plugins/claude-code/.claude-plugin/plugin.json always sends Authorization: Bearer ${FORGE_TOKEN}, so a person without a token sends an empty bearer and gets nowhere. The forge already supports OAuth: /mcp answers 401 with resource_metadata, and /.well-known/oauth-protected-resource is there. Claude Code can sign in through that flow (the Tesla test) if the plugin lets it.
Done when:
[ ] With only FORGE_URL set, the plugin's MCP server has no Authorization header, so Claude Code takes the forge's OAuth sign-in. With FORGE_TOKEN set, the token is sent as today
[ ] The plugin.json description lists the verbs the README and commands/forge.md list (new, tell, status, decide, plan, preview, pulls, runs, log, asked); today it says four
[ ] The README says both ways in two short paragraphs: sign in (nothing to copy) and a token (for scripts)
[ ] test/plugin-claude-oauth.test.ts reads plugin.json and proves that without a token no Authorization header is configured, and that the description names every verb the command handles. It fails without the change
Files: plugins/claude-code/.claude-plugin/plugin.json, plugins/claude-code/README.md, test/plugin-claude-oauth.test.ts
Risk: if one plugin.json cannot make a header conditional, ship two MCP entries (forge with OAuth, forge-token), or pick OAuth as the default. Say which in the pull.
plugins/claude-code/.claude-plugin/plugin.jsonalways sendsAuthorization: Bearer ${FORGE_TOKEN}, so a person without a token sends an empty bearer and gets nowhere. The forge already supports OAuth:/mcpanswers 401 withresource_metadata, and/.well-known/oauth-protected-resourceis there. Claude Code can sign in through that flow (the Tesla test) if the plugin lets it.Done when:
FORGE_URLset, the plugin's MCP server has no Authorization header, so Claude Code takes the forge's OAuth sign-in. WithFORGE_TOKENset, the token is sent as todaycommands/forge.mdlist (new, tell, status, decide, plan, preview, pulls, runs, log, asked); today it says fourtest/plugin-claude-oauth.test.tsreads plugin.json and proves that without a token no Authorization header is configured, and that the description names every verb the command handles. It fails without the changeFiles: plugins/claude-code/.claude-plugin/plugin.json, plugins/claude-code/README.md, test/plugin-claude-oauth.test.ts Risk: if one plugin.json cannot make a header conditional, ship two MCP entries (
forgewith OAuth,forge-token), or pick OAuth as the default. Say which in the pull.