Harden MCP schema and wire Claude OAuth/token handling

tests/config.test.ts

@@ -1,6 +1,6 @@
 import test from "node:test";
 import assert from "node:assert/strict";
-import { loadConfig } from "../src/config.js";
+import { buildClaudeAuthEnv, loadConfig, resolveAnthropicToken } from "../src/config.js";
 
 test("loads defaults and freezes config", () => {
   const config = loadConfig({});
@@ -28,3 +28,34 @@ test("validates security violation mode", () => {
     /invalid_union|Invalid input/i,
   );
 });
+
+test("prefers CLAUDE_CODE_OAUTH_TOKEN over ANTHROPIC_API_KEY", () => {
+  const config = loadConfig({
+    CLAUDE_CODE_OAUTH_TOKEN: "oauth-token",
+    ANTHROPIC_API_KEY: "api-key",
+  });
+
+  assert.equal(config.provider.anthropicOauthToken, "oauth-token");
+  assert.equal(config.provider.anthropicApiKey, "api-key");
+  assert.equal(config.provider.anthropicToken, "oauth-token");
+  assert.equal(resolveAnthropicToken(config.provider), "oauth-token");
+
+  const authEnv = buildClaudeAuthEnv(config.provider);
+  assert.equal(authEnv.CLAUDE_CODE_OAUTH_TOKEN, "oauth-token");
+  assert.equal(authEnv.ANTHROPIC_API_KEY, undefined);
+});
+
+test("falls back to ANTHROPIC_API_KEY when oauth token is absent", () => {
+  const config = loadConfig({
+    ANTHROPIC_API_KEY: "api-key",
+  });
+
+  assert.equal(config.provider.anthropicOauthToken, undefined);
+  assert.equal(config.provider.anthropicApiKey, "api-key");
+  assert.equal(config.provider.anthropicToken, "api-key");
+  assert.equal(resolveAnthropicToken(config.provider), "api-key");
+
+  const authEnv = buildClaudeAuthEnv(config.provider);
+  assert.equal(authEnv.CLAUDE_CODE_OAUTH_TOKEN, undefined);
+  assert.equal(authEnv.ANTHROPIC_API_KEY, "api-key");
+});