Add OAuth token injection for MCP servers using original identifiers

[sestinj]

Summary by cubic

Automatically injects OAuth tokens into MCP server connections using the original --mcp identifiers, reducing extra auth prompts and improving headless startup.

• New Features
  • Track original --mcp values (URLs or hub slugs) and map them to resolved MCP servers in ConfigService.
  • Fetch OAuth tokens via ide/mcp-auth using org or personal scope and inject as apiKey for remote SSE/HTTP servers before connecting.
  • Wire MCPService to AuthService and pass mcpOriginalIds into initialization; silent fallback if no token is available.

^{Written for commit ae4ab80. Summary will update automatically on new commits.}

[cubic-dev-ai]

1 issue found across 5 files

Prompt for AI agents (all 1 issues)

Understand the root cause of the following 1 issues and fix them.


<file name="extensions/cli/src/services/ConfigService.ts">

<violation number="1" location="extensions/cli/src/services/ConfigService.ts:307">
Direct MCP URL mappings are overwritten by slug entries, breaking OAuth token lookups</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

[cubic-dev-ai]

Direct MCP URL mappings are overwritten by slug entries, breaking OAuth token lookups

Prompt for AI agents

Address the following comment on extensions/cli/src/services/ConfigService.ts at line 307:

<comment>Direct MCP URL mappings are overwritten by slug entries, breaking OAuth token lookups</comment>

<file context>
@@ -275,6 +290,35 @@ export class ConfigService
+    for (const mcpServer of merged.mcpServers || []) {
+      if (mcpServer &amp;&amp; &quot;url&quot; in mcpServer &amp;&amp; mcpServer.url) {
+        // Check if this URL came from a pending slug
+        const existingMapping = finalMcpOriginalIds.get(mcpServer.url);
+        if (!existingMapping) {
+          // Find matching pending slug - use URL or name to identify
</file context>