wood-fired-tasks 2.0.1 → 2.0.2

package/CHANGELOG.md

@@ -13,6 +13,22 @@ vulnerabilities, supply-chain pinning) are always called out under `Security`.
 
 _No changes yet._
 
+## [v2.0.2] - 2026-06-08
+
+### Fixed
+- **`tasks setup` remote onboarding now reaches the automated device-flow login
+  instead of always falling back to manual PAT entry.** The onboarding probe
+  read the server's OIDC state from `GET /health/detailed`, but v2.0's identity
+  cutover put that endpoint behind Bearer-PAT auth — so an unauthenticated probe
+  (the only kind possible *before* you have a token) always got `401`, the OIDC
+  state was "undeterminable", and setup fell back to asking you to paste a
+  personal access token. The probe now targets the **public** `GET /auth/login`
+  endpoint (`redirect: 'manual'`): a `3xx` redirect to the IdP means browser
+  login is available (`ready`), a `501` means OIDC is disabled (`manual-pat`).
+  Verified against a live OIDC-ready server: the probe now resolves `ready`
+  where it previously 401'd, so the device-flow browser login launches as
+  intended.
+
 ## [v2.0.1] - 2026-06-08
 
 ### Fixed

package/dist/cli/commands/setup.d.ts

@@ -274,9 +274,11 @@ export declare function writeRemoteMcpEntryOnly(options?: RunSetupOptions): RunS
  */
 export type SetupMode = 'local' | 'service' | 'remote';
 /**
- * Coarse OIDC subsystem state reported by `GET /health/detailed` (task #357).
- * Mirrors the server's `oidc.state` enum so the remote-setup branch selector
- * (#807) can route deterministically.
+ * Coarse OIDC subsystem state used by the remote-setup branch selector (#807)
+ * to route deterministically. Derived by {@link probeOidcState} from the public
+ * `/auth/login` endpoint (`ready` = redirects to IdP, `disabled` = 501 stub).
+ * `degraded` is retained for back-compat but is no longer emitted by the probe
+ * (an unhealthy OIDC surfaces as an inconclusive status → manual-PAT fallback).
  */
 export type OidcState = 'ready' | 'disabled' | 'degraded';
 /**
@@ -287,10 +289,12 @@ export type OidcState = 'ready' | 'disabled' | 'degraded';
  */
 export type RemoteOnboardingMethod = 'device-flow' | 'manual-pat';
 /**
- * Result of probing `GET /health/detailed` for the OIDC state.
- *  - `{ ok: true, oidc }` — the probe returned 2xx and an `oidc.state`.
- *  - `{ ok: false, reason }` — network error / non-2xx / unparseable body.
- *    The `reason` is surfaced to the user before falling back to manual PAT.
+ * Result of probing the server for whether browser/device-flow login is
+ * available.
+ *  - `{ ok: true, oidc }` — the probe got a conclusive answer (`ready` =
+ *    device-flow available, `disabled` = no OIDC → manual PAT).
+ *  - `{ ok: false, reason }` — network error / inconclusive status. The
+ *    `reason` is surfaced to the user before falling back to manual PAT.
  */
 export type OidcProbeResult = {
     ok: true;
@@ -302,13 +306,22 @@ export type OidcProbeResult = {
 /** Injectable probe signature so tests can drive each branch without a server. */
 export type OidcProbe = (baseUrl: string) => Promise<OidcProbeResult>;
 /**
- * Default OIDC probe: `GET <baseUrl>/health/detailed` and read `oidc.state`.
+ * Default OIDC probe: `GET <baseUrl>/auth/login` (the browser-login entry
+ * point) and read OIDC availability from the HTTP status.
  *
- * `/health/detailed` is auth-protected on the server (Bearer PAT), but the only
- * field we need — `oidc.state` — is returned in the JSON body regardless of the
- * auth-derived status code as long as the route renders. We treat ANY non-2xx
- * or unparseable/missing `oidc.state` as a probe failure and fall back to the
- * manual-PAT escape hatch (the route may not even exist on an older server).
+ * Why NOT `/health/detailed` (the original #807 target): v2.0's identity
+ * cutover put `/health/detailed` behind Bearer-PAT auth, so an unauthenticated
+ * probe — which is the ONLY kind possible during onboarding, before any PAT
+ * exists — gets a hard `401 {"error":"UNAUTHORIZED"}` with NO `oidc.state` in
+ * the body. That made this probe always fail and `setup --remote` always fall
+ * back to manual-PAT entry, defeating the automated device-flow login
+ * (wood-fired-tasks #831).
+ *
+ * `/auth/login` is PUBLIC (`skipAuth: true`) and an unambiguous signal:
+ *   - OIDC ready    → `302` redirect to the IdP authorize URL.
+ *   - OIDC disabled → the disabled-stub returns `501`.
+ * We do NOT follow the redirect (`redirect: 'manual'`) — only its status
+ * matters. Any other/unreachable status is inconclusive → manual-PAT fallback.
  * Bounded by a 5s timeout so a half-open server can't hang `setup --remote`.
  */
 export declare function probeOidcState(baseUrl: string): Promise<OidcProbeResult>;
@@ -367,8 +380,8 @@ export declare function persistManualPat(baseUrl: string, token: string): Promis
 export interface RunSetupInteractiveOptions extends RunSetupOptions {
     /**
      * Injectable OIDC-state probe for the `--remote` path (#807). Defaults to
-     * {@link probeOidcState} (a real `GET /health/detailed`). Tests stub this to
-     * drive the ready / disabled / degraded / probe-failure branches.
+     * {@link probeOidcState} (a real `GET /auth/login`, public). Tests stub this
+     * to drive the ready / disabled / probe-failure branches.
      */
     oidcProbe?: OidcProbe;
     /**

package/dist/cli/commands/setup.js

@@ -546,40 +546,50 @@ export function writeRemoteMcpEntryOnly(options = {}) {
     };
 }
 /**
- * Default OIDC probe: `GET <baseUrl>/health/detailed` and read `oidc.state`.
+ * Default OIDC probe: `GET <baseUrl>/auth/login` (the browser-login entry
+ * point) and read OIDC availability from the HTTP status.
  *
- * `/health/detailed` is auth-protected on the server (Bearer PAT), but the only
- * field we need — `oidc.state` — is returned in the JSON body regardless of the
- * auth-derived status code as long as the route renders. We treat ANY non-2xx
- * or unparseable/missing `oidc.state` as a probe failure and fall back to the
- * manual-PAT escape hatch (the route may not even exist on an older server).
+ * Why NOT `/health/detailed` (the original #807 target): v2.0's identity
+ * cutover put `/health/detailed` behind Bearer-PAT auth, so an unauthenticated
+ * probe — which is the ONLY kind possible during onboarding, before any PAT
+ * exists — gets a hard `401 {"error":"UNAUTHORIZED"}` with NO `oidc.state` in
+ * the body. That made this probe always fail and `setup --remote` always fall
+ * back to manual-PAT entry, defeating the automated device-flow login
+ * (wood-fired-tasks #831).
+ *
+ * `/auth/login` is PUBLIC (`skipAuth: true`) and an unambiguous signal:
+ *   - OIDC ready    → `302` redirect to the IdP authorize URL.
+ *   - OIDC disabled → the disabled-stub returns `501`.
+ * We do NOT follow the redirect (`redirect: 'manual'`) — only its status
+ * matters. Any other/unreachable status is inconclusive → manual-PAT fallback.
  * Bounded by a 5s timeout so a half-open server can't hang `setup --remote`.
  */
 export async function probeOidcState(baseUrl) {
-    const probeUrl = new URL('/health/detailed', baseUrl).toString();
+    const probeUrl = new URL('/auth/login', baseUrl).toString();
     let response;
     try {
-        response = await fetch(probeUrl, { method: 'GET', signal: AbortSignal.timeout(5000) });
+        response = await fetch(probeUrl, {
+            method: 'GET',
+            redirect: 'manual',
+            signal: AbortSignal.timeout(5000),
+        });
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         return { ok: false, reason: `could not reach ${probeUrl}: ${message}` };
     }
-    if (!response.ok) {
-        return { ok: false, reason: `${probeUrl} returned HTTP ${response.status}` };
-    }
-    let body;
-    try {
-        body = await response.json();
-    }
-    catch {
-        return { ok: false, reason: `${probeUrl} returned a non-JSON body` };
+    // 3xx → /auth/login is redirecting to the IdP → device-flow is available.
+    // (`redirect: 'manual'` surfaces the real 3xx status rather than following
+    // it; some runtimes report an opaque-redirect as status 0 with type
+    // 'opaqueredirect', which we also treat as a redirect.)
+    if ((response.status >= 300 && response.status < 400) || response.type === 'opaqueredirect') {
+        return { ok: true, oidc: 'ready' };
     }
-    const oidc = body?.oidc?.state;
-    if (oidc === 'ready' || oidc === 'disabled' || oidc === 'degraded') {
-        return { ok: true, oidc };
+    // 501 → the OIDC-disabled stub → no browser login; use a manual PAT.
+    if (response.status === 501) {
+        return { ok: true, oidc: 'disabled' };
     }
-    return { ok: false, reason: `${probeUrl} did not report an oidc.state` };
+    return { ok: false, reason: `${probeUrl} returned HTTP ${response.status}` };
 }
 /**
  * Map a probe outcome to the onboarding method (task #807).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wood-fired-tasks",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "description": "Network-wide task tracking system for Wood Fired Games",
   "keywords": [
     "task-tracker",