Guided-auth removal, OAuth smoke testing, and TUI/CLI support (#1531)

* refactor(web): update OAuth E2E tests to use new authentication method

- Replaced `runGuidedAuth` with `authenticate` in the InspectorClient OAuth end-to-end tests to support quick authentication with CIMD pre-registration.
- Updated comments to reflect the change in authentication method and its support for HTTP test metadata URLs.
- Ensured that the tests continue to validate the expected authorization URL after the change.

Additionally, imported `ensureCimdClientRegistration` in the OAuthManager to streamline client registration during the authentication process.

* Guided-auth removal, OAuth smoke testing, and TUI/CLI support

* Added CLI OAuth runner flags tests

* Added clarifying comment on port 0 binding

* README notes on TUI oauth callback port, prettier fixes for CLI tests

* CIMD validation uses inline like EMA IdP

* Fixed TUI test failures from merge

* test: bring 5 OAuth files over the 90 per-file coverage gate

The guided-auth-removal work added/touched several files that fell below
the repo's >=90 per-file coverage gate (npm run coverage). CI doesn't run
the gate (it's local-only), so validate + test:integration passed while
these gaps slipped through. Bring them all back over the line:

- core/auth/node/runner-oauth-callback.ts: test bad-URL/non-http-scheme
  throws, no-port->80 default, and IPv6 hostname bracketing. Annotate the
  provably-dead guards (empty host, out-of-range port, String(err)
  fallback, pathname "/" fallback) -- all rejected by new URL() upstream --
  with justified v8 ignore comments instead of lowering the gate.
- core/auth/cimd.ts: test the AS-doesn't-support-CIMD early return.
- core/react/useClientSettingsDraft.ts: test the functional-updater path,
  the stale-onChange-after-close prev===null guard, and the
  timer-fires-after-close value===null guard.
- ClientSettingsForm.tsx: test the CIMD checkbox toggle and CIMD URL clear.
- clients/tui/src/utils/oauthDisplay.ts: test static/dcr registration
  kinds, the expired IdP session, and the configured-scope/empty-scope
  branches of formatScopes.

npm run coverage now passes (exit 0) across web, cli, tui, launcher.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: cliffhall <cliff@futurescale.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core/auth/connection-state.ts

@@ -7,7 +7,7 @@ import { getEmaIdpLoginState, normalizeIdpIssuer } from "./ema/idpSession.js";
 import { idpOAuthStorageKey } from "./ema/storage.js";
 import { isJwtExpired } from "./ema/jwt.js";
 import type { OAuthStorage } from "./storage.js";
-import type { AuthProtocol, OAuthConnectionState, OAuthFlowState } from "./types.js";
+import type { AuthProtocol, OAuthClientRegistrationKind, OAuthConnectionState, OAuthFlowState } from "./types.js";
 import { authProtocolFromEnterpriseManaged } from "./types.js";
 
 export interface BuildOAuthConnectionStateParams {
@@ -27,13 +27,28 @@ function isAccessTokenUsable(tokens: OAuthTokens | undefined): boolean {
 function resolveClient(
   preregistered: OAuthClientInformation | undefined,
   dynamic: OAuthClientInformation | undefined,
+  dynamicRegistrationKind: Extract<
+    OAuthClientRegistrationKind,
+    "dcr" | "cimd"
+  > | undefined,
 ): OAuthConnectionState["client"] | undefined {
-  const info = preregistered ?? dynamic;
-  if (!info?.client_id) return undefined;
+  if (preregistered?.client_id) {
+    return {
+      registrationKind: "static",
+      clientId: preregistered.client_id,
+      hasClientSecret:
+        preregistered.client_secret !== undefined &&
+        preregistered.client_secret !== "",
+    };
+  }
+  if (!dynamic?.client_id) return undefined;
   return {
-    source: preregistered ? "preregistered" : "dynamic",
-    clientId: info.client_id,
-    hasClientSecret: info.client_secret !== undefined && info.client_secret !== "",
+    ...(dynamicRegistrationKind && {
+      registrationKind: dynamicRegistrationKind,
+    }),
+    clientId: dynamic.client_id,
+    hasClientSecret:
+      dynamic.client_secret !== undefined && dynamic.client_secret !== "",
   };
 }
 
@@ -76,7 +91,17 @@ export async function buildOAuthConnectionState(
   const authorized = isAccessTokenUsable(tokens);
   const grantedScope = resolveGrantedScope(tokens, storageScope);
 
-  const client = resolveClient(preregistered, dynamic);
+  const registrationKind = storage.getClientRegistrationKind(serverUrl);
+  const dynamicRegistrationKind =
+    registrationKind === "dcr" || registrationKind === "cimd"
+      ? registrationKind
+      : undefined;
+
+  const client = resolveClient(
+    preregistered,
+    dynamic,
+    preregistered?.client_id ? undefined : dynamicRegistrationKind,
+  );
 
   const state: OAuthConnectionState = {
     authorized,
@@ -114,12 +139,31 @@ export function isServerOAuthConfigured(config: {
   clientSecret?: string;
   scope?: string;
   enterpriseManaged?: boolean;
+  clientMetadataUrl?: string;
 }): boolean {
   return (
     config.enterpriseManaged === true ||
     !!config.clientId?.trim() ||
     !!config.clientSecret?.trim() ||
-    !!config.scope?.trim()
+    !!config.scope?.trim() ||
+    !!config.clientMetadataUrl?.trim()
+  );
+}
+
+/** True when persisted OAuth storage has tokens or client registration for a server. */
+export async function hasPersistedOAuthServerState(
+  storage: OAuthStorage,
+  serverUrl: string,
+): Promise<boolean> {
+  const [tokens, preregistered, dynamic] = await Promise.all([
+    storage.getTokens(serverUrl),
+    storage.getClientInformation(serverUrl, true),
+    storage.getClientInformation(serverUrl),
+  ]);
+  return !!(
+    tokens?.access_token ||
+    preregistered?.client_id ||
+    dynamic?.client_id
   );
 }