feat(mcp): MSAL bootstrap for M365 server discovery

[simongdavies]

Add acquireDiscoveryToken() to setup-commands.ts — when no cached token exists for m365-refresh-servers, MSAL acquires one interactively (browser or device-code flow, matching the configured auth flow).

Token chain: --token flag → cached MSAL token → interactive MSAL. Spawns a child process for MSAL to avoid importing the library at module level in the CLI entrypoint.

Also updates MCP.md with minor corrections.

[Copilot]

Pull request overview

Adds an MSAL-based bootstrap path to the MCP M365 server discovery flow so --mcp-m365-refresh-servers can acquire a token interactively when no cached bearer/MSAL token is available, and updates MCP documentation to reflect the new behavior.

Changes:

• Extend --mcp-m365-refresh-servers token chain: --token → cached token → interactive MSAL (browser/device-code) via a spawned Node process.
• Add new refresh CLI flags for MSAL/app context (--client-id, --tenant-id, --scope, --flow).
• Update docs/MCP.md to document the new refresh behavior and examples.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/agent/mcp/setup-commands.ts	Adds MSAL token acquisition via spawned helper script + new refresh args and NODE_PATH helper.
docs/MCP.md	Documents MSAL-based refresh behavior and device-code usage.

Comments suppressed due to low confidence (1)

src/agent/mcp/setup-commands.ts:1437

• Option parsing only recognizes flags when a value is present (--token/--client-id/--tenant-id/--scope/--flow all require index + 1 < argv.length). If a user passes one of these at the end (or forgets the value), it falls through to Unknown --mcp-m365-refresh-servers option, which is misleading. Handle the missing-value case explicitly (e.g., detect the flag and fail("--token requires a value"), etc.) so the error message guides the user correctly.

    if (arg === "--token" && index + 1 < argv.length) {
      parsed.token = argv[++index];
    } else if (arg === "--client-id" && index + 1 < argv.length) {
      parsed.clientId = argv[++index];
    } else if (arg === "--tenant-id" && index + 1 < argv.length) {
      parsed.tenantId = argv[++index];
    } else if (arg === "--scope" && index + 1 < argv.length) {
      parsed.scope = argv[++index];
    } else if (arg === "--flow" && index + 1 < argv.length) {
      const flow = argv[++index];
      if (flow !== "browser" && flow !== "device-code") {
        fail(`--flow must be "browser" or "device-code" (got: ${flow})`);
      }
      parsed.flow = flow;
    } else if (arg === "--include-custom") {
      parsed.includeCustom = true;
    } else if (arg === "--help" || arg === "-h") {
      console.log(
        "Usage: hyperagent --mcp-m365-refresh-servers [--token <bearer>] [--client-id ID] [--tenant-id ID] [--scope SCOPE] [--flow browser|device-code] [--include-custom]",
      );
      process.exit(0);
    } else {
      fail(`Unknown --mcp-m365-refresh-servers option: ${arg}`);
    }