unity-mcp-cli → @baizor/gamedev-cli-core: OAuth login (T1), pinned setup-mcp (T4), optional install-plugin path (T5)

[IvanMurzak]

Summary

Make unity-mcp-cli a thin wrapper over the shared @baizor/gamedev-cli-core package — the first consumer of the adapter pattern — delivering the auth-fixes CLI seams for Unity:

• T1 — OAuth login (closes B2/B3): login now runs the OAuth 2.1 device-authorization grant (RFC 8628; client_id unity-mcp-cli, scope mcp:plugin) via cli-core and stores the FULL credential set (accessToken, refreshToken, expiresAt, serverTarget, subject) in the shared machine credential store. No PAT is ever minted; the legacy /api/auth/device/* flow is removed.
• T4 — pinned setup-mcp (closes B4): setup-mcp writes <base>/mcp/p/<pin-v2> by default (stdio carries project=<pin>), so the config routes strictly to this project's engine instance even with several instances on the account. --no-pin is the escape hatch. The config stays credential-free unless an explicit --token PAT opt-in is given (M7).
• T5 — optional install-plugin path (closes B1): install-plugin resolves path? → --path? → cwd and probes for Packages/manifest.json; on a miss the error lists exactly what was checked.
• enroll: uses cli-core's v2 project identity (the \→/ normalization), removing the Unity-CLI-local projectRootForIdentity workaround (B5).

Context

agents / project-identity (pin+port) / project-marker / machine-credentials / enroll / setup-mcp / install-plugin resolution now come from @baizor/gamedev-cli-core (auth-fixes design 02 §T7). The engine adapter carries the Unity specifics (serverName ai-game-developer, stdio ON, client_id unity-mcp-cli). The cli-core config writers are golden-vector-gated for byte-for-byte parity with the Unity Editor's Configure output.

Proposed approach

Add @baizor/gamedev-cli-core as a real dependency; make the utils/* modules thin re-exports/adapters over cli-core; keep the existing command surface and UX. Parity tests gate the adapter identity, v2 golden vectors, RFC 8628 behaviors, and setup-mcp's pinned-URL output.

Acceptance criteria

• No legacy /api/auth/device/* calls remain; PAT minting gone.
• setup-mcp output == Editor Configure output byte-for-byte (pinned URL).
• install-plugin works from the project cwd without a path; helpful failure otherwise.
• Golden-vector parity + RFC 8628 behaviors green in vitest.
• CLI CI green.