Persist OAuth project scope

[masnwilliams]

summary

• persist authoritative organization/project scope returned by the OAuth server
• preserve scope across automatic refresh and treat legacy credentials as organization-wide
• show the active OAuth scope in kernel auth
• document organization-wide and project-scoped login behavior

tests

• go test ./...
• go vet ./...
• go build ./...

dependency

Pairs with kernel/kernel-mcp-server#138. The fields are optional, so this remains compatible with the currently deployed OAuth server.

---

Note

Medium Risk
Changes authentication token handling and stored credential shape; behavior is backward-compatible for legacy tokens but affects how API requests are scoped after login/refresh.

Overview
OAuth login now stores access_scope and project_id from the authorization server (including values carried in OAuth state and token/refresh responses), saves them in keychain-backed TokenStorage, and keeps scope across token refresh. Tokens without scope metadata are treated as organization-wide; org-wide scope clears any stored project id.

kernel auth prints whether the session is organization-wide or locked to a project. README documents org vs project login at kernel login and documents the global --project flag for org-wide credentials (project-scoped tokens cannot switch projects).

Tests cover code exchange preferring server scope over state, refresh preserving project scope, and legacy refresh defaulting to organization-wide.

^{Reviewed by Cursor Bugbot for commit d766967. Bugbot is set up for automated code reviews on this repo. Configure here.}