fix: drop ungrantable introspection scope from OAuth authorize URL

README.md

@@ -136,7 +136,6 @@ When creating your personal API key, ensure it has the following scopes enabled:
 
 - `user:read` - Required to fetch user information
 - `project:read` - Required to fetch project details and API token
-- `introspection` - Required for API introspection
 - `llm_gateway:read` - Required for LLM gateway access
 - `dashboard:write` - Required to create dashboards
 - `insight:write` - Required to create insights

bin.ts

@@ -5,7 +5,7 @@
 import { hideBin } from 'yargs/helpers';
 import { VERSION } from '@lib/version';
 
 const WIZARD_VERSION = VERSION;
 
 const NODE_VERSION_RANGE = '>=18.17.0';
 
@@ -22,10 +22,7 @@
 import { isNonInteractiveEnvironment } from '@utils/environment';
 import { getUI, setUI } from '@ui';
 import { LoggingUI } from '@ui/logging-ui';
-import {
-  getSubcommandPrograms,
-  Program,
-} from '@lib/programs/program-registry';
+import { getSubcommandPrograms, Program } from '@lib/programs/program-registry';
 import type { ProgramConfig } from '@lib/programs/program-step';
 import type { WizardSession } from '@lib/wizard-session';
 import { POSTHOG_DOCS_URL } from '@lib/constants';
@@ -364,7 +361,7 @@
           const { startPlayground } = await import(
             '@ui/tui/playground/start-playground'
           );
           (startPlayground as (version: string) => void)(WIZARD_VERSION);
         })();
       } else if (options.skill) {
         // Run a specific skill by ID
@@ -431,19 +428,15 @@
             .map((s) => s.trim())
             .filter(Boolean);
           void (async () => {
-            const { readApiKeyFromEnv } = await import(
-              '@utils/env-api-key'
-            );
+            const { readApiKeyFromEnv } = await import('@utils/env-api-key');
             const apiKey =
               (options.apiKey as string | undefined) || readApiKeyFromEnv();
 
             try {
               const { startTUI } = await import('@ui/tui/start-tui');
-              const { buildSession } = await import(
-                '@lib/wizard-session'
-              );
+              const { buildSession } = await import('@lib/wizard-session');
 
               const tui = startTUI(WIZARD_VERSION, Program.McpAdd);
               const session = buildSession({
                 debug: options.debug,
                 localMcp: options.local,
@@ -484,11 +477,9 @@
           void (async () => {
             try {
               const { startTUI } = await import('@ui/tui/start-tui');
-              const { buildSession } = await import(
-                '@lib/wizard-session'
-              );
+              const { buildSession } = await import('@lib/wizard-session');
 
               const tui = startTUI(WIZARD_VERSION, Program.McpRemove);
               const session = buildSession({
                 debug: options.debug,
                 localMcp: options.local,
@@ -557,9 +548,7 @@
 
     void (async () => {
       try {
-        const { provisionNewAccount } = await import(
-          '@utils/provisioning'
-        );
+        const { provisionNewAccount } = await import('@utils/provisioning');
         if (!jsonMode) {
           getUI().log.info(`Provisioning account for ${email} in ${region}...`);
         }
@@ -598,7 +587,7 @@
 // ── Skill-based program subcommands (derived from registry) ─────────
 for (const programConfig of getSubcommandPrograms()) {
   cli.command(
     programConfig.command!,
     programConfig.description,
     (y) =>
       y.options({
@@ -649,7 +638,7 @@
       );
       const { analytics } = await import('@utils/analytics');
 
       const tui = startTUI(WIZARD_VERSION, config.id as any);
 
       const session = buildSession({
         debug: options.debug as boolean | undefined,
@@ -662,7 +651,7 @@
         projectId: options.projectId as string | undefined,
         email: options.email as string | undefined,
         menu: options.menu as boolean | undefined,
         integration: options.integration as any,
         benchmark: options.benchmark as boolean | undefined,
         yaraReport: options.yaraReport as boolean | undefined,
       });
@@ -690,9 +679,7 @@
       const skipAgent = config.run == null;
 
       if (skipAgent) {
-        const { getOrAskForProjectData } = await import(
-          '@utils/setup-utils'
-        );
+        const { getOrAskForProjectData } = await import('@utils/setup-utils');
         const { projectApiKey, host, accessToken, projectId } =
           await getOrAskForProjectData({
             signup: session.signup,
@@ -780,9 +767,7 @@
     const { configureLogFileFromEnvironment, logToFile } = await import(
       '@utils/debug'
     );
-    const { wizardAbort, WizardError } = await import(
-      '@utils/wizard-abort'
-    );
+    const { wizardAbort, WizardError } = await import('@utils/wizard-abort');
 
     configureLogFileFromEnvironment();
 

src/lib/constants.ts

@@ -118,14 +118,16 @@ export const WIZARD_PROVISIONING_SCOPES = [
 
 /**
  * Scopes the wizard requests during the OAuth login flow. Superset of
- * `WIZARD_PROVISIONING_SCOPES` with two scopes that only apply to the login
- * path and are not in the provisioning allowlist:
- * - introspection      lets the wizard introspect its own token
+ * `WIZARD_PROVISIONING_SCOPES` with one extra scope that only applies to the
+ * login path and is not in the provisioning allowlist:
  * - health_issue:read  used by `wizard doctor`
+ *
+ * Note: `introspection` is intentionally absent. Per RFC 7662 it is the token
+ * introspection endpoint, not a grantable scope, and the authorization server
+ * rejects it as `invalid_scope`. Introspection still works via the bearer token.
  */
 export const WIZARD_OAUTH_SCOPES = [
   ...WIZARD_PROVISIONING_SCOPES,
-  'introspection',
   'health_issue:read',
 ] as const;
 

src/ui/tui/components/LearnCard.tsx

@@ -13,7 +13,10 @@ import type { WizardStore } from '@ui/tui/store';
 import { ContentSequencer, TextRevealMode } from '@ui/tui/primitives/index';
 import type { ContentBlock } from '@ui/tui/primitives/index';
 import { useStdoutDimensions } from '@ui/tui/hooks/useStdoutDimensions';
-import { COLLAPSED_COUNT, EXPANDED_COUNT } from '@ui/tui/primitives/TabContainer';
+import {
+  COLLAPSED_COUNT,
+  EXPANDED_COUNT,
+} from '@ui/tui/primitives/TabContainer';
 
 /** Fixed chrome: ScreenContainer (3) + TabContainer tab bar (2) */
 const FIXED_CHROME = 5;

src/ui/tui/components/TipsCard.tsx

@@ -7,10 +7,7 @@
 import { Box, Text, useInput } from 'ink';
 import type { WizardStore } from '@ui/tui/store';
 import { Colors, Icons } from '@ui/tui/styles';
-import {
-  DiscoveredFeature,
-  AdditionalFeature,
-} from '@lib/wizard-session';
+import { DiscoveredFeature, AdditionalFeature } from '@lib/wizard-session';
 
 /** A discrete tip shown in the TipsCard during the agent run. */
 interface Tip {

src/ui/tui/screens/McpScreen.tsx

@@ -21,7 +21,10 @@ import {
   GroupedPickerMenu,
 } from '@ui/tui/primitives/index';
 import { Colors } from '@ui/tui/styles';
-import type { McpInstaller, McpClientInfo } from '@ui/tui/services/mcp-installer';
+import type {
+  McpInstaller,
+  McpClientInfo,
+} from '@ui/tui/services/mcp-installer';
 import {
   AVAILABLE_FEATURES,
   ALL_FEATURE_VALUES,
@@ -235,7 +238,9 @@ export const McpScreen = ({
               <>
                 <Text color="green" bold>
                   {'\u2714'} MCP server
-                  {!isRemove && pluginClients.length > 0 ? ' and plugin' : ''}{' '}
+                  {!isRemove && pluginClients.length > 0
+                    ? ' and plugin'
+                    : ''}{' '}
                   {isRemove ? 'removed from' : 'installed for'}:
                 </Text>
                 {resultClients.map((name, i) => (

src/ui/tui/screens/PostHogIntegrationIntroScreen.tsx

@@ -13,10 +13,7 @@ import { spawnSync } from 'node:child_process';
 import type { ReactNode } from 'react';
 import { useEffect, useState, useSyncExternalStore } from 'react';
 import type { WizardStore } from '@ui/tui/store';
-import {
-  Integration,
-  WIZARD_TOOLS_MENU_FLAG_KEY,
-} from '@lib/constants';
+import { Integration, WIZARD_TOOLS_MENU_FLAG_KEY } from '@lib/constants';
 import { PickerMenu, LoadingBox } from '@ui/tui/primitives/index';
 import { IntroScreenLayout, type DetectionRow } from './IntroScreenLayout.js';
 import { SkillSourceInfo, useSkillEntry } from './SkillSourceInfo.js';
@@ -60,14 +57,12 @@ const FrameworkPicker = ({
       options={options}
       onSelect={(value) => {
         const integration = Array.isArray(value) ? value[0] : value;
-        void import('@lib/registry').then(
-          ({ FRAMEWORK_REGISTRY }) => {
-            const config = FRAMEWORK_REGISTRY[integration];
-            store.setFrameworkConfig(integration, config);
-            store.setDetectedFramework(config.metadata.name);
-            onComplete?.();
-          },
-        );
+        void import('@lib/registry').then(({ FRAMEWORK_REGISTRY }) => {
+          const config = FRAMEWORK_REGISTRY[integration];
+          store.setFrameworkConfig(integration, config);
+          store.setDetectedFramework(config.metadata.name);
+          onComplete?.();
+        });
       }}
     />
   );

src/ui/tui/screens/audit-3000/Audit3000ChecksPanel.tsx

@@ -10,10 +10,7 @@
 
 import { Box, Text } from 'ink';
 import { Spinner } from '@inkjs/ui';
-import {
-  type AuditCheck,
-  type AuditStatus,
-} from '@lib/programs/audit/types';
+import { type AuditCheck, type AuditStatus } from '@lib/programs/audit/types';
 import { Colors, Icons } from '@ui/tui/styles';
 import { LoadingBox } from '@ui/tui/primitives/index';
 

src/ui/tui/screens/audit-3000/Audit3000IntroScreen.tsx

@@ -2,7 +2,10 @@ import { Box, Text } from 'ink';
 import { useEffect, useState, useSyncExternalStore } from 'react';
 import type { WizardStore } from '@ui/tui/store';
 import { IntroScreenLayout } from '@ui/tui/screens/IntroScreenLayout';
-import { SkillSourceInfo, useSkillEntry } from '@ui/tui/screens/SkillSourceInfo';
+import {
+  SkillSourceInfo,
+  useSkillEntry,
+} from '@ui/tui/screens/SkillSourceInfo';
 import { NEON_BLUE, NEON_GOLD, NEON_PINK } from './arcade-colors.js';
 
 const AUDIT3000_SKILL_ID = 'audit-3000';

src/ui/tui/screens/audit/AuditChecksViewer/Header.tsx

@@ -1,8 +1,5 @@
 import { Box, Text } from 'ink';
-import type {
-  AuditCheck,
-  AuditStatus,
-} from '@lib/programs/audit/types';
+import type { AuditCheck, AuditStatus } from '@lib/programs/audit/types';
 import type { ViewerLayout } from './layout.js';
 
 interface HeaderProps {

src/ui/tui/screens/audit/AuditIntroScreen.tsx

@@ -2,7 +2,10 @@ import { Box, Text } from 'ink';
 import { useState, useSyncExternalStore } from 'react';
 import type { WizardStore } from '@ui/tui/store';
 import { IntroScreenLayout } from '@ui/tui/screens/IntroScreenLayout';
-import { SkillSourceInfo, useSkillEntry } from '@ui/tui/screens/SkillSourceInfo';
+import {
+  SkillSourceInfo,
+  useSkillEntry,
+} from '@ui/tui/screens/SkillSourceInfo';
 
 interface AuditIntroScreenProps {
   store: WizardStore;