feat(server): plugins list says which sources sign in with a device code

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/server/src/routes/sources.ts

@@ -38,9 +38,9 @@ export const sourceRoutes = [
   route({
     method: "GET",
     path: "plugins",
-    summary: "Installed source plugins (manifests).",
+    summary: "Installed source plugins (manifests, plus deviceAuth: whether sign-in uses a device code).",
     auth: "any:read",
-    handler: async ({ deps }) => deps.registry.list(),
+    handler: async ({ deps }) => deps.registry.list().map((m) => ({ ...m, deviceAuth: !!deps.registry.get(m.id)?.deviceAuth })),
   }),
   route({
     method: "GET",

apps/server/test/api.test.ts

@@ -348,6 +348,12 @@ forEachDialect("api", (getDb) => {
     expect(await (await call(app, "GET", "copies", { cookie: ana })).json()).toEqual([expect.objectContaining({ workTitle: "Dune", format: "Paperback" })]);
   });
 
+  test("plugins: manifests say whether the source signs in with a device code", async () => {
+    const ana = await signUp(app, "ana");
+    const list = (await (await call(app, "GET", "plugins", { cookie: ana })).json()) as { id: string; deviceAuth: boolean; config: unknown[] }[];
+    expect(list.find((p) => p.id === "echo")).toEqual(expect.objectContaining({ deviceAuth: false, config: expect.any(Array) }));
+  });
+
   test("JSON bodies need Content-Type application/json (415)", async () => {
     const res = await app.fetch(
       new Request(`${BASE}/auth/register`, {