feat(wizard): drop the login prompt from setup

[thecodedrift]

The setup wizard no longer asks "Log in to taskless.io now?". Setup needs no account: the free tier is local-only, and authoring and running sg and vale rules works without one.

The issue places the prompt in taskless init. On main, init is already batch-only with no auth step, so the prompt lives only in the interactive wizard reached by bare taskless in a TTY. That is where it is removed.

Changes

• Deletes the wizard's auth step (wizard/steps/auth.ts) and its call in runWizard. The wizard goes straight from tool selection to the install summary.
• Drops authPromptShown / authCompleted from WizardResult. Nothing read them and no telemetry event carried them, so no event changes shape. cli_run still reports loggedIn, resolved from the token.
• taskless auth login and every "run taskless auth login" remedy are unchanged. login-interactive.ts changes only in comments that named the wizard.
• New wizard test that runs with no token and asserts no confirm offers to log in. The existing tests all stub a token, so this path was untested. Checked by inserting a login confirm into the wizard: the test fails.

Spec

Single-PR OpenSpec change remove-wizard-login-prompt, archived here.

• Removed: "Wizard explains the auth tradeoff and offers to log in". Added: "Wizard does not offer to log in".
• "Shared interactive login routine" and "Wizard cancellation aborts without filesystem writes" each carried one auth-step scenario. A MODIFIED block cannot drop a scenario, so both are REMOVED + ADDED under new titles with every other scenario intact.
• Archive dry-run diff of cli-init scenarios: exactly the six auth-step scenarios are gone, the two new ones are present, and all others survive.

Changeset: patch (pre-1.0, removes a prompt).

Fixes #402

[thecodedrift]

@claude /review

[claude]

Claude finished @thecodedrift's task in 1m 44s —— View job

---

Review complete

Review mode: incremental — read 0 prior review thread(s) before reviewing. .prior-review.json contains only the triggering @claude /review comment itself — no prior reviews, no review threads, no other top-level comments. This is the first substantive review of this PR, so the whole diff was assessed fresh (nothing to classify as "already addressed" or "still open").

• Read .prior-review.json
• Gather PR diff and metadata (gh pr diff 405)
• Review changed files for correctness, security, performance, test adequacy, clarity
• Post findings

Assessment

This is a clean, well-scoped removal. I traced every deleted symbol to confirm nothing is left dangling:

• promptAuth / wizard/steps/auth.ts: no remaining references anywhere in packages/cli outside the deleted file and the (now-historical) archived OpenSpec docs for the original wizard change — confirmed via a repo-wide grep.
• authPromptShown / authCompleted: verified these never appeared in any currently emitted telemetry event. The only place they're mentioned is the archived cli_init_completed/cli_init_cancelled event spec from the original 2026-05-10 wizard change, which itself was superseded by the simpler cli_installed event (wizard/index.ts:118, commands/init.ts:158) before this PR — so the PR's claim that "no telemetry event carried them" checks out against current code, not just the PR's own description.
• loggedIn in the cli_run event is resolved independently via resolveRunIdentity() in index.ts/telemetry.ts, entirely decoupled from the wizard — unaffected by this change, as described.
• The OpenSpec delta correctly uses REMOVED + ADDED (not MODIFIED) for the two requirements that lose only one scenario each ("Shared interactive login routine" → "A single interactive login routine serves auth login", "Wizard cancellation aborts without filesystem writes" → "Cancelling the wizard writes nothing") — this is exactly the pattern the repo's CLAUDE.md calls out as necessary, since a MODIFIED block would silently delete the untouched scenarios. I diffed old vs. new text for both and every other scenario is carried over verbatim.
• The new regression test (wizard-integration.test.ts, "completes without a token and never offers to log in") asserts against the actual confirm() mock call messages rather than a weaker signal, so it would genuinely fail if a login confirm were reintroduced.

One minor, non-blocking nit ([New]): packages/cli/test/wizard-steps.test.ts:26-30 still uses the string "auth" as the step name passed to ask() in the "thrown error carries the step name" test. Since wizard/steps/auth.ts is now deleted, that step name no longer corresponds to any real wizard step — it still exercises ask()'s generic behavior correctly (nothing is broken), but a reader could be misled into thinking an "auth" step still exists. Consider renaming it to a neutral placeholder (e.g. "example-step") to avoid the stale implication.

No correctness, security, or test-adequacy issues found otherwise.

[thecodedrift]

Re: @claude — "Review complete … One minor, non-blocking nit: packages/cli/test/wizard-steps.test.ts:26-30 still uses the string "auth"…"
#405 (comment)

Renamed in 1f9a7d4, to "summary" rather than a placeholder so the test still passes a step name the wizard actually runs.

— AI Coding Agent