wood-fired-tasks 2.0.0 → 2.0.2

package/CHANGELOG.md

@@ -13,6 +13,42 @@ vulnerabilities, supply-chain pinning) are always called out under `Security`.
 
 _No changes yet._
 
+## [v2.0.2] - 2026-06-08
+
+### Fixed
+- **`tasks setup` remote onboarding now reaches the automated device-flow login
+  instead of always falling back to manual PAT entry.** The onboarding probe
+  read the server's OIDC state from `GET /health/detailed`, but v2.0's identity
+  cutover put that endpoint behind Bearer-PAT auth — so an unauthenticated probe
+  (the only kind possible *before* you have a token) always got `401`, the OIDC
+  state was "undeterminable", and setup fell back to asking you to paste a
+  personal access token. The probe now targets the **public** `GET /auth/login`
+  endpoint (`redirect: 'manual'`): a `3xx` redirect to the IdP means browser
+  login is available (`ready`), a `501` means OIDC is disabled (`manual-pat`).
+  Verified against a live OIDC-ready server: the probe now resolves `ready`
+  where it previously 401'd, so the device-flow browser login launches as
+  intended.
+
+## [v2.0.1] - 2026-06-08
+
+### Fixed
+- **`tasks setup` interactive "Remote" selection no longer crashes.** Choosing
+  option **3) Remote** from the interactive setup menu threw
+  `remote onboarding requires a --remote <url> base URL.` because the menu set
+  the mode but never captured the server URL — only the `--remote <url>` flag
+  did. The interactive remote path now prompts for the base URL when it is not
+  supplied as a flag, guarded by a TTY check so non-interactive/CI callers still
+  fail fast with the same clear message instead of hanging on stdin.
+- **DB-path legacy-adopt tests are now hermetic.** `migrate-db-path.test.ts` and
+  `config-path-e2e.test.ts` exercise the "adopt `./data/tasks.db` when the OS
+  app-data DB is absent" precedence, but probed the real filesystem and so
+  failed on any dev machine where the `tasks` CLI had already created
+  `~/.local/share/wood-fired-tasks/tasks.db` (they passed on clean CI by luck).
+  `resolveMigrateDbPath`/`migrateCli` now forward the resolver's existing
+  injectable `exists` seam (default `fs.existsSync`, no behavior change), and the
+  tests inject a probe that hides the app-data DB — making the precedence-2
+  cases deterministic regardless of the developer's local state.
+
 ## [v2.0.0] - 2026-06-07
 
 The **identity auth cutover** — a breaking major. The legacy `X-API-Key`

package/dist/cli/commands/setup.d.ts

@@ -274,9 +274,11 @@ export declare function writeRemoteMcpEntryOnly(options?: RunSetupOptions): RunS
  */
 export type SetupMode = 'local' | 'service' | 'remote';
 /**
- * Coarse OIDC subsystem state reported by `GET /health/detailed` (task #357).
- * Mirrors the server's `oidc.state` enum so the remote-setup branch selector
- * (#807) can route deterministically.
+ * Coarse OIDC subsystem state used by the remote-setup branch selector (#807)
+ * to route deterministically. Derived by {@link probeOidcState} from the public
+ * `/auth/login` endpoint (`ready` = redirects to IdP, `disabled` = 501 stub).
+ * `degraded` is retained for back-compat but is no longer emitted by the probe
+ * (an unhealthy OIDC surfaces as an inconclusive status → manual-PAT fallback).
  */
 export type OidcState = 'ready' | 'disabled' | 'degraded';
 /**
@@ -287,10 +289,12 @@ export type OidcState = 'ready' | 'disabled' | 'degraded';
  */
 export type RemoteOnboardingMethod = 'device-flow' | 'manual-pat';
 /**
- * Result of probing `GET /health/detailed` for the OIDC state.
- *  - `{ ok: true, oidc }` — the probe returned 2xx and an `oidc.state`.
- *  - `{ ok: false, reason }` — network error / non-2xx / unparseable body.
- *    The `reason` is surfaced to the user before falling back to manual PAT.
+ * Result of probing the server for whether browser/device-flow login is
+ * available.
+ *  - `{ ok: true, oidc }` — the probe got a conclusive answer (`ready` =
+ *    device-flow available, `disabled` = no OIDC → manual PAT).
+ *  - `{ ok: false, reason }` — network error / inconclusive status. The
+ *    `reason` is surfaced to the user before falling back to manual PAT.
  */
 export type OidcProbeResult = {
     ok: true;
@@ -302,13 +306,22 @@ export type OidcProbeResult = {
 /** Injectable probe signature so tests can drive each branch without a server. */
 export type OidcProbe = (baseUrl: string) => Promise<OidcProbeResult>;
 /**
- * Default OIDC probe: `GET <baseUrl>/health/detailed` and read `oidc.state`.
+ * Default OIDC probe: `GET <baseUrl>/auth/login` (the browser-login entry
+ * point) and read OIDC availability from the HTTP status.
  *
- * `/health/detailed` is auth-protected on the server (Bearer PAT), but the only
- * field we need — `oidc.state` — is returned in the JSON body regardless of the
- * auth-derived status code as long as the route renders. We treat ANY non-2xx
- * or unparseable/missing `oidc.state` as a probe failure and fall back to the
- * manual-PAT escape hatch (the route may not even exist on an older server).
+ * Why NOT `/health/detailed` (the original #807 target): v2.0's identity
+ * cutover put `/health/detailed` behind Bearer-PAT auth, so an unauthenticated
+ * probe — which is the ONLY kind possible during onboarding, before any PAT
+ * exists — gets a hard `401 {"error":"UNAUTHORIZED"}` with NO `oidc.state` in
+ * the body. That made this probe always fail and `setup --remote` always fall
+ * back to manual-PAT entry, defeating the automated device-flow login
+ * (wood-fired-tasks #831).
+ *
+ * `/auth/login` is PUBLIC (`skipAuth: true`) and an unambiguous signal:
+ *   - OIDC ready    → `302` redirect to the IdP authorize URL.
+ *   - OIDC disabled → the disabled-stub returns `501`.
+ * We do NOT follow the redirect (`redirect: 'manual'`) — only its status
+ * matters. Any other/unreachable status is inconclusive → manual-PAT fallback.
  * Bounded by a 5s timeout so a half-open server can't hang `setup --remote`.
  */
 export declare function probeOidcState(baseUrl: string): Promise<OidcProbeResult>;
@@ -367,8 +380,8 @@ export declare function persistManualPat(baseUrl: string, token: string): Promis
 export interface RunSetupInteractiveOptions extends RunSetupOptions {
     /**
      * Injectable OIDC-state probe for the `--remote` path (#807). Defaults to
-     * {@link probeOidcState} (a real `GET /health/detailed`). Tests stub this to
-     * drive the ready / disabled / degraded / probe-failure branches.
+     * {@link probeOidcState} (a real `GET /auth/login`, public). Tests stub this
+     * to drive the ready / disabled / probe-failure branches.
      */
     oidcProbe?: OidcProbe;
     /**

package/dist/cli/commands/setup.js

@@ -8,7 +8,7 @@ import { resolveAssetPath } from '../../assets/resolve.js';
 import { configDir as defaultConfigDir } from '../../config/paths.js';
 import { resolvePathHint } from '../util/path-hint.js';
 import { buildNpmInvocation } from '../util/npm-spawn.js';
-import { selectFromMenu, promptSecret } from '../util/prompt.js';
+import { selectFromMenu, promptSecret, promptLine } from '../util/prompt.js';
 import { shouldPrompt } from '../prompts/interactive.js';
 import { getServiceBackend } from './service.js';
 import { runDeviceLogin } from './login.js';
@@ -546,40 +546,50 @@ export function writeRemoteMcpEntryOnly(options = {}) {
     };
 }
 /**
- * Default OIDC probe: `GET <baseUrl>/health/detailed` and read `oidc.state`.
+ * Default OIDC probe: `GET <baseUrl>/auth/login` (the browser-login entry
+ * point) and read OIDC availability from the HTTP status.
  *
- * `/health/detailed` is auth-protected on the server (Bearer PAT), but the only
- * field we need — `oidc.state` — is returned in the JSON body regardless of the
- * auth-derived status code as long as the route renders. We treat ANY non-2xx
- * or unparseable/missing `oidc.state` as a probe failure and fall back to the
- * manual-PAT escape hatch (the route may not even exist on an older server).
+ * Why NOT `/health/detailed` (the original #807 target): v2.0's identity
+ * cutover put `/health/detailed` behind Bearer-PAT auth, so an unauthenticated
+ * probe — which is the ONLY kind possible during onboarding, before any PAT
+ * exists — gets a hard `401 {"error":"UNAUTHORIZED"}` with NO `oidc.state` in
+ * the body. That made this probe always fail and `setup --remote` always fall
+ * back to manual-PAT entry, defeating the automated device-flow login
+ * (wood-fired-tasks #831).
+ *
+ * `/auth/login` is PUBLIC (`skipAuth: true`) and an unambiguous signal:
+ *   - OIDC ready    → `302` redirect to the IdP authorize URL.
+ *   - OIDC disabled → the disabled-stub returns `501`.
+ * We do NOT follow the redirect (`redirect: 'manual'`) — only its status
+ * matters. Any other/unreachable status is inconclusive → manual-PAT fallback.
  * Bounded by a 5s timeout so a half-open server can't hang `setup --remote`.
  */
 export async function probeOidcState(baseUrl) {
-    const probeUrl = new URL('/health/detailed', baseUrl).toString();
+    const probeUrl = new URL('/auth/login', baseUrl).toString();
     let response;
     try {
-        response = await fetch(probeUrl, { method: 'GET', signal: AbortSignal.timeout(5000) });
+        response = await fetch(probeUrl, {
+            method: 'GET',
+            redirect: 'manual',
+            signal: AbortSignal.timeout(5000),
+        });
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         return { ok: false, reason: `could not reach ${probeUrl}: ${message}` };
     }
-    if (!response.ok) {
-        return { ok: false, reason: `${probeUrl} returned HTTP ${response.status}` };
-    }
-    let body;
-    try {
-        body = await response.json();
-    }
-    catch {
-        return { ok: false, reason: `${probeUrl} returned a non-JSON body` };
+    // 3xx → /auth/login is redirecting to the IdP → device-flow is available.
+    // (`redirect: 'manual'` surfaces the real 3xx status rather than following
+    // it; some runtimes report an opaque-redirect as status 0 with type
+    // 'opaqueredirect', which we also treat as a redirect.)
+    if ((response.status >= 300 && response.status < 400) || response.type === 'opaqueredirect') {
+        return { ok: true, oidc: 'ready' };
     }
-    const oidc = body?.oidc?.state;
-    if (oidc === 'ready' || oidc === 'disabled' || oidc === 'degraded') {
-        return { ok: true, oidc };
+    // 501 → the OIDC-disabled stub → no browser login; use a manual PAT.
+    if (response.status === 501) {
+        return { ok: true, oidc: 'disabled' };
     }
-    return { ok: false, reason: `${probeUrl} did not report an oidc.state` };
+    return { ok: false, reason: `${probeUrl} returned HTTP ${response.status}` };
 }
 /**
  * Map a probe outcome to the onboarding method (task #807).
@@ -719,7 +729,20 @@ export async function runSetupInteractive(options = {}) {
     // token} without a URL can't get a LOCAL install mislabeled as remote.
     if (mode === 'remote') {
         const hasToken = typeof options.token === 'string' && options.token.length > 0;
-        const hasRemote = typeof options.remote === 'string' && options.remote.length > 0;
+        let hasRemote = typeof options.remote === 'string' && options.remote.length > 0;
+        // Picking "Remote" from the interactive menu sets `mode` but NEVER the base
+        // URL — only the `--remote <url>` flag populates `options.remote`. Without
+        // this prompt the menu selection falls straight into runRemoteOnboarding,
+        // which throws 'remote onboarding requires a --remote <url> base URL.'.
+        // Prompt for it here so the menu path is usable; guarded by isInteractive()
+        // so a non-TTY / programmatic caller never hangs waiting on stdin.
+        if (!hasRemote && isInteractive()) {
+            const url = (await promptLine('Remote server base URL (e.g. http://host:3000): ', options.promptIO)).trim();
+            if (url.length > 0) {
+                options = { ...options, remote: url };
+                hasRemote = true;
+            }
+        }
         if (hasToken && hasRemote) {
             const setup = runSetup(options);
             return { mode: 'remote', oidc: null, method: 'manual-pat', ok: true, setup };

package/dist/db/migrate.d.ts

@@ -23,8 +23,12 @@ export declare function runMigrations(db: Database.Database): Promise<void>;
  * @param env - environment map (defaults to `process.env`).
  * @param cwd - base directory for resolving relative paths and probing the
  *   legacy `./data/tasks.db` (defaults to `process.cwd()`).
+ * @param exists - filesystem existence probe forwarded to the unified resolver
+ *   (defaults to `fs.existsSync`). Injectable so tests can isolate the
+ *   legacy-adopt vs app-data branches without depending on whether the real OS
+ *   app-data DB happens to exist on the dev machine running the suite.
  */
-export declare function resolveMigrateDbPath(env?: NodeJS.ProcessEnv, cwd?: string): string;
+export declare function resolveMigrateDbPath(env?: NodeJS.ProcessEnv, cwd?: string, exists?: (p: string) => boolean): string;
 /**
  * CLI entry point body: resolve the target DB path via the unified resolver
  * (env > legacy-adopt > app-data default), ensure the parent
@@ -32,4 +36,4 @@ export declare function resolveMigrateDbPath(env?: NodeJS.ProcessEnv, cwd?: stri
  *
  * Extracted from the `isMain` guard so it is directly unit-testable.
  */
-export declare function migrateCli(env?: NodeJS.ProcessEnv, cwd?: string): Promise<string>;
+export declare function migrateCli(env?: NodeJS.ProcessEnv, cwd?: string, exists?: (p: string) => boolean): Promise<string>;

package/dist/db/migrate.js

@@ -1,5 +1,6 @@
 import { Umzug } from 'umzug';
 import { mkdir } from 'fs/promises';
+import { existsSync } from 'fs';
 import { dirname, resolve, sep } from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
 import { initDatabase } from './database.js';
@@ -142,9 +143,13 @@ export async function runMigrations(db) {
  * @param env - environment map (defaults to `process.env`).
  * @param cwd - base directory for resolving relative paths and probing the
  *   legacy `./data/tasks.db` (defaults to `process.cwd()`).
+ * @param exists - filesystem existence probe forwarded to the unified resolver
+ *   (defaults to `fs.existsSync`). Injectable so tests can isolate the
+ *   legacy-adopt vs app-data branches without depending on whether the real OS
+ *   app-data DB happens to exist on the dev machine running the suite.
  */
-export function resolveMigrateDbPath(env = process.env, cwd = process.cwd()) {
-    return resolve(cwd, resolveDbPath(env, cwd));
+export function resolveMigrateDbPath(env = process.env, cwd = process.cwd(), exists = existsSync) {
+    return resolve(cwd, resolveDbPath(env, cwd, exists));
 }
 /**
  * CLI entry point body: resolve the target DB path via the unified resolver
@@ -153,8 +158,8 @@ export function resolveMigrateDbPath(env = process.env, cwd = process.cwd()) {
  *
  * Extracted from the `isMain` guard so it is directly unit-testable.
  */
-export async function migrateCli(env = process.env, cwd = process.cwd()) {
-    const dbPath = resolveMigrateDbPath(env, cwd);
+export async function migrateCli(env = process.env, cwd = process.cwd(), exists = existsSync) {
+    const dbPath = resolveMigrateDbPath(env, cwd, exists);
     // Create the parent directory (e.g. ./data, or a user-supplied path) if
     // it doesn't already exist. `recursive: true` is a no-op when present.
     await mkdir(dirname(dbPath), { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wood-fired-tasks",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "Network-wide task tracking system for Wood Fired Games",
   "keywords": [
     "task-tracker",