Guided-auth removal, OAuth smoke testing, and TUI/CLI support (#1531)

* refactor(web): update OAuth E2E tests to use new authentication method

- Replaced `runGuidedAuth` with `authenticate` in the InspectorClient OAuth end-to-end tests to support quick authentication with CIMD pre-registration.
- Updated comments to reflect the change in authentication method and its support for HTTP test metadata URLs.
- Ensured that the tests continue to validate the expected authorization URL after the change.

Additionally, imported `ensureCimdClientRegistration` in the OAuthManager to streamline client registration during the authentication process.

* Guided-auth removal, OAuth smoke testing, and TUI/CLI support

* Added CLI OAuth runner flags tests

* Added clarifying comment on port 0 binding

* README notes on TUI oauth callback port, prettier fixes for CLI tests

* CIMD validation uses inline like EMA IdP

* Fixed TUI test failures from merge

* test: bring 5 OAuth files over the 90 per-file coverage gate

The guided-auth-removal work added/touched several files that fell below
the repo's >=90 per-file coverage gate (npm run coverage). CI doesn't run
the gate (it's local-only), so validate + test:integration passed while
these gaps slipped through. Bring them all back over the line:

- core/auth/node/runner-oauth-callback.ts: test bad-URL/non-http-scheme
  throws, no-port->80 default, and IPv6 hostname bracketing. Annotate the
  provably-dead guards (empty host, out-of-range port, String(err)
  fallback, pathname "/" fallback) -- all rejected by new URL() upstream --
  with justified v8 ignore comments instead of lowering the gate.
- core/auth/cimd.ts: test the AS-doesn't-support-CIMD early return.
- core/react/useClientSettingsDraft.ts: test the functional-updater path,
  the stale-onChange-after-close prev===null guard, and the
  timer-fires-after-close value===null guard.
- ClientSettingsForm.tsx: test the CIMD checkbox toggle and CIMD URL clear.
- clients/tui/src/utils/oauthDisplay.ts: test static/dcr registration
  kinds, the expired IdP session, and the configured-scope/empty-scope
  branches of formatScopes.

npm run coverage now passes (exit 0) across web, cli, tui, launcher.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: cliffhall <cliff@futurescale.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core/auth/cimd.ts

@@ -0,0 +1,54 @@
+import {
+  discoverAuthorizationServerMetadata,
+  discoverOAuthProtectedResourceMetadata,
+} from "@modelcontextprotocol/sdk/client/auth.js";
+import type { OAuthClientInformation } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { getAuthorizationServerUrl } from "./discovery.js";
+import type { BaseOAuthClientProvider } from "./providers.js";
+
+/**
+ * When the authorization server supports URL-based client IDs (SEP-991 / CIMD),
+ * pre-register `{ client_id: clientMetadataUrl }` before SDK `auth()`.
+ *
+ * SDK `auth()` rejects non-HTTPS `clientMetadataUrl` during registration, but
+ * accepts an already-stored `client_id` (including `http://` URLs used by local
+ * dev/test metadata servers). Production CIMD metadata documents should still
+ * use HTTPS per SEP-991.
+ */
+export async function ensureCimdClientRegistration(params: {
+  serverUrl: string;
+  provider: BaseOAuthClientProvider;
+  fetchFn?: typeof fetch;
+}): Promise<void> {
+  const clientMetadataUrl = params.provider.clientMetadataUrl?.trim();
+  if (!clientMetadataUrl) return;
+
+  const existing = await params.provider.clientInformation();
+  if (existing?.client_id) return;
+
+  let resourceMetadata;
+  try {
+    resourceMetadata = await discoverOAuthProtectedResourceMetadata(
+      params.serverUrl,
+    );
+  } catch {
+    resourceMetadata = undefined;
+  }
+
+  const authServerUrl = getAuthorizationServerUrl(
+    params.serverUrl,
+    resourceMetadata,
+  );
+
+  const metadata = await discoverAuthorizationServerMetadata(authServerUrl, {
+    ...(params.fetchFn && { fetchFn: params.fetchFn }),
+  });
+  if (!metadata?.client_id_metadata_document_supported) return;
+
+  const clientInformation: OAuthClientInformation = {
+    client_id: clientMetadataUrl,
+  };
+  await params.provider.saveClientInformation(clientInformation, {
+    registrationKind: "cimd",
+  });
+}