feat(cli): continue oauth for cli MCPs

[RomneyDa]

Description

Adds a 401-detection wrapper to MCP service which attempts to get oauth token from hub if signed in

---

Summary by cubic

Adds automatic OAuth token refresh for CLI MCP HTTP/SSE connections. On 401/405, we fetch a new token from the hub and retry; agent files now support URL-based MCP references.

• New Features

  • 401/405-aware wrapper around MCP operations (connect, listTools, listPrompts, callTool) with retry after token refresh; falls back to mcp-remote (stdio) when not headless.
  • Fetches token from /ide/mcp-auth and caches per server; updates Authorization header and retries.
  • Agent files support URL-based MCP references (http/https), including tool names, ports, paths, and query params; supports localhost/IP with validation and tests.

• Bug Fixes

  • isAuthenticated is now async and properly refreshes expired tokens; updated all call sites.
  • More robust connection sequence: HTTP then SSE with token refresh.

^{Written for commit 26bb215. Summary will update automatically on new commits.}

[github-actions]

✅ Review Complete

Code Review Summary

⚠️ Continue configuration error. Please verify that the assistant exists in Continue Hub.

---

[cubic-dev-ai]

No issues found across 6 files

[cubic-dev-ai]

3 issues found across 4 files (reviewed changes from recent commits).

Prompt for AI agents (all 3 issues)

Understand the root cause of the following 3 issues and fix them.


<file name="extensions/cli/src/configLoader.ts">

<violation number="1" location="extensions/cli/src/configLoader.ts:211">
Treating CLI `--config` errors like user-assistant failures now masks problems with explicitly requested configs by falling back to the default agent, violating the documented precedence where the CLI flag should fail loudly if unreadable.</violation>
</file>

<file name="packages/config-yaml/src/markdown/agentFiles.ts">

<violation number="1" location="packages/config-yaml/src/markdown/agentFiles.ts:133">
Port detection in the URL branch only accepts bare numbers, so valid URLs such as https://host:4000/path (port plus path) are rejected, preventing configuration of those MCP servers.</violation>
</file>

<file name="extensions/cli/src/services/MCPService.ts">

<violation number="1" location="extensions/cli/src/services/MCPService.ts:563">
Catching the HTTP fallback error inside getConnectedClient hides 401/405 responses from withTokenRefresh, so HTTP-only servers with expired tokens never trigger the OAuth refresh and remain unauthenticated.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

[cubic-dev-ai]

1 issue found across 19 files (reviewed changes from recent commits).

Prompt for AI agents (all 1 issues)

Understand the root cause of the following 1 issues and fix them.


<file name="extensions/cli/src/services/MCPService.ts">

<violation number="1" location="extensions/cli/src/services/MCPService.ts:477">
Rethrowing every `isAuthError` before the HTTP→SSE fallback means 405 responses (which `isAuthError` classifies as auth issues) never reach the SSE transport. SSE-only servers with no explicit `type` now fail to connect unless the user is signed in, because `withTokenRefresh` rethrows when `isAuthenticated()` is false, preventing the SSE fallback from running. Allow the SSE fallback to run for transport capability errors such as 405 so these servers remain reachable.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

[cubic-dev-ai]

Rethrowing every isAuthError before the HTTP→SSE fallback means 405 responses (which isAuthError classifies as auth issues) never reach the SSE transport. SSE-only servers with no explicit type now fail to connect unless the user is signed in, because withTokenRefresh rethrows when isAuthenticated() is false, preventing the SSE fallback from running. Allow the SSE fallback to run for transport capability errors such as 405 so these servers remain reachable.

Prompt for AI agents

Address the following comment on extensions/cli/src/services/MCPService.ts at line 477:

<comment>Rethrowing every `isAuthError` before the HTTP→SSE fallback means 405 responses (which `isAuthError` classifies as auth issues) never reach the SSE transport. SSE-only servers with no explicit `type` now fail to connect unless the user is signed in, because `withTokenRefresh` rethrows when `isAuthenticated()` is false, preventing the SSE fallback from running. Allow the SSE fallback to run for transport capability errors such as 405 so these servers remain reachable.</comment>

<file context>
@@ -561,13 +474,9 @@ export class MCPService
-                  error: getErrorString(e),
-                },
-              );
+              if (isAuthError(e)) {
+                throw e;
+              }
</file context>

✅ Addressed in 317f6f4

[RomneyDa]

I think it should work unless 405 is what a server throws when it tries to do http and it should be sse. But this is a bit of an edge case.

[RomneyDa]

but did this to fix case where someone throws 405 when auth is missing

[cubic-dev-ai]

Thanks for the feedback! I've saved this as a new learning to improve future reviews.

[sestinj]

🎉 This PR is included in version 1.34.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[sestinj]

🎉 This PR is included in version 1.30.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[sestinj]

🎉 This PR is included in version 1.5.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀