test(mcp): add OAuth smoke test and dummy-server e2e coverage

[christso]

Summary

The existing HTTP MCP proxy OAuth client (src/core/mcp-http-stdio-proxy.ts, exposed via allagents mcp proxy <url>) had no test coverage beyond one Windows-browser-launcher unit test. This PR adds:

1. A self-contained smoke test that runs the full OAuth -> list-tools -> call-tool flow against a local dummy MCP+OAuth server by default (zero config, zero external network dependency), with an optional override to point it at any real OAuth-protected server instead.
2. A standalone dev-server script for general local development against allagents mcp, reusing the same dummy server.
3. A fully local dummy MCP+OAuth server so the OAuth flow (initial auth, cached-token reuse, token refresh) has automated, CI-safe e2e coverage.
4. A pre-existing, unrelated dependency fix discovered while building this (see "Bundled fix" below).

User-facing impact

None for the published CLI. scripts/ is dev-only tooling (not in package.json's files, never shipped in the npm package), and the only change to shipped code (src/core/mcp-http-stdio-proxy.ts) is:

• A new ALLAGENTS_MCP_OAUTH_NO_BROWSER env var (test-only escape hatch — skips the real OS browser-open; the authorization URL is still always printed either way, so nothing is hidden from a real user even if this were somehow set).
• hashServerUrl and AUTH_URL_LOG_PREFIX are now exported (for test reuse only, no behavior change).

Default allagents mcp proxy behavior for real users is unchanged.

What was delivered

• scripts/smoke-mcp-oauth.ts — with no arguments, spins up the local dummy MCP+OAuth server itself and runs the full connect -> OAuth -> list tools -> call tool flow against it end-to-end, printing the response. OAuth completes via a plain fetch() to the dummy IdP's auto-approving /authorize endpoint (the same "simulate the browser with curl" trick the e2e tests use) — no login screen, no external network, no setup required. Pass a URL explicitly (bun run smoke:mcp-oauth <url> [question]) to instead run the original real-OAuth path against any OAuth-protected server you have access to (opens a real browser for you to complete login).
• scripts/dev-mcp-server.ts — standalone script that starts the same dummy MCP+OAuth server and keeps it running (Ctrl+C to stop), so it can be used for local development against allagents mcp generally, not just this smoke test.
• tests/helpers/dummy-mcp-oauth-server.ts — a local stand-in OAuth IdP (PKCE, dynamic client registration, auto-approving /authorize) plus a protected MCP endpoint (RFC 9728 metadata, bearer-token enforcement, multi-session support) — entirely on 127.0.0.1, no external dependency.
• tests/e2e/mcp-proxy-oauth.test.ts — 3 scenarios against the dummy server:
  1. First connection completes OAuth and calls a tool.
  2. A second connection reuses the cached token with zero new /authorize calls.
  3. An expired access token is refreshed automatically (refresh-token grant), still zero new /authorize calls.
• tests/helpers/mcp-proxy-client.ts — shared stdio-client helper used by the smoke script, dev server example, and the e2e tests, so all of them exercise the identical production code path.
• Bundled fix: downgraded chalk v5→v4 (+ package.json overrides) to resolve a pre-existing, intermittent TypeError: require() async module ... unsupported crash — a Bun/cmd-ts CJS↔ESM interop issue (cmd-ts internally require()s chalk, but chalk v5 is ESM-only). This was hitting ~50% of dev-path CLI invocations (bun run src/cli/index.ts, the same path both existing and new e2e tests spawn), including the already-merged mcp-add-proxy.test.ts. Confirmed 0/10 crashes after the fix vs ~5/10 before; does not affect the built dist/index.js binary real users run (was already unaffected).

Manual test steps (reproduction)

bun install
bun run build   # optional, only if you want to sanity-check dist too

# 1. Self-contained smoke test -- no setup, no external server needed
bun run smoke:mcp-oauth
# -> starts a local dummy server, completes OAuth automatically, lists
#    tools, calls one, and prints a fixture response

# 1b. Optional: validate against a real OAuth-protected MCP server you
#     have access to (requires completing OAuth in your own browser)
bun run smoke:mcp-oauth https://your-mcp-server.example.com "how to rename a company branch"
# Run it again immediately after -- it should NOT prompt for OAuth again
# (cached token reuse), confirming the token/client-registration cache works.

# 2. Standalone dev server, for poking at with `allagents mcp` directly
bun run dev:mcp-server
# (in another terminal) allagents mcp add local-dev http://127.0.0.1:<port> --proxy

# 3. Automated e2e OAuth coverage (no browser, fully local, no external URL)
bun test tests/e2e/mcp-proxy-oauth.test.ts

# 4. Full suite + typecheck + lint
bun test
bun run typecheck
bun run lint

Expected: all pass, no browser windows open during steps 1/2/3/4, no require() async module crashes anywhere.

Review

Went through a 9-persona automated code review (correctness, security, reliability, adversarial, testing, maintainability, project-standards, agent-native, learnings) on the initial implementation. No P0/P1 findings. 6 fixes were applied directly (truncated-URL parsing on stderr chunk boundaries, shared log-prefix constant instead of duplication, explicit logging when the no-browser test escape hatch is active, child-process cleanup on connect failure, clean error response instead of an unhandled rejection in the dummy server, error handling on a fire-and-forget test fetch). Remaining open items (all P2/P3, none blocking):

• tests/helpers/dummy-mcp-oauth-server.ts: stop() doesn't close sessions left mid-handshake (test-only cleanup edge case).
• No unit tests yet for scripts/smoke-mcp-oauth.ts's argument-building/tool-selection heuristics.
• Dummy IdP's invalid_request / PKCE-failure error branches aren't exercised by any test.
• Child-process stderr isn't surfaced in the thrown error if connect() fails (would help debug a hung/crashed proxy in test failures).

Follow-up recommendation (not in this PR)

Compared this implementation against geelen/mcp-remote's approach to reducing repeated OAuth flows. We already avoid its two biggest footguns (version-scoped credential directory that wipes tokens on every upgrade; expires_in-only token bookkeeping with no proactive refresh). The one gap that concretely matters for allagents specifically: no cross-process coordination. Since allagents syncs one MCP server entry into Claude Code, Copilot/VS Code, and Cursor, a cold start after sync/install spawns separate mcp proxy processes per client — each would trigger its own browser popup for the same server on first use. mcp-remote's lockfile + long-poll rendezvous pattern is the direct fix, but is a distinct, separately-scoped change from this PR.

[cloudflare-workers-and-pages]

Deploying allagents with    Cloudflare Pages

Latest commit:	7b801ab
Status:	✅  Deploy successful!
Preview URL:	https://647e6408.allagents.pages.dev
Branch Preview URL:	https://feat-mcp-remote.allagents.pages.dev

View logs