Function configureAuth

packages/plugins/mcp/src/sdk/plugin.ts:1397–1428

(slug: string, input: McpConfigureAuthInput)

       *  (returns `[]`) for an unknown slug, a stdio server, or an
       *  undecodable config. */
      const configureAuth = (slug: string, input: McpConfigureAuthInput) =>
        Effect.gen(function* () {
          const record = yield* ctx.core.integrations.get(slugFrom(slug));
          const current = record ? parseMcpIntegrationConfig(record.config) : null;
          if (!current || current.transport === "stdio") {
            return [] as readonly McpAuthMethod[];
          }

          // Replace mode declares the full set — backfill kind-based slugs.
          // Merge mode appends: `mergeAuthTemplates` replaces on slug match and
          // assigns fresh `custom_<id>` slugs to slug-less entries, so a custom
          // method never silently displaces a declared one.
          const merged =
            input.mode === "replace"
              ? normalizeMcpAuthMethods(input.authenticationTemplate)
              : mergeAuthTemplates(
                  current.authenticationTemplate,
                  expandMcpAuthMethodInputs(
                    input.authenticationTemplate,
                  ) as readonly McpAuthMethod[],
                );

          yield* ctx.core.integrations.update(slugFrom(slug), {
            config: { ...current, authenticationTemplate: merged },
          });

          return merged;
        }).pipe(
          Effect.withSpan("mcp.plugin.configure_auth", {
            attributes: { "mcp.integration.slug": slug },
          }),
        );

      // Discover locally installed Codex plugins with stdio MCP servers. The
      // scanner touches node:fs, so it stays behind a dynamic import (the