Guided-auth removal, OAuth smoke testing, and TUI/CLI support (#1531)

* refactor(web): update OAuth E2E tests to use new authentication method

- Replaced `runGuidedAuth` with `authenticate` in the InspectorClient OAuth end-to-end tests to support quick authentication with CIMD pre-registration.
- Updated comments to reflect the change in authentication method and its support for HTTP test metadata URLs.
- Ensured that the tests continue to validate the expected authorization URL after the change.

Additionally, imported `ensureCimdClientRegistration` in the OAuthManager to streamline client registration during the authentication process.

* Guided-auth removal, OAuth smoke testing, and TUI/CLI support

* Added CLI OAuth runner flags tests

* Added clarifying comment on port 0 binding

* README notes on TUI oauth callback port, prettier fixes for CLI tests

* CIMD validation uses inline like EMA IdP

* Fixed TUI test failures from merge

* test: bring 5 OAuth files over the 90 per-file coverage gate

The guided-auth-removal work added/touched several files that fell below
the repo's >=90 per-file coverage gate (npm run coverage). CI doesn't run
the gate (it's local-only), so validate + test:integration passed while
these gaps slipped through. Bring them all back over the line:

- core/auth/node/runner-oauth-callback.ts: test bad-URL/non-http-scheme
  throws, no-port->80 default, and IPv6 hostname bracketing. Annotate the
  provably-dead guards (empty host, out-of-range port, String(err)
  fallback, pathname "/" fallback) -- all rejected by new URL() upstream --
  with justified v8 ignore comments instead of lowering the gate.
- core/auth/cimd.ts: test the AS-doesn't-support-CIMD early return.
- core/react/useClientSettingsDraft.ts: test the functional-updater path,
  the stale-onChange-after-close prev===null guard, and the
  timer-fires-after-close value===null guard.
- ClientSettingsForm.tsx: test the CIMD checkbox toggle and CIMD URL clear.
- clients/tui/src/utils/oauthDisplay.ts: test static/dcr registration
  kinds, the expired IdP session, and the configured-scope/empty-scope
  branches of formatScopes.

npm run coverage now passes (exit 0) across web, cli, tui, launcher.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: cliffhall <cliff@futurescale.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

clients/web/src/test/integration/auth/node/oauth-callback-server.test.ts

@@ -99,12 +99,12 @@ describe("OAuthCallbackServer", () => {
     expect(received.state).toBeUndefined();
   });
 
-  it("GET /oauth/callback/guided returns 404 (single path only)", async () => {
+  it("GET /oauth/callback/extra returns 404 (single path only)", async () => {
     server = createOAuthCallbackServer();
     const result = await server.start({ port: 0 });
 
     const res = await fetch(
-      `http://localhost:${result.port}/oauth/callback/guided?code=guided-code`,
+      `http://localhost:${result.port}/oauth/callback/extra?code=test-code`,
     );
 
     expect(res.status).toBe(404);

clients/web/src/test/integration/auth/node/storage.test.ts

@@ -72,7 +72,9 @@ describe("NodeOAuthStorage", () => {
         client_secret: "test-secret",
       };
 
-      await storage.saveClientInformation(testServerUrl, clientInfo);
+      await storage.saveClientInformation(testServerUrl, clientInfo, {
+        registrationKind: "dcr",
+      });
 
       const result = await storage.getClientInformation(testServerUrl);
       expect(result).toBeDefined();
@@ -106,7 +108,9 @@ describe("NodeOAuthStorage", () => {
         client_id: "test-client-id",
       };
 
-      await storage.saveClientInformation(testServerUrl, clientInfo);
+      await storage.saveClientInformation(testServerUrl, clientInfo, {
+        registrationKind: "dcr",
+      });
       const result = await storage.getClientInformation(testServerUrl);
 
       expect(result).toBeDefined();
@@ -122,8 +126,12 @@ describe("NodeOAuthStorage", () => {
         client_id: "second-id",
       };
 
-      storage.saveClientInformation(testServerUrl, firstInfo);
-      storage.saveClientInformation(testServerUrl, secondInfo);
+      storage.saveClientInformation(testServerUrl, firstInfo, {
+        registrationKind: "dcr",
+      });
+      storage.saveClientInformation(testServerUrl, secondInfo, {
+        registrationKind: "dcr",
+      });
       const result = await storage.getClientInformation(testServerUrl);
 
       expect(result).toBeDefined();
@@ -292,9 +300,13 @@ describe("NodeOAuthStorage", () => {
 
   describe("clearClientInformation", () => {
     it("removes the dynamically-registered client information by default", async () => {
-      await storage.saveClientInformation(testServerUrl, {
-        client_id: "dyn",
-      });
+      await storage.saveClientInformation(
+        testServerUrl,
+        {
+          client_id: "dyn",
+        },
+        { registrationKind: "dcr" },
+      );
       expect(await storage.getClientInformation(testServerUrl)).toEqual({
         client_id: "dyn",
       });
@@ -365,7 +377,9 @@ describe("NodeOAuthStorage", () => {
         token_type: "Bearer",
       };
 
-      await storage.saveClientInformation(testServerUrl, clientInfo);
+      await storage.saveClientInformation(testServerUrl, clientInfo, {
+        registrationKind: "dcr",
+      });
       await storage.saveTokens(testServerUrl, tokens);
 
       storage.clear(testServerUrl);
@@ -380,8 +394,12 @@ describe("NodeOAuthStorage", () => {
         client_id: "test-client-id",
       };
 
-      await storage.saveClientInformation(testServerUrl, clientInfo);
-      await storage.saveClientInformation(otherServerUrl, clientInfo);
+      await storage.saveClientInformation(testServerUrl, clientInfo, {
+        registrationKind: "dcr",
+      });
+      await storage.saveClientInformation(otherServerUrl, clientInfo, {
+        registrationKind: "dcr",
+      });
 
       storage.clear(testServerUrl);
 
@@ -406,8 +424,12 @@ describe("NodeOAuthStorage", () => {
         client_id: "client-2",
       };
 
-      storage.saveClientInformation(server1Url, clientInfo1);
-      storage.saveClientInformation(server2Url, clientInfo2);
+      storage.saveClientInformation(server1Url, clientInfo1, {
+        registrationKind: "dcr",
+      });
+      storage.saveClientInformation(server2Url, clientInfo2, {
+        registrationKind: "dcr",
+      });
 
       const result1 = await storage.getClientInformation(server1Url);
       const result2 = await storage.getClientInformation(server2Url);