Guided-auth removal, OAuth smoke testing, and TUI/CLI support (#1531)

* refactor(web): update OAuth E2E tests to use new authentication method

- Replaced `runGuidedAuth` with `authenticate` in the InspectorClient OAuth end-to-end tests to support quick authentication with CIMD pre-registration.
- Updated comments to reflect the change in authentication method and its support for HTTP test metadata URLs.
- Ensured that the tests continue to validate the expected authorization URL after the change.

Additionally, imported `ensureCimdClientRegistration` in the OAuthManager to streamline client registration during the authentication process.

* Guided-auth removal, OAuth smoke testing, and TUI/CLI support

* Added CLI OAuth runner flags tests

* Added clarifying comment on port 0 binding

* README notes on TUI oauth callback port, prettier fixes for CLI tests

* CIMD validation uses inline like EMA IdP

* Fixed TUI test failures from merge

* test: bring 5 OAuth files over the 90 per-file coverage gate

The guided-auth-removal work added/touched several files that fell below
the repo's >=90 per-file coverage gate (npm run coverage). CI doesn't run
the gate (it's local-only), so validate + test:integration passed while
these gaps slipped through. Bring them all back over the line:

- core/auth/node/runner-oauth-callback.ts: test bad-URL/non-http-scheme
  throws, no-port->80 default, and IPv6 hostname bracketing. Annotate the
  provably-dead guards (empty host, out-of-range port, String(err)
  fallback, pathname "/" fallback) -- all rejected by new URL() upstream --
  with justified v8 ignore comments instead of lowering the gate.
- core/auth/cimd.ts: test the AS-doesn't-support-CIMD early return.
- core/react/useClientSettingsDraft.ts: test the functional-updater path,
  the stale-onChange-after-close prev===null guard, and the
  timer-fires-after-close value===null guard.
- ClientSettingsForm.tsx: test the CIMD checkbox toggle and CIMD URL clear.
- clients/tui/src/utils/oauthDisplay.ts: test static/dcr registration
  kinds, the expired IdP session, and the configured-scope/empty-scope
  branches of formatScopes.

npm run coverage now passes (exit 0) across web, cli, tui, launcher.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: cliffhall <cliff@futurescale.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core/auth/providers.ts

@@ -5,21 +5,20 @@ import type {
   OAuthTokens,
   OAuthMetadata,
 } from "@modelcontextprotocol/sdk/shared/auth.js";
-import type { OAuthStorage } from "./storage.js";
-import type { AuthExecution } from "./types.js";
-import { generateOAuthStateWithExecution } from "./utils.js";
+import type { OAuthStorage, SaveClientInformationOptions } from "./storage.js";
+import { generateOAuthState } from "./utils.js";
 
 /**
- * Redirect URL provider. Returns the redirect URL for the requested mode.
- * Caller populates the URLs before authenticate() (e.g. from callback server).
+ * Redirect URL provider. Returns the redirect URL for OAuth flows.
+ * Caller populates the URL before authenticate() (e.g. from callback server).
  */
 export interface RedirectUrlProvider {
-  getRedirectUrl(execution?: AuthExecution): string;
+  getRedirectUrl(): string;
 }
 
 /**
  * Mutable redirect URL provider for TUI/CLI. Caller sets redirectUrl
- * before authenticate(); same URL is used for both quick and guided flows.
+ * before authenticate().
  */
 export class MutableRedirectUrlProvider implements RedirectUrlProvider {
   redirectUrl = "";
@@ -109,19 +108,13 @@ export class BaseOAuthClientProvider implements OAuthClientProvider {
   protected redirectUrlProvider: RedirectUrlProvider;
   protected navigation: OAuthNavigation;
   public clientMetadataUrl?: string;
-  protected execution: AuthExecution;
 
-  constructor(
-    serverUrl: string,
-    oauthConfig: OAuthProviderConfig,
-    execution: AuthExecution = "quick",
-  ) {
+  constructor(serverUrl: string, oauthConfig: OAuthProviderConfig) {
     this.serverUrl = serverUrl;
     this.storage = oauthConfig.storage;
     this.redirectUrlProvider = oauthConfig.redirectUrlProvider;
     this.navigation = oauthConfig.navigation;
     this.clientMetadataUrl = oauthConfig.clientMetadataUrl;
-    this.execution = execution;
   }
 
   /**
@@ -149,13 +142,12 @@ export class BaseOAuthClientProvider implements OAuthClientProvider {
     return this.storage.getScope(this.serverUrl);
   }
 
-  /** Redirect URL for the current flow (quick or guided). */
   get redirectUrl(): string {
-    return this.redirectUrlProvider.getRedirectUrl(this.execution);
+    return this.redirectUrlProvider.getRedirectUrl();
   }
 
   get redirect_uris(): string[] {
-    return [this.redirectUrlProvider.getRedirectUrl("quick")];
+    return [this.redirectUrl];
   }
 
   get clientMetadata(): OAuthClientMetadata {
@@ -176,7 +168,7 @@ export class BaseOAuthClientProvider implements OAuthClientProvider {
   }
 
   state(): string | Promise<string> {
-    return generateOAuthStateWithExecution(this.execution);
+    return generateOAuthState();
   }
 
   async clientInformation(): Promise<OAuthClientInformation | undefined> {
@@ -193,8 +185,11 @@ export class BaseOAuthClientProvider implements OAuthClientProvider {
 
   async saveClientInformation(
     clientInformation: OAuthClientInformation,
+    options?: SaveClientInformationOptions,
   ): Promise<void> {
-    await this.storage.saveClientInformation(this.serverUrl, clientInformation);
+    await this.storage.saveClientInformation(this.serverUrl, clientInformation, {
+      registrationKind: options?.registrationKind ?? "dcr",
+    });
   }
 
   async saveScope(scope: string | undefined): Promise<void> {