feat(setup): guide remote browser sign-in

[mohanagy]

Summary

• add a remote sign-in choice to bare interactive setup and delegate it to the existing endpoint-first native OAuth planner
• add a Console entry point that takes users to the existing native OAuth onboarding form
• document the browser sign-in path while keeping generic remote setup non-discovering and no-auth or API-key oriented

Security boundary

• discovery completes before any configuration write
• this path does not open a browser, register a client, or create credentials
• generic remote setup still does not call the upstream or infer OAuth

Validation

• npm test
• npm run test:core
• npm run test:coverage
• npm run lint
• npm run typecheck
• npm run build
• npm run smoke:cli
• npm run check:pack
• npm run test:package

Part of #204.

Summary by CodeRabbit

• New Features

  • Added a remote sign-in option to guided setup for browser-based authentication.
  • Added clearer console onboarding for setting up remote MCP connections with browser sign-in.
  • Remote sign-in now performs endpoint and OAuth discovery before creating configuration.

• Documentation

  • Updated setup guidance to clarify the differences between new, remote sign-in, import, local, and scripted OAuth setup paths.
  • Clarified when remote connections contact upstream services and when OAuth discovery occurs.

• Tests

  • Added coverage for the new guided setup flow and console onboarding experience.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 22 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ada0d7e1-8ad9-4945-905f-4ec9688ced19

📥 Commits

Reviewing files that changed from the base of the PR and between dfbee84 and 3438636.

📒 Files selected for processing (2)

• tests/helpers/fake-remote-upstream.ts
• tests/setup-command.test.ts

📝 Walkthrough

Walkthrough

Guided setup now offers a remote sign-in starting point that invokes native OAuth setup. Console onboarding adds a browser sign-in entry point, while README, preset documentation, and tests describe and validate the updated setup paths.

Changes

Remote sign-in onboarding

Layer / File(s)	Summary
Guided CLI remote sign-in flow src/cli/setup.ts, tests/setup-command.test.ts	The setup prompt accepts remote sign-in, routes it to native OAuth setup, and updates interactive-flow coverage and validation messages.
Console browser sign-in onboarding src/console/console-assets.ts, tests/console-server.test.ts	The console adds a browser sign-in link, revised onboarding text and actions, and assertions for the generated HTML and script.
Setup guidance and README contracts README.md, docs/presets-and-clients.md, tests/readme-product-contract.test.ts	Documentation and product contract tests describe the new, remote sign-in, and import paths and their OAuth behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant GuidedSetup
  participant NativeOAuth
  participant Config
  User->>GuidedSetup: Choose remote sign-in
  GuidedSetup->>NativeOAuth: Start OAuth discovery
  NativeOAuth->>Config: Write discovered configuration

Loading

Possibly related PRs

• mohanagy/miftah#191: Adds the console and native OAuth onboarding paths extended by this PR.
• mohanagy/miftah#220: Implements the native OAuth discovery flow used by the new setup entry point.
• mohanagy/miftah#252: Also changes the guided setup starting-point orchestration in src/cli/setup.ts.

Poem

A rabbit hops to sign in bright,
Browser trails through OAuth light.
“Remote MCP,” the buttons say,
Config blooms before the day.
Three paths guide each careful hare.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: guiding remote browser sign-in in setup.
Description check	✅ Passed	The description covers Summary, security considerations, and validation commands, with only minor template gaps in exact headings and results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/204-guided-browser-signin

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/setup-command.test.ts`:
- Around line 407-447: Extend the test around runSetupCommand to assert that the
generated config contains the expected native OAuth binding, using the validated
config object and existing OAuth-related symbols. Also assert the upstream probe
recorded no registration, authorization, or token-exchange requests, while
preserving the existing metadata and discovery assertions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3a10d88b-5bed-4323-921e-be5a94b4a033

📥 Commits

Reviewing files that changed from the base of the PR and between 4623a91 and dfbee84.

📒 Files selected for processing (7)

• README.md
• docs/presets-and-clients.md
• src/cli/setup.ts
• src/console/console-assets.ts
• tests/console-server.test.ts
• tests/readme-product-contract.test.ts
• tests/setup-command.test.ts