fix: preserve MCP token registration errors and failure exits

[CarmenDou]

A signed-in agent requesting --mcp-token could receive 403 unclassified_agent_action, be told to log in again, and exit 0 without registering MCP. Preserve token-creation errors and return a failure when explicit Claude registration is incomplete, including when another client's OAuth entry was installed.

Token minting now distinguishes absent credentials from API/transport failures. The interactive login retry remains available, but token errors after successful login no longer enter the browser-login catch. Existing registrations stay untouched, OAuth auto-detection still skips absent Claude installations, and --mcp-token with an explicitly different client is rejected before writing configuration.

Agent governance is unchanged: the CLI reports the denial and does not retry as a human. This fixes error reporting, not the separate OAuth continuation issue.

Validation: npm run typecheck and all 899 tests / 60 files pass on Node 22.22.1 in an isolated, unauthenticated test copy. The new subprocess regression exercises the real CLI with a loopback platform and verifies signed agent requests, HTTP 403 in stderr, exit 1, and no registration write; missing login, post-login denial, existing config, and partial setup are also covered. An independent read-only review found no actionable issues.

Closes #209. Companion skill guidance: InsForge/instacloud-skills#88

---

Summary by cubic

Fixes --mcp-token registration so token-creation errors are preserved and incomplete Claude registration now exits with a failure instead of a false success.

Bug Fixes

• Token minting now distinguishes missing credentials from API/transport failures.
• Token errors after a successful login no longer get caught as a failed browser login.
• --mcp-token with a non-Claude agent is rejected before any config is written.
• Existing registrations stay untouched; OAuth auto-detection still skips absent Claude installations.

^{Written for commit 0d911c7. Summary will update on new commits.}

[jwfing]

Summary

The implementation correctly distinguishes missing credentials from token/API failures and prevents incomplete explicit MCP registration from reporting success.

Requirements context

Intent was derived from the PR description, issue #209, repository development guidance, and the companion skill documentation PR. Together they require preserving API/transport errors, failing incomplete explicit token registration, retaining login retry and existing configurations, documenting token-creation permission, preserving agent identity/governance, and keeping optional OAuth discovery functional.

Findings

Critical

(none)

Suggestion

(none)

Information

• Software engineering / functionality: mintMcpToken now returns null only when credentials are absent, validates successful responses, and allows API or transport exceptions to reach the command guard. Required-registration checks correctly set a failure exit, while interactive retry remains outside the token-error catch (src/commands/setup.ts:227-235, src/commands/setup.ts:452-475).
• Explicit non-Claude --mcp-token requests are rejected before configuration writes, while absent-Claude OAuth auto-detection remains optional (src/commands/mcp.ts:120-130). Unit coverage exercises API/transport errors, malformed responses, existing registrations, partial multi-client setup, post-login denial, and unsupported client combinations (test/mcp-token.test.ts:27-113).
• The subprocess regression verifies the real CLI’s HTTP 403 reporting, signed agent request, exit status, lack of registration writes, and absence of credential disclosure (test/mcp-token-cli.test.ts:53-75).
• Security: No authorization bypass was introduced. Token creation continues through the authenticated API client, agent governance errors propagate unchanged, and token values are not added to diagnostic output (src/commands/setup.ts:227-233, src/commands/setup.ts:256-267). No new dependencies or new untrusted-input execution paths were added.
• Performance: No performance-relevant issues found; the change adds only constant-time status checks and response validation around an existing one-shot API request (src/commands/setup.ts:227-235, src/commands/setup.ts:278-283).
• git diff --check is clean, and both Linux and Windows checks passed for the reviewed head. Local typecheck/tests could not start because this read-only checkout lacks installed dependencies (tsc is unavailable).

Verdict

Approved: no Critical, Suggestion, security, or performance findings.

[jwfing]

LGTM - approved.