Setup SSO for a ui-widget-developer Agent (Minimal-Touch, No OBO)

Why this exists. Copilot MCP-server agents come in two widget-standard shapes, and this skill supports both (defaulting to MCP Apps when the layout is ambiguous):

• MCP Apps (create-mcp-app / MCP Apps SDK): a runtimes[] plugin manifest such as appPackage/readiness_plugin.json and an Express-based MCP server (main.ts).
• OAI Apps (ui-widget-developer): appPackage/mcpPlugin.json and a raw-http MCP server under mcp-server/ (no express, no express-jwt).

Both provide a named devtunnel that is already running and env/.env.local. Phase 0 auto-detects the layout (server framework + plugin manifest) and the skill adapts the manifest patch and guard injection accordingly — it never re-scaffolds, so the user's server stays intact.

New to how SSO works here? Read references/sso-explained.md first — it covers what SSO gives you (verified identity, not downstream access), the end-to-end token flow, how claims reach your tools via claimsStore, failure modes, and how to go further with OBO / Microsoft Graph. This SKILL is the procedural runbook; that doc is the mental model.