Use Keycloak OAuth for a2amcp login

tests/config.test.ts

@@ -5,6 +5,7 @@ import path from "node:path";
 import { promises as fs } from "node:fs";
 
 import { addAgent, loadConfig, removeAgent } from "../src/config.js";
+import { loadCredentials, saveCredentials } from "../src/credentials.js";
 
 let originalHome: string | undefined;
 let tmpHome: string;
@@ -44,3 +45,31 @@ test("removeAgent reports hit/miss", async () => {
   const cfg = await loadConfig();
   assert.equal(cfg.agents.length, 0);
 });
+
+test("credentials preserve Keycloak token metadata", async () => {
+  await saveCredentials({
+    apiUrl: "https://api.example.test",
+    token: "access-token",
+    refreshToken: "refresh-token",
+    expiresAt: 12345,
+    email: "dev@example.test",
+    userId: 7,
+    bucket: "user-7-files",
+    issuer: "https://auth.example.test/realms/a2a",
+    clientId: "a2acloud-cli",
+    scope: "openid email mcp:invoke",
+  });
+
+  assert.deepEqual(await loadCredentials(), {
+    apiUrl: "https://api.example.test",
+    token: "access-token",
+    refreshToken: "refresh-token",
+    expiresAt: 12345,
+    email: "dev@example.test",
+    userId: 7,
+    bucket: "user-7-files",
+    issuer: "https://auth.example.test/realms/a2a",
+    clientId: "a2acloud-cli",
+    scope: "openid email mcp:invoke",
+  });
+});