Summary
Introduces internal/oauth, a self-contained OAuth 2.1 login library for the stdio server. Provides:
- Authorization-code + PKCE flow with a local loopback callback server (state/CSRF, XSS-safe result pages)
- Device-authorization flow as headless/container fallback
- A
Manager that selects the most secure available channel (browser → URL elicitation → last-resort message) and exposes a refreshing TokenSource
- Both GitHub OAuth Apps and GitHub Apps are supported; expiring GitHub App tokens are refreshed automatically via
x/oauth2
Prompter interface decouples MCP client interaction from the OAuth flow so tests are runnable without a live sessioninternal/oauth/env.go for detecting headless environments; internal/oauth/callback.go for loopback receiver
Upstream reference
Fork conflict
None. internal/oauth is a new package with no overlap with the fork's project-management additions.
Context
The stdio server previously required a pre-provisioned PAT. This library is the foundation for zero-config OAuth login — users on github.com can authenticate on first tool call without generating a token, removing a significant friction point for new adopters.
Summary
Introduces
internal/oauth, a self-contained OAuth 2.1 login library for the stdio server. Provides:Managerthat selects the most secure available channel (browser → URL elicitation → last-resort message) and exposes a refreshingTokenSourcex/oauth2Prompterinterface decouples MCP client interaction from the OAuth flow so tests are runnable without a live sessioninternal/oauth/env.gofor detecting headless environments;internal/oauth/callback.gofor loopback receiverUpstream reference
Fork conflict
None.
internal/oauthis a new package with no overlap with the fork's project-management additions.Context
The stdio server previously required a pre-provisioned PAT. This library is the foundation for zero-config OAuth login — users on github.com can authenticate on first tool call without generating a token, removing a significant friction point for new adopters.