feat(setup): add outcome-first remote and local choices

[mohanagy]

Summary

Part of #204.

• lets guided setup accept outcome-first remote and local answers while retaining strict catalog validation
• maps remote to the existing HTTPS-only Streamable HTTP preset and local to the existing no-shell local STDIO preset
• makes the generic remote OAuth boundary explicit: it does not discover OAuth or call the upstream; standards-based OAuth remains miftah setup --native-oauth
• documents the first-use flow and locks the behavior with focused regression and README-contract coverage

Validation

• npm test (1,550 passed, 27 skipped)
• npm run test:core
• npm run test:coverage
• npm run lint
• npm run typecheck
• npm run build
• npm run smoke:cli
• npm run check:pack
• npm run test:package

Safety boundaries

• no new transport or configuration writer
• existing strict HTTPS/no-userinfo/no-query/no-fragment validation remains authoritative
• generic remote setup performs no OAuth discovery or upstream call
• local setup preserves literal argv and no-shell handling

Summary by CodeRabbit

• New Features

  • Guided setup now accepts remote and local choices, as well as connector names.
  • Remote setup creates strict Streamable HTTP configurations and supports optional secret-backed headers.
  • Added clearer guidance for using native OAuth with servers that advertise standards-based OAuth.
  • Setup now warns when remote configuration completes without OAuth discovery.

• Documentation

  • Updated setup guidance, interactive command documentation, and supported configuration paths.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ce09f423-902d-45bc-84ce-7f03784bf761

📥 Commits

Reviewing files that changed from the base of the PR and between 5a967a8 and 331ac9e.

📒 Files selected for processing (8)

• README.md
• docs/cli.md
• docs/presets-and-clients.md
• src/cli/init.ts
• src/cli/setup.ts
• tests/init-command.test.ts
• tests/readme-product-contract.test.ts
• tests/setup-command.test.ts

---

📝 Walkthrough

Walkthrough

Interactive setup now accepts remote, local, or connector names, maps remote/local to strict presets, avoids OAuth discovery for plain remote setup, and documents the corresponding --native-oauth path. Tests and product documentation were updated for the new prompts and behavior.

Changes

Guided setup and OAuth boundary

Layer / File(s)	Summary
Guided preset resolution src/cli/init.ts, tests/init-command.test.ts, tests/setup-command.test.ts	The interactive wizard accepts connector names, remote, or local; remote and local resolve to streamable-http and local-stdio, with updated scripted flows.
Remote setup OAuth boundary src/cli/setup.ts, tests/setup-command.test.ts	Remote streamable HTTP setup omits OAuth discovery and emits guidance to use --native-oauth when standards-based OAuth is advertised.
Documentation and contract validation README.md, docs/cli.md, docs/presets-and-clients.md, tests/readme-product-contract.test.ts	Documentation and README contract assertions describe source selection, strict preset routing, configuration handling, and remote OAuth behavior.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• mohanagy/miftah#59: Related interactive onboarding and strict preset mapping.
• mohanagy/miftah#90: Related enforcement and tests for the plain remote OAuth boundary.
• mohanagy/miftah#220: Related remote-versus-local setup and native OAuth onboarding behavior.

Poem

A bunny chose remote, then local in a row,
Strict presets hopped where guided answers go.
No OAuth carrots were fetched upstream,
Native OAuth waits for its proper room.
Docs and tests thump proudly: “All clear!”

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately highlights the main change: guided setup now accepts outcome-first remote and local choices.
Description check	✅ Passed	The description covers summary, validation, and safety boundaries, but it does not use the template's exact Security impact section or checklist format.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/204-remote-onboarding

---

_{Comment @coderabbitai help to get the list of available commands.}