wood-fired-tasks 2.0.4 → 2.0.6

package/CHANGELOG.md

@@ -13,6 +13,62 @@ vulnerabilities, supply-chain pinning) are always called out under `Security`.
 
 _No changes yet._
 
+## [v2.0.6] - 2026-06-08
+
+### Added
+- **`tasks login --token <pat>` — a manual-PAT login path.** `tasks login` was
+  device-flow only and **dead-ended on a remote non-`https` server**: the OAuth
+  device flow can't complete where Google rejects the non-`https` redirect URI,
+  and there was no way to supply a PAT instead. `login` now accepts `--token`
+  (validated against `GET /api/v1/me`, then persisted to the credentials file)
+  and, like `tasks setup`, applies the `canUseBrowserSso` gate — on a plain-`http`
+  non-localhost server it prints the `https`-required / how-to-mint-a-PAT
+  guidance and (on a TTY) prompts for one instead of launching a flow that can't
+  finish. The shared manual-PAT logic now lives in one module so `login` and
+  `setup` can't drift. (#857)
+
+### Fixed
+- **`tasks setup --remote --token <pat>` now actually authenticates you.** The
+  non-interactive `--token` path wrote the PAT to an **orphaned cache file that
+  no code reads** and never to the credentials file, so it reported success while
+  leaving *both* the CLI ("Not authenticated. Run: tasks login") and the remote
+  MCP bridge unauthenticated — the likely root cause of "remote MCP shows 0
+  projects" reports. The path now validates the PAT against `GET /api/v1/me` and
+  persists it to the credentials file (the same writer the device flow uses); the
+  bridge resolves its bearer token from there at runtime. The dead `remote-token`
+  cache (`cachePat`/`patCachePath`) was removed — the credentials file is the
+  single source of truth. (#858)
+- **The interactive "Paste a personal access token:" prompt no longer hangs on a
+  real terminal.** `promptSecret` enables TTY raw mode to suppress echo, which
+  disables CR→LF translation, so the Enter key delivers a bare `\r` (0x0D) — but
+  the line reader only terminated on `\n`, so the read blocked forever (pasted
+  PAT buffered, Enter never recognized). Hit on Windows PowerShell during
+  `tasks setup --remote` manual-PAT entry; platform-independent. The reader now
+  treats `\r`, `\n`, or `\r\n` as the line terminator. (#856)
+
+### Security
+- The `--remote --token` PAT is now stored only in the `0600` credentials file
+  and is still **never** embedded in `~/.claude.json` (the remote MCP entry stays
+  URL-only, #810). The removed `remote-token` cache eliminates a second on-disk
+  copy of the secret.
+
+## [v2.0.5] - 2026-06-08
+
+### Changed
+- **`tasks setup` → Remote now tells you the truth about what a server needs for
+  browser login.** When the server reports OIDC ready but you entered a
+  **plain-http, non-localhost URL**, browser/device login via Google SSO can
+  never complete — identity providers reject non-`https` OAuth redirect URIs
+  except for `localhost`. Previously setup would launch the device flow anyway
+  and the verification page dead-ended at the IdP callback ("unable to connect").
+  Setup now detects this up front and explains it: it tells you to either re-run
+  with an **https** URL (front the server with a TLS reverse proxy / real domain
+  so Google SSO completes) or **paste a personal access token**, and prints the
+  exact on-host command to mint one (`tasks db mint-token --user <email-or-id>`),
+  then drops straight into manual-PAT entry. `https` and `http://localhost`
+  servers are unaffected and complete browser login as before. New exported
+  helper `canUseBrowserSso()`.
+
 ## [v2.0.4] - 2026-06-08
 
 ### Fixed

package/README.md

@@ -119,8 +119,11 @@ wood-fired-tasks self-update       # npm i -g wood-fired-tasks@latest (no sudo)
 wood-fired-tasks setup --remote https://tasks.example.com --token wft_pat_…
 ```
 
-This writes a `wood-fired-tasks-remote` MCP entry (proxying every tool to the
-REST API) and caches the PAT under your OS config dir. For a full
+This writes a URL-only `wood-fired-tasks-remote` MCP entry (proxying every tool
+to the REST API) and persists the validated PAT to the CLI credentials file —
+the same file `tasks login` writes; the bridge reads its bearer token from there
+at runtime (the PAT is never stored in `~/.claude.json`). Omit `--token` to run
+the interactive device-flow / manual-PAT onboarding instead. For a full
 Windows/Linux/macOS fleet on one on-prem server, see
 [Multi-OS client fleet](docs/SETUP.md#multi-os-client-fleet-one-shared-on-prem-server).
 

package/dist/cli/auth/manual-pat.d.ts

@@ -0,0 +1,99 @@
+import { type PromptIO } from '../util/prompt.js';
+/**
+ * Whether the browser/device login (Google SSO) can actually COMPLETE against
+ * `baseUrl` (#835).
+ *
+ * The whole OIDC dance — the verification page AND the IdP's OAuth callback —
+ * happens at the server's origin, and identity providers (Google especially)
+ * reject non-`https` OAuth redirect URIs *except* for `localhost`/`127.0.0.1`.
+ * So a server reached over plain `http` at a non-localhost address can report
+ * `oidc: 'ready'` yet still be unable to finish browser login: the user's
+ * browser gets bounced to an `http://…/auth/callback` the IdP won't honor. We
+ * detect that up front so onboarding can tell the user the truth (need https,
+ * or use a PAT) instead of opening a URL that dead-ends.
+ *
+ * Returns true for any `https` URL and for `http://localhost` / `127.0.0.1` /
+ * `[::1]`; false for plain-http non-loopback hosts and unparseable input.
+ */
+export declare function canUseBrowserSso(baseUrl: string): boolean;
+/**
+ * The advisory block shown when browser SSO can't complete against `baseUrl`
+ * (plain-http non-localhost): explain the https requirement and how to mint a
+ * PAT on the server host. Returned as discrete lines so each caller logs them
+ * through its own sink (setup → `log()`, login → stderr / JSON). Shared so the
+ * two commands print identical guidance (#857).
+ */
+export declare function browserSsoGuidance(baseUrl: string): string[];
+/**
+ * The minimal identity envelope `GET /api/v1/me` returns (task #809). Mirrors
+ * the fields {@link writeCredentials} needs so a manually-pasted PAT lands in
+ * the SAME credentials file the device flow writes — the bridge then resolves
+ * its bearer token from there at runtime (URL-only claude.json entry, #810).
+ */
+export interface ManualPatIdentity {
+    id: number;
+    displayName: string;
+    email: string | null;
+    /** Best-effort token rowid; defaults to 1 when the server omits it. */
+    tokenId?: number;
+}
+/**
+ * Outcome of persisting a manually-supplied PAT (task #809).
+ *  - `{ ok: true, identity }`  — the PAT validated and credentials were written.
+ *  - `{ ok: false, reason }`   — the PAT was rejected / unreachable; `reason`
+ *    is surfaced to the user and NOTHING is persisted.
+ */
+export type ManualPatPersistResult = {
+    ok: true;
+    identity: ManualPatIdentity;
+} | {
+    ok: false;
+    reason: string;
+};
+/** Injectable manual-PAT persistence seam so tests drive it without a server. */
+export type ManualPatPersist = (baseUrl: string, token: string) => Promise<ManualPatPersistResult>;
+/**
+ * Default manual-PAT persistence (task #809).
+ *
+ * Validate the pasted PAT against `GET <baseUrl>/api/v1/me` (the same identity
+ * envelope `tasks whoami` reads), then persist it through {@link writeCredentials}
+ * — the SAME credentials writer the device flow uses. This is the only place the
+ * manual PAT lands; the claude.json entry stays URL-only (#810) and the bridge
+ * resolves the bearer token from this credentials file at runtime, so the secret
+ * is never embedded in claude.json.
+ *
+ * A non-2xx / network failure returns `{ ok: false, reason }` and writes
+ * NOTHING — the caller reports the reason and exits without a half-configured
+ * install.
+ */
+export declare function persistManualPat(baseUrl: string, token: string): Promise<ManualPatPersistResult>;
+/** Inputs to {@link resolveManualPatToken}. */
+export interface ResolveManualPatTokenArgs {
+    /** Explicit PAT (e.g. `--token <pat>`); wins unconditionally when non-empty. */
+    token?: string;
+    /** Injectable prompt IO forwarded to {@link promptSecret} (tests/no-TTY). */
+    promptIO?: PromptIO;
+    /** TTY predicate (defaults to {@link shouldPrompt}). */
+    isInteractive?: () => boolean;
+    /** Injectable secret prompt (defaults to {@link promptSecret}) for tests. */
+    promptSecretFn?: (prompt: string, io?: PromptIO) => Promise<string>;
+    /** Prompt label shown before reading the secret. */
+    promptLabel?: string;
+    /**
+     * Optional env var consulted as the LAST resort on a non-TTY (e.g.
+     * `'WFT_API_KEY'` for `setup`, which the remote bridge also reads). Omit to
+     * disable the env fallback (e.g. `tasks login`).
+     */
+    envVar?: string;
+}
+/**
+ * Resolve a manual PAT from, in precedence order:
+ *   1. an explicit `token` (the `--token` flag),
+ *   2. an interactive `promptSecret` (only on a TTY — never echoed),
+ *   3. an optional `envVar` fallback (non-TTY automation).
+ *
+ * Returns `undefined` when none yields a non-empty value, so the caller can
+ * print actionable guidance instead of hanging on a prompt with no TTY. Shared
+ * by `setup` and `login` so their PAT-sourcing rules stay identical (#857).
+ */
+export declare function resolveManualPatToken(args: ResolveManualPatTokenArgs): Promise<string | undefined>;

package/dist/cli/auth/manual-pat.js

@@ -0,0 +1,163 @@
+/**
+ * Shared manual-PAT onboarding primitives used by BOTH `tasks setup --remote`
+ * and `tasks login` (tasks #857/#858).
+ *
+ * History: `setup` grew a full manual-PAT path (browser-SSO gate → validate the
+ * pasted PAT against `GET /api/v1/me` → persist via {@link writeCredentials}),
+ * but `login` shipped device-flow-only and `setup --remote --token` wrote the
+ * PAT to an orphaned cache file that NO code reads. Both bugs trace to the same
+ * logic living inline in setup.ts where login couldn't reuse it. This module is
+ * the single source of truth so the two commands can't drift again.
+ *
+ * Nothing here writes to `claude.json`; the credentials TOML (owned by
+ * {@link writeCredentials}) is the ONLY place a manual PAT lands. The CLI and the
+ * remote MCP bridge both resolve their bearer token from that file at runtime.
+ */
+import { writeCredentials } from './credentials.js';
+import { promptSecret } from '../util/prompt.js';
+import { shouldPrompt } from '../prompts/interactive.js';
+/**
+ * Whether the browser/device login (Google SSO) can actually COMPLETE against
+ * `baseUrl` (#835).
+ *
+ * The whole OIDC dance — the verification page AND the IdP's OAuth callback —
+ * happens at the server's origin, and identity providers (Google especially)
+ * reject non-`https` OAuth redirect URIs *except* for `localhost`/`127.0.0.1`.
+ * So a server reached over plain `http` at a non-localhost address can report
+ * `oidc: 'ready'` yet still be unable to finish browser login: the user's
+ * browser gets bounced to an `http://…/auth/callback` the IdP won't honor. We
+ * detect that up front so onboarding can tell the user the truth (need https,
+ * or use a PAT) instead of opening a URL that dead-ends.
+ *
+ * Returns true for any `https` URL and for `http://localhost` / `127.0.0.1` /
+ * `[::1]`; false for plain-http non-loopback hosts and unparseable input.
+ */
+export function canUseBrowserSso(baseUrl) {
+    let url;
+    try {
+        url = new URL(baseUrl);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol === 'https:')
+        return true;
+    if (url.protocol !== 'http:')
+        return false;
+    const host = url.hostname.toLowerCase();
+    return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]';
+}
+/**
+ * The advisory block shown when browser SSO can't complete against `baseUrl`
+ * (plain-http non-localhost): explain the https requirement and how to mint a
+ * PAT on the server host. Returned as discrete lines so each caller logs them
+ * through its own sink (setup → `log()`, login → stderr / JSON). Shared so the
+ * two commands print identical guidance (#857).
+ */
+export function browserSsoGuidance(baseUrl) {
+    return [
+        '',
+        `"${baseUrl}" is plain http at a non-localhost address.`,
+        'Browser login via Google SSO requires an https URL — identity providers',
+        'reject non-https OAuth redirect URIs except for localhost — so the device',
+        'flow cannot complete against this server. To finish, either:',
+        '  • re-run with an https URL for this server (e.g. front it with a TLS',
+        '    reverse proxy / real domain so Google SSO completes), or',
+        '  • paste a personal access token now.',
+        '',
+        'To mint a PAT, run this ON THE SERVER HOST:',
+        '  tasks db mint-token --user <your-email-or-user-id>',
+        '(or create one from your account page once logged in via the browser).',
+        '',
+    ];
+}
+/**
+ * Default manual-PAT persistence (task #809).
+ *
+ * Validate the pasted PAT against `GET <baseUrl>/api/v1/me` (the same identity
+ * envelope `tasks whoami` reads), then persist it through {@link writeCredentials}
+ * — the SAME credentials writer the device flow uses. This is the only place the
+ * manual PAT lands; the claude.json entry stays URL-only (#810) and the bridge
+ * resolves the bearer token from this credentials file at runtime, so the secret
+ * is never embedded in claude.json.
+ *
+ * A non-2xx / network failure returns `{ ok: false, reason }` and writes
+ * NOTHING — the caller reports the reason and exits without a half-configured
+ * install.
+ */
+export async function persistManualPat(baseUrl, token) {
+    const meUrl = new URL('/api/v1/me', baseUrl).toString();
+    let response;
+    try {
+        response = await fetch(meUrl, { headers: { Authorization: `Bearer ${token}` } });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { ok: false, reason: `could not reach ${meUrl}: ${message}` };
+    }
+    if (response.status === 401) {
+        return { ok: false, reason: 'the personal access token was rejected (HTTP 401)' };
+    }
+    if (!response.ok) {
+        return { ok: false, reason: `${meUrl} returned HTTP ${response.status}` };
+    }
+    let body;
+    try {
+        body = (await response.json());
+    }
+    catch {
+        return { ok: false, reason: `${meUrl} returned a non-JSON body` };
+    }
+    if (body === null || typeof body.id !== 'number' || typeof body.displayName !== 'string') {
+        return { ok: false, reason: `${meUrl} did not return a usable identity` };
+    }
+    const email = typeof body.email === 'string' ? body.email : null;
+    const identity = { id: body.id, displayName: body.displayName, email };
+    // Persist through the SAME credentials writer the device flow uses. The
+    // server's /me envelope does not carry the token rowid, so default token_id
+    // to 1 (a positive int, satisfying the credentials schema); `whoami`'s
+    // best-effort token enrichment degrades gracefully when it can't match it.
+    try {
+        writeCredentials({
+            active: {
+                token,
+                token_id: 1,
+                server: baseUrl,
+                user_id: identity.id,
+                display_name: identity.displayName,
+                email: identity.email,
+                logged_in_at: new Date().toISOString(),
+            },
+        });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { ok: false, reason: `failed to write credentials file: ${message}` };
+    }
+    return { ok: true, identity };
+}
+/**
+ * Resolve a manual PAT from, in precedence order:
+ *   1. an explicit `token` (the `--token` flag),
+ *   2. an interactive `promptSecret` (only on a TTY — never echoed),
+ *   3. an optional `envVar` fallback (non-TTY automation).
+ *
+ * Returns `undefined` when none yields a non-empty value, so the caller can
+ * print actionable guidance instead of hanging on a prompt with no TTY. Shared
+ * by `setup` and `login` so their PAT-sourcing rules stay identical (#857).
+ */
+export async function resolveManualPatToken(args) {
+    let token = args.token;
+    if ((typeof token !== 'string' || token.length === 0) && (args.isInteractive ?? shouldPrompt)()) {
+        const ask = args.promptSecretFn ?? promptSecret;
+        token = await ask(args.promptLabel ?? 'Paste a personal access token: ', args.promptIO);
+    }
+    if ((typeof token !== 'string' || token.length === 0) && args.envVar) {
+        const envToken = process.env[args.envVar];
+        if (typeof envToken === 'string' && envToken.length > 0) {
+            token = envToken;
+        }
+    }
+    return typeof token === 'string' && token.length > 0 ? token : undefined;
+}
+//# sourceMappingURL=manual-pat.js.map

package/dist/cli/commands/login.d.ts

@@ -1,5 +1,7 @@
 import { Command } from 'commander';
 import { type DeviceTokenSuccess } from '../auth/device-flow.js';
+import { type ManualPatPersist } from '../auth/manual-pat.js';
+import type { PromptIO } from '../util/prompt.js';
 /**
  * Inputs to {@link runDeviceLogin}. All values are already resolved/validated by
  * the caller (the `login` command and, in Phase 30 Plan 07+, the setup wizard).
@@ -39,4 +41,41 @@ export type RunDeviceLoginResult = {
  * emitting the appropriate error output, and the caller decides the exit code.
  */
 export declare function runDeviceLogin(args: RunDeviceLoginArgs): Promise<RunDeviceLoginResult>;
+/**
+ * Inputs to {@link runManualPatLogin} (task #857). Mirrors {@link RunDeviceLoginArgs}
+ * for the parts the command shares (baseUrl, isJson).
+ */
+export interface RunManualPatLoginArgs {
+    /** Validated server base URL. */
+    baseUrl: string;
+    /** Explicit PAT (`--token <pat>`); when absent, prompt on a TTY. */
+    token?: string;
+    /** When true, emit newline-separated JSON envelopes on stdout (vs text on stderr). */
+    isJson: boolean;
+    /** Injectable prompt IO (tests). Defaults to process.stdin/stdout. */
+    promptIO?: PromptIO;
+    /** Injectable TTY predicate (tests). Defaults to the real shouldPrompt. */
+    isInteractive?: () => boolean;
+    /** Injectable persistence seam (tests). Defaults to {@link persistManualPat}. */
+    manualPatPersist?: ManualPatPersist;
+}
+/**
+ * Manual-PAT login core (task #857): the parity-with-`tasks setup` path that
+ * lets `tasks login` finish on a server where browser SSO can't complete (a
+ * plain-http / LAN-IP server the IdP rejects), or whenever the user supplies a
+ * PAT directly.
+ *
+ * Behavior:
+ *   1. If browser SSO can't complete against `baseUrl` AND no `--token` was
+ *      supplied, print the same https-required / mint-a-PAT guidance `setup`
+ *      shows (shared via {@link browserSsoGuidance}).
+ *   2. Resolve the PAT: `--token` flag → interactive `promptSecret` (TTY only).
+ *   3. Validate + persist via {@link persistManualPat} — the SAME credentials
+ *      writer the device flow uses, so `tasks whoami` / the API client / the MCP
+ *      bridge all see the credential afterward.
+ *
+ * Security invariant (matches the device path): the PAT is NEVER written to
+ * stdout/stderr — the credentials file is its only resting place.
+ */
+export declare function runManualPatLogin(args: RunManualPatLoginArgs): Promise<RunDeviceLoginResult>;
 export declare const loginCommand: Command;

package/dist/cli/commands/login.js

@@ -31,6 +31,7 @@ import { env } from '../config/env.js';
 import { writeCredentials } from '../auth/credentials.js';
 import { openBrowser } from '../auth/browser-open.js';
 import { requestDeviceCode, pollForToken } from '../auth/device-flow.js';
+import { canUseBrowserSso, browserSsoGuidance, persistManualPat, resolveManualPatToken, } from '../auth/manual-pat.js';
 /** Emit one newline-separated JSON envelope on stdout (used in --json mode). */
 function emitJsonEvent(event) {
     process.stdout.write(JSON.stringify(event) + '\n');
@@ -185,9 +186,83 @@ export async function runDeviceLogin(args) {
     }
     return { ok: true, user: response.user };
 }
+/**
+ * Manual-PAT login core (task #857): the parity-with-`tasks setup` path that
+ * lets `tasks login` finish on a server where browser SSO can't complete (a
+ * plain-http / LAN-IP server the IdP rejects), or whenever the user supplies a
+ * PAT directly.
+ *
+ * Behavior:
+ *   1. If browser SSO can't complete against `baseUrl` AND no `--token` was
+ *      supplied, print the same https-required / mint-a-PAT guidance `setup`
+ *      shows (shared via {@link browserSsoGuidance}).
+ *   2. Resolve the PAT: `--token` flag → interactive `promptSecret` (TTY only).
+ *   3. Validate + persist via {@link persistManualPat} — the SAME credentials
+ *      writer the device flow uses, so `tasks whoami` / the API client / the MCP
+ *      bridge all see the credential afterward.
+ *
+ * Security invariant (matches the device path): the PAT is NEVER written to
+ * stdout/stderr — the credentials file is its only resting place.
+ */
+export async function runManualPatLogin(args) {
+    const { baseUrl, isJson } = args;
+    const hasToken = typeof args.token === 'string' && args.token.length > 0;
+    // Explain the https requirement up front when the user reached for `login`
+    // on a server browser SSO can't complete against and gave us no PAT to use.
+    if (!hasToken && !canUseBrowserSso(baseUrl) && !isJson) {
+        for (const line of browserSsoGuidance(baseUrl)) {
+            process.stderr.write(`${line}\n`);
+        }
+    }
+    const token = await resolveManualPatToken({
+        ...(args.token !== undefined && { token: args.token }),
+        ...(args.promptIO !== undefined && { promptIO: args.promptIO }),
+        ...(args.isInteractive !== undefined && { isInteractive: args.isInteractive }),
+        promptLabel: 'Paste a personal access token: ',
+    });
+    if (token === undefined) {
+        const message = 'No personal access token supplied. Re-run with --token <pat> to finish login.';
+        if (isJson) {
+            emitJsonEvent({ event: 'failed', error: 'no_token', message });
+        }
+        else {
+            process.stderr.write(`${message}\n`);
+        }
+        return { ok: false };
+    }
+    const persist = args.manualPatPersist ?? persistManualPat;
+    const persisted = await persist(baseUrl, token);
+    if (!persisted.ok) {
+        const message = `Could not store the personal access token: ${persisted.reason}.`;
+        if (isJson) {
+            emitJsonEvent({ event: 'failed', error: 'pat_rejected', message });
+        }
+        else {
+            process.stderr.write(`${message}\n`);
+        }
+        return { ok: false };
+    }
+    const user = {
+        id: persisted.identity.id,
+        displayName: persisted.identity.displayName,
+        email: persisted.identity.email,
+    };
+    if (isJson) {
+        emitJsonEvent({
+            event: 'logged_in',
+            user,
+            token_id: persisted.identity.tokenId ?? null,
+        });
+    }
+    else {
+        process.stderr.write(`Logged in as ${persisted.identity.displayName}\n`);
+    }
+    return { ok: true, user };
+}
 export const loginCommand = new Command('login')
     .description('Authenticate with the WFT server via OAuth device flow')
     .option('--token-name <name>', 'Name for the minted PAT (currently advisory; reserved for v1.7 explicit naming)')
+    .option('--token <pat>', 'Authenticate with a personal access token instead of the browser device flow (required for remote non-https servers where Google SSO cannot complete). The PAT is validated against the server and stored in the credentials file.')
     .option('--no-browser', 'Skip auto-opening the verification URL in a browser')
     .option('--server <url>', 'Override API_BASE_URL for this invocation (stored in credentials file)')
     .action(async (opts) => {
@@ -213,6 +288,30 @@ export const loginCommand = new Command('login')
         process.exitCode = 1;
         return;
     }
+    // `--token` may bind to EITHER the login command (when written as
+    // `tasks login --token <pat>`) or the root program's Bearer-auth flag (when
+    // written as `tasks --token <pat> login`). Accept both so the manual-PAT
+    // login path works regardless of where Commander attached it.
+    const token = typeof opts.token === 'string' && opts.token.length > 0
+        ? opts.token
+        : globalOpts['token'];
+    const hasToken = typeof token === 'string' && token.length > 0;
+    // 2. Choose the login path (task #857):
+    //   - manual-PAT when the user supplied a PAT, OR when browser SSO can't
+    //     complete against this server (plain-http non-localhost — Google
+    //     rejects the non-https OAuth redirect, so the device flow dead-ends).
+    //   - device flow otherwise (the default for https / localhost servers).
+    if (hasToken || !canUseBrowserSso(baseUrl)) {
+        const result = await runManualPatLogin({
+            baseUrl,
+            ...(token !== undefined && { token }),
+            isJson,
+        });
+        if (!result.ok) {
+            process.exitCode = 1;
+        }
+        return;
+    }
     const clientId = process.env['OIDC_CLIENT_ID'] ?? 'wft-cli';
     const hostname = os.hostname();
     // Delegate to the shared device-login core. Commander generates

package/dist/cli/commands/setup.d.ts

@@ -2,6 +2,8 @@ import { Command } from 'commander';
 import { type ClaudeMcpServerEntry } from '../../setup/claude-json.js';
 import { type PromptIO } from '../util/prompt.js';
 import { runDeviceLogin } from './login.js';
+import { canUseBrowserSso, browserSsoGuidance, persistManualPat, type ManualPatIdentity, type ManualPatPersist, type ManualPatPersistResult } from '../auth/manual-pat.js';
+export { canUseBrowserSso, browserSsoGuidance, persistManualPat, type ManualPatIdentity, type ManualPatPersist, type ManualPatPersistResult, };
 /**
  * Resolve the local MCP server entry point. Prefer the built
  * `dist/mcp/index.js` under the package root (deterministic for published
@@ -37,28 +39,6 @@ export declare function resolveRemoteMcpEntryPoint(): string;
 export declare function buildRemoteMcpEntry(apiUrl: string): ClaudeMcpServerEntry;
 /** Default destination for copied skills. */
 export declare function commandsDestDir(home?: string): string;
-/**
- * Absolute path of the cached PAT file under the OS CONFIG dir (task #738).
- *
- * The PAT is operator configuration — NOT persistent application state — so it
- * lives under `configDir` (env-paths, OS-correct), NEVER the data dir where the
- * SQLite DB lives. `configDir` is injectable so tests can sandbox it into a
- * temp directory.
- */
-export declare function patCachePath(configDir?: string): string;
-export interface CachePatResult {
-    /** Absolute path the PAT was written to. */
-    path: string;
-    /** True when the file content changed this run (idempotency signal). */
-    changed: boolean;
-}
-/**
- * Cache the remote PAT to a file under the CONFIG dir, idempotently. On POSIX
- * the file is created/tightened to 0600 (owner read/write only) so the secret
- * is not world-readable; on Windows the mode arg is a best-effort no-op (NTFS
- * ACLs already restrict the per-user config dir).
- */
-export declare function cachePat(token: string, configDir?: string): CachePatResult;
 export interface CopySkillsResult {
     sourceDir: string;
     destDir: string;
@@ -219,17 +199,20 @@ export interface RunSetupOptions {
     npmRunner?: (cmd: string, args: string[]) => void;
     log?: (line: string) => void;
     /**
-     * Remote REST API base URL (task #738). When set, the REMOTE bridge entry
-     * (`wood-fired-tasks-remote`) is written instead of the local one, carrying
-     * `WFT_API_URL` / `WFT_API_KEY`.
+     * Remote REST API base URL (task #738). Routes `tasks setup` to the remote
+     * onboarding path (probe → device-flow / manual-PAT) via
+     * {@link runSetupInteractive}; the URL-only `wood-fired-tasks-remote` bridge
+     * entry is written by {@link writeRemoteMcpEntryOnly}. NOT consumed by
+     * {@link runSetup}, which is the LOCAL install only.
      */
     remote?: string;
-    /** Remote PAT (task #738). Cached under the CONFIG dir; never the data dir. */
-    token?: string;
     /**
-     * Override the OS CONFIG dir (testing). Defaults to the real `configDir`.
-     * Only the PAT cache is directed here — skills/claude.json follow `home`.
+     * Remote PAT (`--token <pat>`). Validated against `GET /api/v1/me` and
+     * persisted to the credentials file via {@link persistManualPat} (#858); it is
+     * NEVER written into claude.json. NOT consumed by {@link runSetup}.
      */
+    token?: string;
+    /** Override the OS CONFIG dir (testing). Reserved for callers that need it. */
     configDir?: string;
 }
 export interface RunSetupResult {
@@ -242,24 +225,27 @@ export interface RunSetupResult {
     skills: CopySkillsResult;
     agents: CopyAgentsResult;
     npmPrefix?: FixNpmPrefixResult;
-    /** Set when a PAT was cached (i.e. `remote` + `token` provided). */
-    patCache?: CachePatResult;
 }
 /**
- * Pure-ish setup action. Resolves all paths from `home` so tests can sandbox
- * with a temp HOME and never touch the real ~/.claude.json or ~/.claude/.
+ * Pure-ish LOCAL setup action. Resolves all paths from `home` so tests can
+ * sandbox with a temp HOME and never touch the real ~/.claude.json or ~/.claude/.
+ *
+ * Remote onboarding is NOT handled here — it requires an async server round-trip
+ * to validate + persist a credential (#858). {@link runSetupInteractive} routes
+ * `--remote` to {@link runRemoteOnboarding} / the manual-PAT path, which write
+ * the URL-only bridge entry via {@link writeRemoteMcpEntryOnly}.
  */
 export declare function runSetup(options?: RunSetupOptions): RunSetupResult;
 /**
  * Write ONLY the URL-only remote MCP bridge entry into ~/.claude.json (and copy
  * skills/agents), WITHOUT requiring or caching a PAT (task #808).
  *
- * This is the device-flow counterpart to {@link runSetup}'s remote branch:
- * after {@link runDeviceLogin} (#806) has self-provisioned the PAT and persisted
- * it via the credentials writer, there is no token to embed or double-cache —
+ * This is the shared remote-entry writer for BOTH onboarding paths: after
+ * {@link runDeviceLogin} (#806) or the manual-PAT path has provisioned the PAT
+ * and persisted it via the credentials writer, there is no token to embed —
  * the claude.json entry must be URL-only (#810). So this helper mirrors
- * runSetup's claude.json/skills/agents work but deliberately OMITS the
- * `--token`-required guard and the `cachePat` step.
+ * runSetup's claude.json/skills/agents work but writes the REMOTE bridge entry
+ * and persists NO token of its own (the credentials file is the sole owner).
  *
  * The written entry is exactly `buildRemoteMcpEntry(apiUrl)`: a stdio bridge
  * carrying only `WFT_API_URL`. The bridge resolves its bearer token at runtime
@@ -334,49 +320,6 @@ export declare function probeOidcState(baseUrl: string): Promise<OidcProbeResult
  *  - probe failure → manual-PAT (connectivity escape hatch).
  */
 export declare function selectRemoteOnboardingMethod(probe: OidcProbeResult): RemoteOnboardingMethod;
-/**
- * The minimal identity envelope `GET /api/v1/me` returns (task #809). Mirrors
- * the fields {@link writeCredentials} needs so a manually-pasted PAT lands in
- * the SAME credentials file the device flow writes — the bridge then resolves
- * its bearer token from there at runtime (URL-only claude.json entry, #810).
- */
-export interface ManualPatIdentity {
-    id: number;
-    displayName: string;
-    email: string | null;
-    /** Best-effort token rowid; defaults to 1 when the server omits it. */
-    tokenId?: number;
-}
-/**
- * Outcome of persisting a manually-supplied PAT (task #809).
- *  - `{ ok: true, identity }`  — the PAT validated and credentials were written.
- *  - `{ ok: false, reason }`   — the PAT was rejected / unreachable; `reason`
- *    is surfaced to the user and NOTHING is persisted.
- */
-export type ManualPatPersistResult = {
-    ok: true;
-    identity: ManualPatIdentity;
-} | {
-    ok: false;
-    reason: string;
-};
-/** Injectable manual-PAT persistence seam so tests drive it without a server. */
-export type ManualPatPersist = (baseUrl: string, token: string) => Promise<ManualPatPersistResult>;
-/**
- * Default manual-PAT persistence (task #809).
- *
- * Validate the pasted PAT against `GET <baseUrl>/api/v1/me` (the same identity
- * envelope `tasks whoami` reads), then persist it through {@link writeCredentials}
- * — the SAME credentials writer {@link runDeviceLogin} uses. This is the only
- * place the manual PAT lands; the claude.json entry stays URL-only (#810) and
- * the bridge resolves the bearer token from this credentials file at runtime,
- * so the secret is never embedded in claude.json.
- *
- * A non-2xx / network failure returns `{ ok: false, reason }` and writes
- * NOTHING — the caller reports the reason and exits without a half-configured
- * install.
- */
-export declare function persistManualPat(baseUrl: string, token: string): Promise<ManualPatPersistResult>;
 export interface RunSetupInteractiveOptions extends RunSetupOptions {
     /**
      * Injectable OIDC-state probe for the `--remote` path (#807). Defaults to

package/dist/cli/commands/setup.js

@@ -5,14 +5,18 @@ import fs from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { mergeClaudeJson } from '../../setup/claude-json.js';
 import { resolveAssetPath } from '../../assets/resolve.js';
-import { configDir as defaultConfigDir } from '../../config/paths.js';
 import { resolvePathHint } from '../util/path-hint.js';
 import { buildNpmInvocation } from '../util/npm-spawn.js';
-import { selectFromMenu, promptSecret, promptLine } from '../util/prompt.js';
+import { selectFromMenu, promptLine } from '../util/prompt.js';
 import { shouldPrompt } from '../prompts/interactive.js';
 import { getServiceBackend } from './service.js';
 import { runDeviceLogin } from './login.js';
-import { writeCredentials } from '../auth/credentials.js';
+import { canUseBrowserSso, browserSsoGuidance, persistManualPat, resolveManualPatToken, } from '../auth/manual-pat.js';
+// Re-export the shared manual-PAT primitives (moved to ../auth/manual-pat.ts in
+// #857/#858 so `tasks login` can reuse them) from their historical import site
+// so existing callers/tests that import them from `commands/setup.js` keep
+// working.
+export { canUseBrowserSso, browserSsoGuidance, persistManualPat, };
 /**
  * `tasks setup` (task #737).
  *
@@ -84,43 +88,6 @@ export function buildRemoteMcpEntry(apiUrl) {
 export function commandsDestDir(home = os.homedir()) {
     return path.join(home, '.claude', 'commands', 'tasks');
 }
-/**
- * Absolute path of the cached PAT file under the OS CONFIG dir (task #738).
- *
- * The PAT is operator configuration — NOT persistent application state — so it
- * lives under `configDir` (env-paths, OS-correct), NEVER the data dir where the
- * SQLite DB lives. `configDir` is injectable so tests can sandbox it into a
- * temp directory.
- */
-export function patCachePath(configDir = defaultConfigDir) {
-    return path.join(configDir, 'remote-token');
-}
-/**
- * Cache the remote PAT to a file under the CONFIG dir, idempotently. On POSIX
- * the file is created/tightened to 0600 (owner read/write only) so the secret
- * is not world-readable; on Windows the mode arg is a best-effort no-op (NTFS
- * ACLs already restrict the per-user config dir).
- */
-export function cachePat(token, configDir = defaultConfigDir) {
-    const filePath = patCachePath(configDir);
-    fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    const existing = fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : null;
-    const changed = existing !== token;
-    if (changed) {
-        fs.writeFileSync(filePath, token, { encoding: 'utf8', mode: 0o600 });
-    }
-    // Tighten perms on POSIX even when bytes were unchanged (defensive). chmod is
-    // a best-effort no-op semantically on Windows; guard so it never throws.
-    if (process.platform !== 'win32') {
-        try {
-            fs.chmodSync(filePath, 0o600);
-        }
-        catch {
-            /* best-effort: never block setup on a chmod failure */
-        }
-    }
-    return { path: filePath, changed };
-}
 /**
  * Copy every `*.md` skill from the asset-resolver source into destDir.
  * Idempotent: a file is only (re)written when its bytes differ.
@@ -384,55 +351,27 @@ export function fixNpmPrefix(options = {}) {
     return { prefix, binDir, guidance };
 }
 /**
- * Pure-ish setup action. Resolves all paths from `home` so tests can sandbox
- * with a temp HOME and never touch the real ~/.claude.json or ~/.claude/.
+ * Pure-ish LOCAL setup action. Resolves all paths from `home` so tests can
+ * sandbox with a temp HOME and never touch the real ~/.claude.json or ~/.claude/.
+ *
+ * Remote onboarding is NOT handled here — it requires an async server round-trip
+ * to validate + persist a credential (#858). {@link runSetupInteractive} routes
+ * `--remote` to {@link runRemoteOnboarding} / the manual-PAT path, which write
+ * the URL-only bridge entry via {@link writeRemoteMcpEntryOnly}.
  */
 export function runSetup(options = {}) {
     const home = options.home ?? os.homedir();
     const log = options.log ?? ((line) => console.log(line));
     const claudeJsonPath = path.join(home, '.claude.json');
-    // Task #738/#810: when a remote URL is supplied, write the URL-only REMOTE
-    // bridge entry (carrying WFT_API_URL only) under 'wood-fired-tasks-remote'
-    // instead of the local stdio entry, and cache the PAT separately. A token is
-    // required so a usable remote credential exists; it is NEVER persisted into
-    // claude.json (the bridge resolves it from the cache at runtime).
-    const isRemote = typeof options.remote === 'string' && options.remote.length > 0;
-    let patCache;
-    let serverName;
-    let merge;
-    if (isRemote) {
-        const apiUrl = options.remote;
-        const token = options.token;
-        if (typeof token !== 'string' || token.length === 0) {
-            throw new Error('--remote requires --token <pat> so the remote PAT can be cached for ' +
-                'the bridge to use at runtime.');
-        }
-        serverName = REMOTE_SERVER_NAME;
-        merge = mergeClaudeJson({
-            filePath: claudeJsonPath,
-            serverName: REMOTE_SERVER_NAME,
-            entry: buildRemoteMcpEntry(apiUrl),
-        });
-        log(!merge.unchanged
-            ? `Installed remote MCP server '${REMOTE_SERVER_NAME}' into ${claudeJsonPath}`
-            : `Remote MCP server '${REMOTE_SERVER_NAME}' already present in ${claudeJsonPath}`);
-        // Cache the PAT under the CONFIG dir (NOT the data dir).
-        patCache = cachePat(token, options.configDir);
-        log(patCache.changed
-            ? `Cached remote PAT at ${patCache.path}`
-            : `Remote PAT already cached at ${patCache.path}`);
-    }
-    else {
-        serverName = SERVER_NAME;
-        merge = mergeClaudeJson({
-            filePath: claudeJsonPath,
-            serverName: SERVER_NAME,
-            entry: buildLocalMcpEntry(),
-        });
-        log(!merge.unchanged
-            ? `Installed local MCP server '${SERVER_NAME}' into ${claudeJsonPath}`
-            : `Local MCP server '${SERVER_NAME}' already present in ${claudeJsonPath}`);
-    }
+    const serverName = SERVER_NAME;
+    const merge = mergeClaudeJson({
+        filePath: claudeJsonPath,
+        serverName: SERVER_NAME,
+        entry: buildLocalMcpEntry(),
+    });
+    log(!merge.unchanged
+        ? `Installed local MCP server '${SERVER_NAME}' into ${claudeJsonPath}`
+        : `Local MCP server '${SERVER_NAME}' already present in ${claudeJsonPath}`);
     // Task #752: ~/.claude.json can carry the local-credentials PAT and the
     // remote WFT_API_KEY env, so tighten it to owner-only (0600) on POSIX after
     // the merge writes it. Best-effort + guarded so a chmod failure (e.g. an
@@ -479,23 +418,22 @@ export function runSetup(options = {}) {
         claudeJsonPath,
         claudeJsonChanged: !merge.unchanged,
         serverName,
-        remote: isRemote,
+        remote: false,
         skills,
         agents,
         ...(npmPrefix !== undefined && { npmPrefix }),
-        ...(patCache !== undefined && { patCache }),
     };
 }
 /**
  * Write ONLY the URL-only remote MCP bridge entry into ~/.claude.json (and copy
  * skills/agents), WITHOUT requiring or caching a PAT (task #808).
  *
- * This is the device-flow counterpart to {@link runSetup}'s remote branch:
- * after {@link runDeviceLogin} (#806) has self-provisioned the PAT and persisted
- * it via the credentials writer, there is no token to embed or double-cache —
+ * This is the shared remote-entry writer for BOTH onboarding paths: after
+ * {@link runDeviceLogin} (#806) or the manual-PAT path has provisioned the PAT
+ * and persisted it via the credentials writer, there is no token to embed —
  * the claude.json entry must be URL-only (#810). So this helper mirrors
- * runSetup's claude.json/skills/agents work but deliberately OMITS the
- * `--token`-required guard and the `cachePat` step.
+ * runSetup's claude.json/skills/agents work but writes the REMOTE bridge entry
+ * and persists NO token of its own (the credentials file is the sole owner).
  *
  * The written entry is exactly `buildRemoteMcpEntry(apiUrl)`: a stdio bridge
  * carrying only `WFT_API_URL`. The bridge resolves its bearer token at runtime
@@ -604,71 +542,6 @@ export function selectRemoteOnboardingMethod(probe) {
         return 'manual-pat';
     return probe.oidc === 'ready' ? 'device-flow' : 'manual-pat';
 }
-/**
- * Default manual-PAT persistence (task #809).
- *
- * Validate the pasted PAT against `GET <baseUrl>/api/v1/me` (the same identity
- * envelope `tasks whoami` reads), then persist it through {@link writeCredentials}
- * — the SAME credentials writer {@link runDeviceLogin} uses. This is the only
- * place the manual PAT lands; the claude.json entry stays URL-only (#810) and
- * the bridge resolves the bearer token from this credentials file at runtime,
- * so the secret is never embedded in claude.json.
- *
- * A non-2xx / network failure returns `{ ok: false, reason }` and writes
- * NOTHING — the caller reports the reason and exits without a half-configured
- * install.
- */
-export async function persistManualPat(baseUrl, token) {
-    const meUrl = new URL('/api/v1/me', baseUrl).toString();
-    let response;
-    try {
-        response = await fetch(meUrl, { headers: { Authorization: `Bearer ${token}` } });
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        return { ok: false, reason: `could not reach ${meUrl}: ${message}` };
-    }
-    if (response.status === 401) {
-        return { ok: false, reason: 'the personal access token was rejected (HTTP 401)' };
-    }
-    if (!response.ok) {
-        return { ok: false, reason: `${meUrl} returned HTTP ${response.status}` };
-    }
-    let body;
-    try {
-        body = (await response.json());
-    }
-    catch {
-        return { ok: false, reason: `${meUrl} returned a non-JSON body` };
-    }
-    if (body === null || typeof body.id !== 'number' || typeof body.displayName !== 'string') {
-        return { ok: false, reason: `${meUrl} did not return a usable identity` };
-    }
-    const email = typeof body.email === 'string' ? body.email : null;
-    const identity = { id: body.id, displayName: body.displayName, email };
-    // Persist through the SAME credentials writer the device flow uses. The
-    // server's /me envelope does not carry the token rowid, so default token_id
-    // to 1 (a positive int, satisfying the credentials schema); `whoami`'s
-    // best-effort token enrichment degrades gracefully when it can't match it.
-    try {
-        writeCredentials({
-            active: {
-                token,
-                token_id: 1,
-                server: baseUrl,
-                user_id: identity.id,
-                display_name: identity.displayName,
-                email: identity.email,
-                logged_in_at: new Date().toISOString(),
-            },
-        });
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        return { ok: false, reason: `failed to write credentials file: ${message}` };
-    }
-    return { ok: true, identity };
-}
 /** Present the Local / Service / Remote menu and resolve the chosen mode. */
 export function selectSetupMode(io) {
     return selectFromMenu({
@@ -718,15 +591,15 @@ export async function runSetupInteractive(options = {}) {
         serviceInstall();
         return { mode: 'service' };
     }
-    // Remote: an explicit `--token` is the NON-INTERACTIVE direct path
-    // (automation / CI): write the URL-only remote bridge entry (WFT_API_URL only,
-    // per the #810 contract — the PAT is NEVER persisted into claude.json) and
-    // cache the PAT separately, with NO OIDC probe and NO server round-trip, so it
-    // succeeds even when the server is unreachable. Only a TOKENLESS `--remote`
-    // runs the probe-driven device-flow / manual-PAT onboarding
-    // (runRemoteOnboarding), which is for the interactive operator who has no PAT
-    // yet. Require `remote` too so a programmatic caller passing {mode:'remote',
-    // token} without a URL can't get a LOCAL install mislabeled as remote.
+    // Remote: an explicit `--token` is the NON-INTERACTIVE direct manual-PAT path
+    // (automation / CI). It validates the PAT against /api/v1/me, persists it to
+    // the credentials file (the single source of truth the CLI + bridge read), and
+    // writes the URL-only remote bridge entry (WFT_API_URL only — the PAT is NEVER
+    // persisted into claude.json, #810), skipping only the OIDC probe. A TOKENLESS
+    // `--remote` runs the probe-driven device-flow / manual-PAT onboarding
+    // (runRemoteOnboarding), for the interactive operator who has no PAT yet.
+    // Require `remote` too so a programmatic caller passing {mode:'remote', token}
+    // without a URL can't get a LOCAL install mislabeled as remote.
     if (mode === 'remote') {
         const hasToken = typeof options.token === 'string' && options.token.length > 0;
         let hasRemote = typeof options.remote === 'string' && options.remote.length > 0;
@@ -743,9 +616,17 @@ export async function runSetupInteractive(options = {}) {
                 hasRemote = true;
             }
         }
+        // #858: an explicit `--token` is the NON-INTERACTIVE direct manual-PAT path
+        // (automation / CI). It MUST persist a usable credential — validate the PAT
+        // against /api/v1/me and writeCredentials via completeManualPatOnboarding,
+        // then write the URL-only bridge entry — exactly like the interactive
+        // manual-PAT path. (The old code routed here to runSetup, which only cached
+        // the PAT to an ORPHANED file that nothing reads, leaving both the CLI and
+        // the MCP bridge unauthenticated despite reporting success.) Skips the OIDC
+        // probe — we already have a PAT — but the /api/v1/me validation round-trip is
+        // required to learn the identity the credentials file needs.
         if (hasToken && hasRemote) {
-            const setup = runSetup(options);
-            return { mode: 'remote', oidc: null, method: 'manual-pat', ok: true, setup };
+            return completeManualPatOnboarding(options, options.remote, null);
         }
         return runRemoteOnboarding(options);
     }
@@ -811,6 +692,17 @@ export async function runRemoteOnboarding(options = {}) {
     // 3. Branch on the selected method.
     let method = selectRemoteOnboardingMethod(probeResult);
     const oidc = probeResult.ok ? probeResult.oidc : null;
+    // #835: even when the server reports OIDC ready, browser login can only
+    // COMPLETE over https (or localhost) — Google rejects non-https OAuth
+    // redirect URIs everywhere else. Catch a plain-http non-localhost URL here
+    // and tell the user plainly, then route to manual-PAT entry (with on-host
+    // mint instructions) rather than opening a verification URL that dead-ends at
+    // the IdP callback.
+    if (method === 'device-flow' && !canUseBrowserSso(baseUrl)) {
+        for (const line of browserSsoGuidance(baseUrl))
+            log(line);
+        method = 'manual-pat';
+    }
     if (method === 'device-flow') {
         // Self-provision a PAT via the OIDC device flow (#806). runDeviceLogin owns
         // the entire RFC 8628 exchange AND persists the minted PAT via the
@@ -854,39 +746,46 @@ export async function runRemoteOnboarding(options = {}) {
             return { mode: 'remote', oidc, method, ok: true, setup };
         }
         // Device flow unavailable/aborted → fall through to the manual-PAT path
-        // below (records the method actually used so the result reflects reality).
+        // (records the method actually used so the result reflects reality).
         method = 'manual-pat';
     }
-    // method === 'manual-pat' (task #809): obtain a PAT, validate it, and persist
-    // it through the SAME credentials writer the device flow uses
-    // (writeCredentials), then write the URL-only claude.json entry via the
-    // shared writeRemoteMcpEntryOnly helper (#808/#810) — identical entry shape to
-    // the device-flow path; only the PAT source differs.
-    //
-    // PAT precedence:
-    //   1. `--token <pat>`            (explicit flag; wins).
-    //   2. interactive promptSecret   (a TTY pastes the PAT, never echoed).
-    //   3. env `WFT_API_KEY`          (DOCUMENTED non-TTY fallback — the same env
-    //      the remote bridge reads at runtime; lets CI / non-TTY callers supply
-    //      the PAT without a prompt instead of hanging).
-    // On a non-TTY with none of the above, fail clearly (no hang).
-    let token = options.token;
-    if ((typeof token !== 'string' || token.length === 0) &&
-        (options.isInteractive ?? shouldPrompt)()) {
-        token = await promptSecret('Paste a personal access token: ', options.promptIO);
-    }
-    if (typeof token !== 'string' || token.length === 0) {
-        // Non-TTY (or empty prompt) fallback: read the PAT from the documented
-        // WFT_API_KEY env var rather than hanging on a prompt that has no TTY.
-        const envToken = process.env['WFT_API_KEY'];
-        if (typeof envToken === 'string' && envToken.length > 0) {
-            token = envToken;
-        }
-    }
-    if (typeof token !== 'string' || token.length === 0) {
+    return completeManualPatOnboarding(options, baseUrl, oidc);
+}
+/**
+ * Shared manual-PAT onboarding tail (#858/#857): obtain a PAT, validate it
+ * against `GET /api/v1/me`, persist it through {@link persistManualPat} (the
+ * SAME credentials writer the device flow uses), then write the URL-only
+ * claude.json bridge entry via {@link writeRemoteMcpEntryOnly} (#808/#810). The
+ * claude.json entry is identical regardless of how the PAT was obtained — only
+ * the PAT source differs.
+ *
+ * This is invoked from TWO places, so the logic can't drift (the root cause of
+ * #858, where the non-interactive `--remote --token` path took a DIFFERENT,
+ * credential-less route):
+ *   1. {@link runRemoteOnboarding}'s manual-PAT branch (probe said no browser
+ *      login, or device flow failed/aborted).
+ *   2. {@link runSetupInteractive}'s non-interactive `--remote --token` path.
+ *
+ * PAT precedence (via {@link resolveManualPatToken}):
+ *   1. `--token <pat>`           (explicit flag; wins).
+ *   2. interactive promptSecret  (a TTY pastes the PAT, never echoed).
+ *   3. env `WFT_API_KEY`         (DOCUMENTED non-TTY fallback — the same env the
+ *      remote bridge reads at runtime; lets CI / non-TTY callers supply the PAT
+ *      without a prompt instead of hanging).
+ * On a non-TTY with none of the above, fail clearly (no hang) and write NOTHING.
+ */
+async function completeManualPatOnboarding(options, baseUrl, oidc) {
+    const log = options.log ?? ((line) => console.log(line));
+    const token = await resolveManualPatToken({
+        ...(options.token !== undefined && { token: options.token }),
+        ...(options.promptIO !== undefined && { promptIO: options.promptIO }),
+        ...(options.isInteractive !== undefined && { isInteractive: options.isInteractive }),
+        envVar: 'WFT_API_KEY',
+    });
+    if (token === undefined) {
         log('No personal access token supplied. Re-run with --token <pat> ' +
             'or set the WFT_API_KEY environment variable to finish remote setup.');
-        return { mode: 'remote', oidc, method, ok: false };
+        return { mode: 'remote', oidc, method: 'manual-pat', ok: false };
     }
     // Validate the PAT and persist it via writeCredentials (the device-flow
     // writer). Nothing is written to claude.json until the PAT proves valid, so a
@@ -895,7 +794,7 @@ export async function runRemoteOnboarding(options = {}) {
     const persisted = await persist(baseUrl, token);
     if (!persisted.ok) {
         log(`Could not store the personal access token: ${persisted.reason}.`);
-        return { mode: 'remote', oidc, method, ok: false };
+        return { mode: 'remote', oidc, method: 'manual-pat', ok: false };
     }
     log(`Stored credentials for ${persisted.identity.displayName}.`);
     // URL-only claude.json entry (#810) via the SAME helper the device-flow path
@@ -905,7 +804,7 @@ export async function runRemoteOnboarding(options = {}) {
     return {
         mode: 'remote',
         oidc,
-        method,
+        method: 'manual-pat',
         ok: true,
         setup,
         manualPatIdentity: persisted.identity,
@@ -917,7 +816,7 @@ export const setupCommand = new Command('setup')
     .option('--local', 'Run the Local setup path non-interactively (skip the menu)')
     .option('--service', 'Run the Service setup path non-interactively (user-scoped service install)')
     .option('--remote <url>', 'Install the remote MCP bridge (wood-fired-tasks-remote) pointed at the given REST API base URL; requires --token')
-    .option('--token <pat>', 'Personal access token for `--remote`. When supplied, setup writes the URL-only remote MCP entry (WFT_API_URL; the PAT is never stored in claude.json) and caches the PAT separately — no OIDC probe, no server round-trip — so it works offline/non-interactively. Omit --token to run the interactive device-flow / manual-PAT onboarding instead.')
+    .option('--token <pat>', 'Personal access token for `--remote`. When supplied, setup validates it against the server, persists it to the credentials file (the PAT is never stored in claude.json), and writes the URL-only remote MCP entry (WFT_API_URL) — skipping the OIDC probe. Omit --token to run the interactive device-flow / manual-PAT onboarding instead.')
     .action((opts) => {
     // `--token` is ALSO a global option on the root program (src/cli/bin/tasks.ts),
     // registered for Bearer-auth override. When a user runs

package/dist/cli/util/prompt.d.ts

@@ -35,8 +35,8 @@ export interface PromptIO {
 }
 /**
  * Read a single line of input from the given stream, resolving when the first
- * newline (`\n`, with an optional preceding `\r`) is seen or the stream ends.
- * The trailing newline is stripped from the returned value.
+ * line terminator (`\n`, `\r`, or `\r\n`) is seen or the stream ends. The
+ * terminator is stripped from the returned value.
  *
  * @param prompt - Message written to the output stream before reading.
  * @param io - Injectable input/output streams (defaults to process streams).

package/dist/cli/util/prompt.js

@@ -7,8 +7,8 @@ function resolveOutput(io) {
 }
 /**
  * Read a single line of input from the given stream, resolving when the first
- * newline (`\n`, with an optional preceding `\r`) is seen or the stream ends.
- * The trailing newline is stripped from the returned value.
+ * line terminator (`\n`, `\r`, or `\r\n`) is seen or the stream ends. The
+ * terminator is stripped from the returned value.
  *
  * @param prompt - Message written to the output stream before reading.
  * @param io - Injectable input/output streams (defaults to process streams).
@@ -114,8 +114,15 @@ export async function selectFromMenu(config, io) {
 }
 /**
  * Resolve with the first line emitted by `input`. Accumulates chunks until a
- * newline is seen (stripping a trailing `\r\n` or `\n`); if the stream ends
- * first, resolves with whatever was buffered.
+ * line terminator is seen — `\n`, `\r`, or `\r\n`, all stripped — then resolves;
+ * if the stream ends first, resolves with whatever was buffered.
+ *
+ * Accepting a BARE `\r` is load-bearing for {@link promptSecret} on a real TTY
+ * (task #856): raw mode disables the terminal's CR→LF translation, so the Enter
+ * key delivers `\r` (0x0D) with NO following `\n`. Terminating only on `\n` left
+ * the read hanging forever (the pasted secret buffered, Enter never recognized).
+ * The unit tests never caught it because injected fake streams feed `\n`, which
+ * never exercises raw mode.
  */
 function readLineFrom(input) {
     return new Promise((resolve, reject) => {
@@ -140,13 +147,25 @@ function readLineFrom(input) {
         };
         const onData = (chunk) => {
             buffer += typeof chunk === 'string' ? chunk : chunk.toString('utf8');
-            const nlIdx = buffer.indexOf('\n');
-            if (nlIdx !== -1) {
-                let line = buffer.slice(0, nlIdx);
-                if (line.endsWith('\r')) {
-                    line = line.slice(0, -1);
-                }
-                finish(line);
+            // Terminate on the FIRST `\r` or `\n` (#856). A bare `\r` is what raw-mode
+            // Enter sends (no CR→LF translation), so we must not wait for a `\n` that
+            // will never arrive. `slice(0, termIdx)` drops the terminator and — for
+            // `\r\n` — leaves the trailing `\n` in `buffer`, which is discarded since
+            // the line is already settled.
+            const crIdx = buffer.indexOf('\r');
+            const lfIdx = buffer.indexOf('\n');
+            let termIdx = -1;
+            if (crIdx !== -1 && lfIdx !== -1) {
+                termIdx = Math.min(crIdx, lfIdx);
+            }
+            else if (crIdx !== -1) {
+                termIdx = crIdx;
+            }
+            else if (lfIdx !== -1) {
+                termIdx = lfIdx;
+            }
+            if (termIdx !== -1) {
+                finish(buffer.slice(0, termIdx));
             }
         };
         const onEnd = () => {

package/docs/CLI.md

@@ -48,8 +48,9 @@ The CLI requires these environment variables to connect to the API server:
 
 [IMPORTANT] Authentication uses a Personal Access Token (PAT) sent as
 `Authorization: Bearer <pat>`. For interactive use prefer
-[`tasks login`](#tasks-login) (OIDC device flow; caches a PAT to the credentials
-file, which takes precedence over `API_KEY`). For scripting/CI, set `API_KEY` to
+[`tasks login`](#tasks-login) (OIDC device flow, or `--token <pat>` for a manual
+PAT on non-`https` servers; writes a PAT to the credentials file, which takes
+precedence over `API_KEY`). For scripting/CI, set `API_KEY` to
 a `wft_pat_…` value or pass `--token wft_pat_…`. Mint a PAT via the web UI (`/me`),
 `tasks login`, or `tasks db mint-token` (headless bootstrap).
 
@@ -848,12 +849,19 @@ These commands manage the local credentials file used for Bearer (PAT) authentic
 
 ### tasks login
 
-Authenticate with the WFT server via the OAuth device flow. Requests a device code, surfaces a verification URL and user code, best-effort opens a browser, then polls until you approve. On success the minted Personal Access Token is written to the credentials file. The PAT value itself is never printed.
+Authenticate with the WFT server and write a Personal Access Token to the credentials file. The PAT value itself is never printed (stdout or stderr). Two paths:
+
+- **Device flow (default).** Requests a device code, surfaces a verification URL and user code, best-effort opens a browser, then polls until you approve. Used when browser login can complete against the server — that is, an `https` URL or `http://localhost` / `127.0.0.1`.
+- **Manual PAT.** Triggered when you pass `--token <pat>`, *or* automatically when browser login can't complete against the target server (a plain-`http` non-localhost URL — identity providers like Google reject non-`https` OAuth redirect URIs, so the device flow would dead-end). The PAT is validated against `GET /api/v1/me` and persisted to the credentials file. When no `--token` is given on such a server, `login` prints the same `https`-required / how-to-mint-a-PAT guidance `tasks setup` shows, then (on a TTY) prompts you to paste one.
+
+This makes `tasks login` reach parity with `tasks setup --remote`: a remote non-`https` server is no longer a dead end. Both commands share the manual-PAT logic (`canUseBrowserSso` gate + `persistManualPat`), so they can't drift.
+
+> Note: the login-command `--token <pat>` flag (which **persists** a credential) is distinct from the global `--token` flag (which sets a per-invocation Bearer header for outbound API calls and does **not** persist anything). `tasks login --token …` and `tasks --token … login` both reach the manual-PAT persistence path.
 
 **Examples:**
 
 ```bash
-# Standard interactive login
+# Standard interactive device-flow login (https / localhost server)
 tasks login
 
 # Don't auto-open a browser (print the URL only)
@@ -861,23 +869,28 @@ tasks login --no-browser
 
 # Override the server for this login (stored in the credentials file)
 tasks login --server https://tasks.example.com
+
+# Manual PAT — required for a remote plain-http / LAN-IP server where
+# Google SSO can't complete. Validated against /api/v1/me, then persisted.
+tasks login --server http://tasks.example.local:3000 --token wft_pat_…
 ```
 
 **Options:**
 
 | Option | Type | Description |
 |--------|------|-------------|
+| --token | string | Authenticate with a Personal Access Token instead of the device flow (required for remote non-`https` servers). Validated against `GET /api/v1/me`, then stored in the credentials file. |
 | --token-name | string | Name for the minted PAT (advisory in v1.6; reserved for v1.7 explicit naming) |
 | --no-browser | flag | Skip auto-opening the verification URL in a browser |
 | --server | string | Override `API_BASE_URL` for this invocation (persisted to the credentials file) |
 
 **Output:**
 
-In text mode, login chrome (verification URL, user code, progress) is written to **stderr**, so `tasks login && tasks list` keeps stdout clean. On success it prints `Logged in as <displayName>`. With `--json`, a sequence of newline-separated JSON event envelopes is written to stdout (`{event:"pending"}`, optional `{event:"slow_down"}`, then `{event:"logged_in"}` or `{event:"failed"}`).
+In text mode, login chrome (verification URL, user code, progress, or the manual-PAT guidance) is written to **stderr**, so `tasks login && tasks list` keeps stdout clean. On success it prints `Logged in as <displayName>`. With `--json`, a sequence of newline-separated JSON event envelopes is written to stdout — device flow: `{event:"pending"}`, optional `{event:"slow_down"}`, then `{event:"logged_in"}` or `{event:"failed"}`; manual PAT: a single `{event:"logged_in"}` or `{event:"failed"}`.
 
 **Exit codes:**
 
-Returns `0` on a successful login. Returns `1` on an invalid server URL, a failed device-code request, a terminal polling error, or a credentials-write failure.
+Returns `0` on a successful login. Returns `1` on an invalid server URL, a failed device-code request, a terminal polling error, a rejected/unreachable PAT, no PAT supplied on a non-`https` server, or a credentials-write failure.
 
 ### tasks logout
 

package/docs/SETUP.md

@@ -106,17 +106,28 @@ wood-fired-tasks setup \
   --token  wft_pat_…this-machine…
 ```
 
-This writes a **`wood-fired-tasks-remote`** entry to `~/.claude.json` (distinct
-from the local `wood-fired-tasks` entry — the two coexist) whose `env` carries
-`WFT_API_URL` (the base URL) and `WFT_API_KEY` (the PAT). That entry spawns the
-remote stdio bridge (`dist/mcp/remote/index.js`), which proxies every MCP tool
-call to the REST API over HTTP, so every machine sees one backlog.
-
-The PAT is also **cached under your OS config dir** (`remote-token`, mode `0600`
-on POSIX) — operator configuration, never the data dir where the SQLite DB
-lives. `--remote` without `--token` is an error: a token is required so
-`WFT_API_KEY` can be set on the entry. Mint a per-machine PAT with
-`tasks db mint-token` (see [Bootstrap a PAT without a browser](#6-bootstrap-a-pat-without-a-browser-servers-ci-headless-agents))
+This writes a **URL-only `wood-fired-tasks-remote`** entry to `~/.claude.json`
+(distinct from the local `wood-fired-tasks` entry — the two coexist) whose `env`
+carries **only** `WFT_API_URL` (the base URL). The PAT is **never** embedded in
+`~/.claude.json` (#810). That entry spawns the remote stdio bridge
+(`dist/mcp/remote/index.js`), which proxies every MCP tool call to the REST API
+over HTTP, so every machine sees one backlog.
+
+When you pass `--token <pat>`, setup **validates it against `GET /api/v1/me`** and
+**persists it to the CLI credentials file** (`~/.config/wood-fired-tasks/credentials`,
+mode `0600` on POSIX) — the *same* file `tasks login` writes. The remote bridge
+then resolves its bearer token from that credentials file at runtime. There is no
+separate PAT "cache" file (the old `remote-token` cache was removed in #858 —
+nothing read it, so `setup --remote --token` reported success while leaving both
+the CLI and the bridge unauthenticated).
+
+`--token` is **optional**: omit it and `setup --remote <url>` runs the interactive
+onboarding — the OIDC **device flow** when the server supports browser login
+(https / localhost), otherwise a **manual-PAT** prompt. Supply `--token` (or set
+`WFT_API_KEY` for non-TTY/CI callers) for the non-interactive direct path, which
+skips the OIDC probe but still performs the `/api/v1/me` validation round-trip.
+Mint a per-machine PAT with `tasks db mint-token` (see
+[Bootstrap a PAT without a browser](#6-bootstrap-a-pat-without-a-browser-servers-ci-headless-agents))
 and revoke it independently to cut off a single client. For the full
 Windows/Linux/macOS fleet recipe, see
 [Multi-OS client fleet](#multi-os-client-fleet-one-shared-on-prem-server).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wood-fired-tasks",
-  "version": "2.0.4",
+  "version": "2.0.6",
   "description": "Network-wide task tracking system for Wood Fired Games",
   "keywords": [
     "task-tracker",