wood-fired-tasks 2.0.5 → 2.0.6

package/CHANGELOG.md

@@ -13,6 +13,45 @@ vulnerabilities, supply-chain pinning) are always called out under `Security`.
 
 _No changes yet._
 
+## [v2.0.6] - 2026-06-08
+
+### Added
+- **`tasks login --token <pat>` — a manual-PAT login path.** `tasks login` was
+  device-flow only and **dead-ended on a remote non-`https` server**: the OAuth
+  device flow can't complete where Google rejects the non-`https` redirect URI,
+  and there was no way to supply a PAT instead. `login` now accepts `--token`
+  (validated against `GET /api/v1/me`, then persisted to the credentials file)
+  and, like `tasks setup`, applies the `canUseBrowserSso` gate — on a plain-`http`
+  non-localhost server it prints the `https`-required / how-to-mint-a-PAT
+  guidance and (on a TTY) prompts for one instead of launching a flow that can't
+  finish. The shared manual-PAT logic now lives in one module so `login` and
+  `setup` can't drift. (#857)
+
+### Fixed
+- **`tasks setup --remote --token <pat>` now actually authenticates you.** The
+  non-interactive `--token` path wrote the PAT to an **orphaned cache file that
+  no code reads** and never to the credentials file, so it reported success while
+  leaving *both* the CLI ("Not authenticated. Run: tasks login") and the remote
+  MCP bridge unauthenticated — the likely root cause of "remote MCP shows 0
+  projects" reports. The path now validates the PAT against `GET /api/v1/me` and
+  persists it to the credentials file (the same writer the device flow uses); the
+  bridge resolves its bearer token from there at runtime. The dead `remote-token`
+  cache (`cachePat`/`patCachePath`) was removed — the credentials file is the
+  single source of truth. (#858)
+- **The interactive "Paste a personal access token:" prompt no longer hangs on a
+  real terminal.** `promptSecret` enables TTY raw mode to suppress echo, which
+  disables CR→LF translation, so the Enter key delivers a bare `\r` (0x0D) — but
+  the line reader only terminated on `\n`, so the read blocked forever (pasted
+  PAT buffered, Enter never recognized). Hit on Windows PowerShell during
+  `tasks setup --remote` manual-PAT entry; platform-independent. The reader now
+  treats `\r`, `\n`, or `\r\n` as the line terminator. (#856)
+
+### Security
+- The `--remote --token` PAT is now stored only in the `0600` credentials file
+  and is still **never** embedded in `~/.claude.json` (the remote MCP entry stays
+  URL-only, #810). The removed `remote-token` cache eliminates a second on-disk
+  copy of the secret.
+
 ## [v2.0.5] - 2026-06-08
 
 ### Changed

package/README.md

@@ -119,8 +119,11 @@ wood-fired-tasks self-update       # npm i -g wood-fired-tasks@latest (no sudo)
 wood-fired-tasks setup --remote https://tasks.example.com --token wft_pat_…
 ```
 
-This writes a `wood-fired-tasks-remote` MCP entry (proxying every tool to the
-REST API) and caches the PAT under your OS config dir. For a full
+This writes a URL-only `wood-fired-tasks-remote` MCP entry (proxying every tool
+to the REST API) and persists the validated PAT to the CLI credentials file —
+the same file `tasks login` writes; the bridge reads its bearer token from there
+at runtime (the PAT is never stored in `~/.claude.json`). Omit `--token` to run
+the interactive device-flow / manual-PAT onboarding instead. For a full
 Windows/Linux/macOS fleet on one on-prem server, see
 [Multi-OS client fleet](docs/SETUP.md#multi-os-client-fleet-one-shared-on-prem-server).
 

package/dist/cli/auth/manual-pat.d.ts

@@ -0,0 +1,99 @@
+import { type PromptIO } from '../util/prompt.js';
+/**
+ * Whether the browser/device login (Google SSO) can actually COMPLETE against
+ * `baseUrl` (#835).
+ *
+ * The whole OIDC dance — the verification page AND the IdP's OAuth callback —
+ * happens at the server's origin, and identity providers (Google especially)
+ * reject non-`https` OAuth redirect URIs *except* for `localhost`/`127.0.0.1`.
+ * So a server reached over plain `http` at a non-localhost address can report
+ * `oidc: 'ready'` yet still be unable to finish browser login: the user's
+ * browser gets bounced to an `http://…/auth/callback` the IdP won't honor. We
+ * detect that up front so onboarding can tell the user the truth (need https,
+ * or use a PAT) instead of opening a URL that dead-ends.
+ *
+ * Returns true for any `https` URL and for `http://localhost` / `127.0.0.1` /
+ * `[::1]`; false for plain-http non-loopback hosts and unparseable input.
+ */
+export declare function canUseBrowserSso(baseUrl: string): boolean;
+/**
+ * The advisory block shown when browser SSO can't complete against `baseUrl`
+ * (plain-http non-localhost): explain the https requirement and how to mint a
+ * PAT on the server host. Returned as discrete lines so each caller logs them
+ * through its own sink (setup → `log()`, login → stderr / JSON). Shared so the
+ * two commands print identical guidance (#857).
+ */
+export declare function browserSsoGuidance(baseUrl: string): string[];
+/**
+ * The minimal identity envelope `GET /api/v1/me` returns (task #809). Mirrors
+ * the fields {@link writeCredentials} needs so a manually-pasted PAT lands in
+ * the SAME credentials file the device flow writes — the bridge then resolves
+ * its bearer token from there at runtime (URL-only claude.json entry, #810).
+ */
+export interface ManualPatIdentity {
+    id: number;
+    displayName: string;
+    email: string | null;
+    /** Best-effort token rowid; defaults to 1 when the server omits it. */
+    tokenId?: number;
+}
+/**
+ * Outcome of persisting a manually-supplied PAT (task #809).
+ *  - `{ ok: true, identity }`  — the PAT validated and credentials were written.
+ *  - `{ ok: false, reason }`   — the PAT was rejected / unreachable; `reason`
+ *    is surfaced to the user and NOTHING is persisted.
+ */
+export type ManualPatPersistResult = {
+    ok: true;
+    identity: ManualPatIdentity;
+} | {
+    ok: false;
+    reason: string;
+};
+/** Injectable manual-PAT persistence seam so tests drive it without a server. */
+export type ManualPatPersist = (baseUrl: string, token: string) => Promise<ManualPatPersistResult>;
+/**
+ * Default manual-PAT persistence (task #809).
+ *
+ * Validate the pasted PAT against `GET <baseUrl>/api/v1/me` (the same identity
+ * envelope `tasks whoami` reads), then persist it through {@link writeCredentials}
+ * — the SAME credentials writer the device flow uses. This is the only place the
+ * manual PAT lands; the claude.json entry stays URL-only (#810) and the bridge
+ * resolves the bearer token from this credentials file at runtime, so the secret
+ * is never embedded in claude.json.
+ *
+ * A non-2xx / network failure returns `{ ok: false, reason }` and writes
+ * NOTHING — the caller reports the reason and exits without a half-configured
+ * install.
+ */
+export declare function persistManualPat(baseUrl: string, token: string): Promise<ManualPatPersistResult>;
+/** Inputs to {@link resolveManualPatToken}. */
+export interface ResolveManualPatTokenArgs {
+    /** Explicit PAT (e.g. `--token <pat>`); wins unconditionally when non-empty. */
+    token?: string;
+    /** Injectable prompt IO forwarded to {@link promptSecret} (tests/no-TTY). */
+    promptIO?: PromptIO;
+    /** TTY predicate (defaults to {@link shouldPrompt}). */
+    isInteractive?: () => boolean;
+    /** Injectable secret prompt (defaults to {@link promptSecret}) for tests. */
+    promptSecretFn?: (prompt: string, io?: PromptIO) => Promise<string>;
+    /** Prompt label shown before reading the secret. */
+    promptLabel?: string;
+    /**
+     * Optional env var consulted as the LAST resort on a non-TTY (e.g.
+     * `'WFT_API_KEY'` for `setup`, which the remote bridge also reads). Omit to
+     * disable the env fallback (e.g. `tasks login`).
+     */
+    envVar?: string;
+}
+/**
+ * Resolve a manual PAT from, in precedence order:
+ *   1. an explicit `token` (the `--token` flag),
+ *   2. an interactive `promptSecret` (only on a TTY — never echoed),
+ *   3. an optional `envVar` fallback (non-TTY automation).
+ *
+ * Returns `undefined` when none yields a non-empty value, so the caller can
+ * print actionable guidance instead of hanging on a prompt with no TTY. Shared
+ * by `setup` and `login` so their PAT-sourcing rules stay identical (#857).
+ */
+export declare function resolveManualPatToken(args: ResolveManualPatTokenArgs): Promise<string | undefined>;

package/dist/cli/auth/manual-pat.js

@@ -0,0 +1,163 @@
+/**
+ * Shared manual-PAT onboarding primitives used by BOTH `tasks setup --remote`
+ * and `tasks login` (tasks #857/#858).
+ *
+ * History: `setup` grew a full manual-PAT path (browser-SSO gate → validate the
+ * pasted PAT against `GET /api/v1/me` → persist via {@link writeCredentials}),
+ * but `login` shipped device-flow-only and `setup --remote --token` wrote the
+ * PAT to an orphaned cache file that NO code reads. Both bugs trace to the same
+ * logic living inline in setup.ts where login couldn't reuse it. This module is
+ * the single source of truth so the two commands can't drift again.
+ *
+ * Nothing here writes to `claude.json`; the credentials TOML (owned by
+ * {@link writeCredentials}) is the ONLY place a manual PAT lands. The CLI and the
+ * remote MCP bridge both resolve their bearer token from that file at runtime.
+ */
+import { writeCredentials } from './credentials.js';
+import { promptSecret } from '../util/prompt.js';
+import { shouldPrompt } from '../prompts/interactive.js';
+/**
+ * Whether the browser/device login (Google SSO) can actually COMPLETE against
+ * `baseUrl` (#835).
+ *
+ * The whole OIDC dance — the verification page AND the IdP's OAuth callback —
+ * happens at the server's origin, and identity providers (Google especially)
+ * reject non-`https` OAuth redirect URIs *except* for `localhost`/`127.0.0.1`.
+ * So a server reached over plain `http` at a non-localhost address can report
+ * `oidc: 'ready'` yet still be unable to finish browser login: the user's
+ * browser gets bounced to an `http://…/auth/callback` the IdP won't honor. We
+ * detect that up front so onboarding can tell the user the truth (need https,
+ * or use a PAT) instead of opening a URL that dead-ends.
+ *
+ * Returns true for any `https` URL and for `http://localhost` / `127.0.0.1` /
+ * `[::1]`; false for plain-http non-loopback hosts and unparseable input.
+ */
+export function canUseBrowserSso(baseUrl) {
+    let url;
+    try {
+        url = new URL(baseUrl);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol === 'https:')
+        return true;
+    if (url.protocol !== 'http:')
+        return false;
+    const host = url.hostname.toLowerCase();
+    return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]';
+}
+/**
+ * The advisory block shown when browser SSO can't complete against `baseUrl`
+ * (plain-http non-localhost): explain the https requirement and how to mint a
+ * PAT on the server host. Returned as discrete lines so each caller logs them
+ * through its own sink (setup → `log()`, login → stderr / JSON). Shared so the
+ * two commands print identical guidance (#857).
+ */
+export function browserSsoGuidance(baseUrl) {
+    return [
+        '',
+        `"${baseUrl}" is plain http at a non-localhost address.`,
+        'Browser login via Google SSO requires an https URL — identity providers',
+        'reject non-https OAuth redirect URIs except for localhost — so the device',
+        'flow cannot complete against this server. To finish, either:',
+        '  • re-run with an https URL for this server (e.g. front it with a TLS',
+        '    reverse proxy / real domain so Google SSO completes), or',
+        '  • paste a personal access token now.',
+        '',
+        'To mint a PAT, run this ON THE SERVER HOST:',
+        '  tasks db mint-token --user <your-email-or-user-id>',
+        '(or create one from your account page once logged in via the browser).',
+        '',
+    ];
+}
+/**
+ * Default manual-PAT persistence (task #809).
+ *
+ * Validate the pasted PAT against `GET <baseUrl>/api/v1/me` (the same identity
+ * envelope `tasks whoami` reads), then persist it through {@link writeCredentials}
+ * — the SAME credentials writer the device flow uses. This is the only place the
+ * manual PAT lands; the claude.json entry stays URL-only (#810) and the bridge
+ * resolves the bearer token from this credentials file at runtime, so the secret
+ * is never embedded in claude.json.
+ *
+ * A non-2xx / network failure returns `{ ok: false, reason }` and writes
+ * NOTHING — the caller reports the reason and exits without a half-configured
+ * install.
+ */
+export async function persistManualPat(baseUrl, token) {
+    const meUrl = new URL('/api/v1/me', baseUrl).toString();
+    let response;
+    try {
+        response = await fetch(meUrl, { headers: { Authorization: `Bearer ${token}` } });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { ok: false, reason: `could not reach ${meUrl}: ${message}` };
+    }
+    if (response.status === 401) {
+        return { ok: false, reason: 'the personal access token was rejected (HTTP 401)' };
+    }
+    if (!response.ok) {
+        return { ok: false, reason: `${meUrl} returned HTTP ${response.status}` };
+    }
+    let body;
+    try {
+        body = (await response.json());
+    }
+    catch {
+        return { ok: false, reason: `${meUrl} returned a non-JSON body` };
+    }
+    if (body === null || typeof body.id !== 'number' || typeof body.displayName !== 'string') {
+        return { ok: false, reason: `${meUrl} did not return a usable identity` };
+    }
+    const email = typeof body.email === 'string' ? body.email : null;
+    const identity = { id: body.id, displayName: body.displayName, email };
+    // Persist through the SAME credentials writer the device flow uses. The
+    // server's /me envelope does not carry the token rowid, so default token_id
+    // to 1 (a positive int, satisfying the credentials schema); `whoami`'s
+    // best-effort token enrichment degrades gracefully when it can't match it.
+    try {
+        writeCredentials({
+            active: {
+                token,
+                token_id: 1,
+                server: baseUrl,
+                user_id: identity.id,
+                display_name: identity.displayName,
+                email: identity.email,
+                logged_in_at: new Date().toISOString(),
+            },
+        });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { ok: false, reason: `failed to write credentials file: ${message}` };
+    }
+    return { ok: true, identity };
+}
+/**
+ * Resolve a manual PAT from, in precedence order:
+ *   1. an explicit `token` (the `--token` flag),
+ *   2. an interactive `promptSecret` (only on a TTY — never echoed),
+ *   3. an optional `envVar` fallback (non-TTY automation).
+ *
+ * Returns `undefined` when none yields a non-empty value, so the caller can
+ * print actionable guidance instead of hanging on a prompt with no TTY. Shared
+ * by `setup` and `login` so their PAT-sourcing rules stay identical (#857).
+ */
+export async function resolveManualPatToken(args) {
+    let token = args.token;
+    if ((typeof token !== 'string' || token.length === 0) && (args.isInteractive ?? shouldPrompt)()) {
+        const ask = args.promptSecretFn ?? promptSecret;
+        token = await ask(args.promptLabel ?? 'Paste a personal access token: ', args.promptIO);
+    }
+    if ((typeof token !== 'string' || token.length === 0) && args.envVar) {
+        const envToken = process.env[args.envVar];
+        if (typeof envToken === 'string' && envToken.length > 0) {
+            token = envToken;
+        }
+    }
+    return typeof token === 'string' && token.length > 0 ? token : undefined;
+}
+//# sourceMappingURL=manual-pat.js.map

package/dist/cli/commands/login.d.ts

@@ -1,5 +1,7 @@
 import { Command } from 'commander';
 import { type DeviceTokenSuccess } from '../auth/device-flow.js';
+import { type ManualPatPersist } from '../auth/manual-pat.js';
+import type { PromptIO } from '../util/prompt.js';
 /**
  * Inputs to {@link runDeviceLogin}. All values are already resolved/validated by
  * the caller (the `login` command and, in Phase 30 Plan 07+, the setup wizard).
@@ -39,4 +41,41 @@ export type RunDeviceLoginResult = {
  * emitting the appropriate error output, and the caller decides the exit code.
  */
 export declare function runDeviceLogin(args: RunDeviceLoginArgs): Promise<RunDeviceLoginResult>;
+/**
+ * Inputs to {@link runManualPatLogin} (task #857). Mirrors {@link RunDeviceLoginArgs}
+ * for the parts the command shares (baseUrl, isJson).
+ */
+export interface RunManualPatLoginArgs {
+    /** Validated server base URL. */
+    baseUrl: string;
+    /** Explicit PAT (`--token <pat>`); when absent, prompt on a TTY. */
+    token?: string;
+    /** When true, emit newline-separated JSON envelopes on stdout (vs text on stderr). */
+    isJson: boolean;
+    /** Injectable prompt IO (tests). Defaults to process.stdin/stdout. */
+    promptIO?: PromptIO;
+    /** Injectable TTY predicate (tests). Defaults to the real shouldPrompt. */
+    isInteractive?: () => boolean;
+    /** Injectable persistence seam (tests). Defaults to {@link persistManualPat}. */
+    manualPatPersist?: ManualPatPersist;
+}
+/**
+ * Manual-PAT login core (task #857): the parity-with-`tasks setup` path that
+ * lets `tasks login` finish on a server where browser SSO can't complete (a
+ * plain-http / LAN-IP server the IdP rejects), or whenever the user supplies a
+ * PAT directly.
+ *
+ * Behavior:
+ *   1. If browser SSO can't complete against `baseUrl` AND no `--token` was
+ *      supplied, print the same https-required / mint-a-PAT guidance `setup`
+ *      shows (shared via {@link browserSsoGuidance}).
+ *   2. Resolve the PAT: `--token` flag → interactive `promptSecret` (TTY only).
+ *   3. Validate + persist via {@link persistManualPat} — the SAME credentials
+ *      writer the device flow uses, so `tasks whoami` / the API client / the MCP
+ *      bridge all see the credential afterward.
+ *
+ * Security invariant (matches the device path): the PAT is NEVER written to
+ * stdout/stderr — the credentials file is its only resting place.
+ */
+export declare function runManualPatLogin(args: RunManualPatLoginArgs): Promise<RunDeviceLoginResult>;
 export declare const loginCommand: Command;

package/dist/cli/commands/login.js

@@ -31,6 +31,7 @@ import { env } from '../config/env.js';
 import { writeCredentials } from '../auth/credentials.js';
 import { openBrowser } from '../auth/browser-open.js';
 import { requestDeviceCode, pollForToken } from '../auth/device-flow.js';
+import { canUseBrowserSso, browserSsoGuidance, persistManualPat, resolveManualPatToken, } from '../auth/manual-pat.js';
 /** Emit one newline-separated JSON envelope on stdout (used in --json mode). */
 function emitJsonEvent(event) {
     process.stdout.write(JSON.stringify(event) + '\n');
@@ -185,9 +186,83 @@ export async function runDeviceLogin(args) {
     }
     return { ok: true, user: response.user };
 }
+/**
+ * Manual-PAT login core (task #857): the parity-with-`tasks setup` path that
+ * lets `tasks login` finish on a server where browser SSO can't complete (a
+ * plain-http / LAN-IP server the IdP rejects), or whenever the user supplies a
+ * PAT directly.
+ *
+ * Behavior:
+ *   1. If browser SSO can't complete against `baseUrl` AND no `--token` was
+ *      supplied, print the same https-required / mint-a-PAT guidance `setup`
+ *      shows (shared via {@link browserSsoGuidance}).
+ *   2. Resolve the PAT: `--token` flag → interactive `promptSecret` (TTY only).
+ *   3. Validate + persist via {@link persistManualPat} — the SAME credentials
+ *      writer the device flow uses, so `tasks whoami` / the API client / the MCP
+ *      bridge all see the credential afterward.
+ *
+ * Security invariant (matches the device path): the PAT is NEVER written to
+ * stdout/stderr — the credentials file is its only resting place.
+ */
+export async function runManualPatLogin(args) {
+    const { baseUrl, isJson } = args;
+    const hasToken = typeof args.token === 'string' && args.token.length > 0;
+    // Explain the https requirement up front when the user reached for `login`
+    // on a server browser SSO can't complete against and gave us no PAT to use.
+    if (!hasToken && !canUseBrowserSso(baseUrl) && !isJson) {
+        for (const line of browserSsoGuidance(baseUrl)) {
+            process.stderr.write(`${line}\n`);
+        }
+    }
+    const token = await resolveManualPatToken({
+        ...(args.token !== undefined && { token: args.token }),
+        ...(args.promptIO !== undefined && { promptIO: args.promptIO }),
+        ...(args.isInteractive !== undefined && { isInteractive: args.isInteractive }),
+        promptLabel: 'Paste a personal access token: ',
+    });
+    if (token === undefined) {
+        const message = 'No personal access token supplied. Re-run with --token <pat> to finish login.';
+        if (isJson) {
+            emitJsonEvent({ event: 'failed', error: 'no_token', message });
+        }
+        else {
+            process.stderr.write(`${message}\n`);
+        }
+        return { ok: false };
+    }
+    const persist = args.manualPatPersist ?? persistManualPat;
+    const persisted = await persist(baseUrl, token);
+    if (!persisted.ok) {
+        const message = `Could not store the personal access token: ${persisted.reason}.`;
+        if (isJson) {
+            emitJsonEvent({ event: 'failed', error: 'pat_rejected', message });
+        }
+        else {
+            process.stderr.write(`${message}\n`);
+        }
+        return { ok: false };
+    }
+    const user = {
+        id: persisted.identity.id,
+        displayName: persisted.identity.displayName,
+        email: persisted.identity.email,
+    };
+    if (isJson) {
+        emitJsonEvent({
+            event: 'logged_in',
+            user,
+            token_id: persisted.identity.tokenId ?? null,
+        });
+    }
+    else {
+        process.stderr.write(`Logged in as ${persisted.identity.displayName}\n`);
+    }
+    return { ok: true, user };
+}
 export const loginCommand = new Command('login')
     .description('Authenticate with the WFT server via OAuth device flow')
     .option('--token-name <name>', 'Name for the minted PAT (currently advisory; reserved for v1.7 explicit naming)')
+    .option('--token <pat>', 'Authenticate with a personal access token instead of the browser device flow (required for remote non-https servers where Google SSO cannot complete). The PAT is validated against the server and stored in the credentials file.')
     .option('--no-browser', 'Skip auto-opening the verification URL in a browser')
     .option('--server <url>', 'Override API_BASE_URL for this invocation (stored in credentials file)')
     .action(async (opts) => {
@@ -213,6 +288,30 @@ export const loginCommand = new Command('login')
         process.exitCode = 1;
         return;
     }
+    // `--token` may bind to EITHER the login command (when written as
+    // `tasks login --token <pat>`) or the root program's Bearer-auth flag (when
+    // written as `tasks --token <pat> login`). Accept both so the manual-PAT
+    // login path works regardless of where Commander attached it.
+    const token = typeof opts.token === 'string' && opts.token.length > 0
+        ? opts.token
+        : globalOpts['token'];
+    const hasToken = typeof token === 'string' && token.length > 0;
+    // 2. Choose the login path (task #857):
+    //   - manual-PAT when the user supplied a PAT, OR when browser SSO can't
+    //     complete against this server (plain-http non-localhost — Google
+    //     rejects the non-https OAuth redirect, so the device flow dead-ends).
+    //   - device flow otherwise (the default for https / localhost servers).
+    if (hasToken || !canUseBrowserSso(baseUrl)) {
+        const result = await runManualPatLogin({
+            baseUrl,
+            ...(token !== undefined && { token }),
+            isJson,
+        });
+        if (!result.ok) {
+            process.exitCode = 1;
+        }
+        return;
+    }
     const clientId = process.env['OIDC_CLIENT_ID'] ?? 'wft-cli';
     const hostname = os.hostname();
     // Delegate to the shared device-login core. Commander generates

package/dist/cli/commands/setup.d.ts

@@ -2,6 +2,8 @@ import { Command } from 'commander';
 import { type ClaudeMcpServerEntry } from '../../setup/claude-json.js';
 import { type PromptIO } from '../util/prompt.js';
 import { runDeviceLogin } from './login.js';
+import { canUseBrowserSso, browserSsoGuidance, persistManualPat, type ManualPatIdentity, type ManualPatPersist, type ManualPatPersistResult } from '../auth/manual-pat.js';
+export { canUseBrowserSso, browserSsoGuidance, persistManualPat, type ManualPatIdentity, type ManualPatPersist, type ManualPatPersistResult, };
 /**
  * Resolve the local MCP server entry point. Prefer the built
  * `dist/mcp/index.js` under the package root (deterministic for published
@@ -37,28 +39,6 @@ export declare function resolveRemoteMcpEntryPoint(): string;
 export declare function buildRemoteMcpEntry(apiUrl: string): ClaudeMcpServerEntry;
 /** Default destination for copied skills. */
 export declare function commandsDestDir(home?: string): string;
-/**
- * Absolute path of the cached PAT file under the OS CONFIG dir (task #738).
- *
- * The PAT is operator configuration — NOT persistent application state — so it
- * lives under `configDir` (env-paths, OS-correct), NEVER the data dir where the
- * SQLite DB lives. `configDir` is injectable so tests can sandbox it into a
- * temp directory.
- */
-export declare function patCachePath(configDir?: string): string;
-export interface CachePatResult {
-    /** Absolute path the PAT was written to. */
-    path: string;
-    /** True when the file content changed this run (idempotency signal). */
-    changed: boolean;
-}
-/**
- * Cache the remote PAT to a file under the CONFIG dir, idempotently. On POSIX
- * the file is created/tightened to 0600 (owner read/write only) so the secret
- * is not world-readable; on Windows the mode arg is a best-effort no-op (NTFS
- * ACLs already restrict the per-user config dir).
- */
-export declare function cachePat(token: string, configDir?: string): CachePatResult;
 export interface CopySkillsResult {
     sourceDir: string;
     destDir: string;
@@ -219,17 +199,20 @@ export interface RunSetupOptions {
     npmRunner?: (cmd: string, args: string[]) => void;
     log?: (line: string) => void;
     /**
-     * Remote REST API base URL (task #738). When set, the REMOTE bridge entry
-     * (`wood-fired-tasks-remote`) is written instead of the local one, carrying
-     * `WFT_API_URL` / `WFT_API_KEY`.
+     * Remote REST API base URL (task #738). Routes `tasks setup` to the remote
+     * onboarding path (probe → device-flow / manual-PAT) via
+     * {@link runSetupInteractive}; the URL-only `wood-fired-tasks-remote` bridge
+     * entry is written by {@link writeRemoteMcpEntryOnly}. NOT consumed by
+     * {@link runSetup}, which is the LOCAL install only.
      */
     remote?: string;
-    /** Remote PAT (task #738). Cached under the CONFIG dir; never the data dir. */
-    token?: string;
     /**
-     * Override the OS CONFIG dir (testing). Defaults to the real `configDir`.
-     * Only the PAT cache is directed here — skills/claude.json follow `home`.
+     * Remote PAT (`--token <pat>`). Validated against `GET /api/v1/me` and
+     * persisted to the credentials file via {@link persistManualPat} (#858); it is
+     * NEVER written into claude.json. NOT consumed by {@link runSetup}.
      */
+    token?: string;
+    /** Override the OS CONFIG dir (testing). Reserved for callers that need it. */
     configDir?: string;
 }
 export interface RunSetupResult {
@@ -242,24 +225,27 @@ export interface RunSetupResult {
     skills: CopySkillsResult;
     agents: CopyAgentsResult;
     npmPrefix?: FixNpmPrefixResult;
-    /** Set when a PAT was cached (i.e. `remote` + `token` provided). */
-    patCache?: CachePatResult;
 }
 /**
- * Pure-ish setup action. Resolves all paths from `home` so tests can sandbox
- * with a temp HOME and never touch the real ~/.claude.json or ~/.claude/.
+ * Pure-ish LOCAL setup action. Resolves all paths from `home` so tests can
+ * sandbox with a temp HOME and never touch the real ~/.claude.json or ~/.claude/.
+ *
+ * Remote onboarding is NOT handled here — it requires an async server round-trip
+ * to validate + persist a credential (#858). {@link runSetupInteractive} routes
+ * `--remote` to {@link runRemoteOnboarding} / the manual-PAT path, which write
+ * the URL-only bridge entry via {@link writeRemoteMcpEntryOnly}.
  */
 export declare function runSetup(options?: RunSetupOptions): RunSetupResult;
 /**
  * Write ONLY the URL-only remote MCP bridge entry into ~/.claude.json (and copy
  * skills/agents), WITHOUT requiring or caching a PAT (task #808).
  *
- * This is the device-flow counterpart to {@link runSetup}'s remote branch:
- * after {@link runDeviceLogin} (#806) has self-provisioned the PAT and persisted
- * it via the credentials writer, there is no token to embed or double-cache —
+ * This is the shared remote-entry writer for BOTH onboarding paths: after
+ * {@link runDeviceLogin} (#806) or the manual-PAT path has provisioned the PAT
+ * and persisted it via the credentials writer, there is no token to embed —
  * the claude.json entry must be URL-only (#810). So this helper mirrors
- * runSetup's claude.json/skills/agents work but deliberately OMITS the
- * `--token`-required guard and the `cachePat` step.
+ * runSetup's claude.json/skills/agents work but writes the REMOTE bridge entry
+ * and persists NO token of its own (the credentials file is the sole owner).
  *
  * The written entry is exactly `buildRemoteMcpEntry(apiUrl)`: a stdio bridge
  * carrying only `WFT_API_URL`. The bridge resolves its bearer token at runtime
@@ -334,66 +320,6 @@ export declare function probeOidcState(baseUrl: string): Promise<OidcProbeResult
  *  - probe failure → manual-PAT (connectivity escape hatch).
  */
 export declare function selectRemoteOnboardingMethod(probe: OidcProbeResult): RemoteOnboardingMethod;
-/**
- * Whether the browser/device login (Google SSO) can actually COMPLETE against
- * `baseUrl` (#835).
- *
- * The whole OIDC dance — the verification page AND the IdP's OAuth callback —
- * happens at the server's origin, and identity providers (Google especially)
- * reject non-`https` OAuth redirect URIs *except* for `localhost`/`127.0.0.1`.
- * So a server reached over plain `http` at a non-localhost address can report
- * `oidc: 'ready'` yet still be unable to finish browser login: the user's
- * browser gets bounced to an `http://…/auth/callback` the IdP won't honor. We
- * detect that up front so the interview can tell the user the truth (need https,
- * or use a PAT) instead of opening a URL that dead-ends.
- *
- * Returns true for any `https` URL and for `http://localhost` / `127.0.0.1` /
- * `[::1]`; false for plain-http non-loopback hosts and unparseable input.
- */
-export declare function canUseBrowserSso(baseUrl: string): boolean;
-/**
- * The minimal identity envelope `GET /api/v1/me` returns (task #809). Mirrors
- * the fields {@link writeCredentials} needs so a manually-pasted PAT lands in
- * the SAME credentials file the device flow writes — the bridge then resolves
- * its bearer token from there at runtime (URL-only claude.json entry, #810).
- */
-export interface ManualPatIdentity {
-    id: number;
-    displayName: string;
-    email: string | null;
-    /** Best-effort token rowid; defaults to 1 when the server omits it. */
-    tokenId?: number;
-}
-/**
- * Outcome of persisting a manually-supplied PAT (task #809).
- *  - `{ ok: true, identity }`  — the PAT validated and credentials were written.
- *  - `{ ok: false, reason }`   — the PAT was rejected / unreachable; `reason`
- *    is surfaced to the user and NOTHING is persisted.
- */
-export type ManualPatPersistResult = {
-    ok: true;
-    identity: ManualPatIdentity;
-} | {
-    ok: false;
-    reason: string;
-};
-/** Injectable manual-PAT persistence seam so tests drive it without a server. */
-export type ManualPatPersist = (baseUrl: string, token: string) => Promise<ManualPatPersistResult>;
-/**
- * Default manual-PAT persistence (task #809).
- *
- * Validate the pasted PAT against `GET <baseUrl>/api/v1/me` (the same identity
- * envelope `tasks whoami` reads), then persist it through {@link writeCredentials}
- * — the SAME credentials writer {@link runDeviceLogin} uses. This is the only
- * place the manual PAT lands; the claude.json entry stays URL-only (#810) and
- * the bridge resolves the bearer token from this credentials file at runtime,
- * so the secret is never embedded in claude.json.
- *
- * A non-2xx / network failure returns `{ ok: false, reason }` and writes
- * NOTHING — the caller reports the reason and exits without a half-configured
- * install.
- */
-export declare function persistManualPat(baseUrl: string, token: string): Promise<ManualPatPersistResult>;
 export interface RunSetupInteractiveOptions extends RunSetupOptions {
     /**
      * Injectable OIDC-state probe for the `--remote` path (#807). Defaults to