feat(cli): unity-mcp-cli → @baizor/gamedev-cli-core (OAuth login, pinned setup-mcp, optional install-plugin path) (#907)

Migrated unity-mcp-cli to a thin wrapper over @baizor/gamedev-cli-core: OAuth device login (T1), pinned setup-mcp URL (T4), optional install-plugin path (T5), v2 enroll identity; legacy /api/auth/device PAT flow removed.

Closes #906

Author: IvanMurzak

cli/package-lock.json

@@ -62,6 +62,7 @@
     "node": "^20.19.0 || >=22.12.0"
   },
   "dependencies": {
+    "@baizor/gamedev-cli-core": "^0.1.0",
     "chalk": "^5.6.2",
     "commander": "^13.1.0",
     "yocto-spinner": "^1.1.0"
@@ -71,4 +72,4 @@
     "typescript": "^5.8.0",
     "vitest": "^3.1.0"
   }
-}
+}

cli/package.json

@@ -1,13 +1,13 @@
 import { Command } from 'commander';
 import * as fs from 'fs';
-import * as path from 'path';
 import * as ui from '../utils/ui.js';
 import { verbose } from '../utils/ui.js';
 import { installPlugin } from '../lib/install-plugin.js';
 import { downloadServerBinary } from '../utils/managed-server.js';
 import { DEFAULT_SERVER_VERSION } from '../utils/server-version.js';
 import { resolveEnrollCode, runEnroll, EnrollmentError } from '../utils/enroll.js';
 import { MachineCredentialStore } from '../utils/machine-credentials.js';
+import { resolveInstallTarget, unityAdapter } from '@baizor/gamedev-cli-core';
 
 interface InstallPluginOptions {
   path?: string;
@@ -30,13 +30,20 @@ export const installPluginCommand = new Command('install-plugin')
   .option('--enroll <code>', 'Redeem an enrollment code for a plugin credential (planted in the shared machine store)')
   .option('--enroll-stdin', 'Read the enrollment code from stdin (never argv/shell history)')
   .action(async (positionalPath: string | undefined, options: InstallPluginOptions) => {
-    const resolvedPath = positionalPath ?? options.path;
-    if (!resolvedPath) {
-      ui.error('Path is required. Usage: unity-mcp-cli install-plugin <path> or --path <path>');
+    // T5/B1: path is OPTIONAL — resolve `path? → --path? → cwd`, then verify the directory is a real
+    // Unity project (marker probe for `Packages/manifest.json`). On a miss the error lists exactly
+    // what was checked, so `install-plugin` "just works" from a project folder with no path.
+    const target = resolveInstallTarget({
+      adapter: unityAdapter,
+      positional: positionalPath,
+      path: options.path,
+    });
+    if (target.kind === 'failure') {
+      ui.error(target.error.message);
       process.exit(1);
     }
 
-    const projectPath = path.resolve(resolvedPath);
+    const projectPath = target.projectRoot;
 
     // ── Phase 1: install the plugin into the Unity project's manifest ────────
     // Wire the library's progress events back into the CLI's chalk-
@@ -128,6 +135,7 @@ export const installPluginCommand = new Command('install-plugin')
         const enrolled = await runEnroll({
           code,
           projectPath,
+          adapter: unityAdapter,
           store: new MachineCredentialStore(),
         });
         enrollSpinner.success('Enrollment complete');

cli/src/commands/install-plugin.ts

@@ -15,6 +15,8 @@ interface SetupMcpCliOptions {
   url?: string;
   token?: string;
   list?: boolean;
+  /** commander sets this to `false` when `--no-pin` is passed (defaults to `true`). */
+  pin?: boolean;
 }
 
 function listAgents(): void {
@@ -31,7 +33,8 @@ export const setupMcpCommand = new Command('setup-mcp')
     'http',
   )
   .option('--url <url>', 'Server URL override (for http transport)')
-  .option('--token <token>', 'Auth token override')
+  .option('--token <token>', 'Explicit PAT opt-in — writes a static credential into the config (default: credential-free, native OAuth)')
+  .option('--no-pin', 'Write an unpinned URL / omit the project= arg (default: pin to this project via /mcp/p/<pin>)')
   .option('--list', 'List all available agent IDs')
   .action(
     async (
@@ -74,6 +77,8 @@ export const setupMcpCommand = new Command('setup-mcp')
         transport,
         url: options.url,
         token: options.token,
+        // commander sets `options.pin === false` when `--no-pin` was passed.
+        noPin: options.pin === false,
       });
 
       if (result.kind === 'failure') {

cli/src/commands/setup-mcp.ts

@@ -1,16 +1,10 @@
 import * as fs from 'fs';
 import * as path from 'path';
-import { generatePortFromDirectory } from '../utils/port.js';
-import { readConfig, resolveConnectionFromConfig } from '../utils/config.js';
 import {
-  getAgentById,
+  setupMcp as coreSetupMcp,
+  unityAdapter,
   getAgentIds,
-  resolveServerBinaryPath,
-  writeJsonAgentConfig,
-  writeTomlAgentConfig,
-  MCP_SERVER_NAME,
-} from '../utils/agents.js';
-import { emitProgress } from './progress.js';
+} from '@baizor/gamedev-cli-core';
 import { requireExistingPath } from './validation.js';
 import type {
   SetupMcpOptions,
@@ -23,199 +17,102 @@ function isValidTransport(t: string | undefined): t is McpTransport {
 }
 
 /**
- * Extract a port from a `host` URL string, falling back to the
- * project-directory-derived deterministic port on any parse failure.
- */
-function portFromHost(host: string | undefined, projectPath: string): number {
-  if (!host) return generatePortFromDirectory(projectPath);
-  try {
-    return parseInt(new URL(host).port, 10) || generatePortFromDirectory(projectPath);
-  } catch {
-    return generatePortFromDirectory(projectPath);
-  }
-}
-
-/**
- * True when `configPath` resolves to a location at or under `projectRoot`
- * (separator- and case-insensitive) — i.e. a VCS-visible project-scoped file.
- * Mirrors the b6 configurator's `IsProjectScopedPath`, used to decide whether a
- * written access token would land in a committable file (design 03 Flow C).
- */
-function isProjectScoped(configPath: string, projectRoot: string): boolean {
-  const norm = (p: string): string =>
-    path.resolve(p).replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase();
-  const root = norm(projectRoot);
-  const target = norm(configPath);
-  return target === root || target.startsWith(root + '/');
-}
-
-/**
- * Write MCP configuration for the given AI agent, so it can talk to
- * Unity-MCP. Library-safe: no stdout noise, no process.exit, no throws
- * past the public boundary.
+ * Write MCP configuration for the given AI agent, so it can talk to the Unity MCP hub.
  *
- * The returned `SetupMcpResult` is a discriminated union — narrow with
- * `result.kind === 'success'` to access `agentId` / `configPath` /
- * `transport`, or `result.kind === 'failure'` to access `error`.
+ * This is now a thin adapter over `@baizor/gamedev-cli-core`'s `setupMcp` (auth-fixes T4/M7/M8):
+ *   - the http URL is **pinned by default** to `<base>/mcp/p/<pin-v2>` and the stdio config carries a
+ *     `project=<pin>` arg, so the config routes strictly to this project's engine instance even when
+ *     the account has several (`--no-pin` is the escape hatch);
+ *   - the config is **credential-free by default** — a static `Authorization: Bearer` header (http)
+ *     or `token=` arg (stdio) is written ONLY on an explicit `--token` PAT opt-in, so an OAuth-capable
+ *     client authorizes natively (RFC 9728) instead of being suppressed by a static header;
+ *   - the config bytes are written by cli-core's golden-vector-gated JSON/TOML writers, so `setup-mcp`
+ *     output matches the Unity Editor's Configure output byte-for-byte.
+ *
+ * Library-safe: no stdout noise, no `process.exit`, no throws past the public boundary. Narrow the
+ * returned `SetupMcpResult` with `result.kind === 'success'` / `=== 'failure'`.
  */
 export async function setupMcp(opts: SetupMcpOptions): Promise<SetupMcpResult> {
-  const warnings: string[] = [];
-  const nextSteps: string[] = [];
-
+  // This wrapper never accumulates its own warnings/next-steps — cli-core owns the warning channel
+  // (`result.warnings`), and `nextSteps` is always empty here. Both fields are written as literals
+  // on each return to satisfy the `SetupMcpResult` shape.
   try {
-    if (!opts || typeof opts.agentId !== 'string' || opts.agentId.length === 0) {
-      return {
-        kind: 'failure',
-        success: false,
-        warnings,
-        nextSteps,
-        error: new Error(
-          `agentId is required. Available agent IDs: ${getAgentIds().join(', ')}`,
-        ),
-      };
+    // Resolve project path. If the caller supplied one explicitly it must exist; otherwise cli-core
+    // falls back to cwd (matching the CLI behaviour and closing the "path required" half of B1).
+    let projectPath: string | undefined;
+    if (opts.unityProjectPath) {
+      const validated = requireExistingPath(opts.unityProjectPath);
+      if (!validated.ok) {
+        return { kind: 'failure', success: false, warnings: [], nextSteps: [], error: validated.error };
+      }
+      projectPath = validated.projectPath;
     }
 
-    const agent = getAgentById(opts.agentId);
-    if (!agent) {
+    const transport = opts.transport ?? 'http';
+    if (!isValidTransport(transport)) {
       return {
         kind: 'failure',
         success: false,
-        warnings,
-        nextSteps,
-        error: new Error(
-          `Unknown agent: "${opts.agentId}". Available agent IDs: ${getAgentIds().join(', ')}`,
-        ),
+        warnings: [],
+        nextSteps: [],
+        error: new Error(`Invalid transport: "${transport}". Must be "stdio" or "http".`),
       };
     }
 
-    const transport: McpTransport = opts.transport ?? 'http';
-    if (!isValidTransport(transport)) {
+    const result = coreSetupMcp({
+      adapter: unityAdapter,
+      agentId: opts.agentId,
+      transport,
+      projectPath,
+      url: opts.url,
+      token: opts.token,
+      noPin: opts.noPin === true,
+    });
+
+    if (result.kind === 'failure') {
       return {
         kind: 'failure',
         success: false,
-        warnings,
-        nextSteps,
-        error: new Error(`Invalid transport: "${transport}". Must be "stdio" or "http".`),
+        warnings: result.warnings,
+        nextSteps: [],
+        error: result.error,
       };
     }
 
-    // Resolve project path. If the caller supplied one explicitly it
-    // must exist; otherwise fall back to cwd (matches CLI behaviour).
-    let projectPath: string;
-    if (opts.unityProjectPath) {
-      const validated = requireExistingPath(opts.unityProjectPath);
-      if (!validated.ok) {
-        return { kind: 'failure', success: false, warnings, nextSteps, error: validated.error };
-      }
-      projectPath = validated.projectPath;
-    } else {
-      projectPath = path.resolve(process.cwd());
-    }
-
-    emitProgress(opts.onProgress, {
-      phase: 'start',
-      message: `Configuring ${agent.name} (${transport}) for ${projectPath}`,
-    });
-
-    const config = readConfig(projectPath);
-    const fromConfig = config
-      ? resolveConnectionFromConfig(config)
-      : { url: undefined, token: undefined };
-
-    const port = portFromHost(config?.host, projectPath);
-
-    const timeout = (config?.timeoutMs as number) ?? 10000;
-    const auth = (config?.authOption as string) ?? 'none';
-
-    // Explicit PAT opt-in (design 03 Flow C): a token the caller passed on the
-    // command line (`--token`). Only an explicit opt-in — never a token merely
-    // resolved from the project config — places a static credential in the file.
-    const patOptIn = typeof opts.token === 'string' && opts.token.length > 0;
-    const token = opts.token ?? fromConfig.token ?? '';
-
-    // b6 credential policy (design decision D11): the DEFAULT http config is
-    // credential-free. OAuth-capable clients perform native RFC 9728 OAuth
-    // against the URL (Flow A), so a static `Authorization: Bearer` header both
-    // FAILS (the hosted ai-game.dev/mcp endpoint 401s the token) AND suppresses
-    // the client's own OAuth handshake ("OAuth fallback is disabled when
-    // headers.Authorization is set"). A static header is written ONLY for an
-    // explicit PAT opt-in (Flow C) or a client that cannot do MCP OAuth
-    // (`supportsOAuth === false`) — never automatically for an OAuth-capable
-    // client, regardless of the server's `authRequired` setting.
-    const supportsOAuth = agent.supportsOAuth !== false;
-    const emitAuthHeader = token.length > 0 && (patOptIn || !supportsOAuth);
-
-    const serverPath = resolveServerBinaryPath(projectPath).replace(/\\/g, '/');
-
-    // Resolve URL for HTTP — explicit override, then config, then
-    // deterministic localhost fallback. Trailing slash stripped.
-    const serverUrl = (opts.url ?? fromConfig.url ?? `http://localhost:${port}`).replace(/\/$/, '');
-
-    const configPath = agent.getConfigPath(projectPath);
-
-    let props: Record<string, unknown>;
-    let removeKeys: string[];
-
+    // Preserve the historical stdio-server-missing warning (cli-core does not emit it): the plugin
+    // downloads the server binary when Unity opens, so a stdio config written before that is valid
+    // but not yet runnable.
     if (transport === 'stdio') {
-      props = agent.getStdioProps(serverPath, port, timeout, auth, token);
-      removeKeys = agent.stdioRemoveKeys;
-    } else {
-      props = agent.getHttpProps(serverUrl, token, emitAuthHeader);
-      removeKeys = agent.httpRemoveKeys;
-    }
-
-    if (agent.configFormat === 'toml') {
-      writeTomlAgentConfig(configPath, agent.bodyPath, MCP_SERVER_NAME, props, removeKeys);
-    } else {
-      writeJsonAgentConfig(configPath, agent.bodyPath, MCP_SERVER_NAME, props, removeKeys);
-    }
-
-    emitProgress(opts.onProgress, {
-      phase: 'manifest-patched',
-      message: `Wrote ${configPath}`,
-      manifestPath: configPath,
-    });
-
-    // Flow C credential-placement rule (design 03): a static access token
-    // written into a project-scoped config file is VCS-visible. Warn so the
-    // user prefers an env-var / user-scope placement for the credential.
-    if (transport === 'http' && emitAuthHeader && isProjectScoped(configPath, projectPath)) {
-      warnings.push(
-        `Wrote an access token into project-scoped config file "${configPath}" — it is under the project root and may be committed to version control. Prefer an env-var or user-scope placement for the access token (design 03 Flow C).`,
-      );
-    }
-
-    if (transport === 'stdio' && !fs.existsSync(serverPath.replace(/\//g, path.sep))) {
-      warnings.push(
-        'Server binary not found. Open Unity with the MCP plugin to download it automatically.',
-      );
+      const serverPath = unityAdapter.serverBinaryPath(projectPath ?? path.resolve(process.cwd()));
+      if (!fs.existsSync(serverPath)) {
+        result.warnings.push(
+          'Server binary not found. Open Unity with the MCP plugin to download it automatically.',
+        );
+      }
     }
 
-    emitProgress(opts.onProgress, { phase: 'done', message: `${agent.name} configured successfully.` });
-
     return {
       kind: 'success',
       success: true,
-      agentId: agent.id,
-      configPath,
-      transport,
-      warnings,
-      nextSteps,
+      agentId: result.agentId,
+      configPath: result.configPath,
+      transport: result.transport,
+      warnings: result.warnings,
+      nextSteps: [],
     };
   } catch (err: unknown) {
     return {
       kind: 'failure',
       success: false,
-      warnings,
-      nextSteps,
+      warnings: [],
+      nextSteps: [],
       error: err instanceof Error ? err : new Error(String(err)),
     };
   }
 }
 
 /**
- * List every agent id known to the `setupMcp` function. Useful for
- * consumer UIs that want to render a picker.
+ * List every agent id known to `setupMcp`. Useful for consumer UIs that want to render a picker.
  */
 export function listAgentIds(): string[] {
   return getAgentIds();