Add enforcedAuthType setting (#6564)

packages/cli/src/config/settings.ts

@@ -85,6 +85,7 @@ const MIGRATION_MAP: Record<string, string> = {
   excludeMCPServers: 'mcp.excluded',
   folderTrust: 'security.folderTrust.enabled',
   selectedAuthType: 'security.auth.selectedType',
+  enforcedAuthType: 'security.auth.enforcedType',
   useExternalAuth: 'security.auth.useExternal',
   autoConfigureMaxOldSpaceSize: 'advanced.autoConfigureMemory',
   dnsResolutionOrder: 'advanced.dnsResolutionOrder',

packages/cli/src/config/settingsSchema.ts

@@ -737,6 +737,16 @@ export const SETTINGS_SCHEMA = {
             description: 'The currently selected authentication type.',
             showInDialog: false,
           },
+          enforcedType: {
+            type: 'string',
+            label: 'Enforced Auth Type',
+            category: 'Advanced',
+            requiresRestart: true,
+            default: undefined as AuthType | undefined,
+            description:
+              'The required auth type. If this does not match the selected auth type, the user will be prompted to re-authenticate.',
+            showInDialog: false,
+          },
           useExternal: {
             type: 'boolean',
             label: 'Use External Auth',