Guided-auth removal, OAuth smoke testing, and TUI/CLI support (#1531)

* refactor(web): update OAuth E2E tests to use new authentication method

- Replaced `runGuidedAuth` with `authenticate` in the InspectorClient OAuth end-to-end tests to support quick authentication with CIMD pre-registration.
- Updated comments to reflect the change in authentication method and its support for HTTP test metadata URLs.
- Ensured that the tests continue to validate the expected authorization URL after the change.

Additionally, imported `ensureCimdClientRegistration` in the OAuthManager to streamline client registration during the authentication process.

* Guided-auth removal, OAuth smoke testing, and TUI/CLI support

* Added CLI OAuth runner flags tests

* Added clarifying comment on port 0 binding

* README notes on TUI oauth callback port, prettier fixes for CLI tests

* CIMD validation uses inline like EMA IdP

* Fixed TUI test failures from merge

* test: bring 5 OAuth files over the 90 per-file coverage gate

The guided-auth-removal work added/touched several files that fell below
the repo's >=90 per-file coverage gate (npm run coverage). CI doesn't run
the gate (it's local-only), so validate + test:integration passed while
these gaps slipped through. Bring them all back over the line:

- core/auth/node/runner-oauth-callback.ts: test bad-URL/non-http-scheme
  throws, no-port->80 default, and IPv6 hostname bracketing. Annotate the
  provably-dead guards (empty host, out-of-range port, String(err)
  fallback, pathname "/" fallback) -- all rejected by new URL() upstream --
  with justified v8 ignore comments instead of lowering the gate.
- core/auth/cimd.ts: test the AS-doesn't-support-CIMD early return.
- core/react/useClientSettingsDraft.ts: test the functional-updater path,
  the stale-onChange-after-close prev===null guard, and the
  timer-fires-after-close value===null guard.
- ClientSettingsForm.tsx: test the CIMD checkbox toggle and CIMD URL clear.
- clients/tui/src/utils/oauthDisplay.ts: test static/dcr registration
  kinds, the expired IdP session, and the configured-scope/empty-scope
  branches of formatScopes.

npm run coverage now passes (exit 0) across web, cli, tui, launcher.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: cliffhall <cliff@futurescale.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core/mcp/node/index.ts

@@ -19,4 +19,5 @@ export {
   type ResolvedServer,
   type ServerLoadOptions,
 } from "./servers.js";
+export { rehydrateMcpConfigFromKeychain } from "./server-secrets.js";
 export { createTransportNode } from "./transport.js";

core/mcp/node/server-secrets.ts

@@ -0,0 +1,34 @@
+import type { SecretStore } from "../../auth/node/secret-store.js";
+import {
+  expectedSecretFields,
+  mergeSecretsIntoStored,
+} from "../serverList.js";
+import type { MCPConfig } from "../types.js";
+
+/**
+ * Merge per-server secrets from the OS keychain into an on-disk MCP catalog
+ * shape. Mirrors the web `/api/servers` GET rehydration path so TUI/CLI see
+ * the same effective OAuth client secrets and stdio env values as the browser.
+ */
+export async function rehydrateMcpConfigFromKeychain(
+  config: MCPConfig,
+  secretStore: SecretStore,
+): Promise<MCPConfig> {
+  const out: MCPConfig = { mcpServers: {} };
+  await Promise.all(
+    Object.entries(config.mcpServers).map(async ([id, stored]) => {
+      const fields = expectedSecretFields(stored);
+      const secrets: Record<string, string> = {};
+      await Promise.all(
+        fields.map(async (field) => {
+          const value = await secretStore.get(id, field);
+          if (value !== null) {
+            secrets[field] = value;
+          }
+        }),
+      );
+      out.mcpServers[id] = mergeSecretsIntoStored(stored, secrets);
+    }),
+  );
+  return out;
+}

core/mcp/node/servers.ts

@@ -1,3 +1,7 @@
+import {
+  KeyringSecretStore,
+  type SecretStore,
+} from "../../auth/node/secret-store.js";
 import type { InspectorServerSettings, MCPServerConfig } from "../types.js";
 import { DEFAULT_MAX_FETCH_REQUESTS, DEFAULT_TASK_TTL_MS } from "../types.js";
 import { mcpConfigToServerEntries } from "../serverList.js";
@@ -11,6 +15,7 @@ import {
   withDefaultCatalogPath,
   type ServerConfigOptions,
 } from "./config.js";
+import { rehydrateMcpConfigFromKeychain } from "./server-secrets.js";
 
 /**
  * A server resolved from a catalog/config file or an ad-hoc target, paired with
@@ -27,6 +32,8 @@ export type ResolvedServer = {
  * broadcast into every resolved server's settings. */
 export type ServerLoadOptions = ServerConfigOptions & {
   headers?: Record<string, string>;
+  /** Test injection; defaults to {@link KeyringSecretStore} for catalog/config loads. */
+  secretStore?: SecretStore;
 };
 
 /**
@@ -78,9 +85,9 @@ function mergeSettings(
  * enforces the `--catalog`/`--config`/ad-hoc conflict matrix, and seeds an empty
  * writable catalog on first run (a missing read-only `--config` still errors).
  */
-export function loadServerEntries(
+export async function loadServerEntries(
   serverOptions: ServerLoadOptions,
-): Record<string, ResolvedServer> {
+): Promise<Record<string, ResolvedServer>> {
   serverOptions = withDefaultCatalogPath(serverOptions);
 
   const conflict = serverSourceConflict({
@@ -95,7 +102,9 @@ export function loadServerEntries(
   const source = resolveServerSource(serverOptions);
 
   if (source) {
-    const config = readServerListFile(source.path, source.writable);
+    let config = readServerListFile(source.path, source.writable);
+    const secretStore = serverOptions.secretStore ?? new KeyringSecretStore();
+    config = await rehydrateMcpConfigFromKeychain(config, secretStore);
     const entries = mcpConfigToServerEntries(config);
     const result: Record<string, ResolvedServer> = {};
     for (const entry of entries) {