fix(http): support auth_tools: null and static headers to override auto-generated auth

packages/http/src/http_communication_protocol.ts

@@ -90,7 +90,9 @@ export class HttpCommunicationProtocol implements CommunicationProtocol {
         this._logInfo(`Assuming OpenAPI spec from '${httpCallTemplate.name}'. Converting to UTCP manual.`);
         const converter = new OpenApiConverter(responseData, {
           specUrl: httpCallTemplate.url,
-          callTemplateName: httpCallTemplate.name
+          callTemplateName: httpCallTemplate.name,
+          authTools: httpCallTemplate.auth_tools,
+          headers: httpCallTemplate.headers
         });
         utcpManual = converter.convert();
       } else {

packages/http/src/openapi_converter.ts

@@ -32,8 +32,19 @@ import { HttpCallTemplate } from './http_call_template';
 export interface OpenApiConverterOptions {
   specUrl?: string;
   callTemplateName?: string;
-  authTools?: Auth;
+  /**
+   * Authentication configuration for generated tools.
+   * - undefined: Auto-generate placeholder auth from OpenAPI security schemes
+   * - null: Explicitly disable auth for all generated tools
+   * - Auth object: Use the provided auth configuration
+   */
+  authTools?: Auth | null;
   baseUrl?: string;
+  /**
+   * Static headers to include in all generated tool call templates.
+   * These headers will be sent with every tool request.
+   */
+  headers?: Record<string, string>;
 }
 
 /**
@@ -49,7 +60,8 @@ export class OpenApiConverter {
   private spec: Record<string, any>;
   private spec_url: string | undefined;
   private base_url: string | undefined;
-  private auth_tools: Auth | undefined;
+  private auth_tools: Auth | null | undefined;
+  private headers: Record<string, string> | undefined;
   private placeholder_counter: number = 0;
   private call_template_name: string;
 
@@ -68,6 +80,7 @@ export class OpenApiConverter {
     this.spec_url = options?.specUrl;
     this.base_url = options?.baseUrl;
     this.auth_tools = options?.authTools;
+    this.headers = options?.headers;
     this.placeholder_counter = 0;
 
     let callTemplateName = options?.callTemplateName;
@@ -248,6 +261,7 @@ export class OpenApiConverter {
       url: fullUrl,
       body_field: bodyField ?? undefined,
       header_fields: headerFields.length > 0 ? headerFields : undefined,
+      headers: this.headers,
       auth,
       content_type: 'application/json',
       timeout: 30
@@ -410,6 +424,11 @@ export class OpenApiConverter {
    * @returns An Auth object or undefined if no authentication is specified.
    */
   private _extractAuth(operation: Record<string, any>): Auth | undefined {
+    // If auth_tools is explicitly set to null, disable auth for all tools
+    if (this.auth_tools === null) {
+      return undefined;
+    }
+
     // First check for operation-level security requirements
     let securityRequirements = operation.security || [];