Guided-auth removal, OAuth smoke testing, and TUI/CLI support (#1531)

* refactor(web): update OAuth E2E tests to use new authentication method

- Replaced `runGuidedAuth` with `authenticate` in the InspectorClient OAuth end-to-end tests to support quick authentication with CIMD pre-registration.
- Updated comments to reflect the change in authentication method and its support for HTTP test metadata URLs.
- Ensured that the tests continue to validate the expected authorization URL after the change.

Additionally, imported `ensureCimdClientRegistration` in the OAuthManager to streamline client registration during the authentication process.

* Guided-auth removal, OAuth smoke testing, and TUI/CLI support

* Added CLI OAuth runner flags tests

* Added clarifying comment on port 0 binding

* README notes on TUI oauth callback port, prettier fixes for CLI tests

* CIMD validation uses inline like EMA IdP

* Fixed TUI test failures from merge

* test: bring 5 OAuth files over the 90 per-file coverage gate

The guided-auth-removal work added/touched several files that fell below
the repo's >=90 per-file coverage gate (npm run coverage). CI doesn't run
the gate (it's local-only), so validate + test:integration passed while
these gaps slipped through. Bring them all back over the line:

- core/auth/node/runner-oauth-callback.ts: test bad-URL/non-http-scheme
  throws, no-port->80 default, and IPv6 hostname bracketing. Annotate the
  provably-dead guards (empty host, out-of-range port, String(err)
  fallback, pathname "/" fallback) -- all rejected by new URL() upstream --
  with justified v8 ignore comments instead of lowering the gate.
- core/auth/cimd.ts: test the AS-doesn't-support-CIMD early return.
- core/react/useClientSettingsDraft.ts: test the functional-updater path,
  the stale-onChange-after-close prev===null guard, and the
  timer-fires-after-close value===null guard.
- ClientSettingsForm.tsx: test the CIMD checkbox toggle and CIMD URL clear.
- clients/tui/src/utils/oauthDisplay.ts: test static/dcr registration
  kinds, the expired IdP session, and the configured-scope/empty-scope
  branches of formatScopes.

npm run coverage now passes (exit 0) across web, cli, tui, launcher.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: cliffhall <cliff@futurescale.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core/auth/utils.ts

@@ -1,4 +1,3 @@
-import type { AuthExecution } from "./types.js";
 import type { CallbackParams } from "./types.js";
 
 /**
@@ -71,47 +70,13 @@ export const generateOAuthState = (): string => {
 };
 
 /**
- * Generate OAuth `state` with execution prefix for single-redirect-URL flows.
- * Format: `{execution}:{authId}` (e.g. "guided:a1b2c3...").
- * Protocol (standard vs EMA) is not encoded here — it comes from server config.
- * The authId is 64 hex chars for CSRF protection and serves as session identifier.
+ * Parse OAuth `state` to extract the auth session id (CSRF token).
+ * Must be the 64-char hex value from {@link generateOAuthState}.
  */
-export const generateOAuthStateWithExecution = (
-  execution: AuthExecution,
-): string => {
-  const authId = generateOAuthState();
-  return `${execution}:${authId}`;
-};
-
-/** @deprecated Use {@link generateOAuthStateWithExecution}. */
-export const generateOAuthStateWithMode = generateOAuthStateWithExecution;
-
-/**
- * Parse OAuth `state` to extract execution and authId.
- * Returns null if invalid.
- * Legacy prefixes `normal:` and `ema-idp:` map to `quick`.
- * Plain 64-char hex (no prefix) is treated as quick.
- */
-export const parseOAuthState = (
-  state: string,
-): { execution: AuthExecution; authId: string } | null => {
+export const parseOAuthState = (state: string): { authId: string } | null => {
   if (!state || typeof state !== "string") return null;
-  if (state.startsWith("quick:")) {
-    return { execution: "quick", authId: state.slice(6) };
-  }
-  if (state.startsWith("guided:")) {
-    return { execution: "guided", authId: state.slice(7) };
-  }
-  // Legacy execution prefixes
-  if (state.startsWith("normal:")) {
-    return { execution: "quick", authId: state.slice(7) };
-  }
-  if (state.startsWith("ema-idp:")) {
-    return { execution: "quick", authId: state.slice(8) };
-  }
-  // Legacy: plain 64-char hex
   if (/^[a-f0-9]{64}$/i.test(state)) {
-    return { execution: "quick", authId: state };
+    return { authId: state };
   }
   return null;
 };
@@ -136,3 +101,19 @@ export const generateOAuthErrorDescription = (
     .filter(Boolean)
     .join("\n");
 };
+
+/**
+ * True when a thrown connect error represents an upstream 401. The remote
+ * transport preserves the status on the error object; as a fallback, match
+ * transport wording `"failed …(401)"` so unrelated `(401)` in messages does
+ * not trigger OAuth.
+ */
+export function isUnauthorizedError(err: unknown): boolean {
+  if (typeof err === "object" && err !== null) {
+    const status = (err as { status?: number; code?: number }).status;
+    const code = (err as { code?: number }).code;
+    if (status === 401 || code === 401) return true;
+  }
+  const message = err instanceof Error ? err.message : String(err);
+  return /\bfailed\b[^\n]*\(401\)/i.test(message);
+}