {
+    phase: 'server-materialized';
+    message: string;
+    serverDir: string;
+    source: 'download' | 'local';
+} | {
+    phase: 'enroll-redeeming';
+    message: string;
+} | {
+    phase: 'enroll-redeemed';
+    message: string;
+    serverTarget: string;
 } | {
     phase: 'project-scaffolded';
     message: string;
@@ -476,3 +498,119 @@ export interface InstallExtensionFailure {
     error: Error;
 }
 export type InstallExtensionResult = InstallExtensionSuccess | InstallExtensionFailure;
+export interface InstallServerOptions {
+    /** Absolute or relative path to the Godot project root (holds the managed server dir). */
+    godotProjectPath: string;
+    /**
+     * Local path to install the server from instead of downloading it (offline /
+     * dev / CI — the `--server-source` flag). May be a directory containing the
+     * server binary, or a `.zip` archive of one. When set, no network call is made
+     * and no checksum is verified (the local artifact is trusted).
+     */
+    source?: string;
+    /**
+     * Shared-server version to download (`v<version>` release on GameDev-MCP-Server).
+     * Defaults to the addon's pinned `ServerVersion`. Ignored when `source` is set.
+     */
+    version?: string;
+    /** Host RID override (`<os>-<arch>`). Defaults to the detected host RID. */
+    rid?: string;
+    /** Injectable fetch for tests (mock the GitHub download). Used only on the download path. */
+    fetchImpl?: typeof fetch;
+    onProgress?: ProgressCallback;
+}
+export interface InstallServerSuccess {
+    kind: 'success';
+    success: true;
+    /** Where the server binary came from. */
+    source: 'download' | 'local';
+    /** The host RID the binary was resolved for. */
+    rid: string;
+    /** The downloaded server version (empty on the local path). */
+    version: string;
+    /** Absolute path to the CLI-managed server directory the binary was extracted into. */
+    serverDir: string;
+    /** Absolute path to the resolved server executable. */
+    executablePath: string;
+    /** The download URL used (download path only). */
+    downloadUrl?: string;
+    warnings: string[];
+}
+export interface InstallServerFailure {
+    kind: 'failure';
+    success: false;
+    warnings: string[];
+    error: Error;
+}
+export type InstallServerResult = InstallServerSuccess | InstallServerFailure;
+export interface EnrollPluginOptions {
+    /** Absolute or relative path to the Godot project root (holds the project marker). */
+    godotProjectPath: string;
+    /** The D13 enrollment code to redeem. */
+    code: string;
+    /** Cloud AS base URL to redeem against (default https://ai-game.dev). */
+    baseUrl?: string;
+    /** Override the machine credential store directory (tests only). */
+    storeBaseDir?: string;
+    /** Injectable fetch for the redeem round-trip (tests). */
+    fetchImpl?: typeof fetch;
+    onProgress?: ProgressCallback;
+}
+export interface EnrollPluginSuccess {
+    kind: 'success';
+    success: true;
+    /** The server target the enrollment code was minted for (recorded in the marker). */
+    serverTarget: string;
+    /** The D14 routing pin recorded in the marker. */
+    pin: string;
+    /** The deterministic local port recorded for a localhost target (undefined for a hosted target). */
+    port?: number;
+    /** Absolute path to the machine credential store the plugin credential was written to. */
+    credentialsPath: string;
+    /** Absolute path to the project marker written. */
+    markerPath: string;
+    /** Absolute paths of any existing project-local agent configs whose URL was pin-upserted. */
+    pinnedConfigs: string[];
+    warnings: string[];
+}
+export interface EnrollPluginFailure {
+    kind: 'failure';
+    success: false;
+    warnings: string[];
+    error: Error;
+}
+export type EnrollPluginResult = EnrollPluginSuccess | EnrollPluginFailure;
+export interface ConfigureAgentOptions {
+    /** Absolute or relative path to the Godot project root (locates the managed server binary + is the config target). */
+    godotProjectPath: string;
+    /** The agent id to configure (forwarded verbatim to the server binary's `configure --agent`). */
+    agentId: string;
+    /** Explicit MCP server URL override (forwarded as `--url`). */
+    url?: string;
+    /** Injectable `child_process.spawn` for tests (mock the server binary). */
+    spawnImpl?: typeof import('child_process').spawn;
+    onProgress?: ProgressCallback;
+}
+export interface ConfigureAgentSuccess {
+    kind: 'success';
+    success: true;
+    agentId: string;
+    /** Absolute path to the managed server binary that was proxied to. */
+    serverBinaryPath: string;
+    /** The argv passed to the server binary (after the executable), for diagnostics. */
+    args: string[];
+    /** The server binary's exit code (0 on success). */
+    exitCode: number;
+    /** The server binary's captured stdout+stderr (surfaced to the user by the command). */
+    output: string;
+    warnings: string[];
+}
+export interface ConfigureAgentFailure {
+    kind: 'failure';
+    success: false;
+    /** The server binary's exit code when it ran and failed; undefined when it could not be launched. */
+    exitCode?: number;
+    warnings: string[];
+    error: Error;
+}
+export type ConfigureAgentResult = ConfigureAgentSuccess | ConfigureAgentFailure;

package/dist/lib.d.ts

@@ -6,6 +6,9 @@ export { setupMcp, listAgentIds } from './lib/setup-mcp.js';
 export { setupSkills } from './lib/setup-skills.js';
 export { installPlugin, removePlugin } from './lib/install-plugin.js';
 export { installExtension } from './lib/install-extension.js';
+export { installServer } from './lib/install-server.js';
+export { enrollPlugin } from './lib/enroll.js';
+export { configureAgentViaServer } from './lib/configure-agent.js';
 export { EXTENSIONS_CATALOG, findExtension, hasVersion } from './utils/extensions-catalog.js';
 export type { ExtensionDescriptor, ExtensionTool } from './utils/extensions-catalog.js';
-export type { ProgressEvent, ProgressCallback, ResultKind, OpenProjectOptions, OpenProjectResult, OpenProjectSuccess, OpenProjectFailure, OpenProjectAuthOption, OpenProjectConnectionMode, BuildProjectOptions, BuildProjectResult, BuildProjectSuccess, BuildProjectFailure, BuildSkipReason, CreateProjectOptions, CreateProjectResult, CreateProjectSuccess, CreateProjectFailure, RunToolOptions, RunToolResult, RunToolSuccess, RunToolFailure, RunToolFailureReason, RunSystemToolOptions, RunSystemToolResult, RunSystemToolSuccess, RunSystemToolFailure, SetupMcpOptions, SetupMcpResult, SetupMcpSuccess, SetupMcpFailure, SetupSkillsOptions, SetupSkillsResult, SetupSkillsSuccess, SetupSkillsFailure, InstallPluginOptions, InstallPluginResult, InstallPluginSuccess, InstallPluginFailure, AddonMaterializeOutcome, CsprojPatchOutcome, RemovePluginOptions, RemovePluginResult, RemovePluginSuccess, RemovePluginFailure, InstallExtensionOptions, InstallExtensionResult, InstallExtensionSuccess, InstallExtensionFailure, ExtensionInstallOutcome, } from './lib/types.js';
+export type { ProgressEvent, ProgressCallback, ResultKind, OpenProjectOptions, OpenProjectResult, OpenProjectSuccess, OpenProjectFailure, OpenProjectAuthOption, OpenProjectConnectionMode, BuildProjectOptions, BuildProjectResult, BuildProjectSuccess, BuildProjectFailure, BuildSkipReason, CreateProjectOptions, CreateProjectResult, CreateProjectSuccess, CreateProjectFailure, RunToolOptions, RunToolResult, RunToolSuccess, RunToolFailure, RunToolFailureReason, RunSystemToolOptions, RunSystemToolResult, RunSystemToolSuccess, RunSystemToolFailure, SetupMcpOptions, SetupMcpResult, SetupMcpSuccess, SetupMcpFailure, SetupSkillsOptions, SetupSkillsResult, SetupSkillsSuccess, SetupSkillsFailure, InstallPluginOptions, InstallPluginResult, InstallPluginSuccess, InstallPluginFailure, AddonMaterializeOutcome, CsprojPatchOutcome, RemovePluginOptions, RemovePluginResult, RemovePluginSuccess, RemovePluginFailure, InstallExtensionOptions, InstallExtensionResult, InstallExtensionSuccess, InstallExtensionFailure, ExtensionInstallOutcome, InstallServerOptions, InstallServerResult, InstallServerSuccess, InstallServerFailure, EnrollPluginOptions, EnrollPluginResult, EnrollPluginSuccess, EnrollPluginFailure, ConfigureAgentOptions, ConfigureAgentResult, ConfigureAgentSuccess, ConfigureAgentFailure, } from './lib/types.js';

package/dist/lib.js

@@ -20,6 +20,9 @@ export { setupMcp, listAgentIds } from './lib/setup-mcp.js';
 export { setupSkills } from './lib/setup-skills.js';
 export { installPlugin, removePlugin } from './lib/install-plugin.js';
 export { installExtension } from './lib/install-extension.js';
+export { installServer } from './lib/install-server.js';
+export { enrollPlugin } from './lib/enroll.js';
+export { configureAgentViaServer } from './lib/configure-agent.js';
 // Shared extension catalog (single-sourced from addons/godot_mcp/extensions.catalog.json)
 // + its lookup helpers, so the app can render the same list the dock + CLI install from.
 export { EXTENSIONS_CATALOG, findExtension, hasVersion } from './utils/extensions-catalog.js';

package/dist/lib.js.map

@@ -1 +1 @@
-{"version":3,"file":"lib.js","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,EAAE;AACF,eAAe;AACf,+EAA+E;AAC/E,wDAAwD;AACxD,oDAAoD;AACpD,yEAAyE;AACzE,4DAA4D;AAC5D,+EAA+E;AAC/E,gEAAgE;AAChE,6EAA6E;AAC7E,EAAE;AACF,0EAA0E;AAC1E,4CAA4C;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAE9D,0FAA0F;AAC1F,yFAAyF;AACzF,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC"}
+{"version":3,"file":"lib.js","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,EAAE;AACF,eAAe;AACf,+EAA+E;AAC/E,wDAAwD;AACxD,oDAAoD;AACpD,yEAAyE;AACzE,4DAA4D;AAC5D,+EAA+E;AAC/E,gEAAgE;AAChE,6EAA6E;AAC7E,EAAE;AACF,0EAA0E;AAC1E,4CAA4C;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,0FAA0F;AAC1F,yFAAyF;AACzF,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/utils/addon-deps.js

@@ -19,8 +19,8 @@
  * addon csproj (ReflectorNet first, then McpPlugin).
  */
 export const ADDON_PACKAGE_REFERENCES = [
-    { id: 'com.IvanMurzak.ReflectorNet', version: '5.3.1' },
-    { id: 'com.IvanMurzak.McpPlugin', version: '6.11.0' },
+    { id: 'com.IvanMurzak.ReflectorNet', version: '5.3.2' },
+    { id: 'com.IvanMurzak.McpPlugin', version: '7.0.0' },
 ];
 /**
  * The exact `<EmbeddedResource>`s the consumer's project `.csproj` needs, single-sourced

package/dist/utils/addon-deps.js.map

@@ -1 +1 @@
-{"version":3,"file":"addon-deps.js","sourceRoot":"","sources":["../../src/utils/addon-deps.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,mFAAmF;AACnF,oEAAoE;AACpE,8EAA8E;AAC9E,yEAAyE;AACzE,EAAE;AACF,6EAA6E;AAC7E,kFAAkF;AAClF,8EAA8E;AAC9E,4EAA4E;AAC5E,iFAAiF;AACjF,iFAAiF;AACjF,+CAA+C;AAC/C,EAAE;AACF,sEAAsE;AAwBtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAqC;IACxE,EAAE,EAAE,EAAE,6BAA6B,EAAE,OAAO,EAAE,OAAO,EAAE;IACvD,EAAE,EAAE,EAAE,0BAA0B,EAAE,OAAO,EAAE,QAAQ,EAAE;CAC7C,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAqC;IACxE;QACE,OAAO,EAAE,0CAA0C;QACnD,WAAW,EAAE,mCAAmC;KACjD;CACO,CAAC;AAEX,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,mCAAmC,CAAC"}
+{"version":3,"file":"addon-deps.js","sourceRoot":"","sources":["../../src/utils/addon-deps.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,mFAAmF;AACnF,oEAAoE;AACpE,8EAA8E;AAC9E,yEAAyE;AACzE,EAAE;AACF,6EAA6E;AAC7E,kFAAkF;AAClF,8EAA8E;AAC9E,4EAA4E;AAC5E,iFAAiF;AACjF,iFAAiF;AACjF,+CAA+C;AAC/C,EAAE;AACF,sEAAsE;AAwBtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAqC;IACxE,EAAE,EAAE,EAAE,6BAA6B,EAAE,OAAO,EAAE,OAAO,EAAE;IACvD,EAAE,EAAE,EAAE,0BAA0B,EAAE,OAAO,EAAE,OAAO,EAAE;CAC5C,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAqC;IACxE;QACE,OAAO,EAAE,0CAA0C;QACnD,WAAW,EAAE,mCAAmC;KACjD;CACO,CAAC;AAEX,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,mCAAmC,CAAC"}

package/dist/utils/agents.d.ts

@@ -30,6 +30,18 @@ export interface AgentDefinition {
     /** Config-file serialization format. `toml` is the Codex branch. */
     configFormat: 'json' | 'toml';
     bodyPath: string;
+    /**
+     * Whether this MCP client performs native RFC 9728 OAuth against the hosted
+     * endpoint (auth Flow A). Default policy is `true`, mirroring the shared b6
+     * configurators / decision D11: OAuth-capable clients get a credential-free,
+     * URL-only `{type,url}` config so their own OAuth handshake runs, and
+     * `setup-mcp` OMITS the static `Authorization` header for them — a static
+     * header both fails against the hosted AS (401) and suppresses the client's
+     * OAuth fallback ("OAuth fallback is disabled when headers.Authorization is
+     * set"). Set `false` only for a client that cannot OAuth and needs a static
+     * token against a required-auth (typically self-hosted) endpoint (Flow C).
+     */
+    supportsOAuth: boolean;
     /** Resolve the absolute config-file path for a given project root. */
     getConfigPath(projectPath: string): string;
     /** Build the HTTP server entry written under `bodyPath[MCP_SERVER_NAME]`. */