Guided-auth removal, OAuth smoke testing, and TUI/CLI support (#1531)

* refactor(web): update OAuth E2E tests to use new authentication method

- Replaced `runGuidedAuth` with `authenticate` in the InspectorClient OAuth end-to-end tests to support quick authentication with CIMD pre-registration.
- Updated comments to reflect the change in authentication method and its support for HTTP test metadata URLs.
- Ensured that the tests continue to validate the expected authorization URL after the change.

Additionally, imported `ensureCimdClientRegistration` in the OAuthManager to streamline client registration during the authentication process.

* Guided-auth removal, OAuth smoke testing, and TUI/CLI support

* Added CLI OAuth runner flags tests

* Added clarifying comment on port 0 binding

* README notes on TUI oauth callback port, prettier fixes for CLI tests

* CIMD validation uses inline like EMA IdP

* Fixed TUI test failures from merge

* test: bring 5 OAuth files over the 90 per-file coverage gate

The guided-auth-removal work added/touched several files that fell below
the repo's >=90 per-file coverage gate (npm run coverage). CI doesn't run
the gate (it's local-only), so validate + test:integration passed while
these gaps slipped through. Bring them all back over the line:

- core/auth/node/runner-oauth-callback.ts: test bad-URL/non-http-scheme
  throws, no-port->80 default, and IPv6 hostname bracketing. Annotate the
  provably-dead guards (empty host, out-of-range port, String(err)
  fallback, pathname "/" fallback) -- all rejected by new URL() upstream --
  with justified v8 ignore comments instead of lowering the gate.
- core/auth/cimd.ts: test the AS-doesn't-support-CIMD early return.
- core/react/useClientSettingsDraft.ts: test the functional-updater path,
  the stale-onChange-after-close prev===null guard, and the
  timer-fires-after-close value===null guard.
- ClientSettingsForm.tsx: test the CIMD checkbox toggle and CIMD URL clear.
- clients/tui/src/utils/oauthDisplay.ts: test static/dcr registration
  kinds, the expired IdP session, and the configured-scope/empty-scope
  branches of formatScopes.

npm run coverage now passes (exit 0) across web, cli, tui, launcher.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: cliffhall <cliff@futurescale.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core/client/config-parse.ts

@@ -54,6 +54,76 @@ const HttpUrlStringSchema = z
     }
   });
 
+/** Field-level error when a CIMD metadata URL is not a parseable http(s) URL. */
+export const CIMD_METADATA_URL_INVALID_ERROR =
+  "Must be a valid URL, like https://example.com/oauth/client.json";
+
+/** Field-level error when a CIMD metadata URL is not HTTPS. */
+export const CIMD_METADATA_URL_HTTPS_ERROR =
+  "CIMD client metadata URL must use HTTPS";
+
+/** Field-level error when a CIMD metadata URL has no path segment. */
+export const CIMD_METADATA_URL_PATH_ERROR =
+  "Must include a path (not the site root), like https://example.com/oauth/client.json";
+
+/**
+ * Inline / form validation for a non-empty CIMD client metadata URL.
+ * Returns undefined when the value is valid; empty strings are not flagged here
+ * (required-field gating lives in {@link canPersistClientSettingsDraft}).
+ */
+export function getCimdClientMetadataUrlError(value: string): string | undefined {
+  const trimmed = value.trim();
+  if (trimmed === "") return undefined;
+  if (!isAbsoluteHttpUrl(trimmed)) {
+    return CIMD_METADATA_URL_INVALID_ERROR;
+  }
+  try {
+    const url = new URL(trimmed);
+    if (url.protocol !== "https:") {
+      return CIMD_METADATA_URL_HTTPS_ERROR;
+    }
+    if (url.pathname === "/" || url.pathname === "") {
+      return CIMD_METADATA_URL_PATH_ERROR;
+    }
+  } catch {
+    return CIMD_METADATA_URL_INVALID_ERROR;
+  }
+  return undefined;
+}
+
+function refineCimdMetadataUrl(
+  val: string,
+  ctx: z.RefinementCtx,
+  required: boolean,
+): void {
+  const trimmed = val.trim();
+  if (trimmed === "") {
+    if (required) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "CIMD client metadata URL is required when CIMD is enabled",
+      });
+    }
+    return;
+  }
+  const error = getCimdClientMetadataUrlError(trimmed);
+  if (error) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: error,
+    });
+  }
+}
+
+const CimdConfigSchema = z
+  .object({
+    enabled: z.boolean(),
+    clientMetadataUrl: z.string(),
+  })
+  .superRefine((data, ctx) => {
+    refineCimdMetadataUrl(data.clientMetadataUrl, ctx, data.enabled === true);
+  });
+
 const EnterpriseManagedAuthIdpConfigSchema = z.object({
   issuer: HttpUrlStringSchema,
   clientId: z.string().min(1),
@@ -67,6 +137,7 @@ const ClientConfigSchema = z.object({
       idp: EnterpriseManagedAuthIdpConfigSchema,
     })
     .optional(),
+  cimd: CimdConfigSchema.optional(),
 });
 
 /**

core/client/index.ts

@@ -1,9 +1,12 @@
 export type {
   ClientConfig,
+  CimdConfig,
   EnterpriseManagedAuthIdpConfig,
 } from "./types.js";
 export {
+  getActiveCimdClientMetadataUrl,
   getActiveEnterpriseManagedAuthIdp,
+  isCimdEnabled,
   isEnterpriseManagedAuthEnabled,
 } from "./types.js";
 export {
@@ -18,3 +21,10 @@ export {
   saveClientConfigRemote,
   type RemoteClientConfigOptions,
 } from "./remote.js";
+export {
+  buildRunnerClientAuthOptions,
+  isOAuthCapableServerConfig,
+  loadRunnerClientConfig,
+  type LoadRunnerClientConfigOptions,
+  type RunnerClientConfigOverrides,
+} from "./runner.js";

core/client/runner.ts

@@ -0,0 +1,116 @@
+/**
+ * Install-level client config loading and InspectorClient auth option wiring
+ * for Node runners (TUI, CLI).
+ */
+
+import { KeyringSecretStore } from "../auth/node/secret-store.js";
+import type { InspectorClientOptions, InspectorServerSettings } from "../mcp/types.js";
+import { loadClientConfig } from "./config.js";
+import type { ClientConfig } from "./types.js";
+import {
+  getActiveCimdClientMetadataUrl,
+  getActiveEnterpriseManagedAuthIdp,
+} from "./types.js";
+
+export interface LoadRunnerClientConfigOptions {
+  /** Explicit path from `--client-config` (or MCP_CLIENT_CONFIG_PATH when unset). */
+  clientConfigPath?: string;
+}
+
+/** Load install-level client.json with keychain-backed IdP secrets. */
+export async function loadRunnerClientConfig(
+  options?: LoadRunnerClientConfigOptions,
+): Promise<ClientConfig> {
+  const customPath =
+    options?.clientConfigPath?.trim() ||
+    process.env.MCP_CLIENT_CONFIG_PATH?.trim() ||
+    undefined;
+  const secretStore = new KeyringSecretStore();
+  return loadClientConfig({ filePath: customPath, secretStore });
+}
+
+export interface RunnerClientConfigOverrides {
+  clientId?: string;
+  clientSecret?: string;
+  clientMetadataUrl?: string;
+}
+
+/** HTTP transports (SSE, streamable-http) can use OAuth. */
+export function isOAuthCapableServerConfig(
+  config: { type?: string } | null | undefined,
+): boolean {
+  if (!config) return false;
+  return config.type === "sse" || config.type === "streamable-http";
+}
+
+/**
+ * Derive OAuth / EMA / CIMD InspectorClient options from install client.json,
+ * per-server settings, and CLI flag overrides (flags win over client.json).
+ */
+export function buildRunnerClientAuthOptions(
+  clientConfig: ClientConfig,
+  savedSettings?: InspectorServerSettings,
+  cliOverrides?: RunnerClientConfigOverrides,
+): Pick<
+  InspectorClientOptions,
+  "oauth" | "enterpriseManagedAuth" | "installEnterpriseManagedAuth"
+> {
+  const activeIdp = getActiveEnterpriseManagedAuthIdp(clientConfig);
+  const activeCimdUrl = getActiveCimdClientMetadataUrl(clientConfig);
+
+  const oauthFromServer =
+    savedSettings &&
+    (savedSettings.oauthClientId ||
+      savedSettings.oauthClientSecret ||
+      savedSettings.oauthScopes ||
+      savedSettings.enterpriseManaged)
+      ? {
+          ...(savedSettings.oauthClientId && {
+            clientId: savedSettings.oauthClientId,
+          }),
+          ...(savedSettings.oauthClientSecret && {
+            clientSecret: savedSettings.oauthClientSecret,
+          }),
+          ...(savedSettings.oauthScopes && {
+            scope: savedSettings.oauthScopes,
+          }),
+          ...(savedSettings.enterpriseManaged && {
+            enterpriseManaged: true,
+          }),
+        }
+      : undefined;
+
+  const clientMetadataUrl =
+    cliOverrides?.clientMetadataUrl?.trim() || activeCimdUrl;
+
+  const oauthFromCli =
+    cliOverrides?.clientId ||
+    cliOverrides?.clientSecret ||
+    clientMetadataUrl
+      ? {
+          ...(cliOverrides?.clientId && { clientId: cliOverrides.clientId }),
+          ...(cliOverrides?.clientSecret && {
+            clientSecret: cliOverrides.clientSecret,
+          }),
+          ...(clientMetadataUrl && { clientMetadataUrl }),
+        }
+      : undefined;
+
+  const oauth =
+    oauthFromServer || oauthFromCli
+      ? {
+          ...(oauthFromServer ?? {}),
+          ...(oauthFromCli ?? {}),
+        }
+      : undefined;
+
+  return {
+    ...(oauth && { oauth }),
+    ...(activeIdp && {
+      enterpriseManagedAuth: { idp: activeIdp },
+    }),
+    ...(clientConfig.enterpriseManagedAuth && {
+      installEnterpriseManagedAuth: clientConfig.enterpriseManagedAuth,
+    }),
+  };
+}

core/client/types.ts

@@ -11,12 +11,20 @@ export interface EnterpriseManagedAuthIdpConfig {
   clientSecret?: string;
 }
 
+/** Install-level CIMD (Client ID Metadata Document) settings. */
+export interface CimdConfig {
+  /** When false, the metadata URL is kept but CIMD is inactive install-wide. */
+  enabled?: boolean;
+  clientMetadataUrl: string;
+}
+
 export interface ClientConfig {
   enterpriseManagedAuth?: {
     /** When false, IdP credentials are kept but EMA is inactive install-wide. */
     enabled?: boolean;
     idp: EnterpriseManagedAuthIdpConfig;
   };
+  cimd?: CimdConfig;
 }
 
 /** True when install-level EMA IdP config is active (not just stored). */
@@ -34,3 +42,16 @@ export function getActiveEnterpriseManagedAuthIdp(
   if (!isEnterpriseManagedAuthEnabled(config)) return undefined;
   return config.enterpriseManagedAuth!.idp;
 }
+
+/** True when install-level CIMD is active (not just stored). */
+export function isCimdEnabled(config: ClientConfig): boolean {
+  return config.cimd?.enabled === true;
+}
+
+export function getActiveCimdClientMetadataUrl(
+  config: ClientConfig,
+): string | undefined {
+  if (!isCimdEnabled(config)) return undefined;
+  const url = config.cimd?.clientMetadataUrl?.trim();
+  return url || undefined;
+}