[WIP] Add OAuth client_credentials grant for machine-to-machine auth

[jancurn]

Summary

• Adds --grant client-credentials to mcpc login for non-interactive M2M authentication (MCP extension spec)
• Tokens are re-issued automatically when they expire — no browser, no user interaction
• Client ID and secret are stored in the OS keychain; token endpoint is cached in the profile

Usage

mcpc login mcp.example.com --grant client-credentials \
  --client-id my-service --client-secret "$SECRET" \
  [--scope "tools:read"] [--token-endpoint https://auth.example.com/token]

mcpc connect mcp.example.com @svc
mcpc @svc tools-list

Changes

New files

• src/lib/auth/client-credentials-flow.ts — discovers token endpoint, POSTs grant_type=client_credentials, persists credentials + tokens to keychain, writes profile metadata

Modified files

• src/lib/auth/oauth-utils.ts — new requestClientCredentialsToken() function
• src/lib/auth/oauth-token-manager.ts — grantType option (refresh_token | client_credentials); re-issues tokens via client credentials when refresh token is absent
• src/lib/auth/token-refresh.ts — handles authType: 'oauth-client-credentials' profiles
• src/lib/types.ts — AuthProfile.authType union expanded; AuthCredentials IPC extended with grantType, clientSecret, scope, tokenEndpoint, accessTokenExpiresAt
• src/bridge/index.ts — bridge initializes token manager in client_credentials mode; persists re-issued tokens to keychain
• src/lib/bridge-manager.ts — forwards client secret, token endpoint, scope, and grant type to bridge via IPC
• src/lib/bridge-client.ts — sendAuthCredentials now uses the AuthCredentials type directly
• src/cli/commands/auth.ts — routes --grant client-credentials to the new flow; validates flag combinations
• src/cli/index.ts — --grant and --token-endpoint options on login command; updated help text
• src/cli/commands/sessions.ts — profile listing tags [client-credentials] profiles
• README.md — new "Machine-to-machine authentication" section
• CHANGELOG.md — entry under [Unreleased]

Tests

• test/unit/lib/auth/oauth-utils.test.ts — 4 new tests for requestClientCredentialsToken() covering request body, scope, 401, and 5xx errors

Test plan

• npm run build passes
• npm run lint passes
• npm run test:unit — 536/536 tests pass
• mcpc login --help shows new --grant and --token-endpoint options
• mcpc login <url> --grant bogus → clear error
• mcpc login <url> --grant client-credentials without --client-id/--client-secret → clear error
• E2E: mcpc login <server> --grant client-credentials --client-id X --client-secret Y against a real OAuth server

https://claude.ai/code/session_01E96muBqt36zJHubmGFUWfB