Sam Morrow
5e0be03d18
CodeQL / Analyze (go) (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
CodeQL / Analyze (javascript) (push) Has been cancelled
Build and Test Go Project / build (macos-latest) (push) Has been cancelled
Build and Test Go Project / build (ubuntu-latest) (push) Has been cancelled
Build and Test Go Project / build (windows-latest) (push) Has been cancelled
Add PKCE and device flow OAuth support for stdio mode, enabling browser-based authentication as an alternative to PATs. Flow priority (security-ordered): 1. PKCE + browser auto-open (native) 2. PKCE + URL elicitation (Docker with bound port) 3. Device flow fallback (more phishable, last resort) Key changes: - internal/oauth: self-contained OAuth manager with PKCE and device flow - internal/buildinfo: build-time OAuth credential injection via ldflags - BearerAuthTransport: added TokenProvider for dynamic token resolution - OAuth middleware intercepts tools/call to trigger lazy authentication - Scope-based tool filtering using existing SupportedScopes - PAT remains optional when OAuth credentials are configured Security: - PKCE S256 prevents code interception - State parameter prevents CSRF - Callback binds to 127.0.0.1 only - URL elicitation for sensitive URLs (never exposed to LLM) - Tokens stored in memory only, never persisted to disk - ReadHeaderTimeout prevents Slowloris on callback server - html/template auto-escaping prevents XSS in callback pages Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>