xero: optional XERO_SCOPES setup field for post-April-2026 Custom Connections (1.0.1)

[ericgyl817]

Customer impact: CM-37: Xero users whose Custom Connection was created on or after 29 Apr 2026 always failed to connect with invalid_client, because the server asks Xero for old bundled scopes those connections reject; they can now enter their granted scopes in the new optional Xero scopes field and connect (on Grok Bot this also needs everysphere #1079195 so saved values reach the plugin).

• Adds an optional Xero scopes setup field, passed as XERO_SCOPES: "${XERO_SCOPES:-}", so Custom Connections created on or after 2026-04-29 can skip the bundled-scope token request that Xero rejects with invalid_client (CM-37; upstream fix fix: try no-scope token request first for new custom connections XeroAPI/xero-mcp-server#288 is still unmerged, and the published 0.0.17 already honors XERO_SCOPES).
• Verified against Xero's token endpoint with 0.0.17: blank keeps today's V1 path (...with V1 scopes), a value takes the XERO_SCOPES path; Cursor's expansion turns the blank default into "", which the server treats as unset.
• Regression: no; existing installs leave the field blank and get byte-identical behavior, and node scripts/validate-plugins.mjs passes.

---

Note

Low Risk
Optional plugin configuration and env passthrough only; existing installs with a blank scopes field keep the same MCP env behavior.

Overview
Bumps the Xero plugin to 1.0.1 and adds an optional Xero scopes setup field (XERO_SCOPES) wired through mcp.json as XERO_SCOPES: "${XERO_SCOPES:-}" so the local @xeroapi/xero-mcp-server can request granular OAuth scopes instead of the bundled set.

README, CHANGELOG, and plugin.json now document that Custom Connections created on or after 2026-04-29 must supply space-separated scopes (e.g. accounting.invoices accounting.contacts); otherwise Xero returns invalid_client. Leaving the field blank preserves prior behavior for older connections.

^{Reviewed by Cursor Bugbot for commit 503d627. Bugbot is set up for automated code reviews on this repo. Configure here.}