Method beginDevice

internal/oauth/flow.go:159–211

beginDevice prepares the device authorization flow. It requests a device code up front (so the code can be displayed) and selects a display channel: URL elicitation, then form elicitation, then a tool-response message.

(prompter Prompter)

// up front (so the code can be displayed) and selects a display channel:
// URL elicitation, then form elicitation, then a tool-response message.
func (m *Manager) beginDevice(prompter Prompter) (*flowPlan, error) {
	oc := m.oauth2Config("")

	ctx, cancel := context.WithTimeout(context.Background(), deviceAuthTimeout)
	defer cancel()
	da, err := oc.DeviceAuth(ctx)
	if err != nil {
		return nil, fmt.Errorf("requesting device code: %w", err)
	}

	run := func(ctx context.Context) (*oauth2.Token, error) {
		tok, err := oc.DeviceAccessToken(ctx, da)
		if err != nil {
			return nil, fmt.Errorf("awaiting device authorization: %w", err)
		}
		return tok, nil
	}

	// As with PKCE, the manual instructions double as the runtime fallback, so
	// build them once and reuse for both display plans and the last resort.
	manual := &UserAction{
		URL:      da.VerificationURI,
		UserCode: da.UserCode,
		Message: fmt.Sprintf(
			"%s\n\nAfter authorizing, retry your request.\n\n%s",
			deviceInstruction(da), securityAdvisory,
		),
	}

	if canPromptURL(prompter) {
		display := func(ctx context.Context) error {
			return prompter.PromptURL(ctx, Prompt{
				Message:  fmt.Sprintf("Enter code %s to authorize the GitHub MCP Server.", da.UserCode),
				URL:      da.VerificationURI,
				UserCode: da.UserCode,
			})
		}
		return &flowPlan{run: run, display: display, fallback: manual}, nil
	}

	if canPromptForm(prompter) {
		display := func(ctx context.Context) error {
			return prompter.PromptForm(ctx, Prompt{
				Message:  deviceInstruction(da),
				URL:      da.VerificationURI,
				UserCode: da.UserCode,
			})
		}
		return &flowPlan{run: run, display: display, fallback: manual}, nil
	}

	return &flowPlan{run: run, userAction: manual}, nil
}

// securityAdvisory nudges users on clients without URL elicitation to ask their
// vendor for it, since it keeps the authorization URL out of the model context.