fix(auth): structural gate covers no-pre-selection case (env-picker hang follow-up)

[kelsonpw]

Summary

When git reset --hard wipes <installDir>/.amplitude/ and PR #778's loadCheckpoint invalidates the per-user checkpoint, the session reaches Auth with selectedOrgId === null AND selectedProjectId === null — resolveCredentials does NOT set those in the multi-env defer branch.

PR #775's structural gate (needsEnvPickStillRequired) short-circuited to false in that case, leaving only pendingEnvSelection as a gate. The recurring "stuck on Setup with no env-picker" bug class then reproduces if anything clobbers that flag — exactly the symptom users keep reporting (✓ Welcome ─ ✓ Auth ─ ● Setup ←, no env picker rendered, TUI stuck).

This commit extends the structural gate with a fallback path that mirrors resolveCredentials' own "first project of first org" heuristic (credential-resolution.ts ~line 483). When no specific selection has been made, the gate consults pendingOrgs[0].projects[0] — the exact (org, project) tuple resolveCredentials walked when it issued the deferral. Once the user picks an org/project via AuthScreen, the existing specific-IDs guard takes over.

Why this is the right layer

Prior PRs in this bug class:

• fix(auth): clear credentials on needs_user_choice/environment_selection #747 cleared credentials/env-name/app-id on the deferral signal
• fix(auth): block flow forward-walk while env selection is pending #760 added pendingEnvSelection flag + gated post-Auth show: predicates on !s.pendingEnvSelection
• fix(tui): patch nanostores map.setKey to mutate $session in place #762 patched nanostores setKey to mutate in-place
• fix(auth): structural fallback gate for env-picker so Auth blocks even when pendingEnvSelection gets clobbered #775 added a structural defense-in-depth gate so Auth.isComplete blocks even when pendingEnvSelection gets clobbered

#778 (the most recent fix) is doing its job — invalidating the stale checkpoint. But it surfaces a case PR #775's gate didn't cover: when no IDs are pre-selected. This commit plugs that gap precisely.

Files changed

• src/ui/tui/flows.ts — needsEnvPickStillRequired adds the IDs-null fallback to pendingOrgs[0].projects[0]
• src/ui/tui/__tests__/flow-invariants.test.ts — adds smoking-gun regression test (fails without the fix), counter-test (manual-API-key carve-out), wider restart-after-reset router-resolve test
• src/ui/tui/screens/__tests__/AuthScreen.snap.test.tsx — pins env picker rendering when pendingEnvSelection: true

Test plan

• pnpm tsc --noEmit clean
• pnpm lint clean
• pnpm test — all 4258 tests pass (after one flaky unrelated re-run on agent-interface MCP auth refresh test)
• New regression test structural gate alone holds Auth in restart-after-reset fails without the flows.ts change (verified via stash + re-test)
• wizard-abort.ts untouched
• No changes to other env-picker logic — minimal-surface fix

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes the Auth completion gating logic in the TUI wizard, which can affect routing between major setup steps; however it’s a targeted fallback with added regression tests covering the affected restart scenarios.

Overview
Prevents the wizard from advancing past Auth (into Setup/post-auth screens) when multi-environment selection is still required but selectedOrgId/selectedProjectId are null (e.g. after checkpoint invalidation on restart).

Updates needsEnvPickStillRequired to fall back to the same pendingOrgs[0].projects[0] target used by credential resolution, and adds regression/counter tests plus an AuthScreen snapshot to pin env-picker rendering and correct router parking behavior.

^{Reviewed by Cursor Bugbot for commit 5dccb96. Bugbot is set up for automated code reviews on this repo. Configure here.}