Quiet noisy dev-run logs: fix a settings init race and right-size MCP token rejections

The dev-run terminal carried warnings that were either a real ordering bug or mislevelled noise. Two fixes plus a doc:

- **Fix pre-init settings reads.** The main window now gates its children render on `settingsReady`, which flips only after `initReactiveSettings()` + `initSettingsApplier()` resolve. `FilePane` / `BriefList` read `getSetting()` synchronously at mount; before this they mounted before the store loaded and got registry defaults, logging `getSetting(...) called before settings were initialized` and (worse) risking a default getting pushed to the backend as if chosen (the `ai.provider` "off" trap). The flag flips in `finally` so a settings-load failure still mounts on defaults rather than a blank window. Guardrail added to `(main)/CLAUDE.md`.
- **Demote the bearer-token rejection** (`mcp::server`) from WARN to INFO: a token-gated call arriving without the token is expected protocol flow (the client gets the friendly "here's where the token lives" response and retries), not an anomaly. Kept at INFO, not debug, so a non-Cmdr process probing the gate stays visible in terminal and error bundles. The fail-closed "no token configured" case stays WARN.
- **Document MCP auth** in `docs/tooling/mcp.md` (which tools are token-gated, and that `mcp-call.sh` sends the token automatically) so agents reach for the right path on the first try instead of tripping the rejection.

Author: vdavid

apps/desktop/src-tauri/src/mcp/server.rs

@@ -604,7 +604,13 @@ pub fn validate_token(headers: &HeaderMap) -> Result<(), ()> {
         .unwrap_or("");
 
     if presented.is_empty() || !constant_time_eq(presented.as_bytes(), expected.as_bytes()) {
-        log::warn!(target: "mcp::server", "MCP: rejected request with missing/invalid bearer token");
+        // INFO, not WARN: a token-gated call arriving without the token is expected protocol
+        // flow, not an anomaly. Agents reach a gated tool (`set_setting`, auto-confirm
+        // delete/move/copy, `dialog confirm`) before reading `<data_dir>/mcp.token`, get the
+        // friendly `auto_confirm_token_required_response` telling them where the token lives,
+        // and retry. We still log it (not `debug`) so the security-relevant case — a local
+        // non-Cmdr process probing the gate — stays visible in terminal and error bundles.
+        log::info!(target: "mcp::server", "MCP: rejected request with missing/invalid bearer token");
         return Err(());
     }
 

apps/desktop/src/routes/(main)/+layout.svelte

@@ -63,6 +63,15 @@
 
     const { children }: Props = $props()
 
+    // Gates the children render until settings are loaded and applied. File-explorer
+    // components (FilePane, BriefList, ...) read getSetting() synchronously at mount; if
+    // they mount before the store finishes loading they get the registry default, which
+    // logs a pre-init-read warning and, worse, can push a default back to the backend as
+    // if the user chose it (this is how a pre-init read of `ai.provider` could quietly set
+    // AI to "off"). Mounting the page only once settings are ready closes that race for the
+    // whole subtree. See settings-store.ts § getSetting and (main)/CLAUDE.md § Gotchas.
+    let settingsReady = $state(false)
+
     // State for crash report dialog
     let showCrashReportDialog = $state(false)
     let pendingCrashReport = $state<CrashReport | null>(null)
@@ -178,14 +187,24 @@
 
         // Initialize all async setup
         void (async () => {
-            // Initialize reactive settings for UI components
-            await initReactiveSettings()
-
-            // Initialize settings and apply them to CSS variables
-            await initSettingsApplier()
-
-            // Subscribe to volume-tint settings so FilePane bg updates live
-            initVolumeTints()
+            try {
+                // Initialize reactive settings for UI components
+                await initReactiveSettings()
+
+                // Initialize settings and apply them to CSS variables
+                await initSettingsApplier()
+
+                // Subscribe to volume-tint settings so FilePane bg updates live
+                initVolumeTints()
+            } finally {
+                // Settings are now loaded, applied to CSS, and volume tints are wired, so the
+                // file-explorer subtree can mount without any pre-init getSetting() reads (and
+                // without a flash of default git chip / volume tint). In `finally` so a settings
+                // load failure (which logs its own error in initializeSettings) still mounts the
+                // page on registry defaults rather than leaving a blank window. Everything below
+                // is independent of the children mounting, so it keeps running in the background.
+                settingsReady = true
+            }
 
             // Log once whether this WebKit supports the modern CSS we lean on
             // (`color-mix()`). Old Safari versions on macOS 12 Monterey fall
@@ -314,7 +333,9 @@
     <MtpPermissionDialog onClose={closePermissionDialog} onRetry={retryPermissionConnection} />
 {/if}
 <div class="page-wrapper">
-    {@render children?.()}
+    {#if settingsReady}
+        {@render children?.()}
+    {/if}
 </div>
 
 <style>

apps/desktop/src/routes/(main)/CLAUDE.md

@@ -119,6 +119,11 @@ through the bus would pollute the `CommandId` union with dev-only ids for zero g
 
 ## Gotchas
 
+- **`+layout.svelte` gates the children render on `settingsReady`.** The page subtree mounts only after
+  `initReactiveSettings()` + `initSettingsApplier()` resolve in `onMount`. File-explorer components read `getSetting()`
+  synchronously at mount; without the gate they mount before the store loads and get registry defaults (a logged
+  pre-init read, and a default that can be pushed back to the backend as if chosen — see `settings-store.ts` §
+  `getSetting`). Don't remove the `{#if settingsReady}` wrapper, and don't move setting-reading work ahead of the flag.
 - **`+page.svelte` is >900 lines, flagged by `file-length`.** Don't pile new state into the page — extract another
   `setupXxxListeners(ctx)` module like `mcp-listeners.ts`. The dispatch core (`command-dispatch.ts`) is small (~170
   lines): new commands get a handler in the relevant `command-handlers/` family module, NOT a branch in the core. If a

docs/tooling/mcp.md

@@ -75,6 +75,25 @@ connects independently and works regardless of the session's MCP state.
 ./scripts/mcp-call.sh --list-tools
 ```
 
+## Authentication (token-gated tools)
+
+Most tools (resource reads, nav, search, dialog-prompting ops) need no auth. A bearer token is required ONLY for the
+calls that bypass the user's confirmation dialog: `set_setting`, `delete` / `move` / `copy` with `autoConfirm: true`,
+and `dialog` with `action: "confirm"`. Calling one of these without the token logs
+`MCP: rejected request with missing/invalid bearer token` and returns a JSON-RPC error pointing at the token file. To
+get it right on the first try:
+
+- **`./scripts/mcp-call.sh` handles the token for you.** It reads `<data_dir>/mcp.token` (or `CMDR_MCP_TOKEN`) and sends
+  `Authorization: Bearer <token>` on every request. Prefer it for any gated call: `./scripts/mcp-call.sh set_setting …`
+  just works.
+- **The wired-up `mcp__cmdr-*__*` tools can't add headers**, so gated ops through them fail unless you start Cmdr with
+  `CMDR_MCP_TOKEN` exported and add `"headers": { "Authorization": "Bearer ${CMDR_MCP_TOKEN}" }` to the server entry in
+  `.mcp.json`. Without that setup, route gated ops through `mcp-call.sh` instead. Read-only / nav / search tools work
+  through the wired-up tools regardless.
+
+Full token model (why a per-launch CSPRNG token, the `CMDR_MCP_TOKEN` override, why rejection is HTTP 200 not 401):
+`apps/desktop/src-tauri/src/mcp/DETAILS.md` § Authentication.
+
 ## Action-tool ack contract
 
 Action tools (`copy`, `move`, `delete`, `mkdir`, `mkfile`, `select`, `toggle_hidden`, `set_view_mode`, `sort`, `tab`,