feat: add guided profile readiness checks

[mohanagy]

Summary

This is the first-success/readiness slice of #204; it does not close the parent onboarding issue.

• adds one shared, explicit provider-declared read-only check to miftah setup and Miftah Console
• trusts the Google Search Console check only when the effective launch shape remains inside the reviewed adapter envelope
• evaluates audit and policy before resolving secrets, plugins, OAuth runtime, or the upstream process; readiness resolution is scoped to the selected profile/upstream
• carries Console disconnect cancellation through plugin, secret, runtime, and upstream-process boundaries while retaining process containment
• makes Console configuration ownership truthful (provider-adapter, native OAuth, or manual-only) and clears stale readiness UI when a configuration is deselected
• documents the opt-in check and adds end-to-end CLI/Console/security/cancellation regression coverage

Validation

• npm test — 1,370 passed, 23 skipped
• npm run test:core — 408 passed, 21 skipped
• npm run test:coverage — 1,370 passed, 23 skipped; thresholds met
• npm run lint
• npm run typecheck
• npm run build
• npm run smoke:cli
• npm run check:pack
• npm run test:package
• git diff --check

Partially addresses #204.

Summary by CodeRabbit

• New Features

  • Added optional readiness verification to Google Search Console setup, with checks available for each configured profile.
  • Added a Console action to run reviewed, read-only profile checks and display bounded results.
  • Added cancellation handling when a Console session disconnects.

• Bug Fixes

  • Setup verification now reports incomplete results correctly and preserves written configuration.
  • Unsafe or customized configurations fail closed without starting provider processes.

• Documentation

  • Updated CLI, Console API, README, and provider guidance for the new verification workflow.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR adds opt-in profile readiness checks for Google Search Console through CLI setup and the local Console. It introduces reviewed adapter matching, safe read-only probing, audit and policy gates, identity reporting, cancellation propagation, bounded results, and related tests and documentation.

Changes

Profile readiness onboarding

Layer / File(s)	Summary
Adapter and command contracts src/config/provider-adapters.ts, src/cli/parse.ts, src/policy/*	Provider adapters declare reviewed execution envelopes and safe probes; CLI parsing and risk classification recognize readiness checks.
Readiness execution and cancellation src/setup/profile-readiness.ts, src/runtime/*, src/secrets/*, src/plugins/*, src/upstream/*	Selected targets are audited, policy-checked, schema-validated, identity-checked, and probed with cancellation propagated through runtime and provider startup.
CLI setup verification src/cli/init.ts, src/cli/setup.ts, src/cli/main.ts, tests/setup-command.test.ts	setup --verify runs checks per profile, interactive setup can prompt for checks, and incomplete verification returns exit code 1 while retaining configuration.
Console readiness controls src/console/*, tests/console-*.test.ts	The Console exposes target metadata, a CSRF-protected cancellable endpoint, audit records, selectors, and bounded readiness results.
Validation and documentation tests/setup-profile-readiness.test.ts, tests/runtime-config-resolution.test.ts, README.md, docs/*, CHANGELOG.md	Fixtures and contract tests cover safe probing, policy, identity, cancellation, adapter matching, and documented CLI/API behavior.

Estimated code review effort: 4 (Complex) | ~60 minutes

Possibly related issues

• [Onboarding] Build a shared CLI and Console MCP setup wizard #204 — This PR implements the issue’s guided multi-account setup and provider-adapter readiness objectives.

Possibly related PRs

• mohanagy/miftah#183 — Provides the Console control API extended here with profile readiness.
• mohanagy/miftah#184 — Introduces the provider-adapter infrastructure extended with execution-envelope and safe-probe matching.
• mohanagy/miftah#62 — Introduces typed secret-provider APIs extended here with AbortSignal cancellation.

Poem

A rabbit checks one profile bright,
With audit gates before the flight.
Safe probes hop, then reports appear,
While canceled paths leave config clear.
OAuth burrows stay apart—
A tidy setup, a careful start.

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	❌ Error	Docstring coverage is 3.54% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check	⚠️ Warning	The description covers summary and validation, but it omits the required Security impact section from the template.	Add a Security impact section covering credential handling, routing, policy, redaction, audit data, subprocesses, dependencies, and failure behavior.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the main change: guided profile readiness checks.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/204-setup-verification

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/setup/profile-readiness.ts`:
- Around line 267-276: Update the unsupported path around configuredAuditTrail
so audit.ensureWritable() runs before audit.beginOperation, matching the main
readiness flow. Wrap or normalize ensureWritable failures through the existing
safeReadinessError mechanism, then begin and finish the provider-adapter scope
only after writability succeeds, preserving the blocked status and
PROFILE_READINESS_UNSUPPORTED error code.
- Around line 182-183: Remove the redundant consecutive
throwIfAborted(target.signal) call in the surrounding setup flow, retaining a
single cancellation check; only add a different guard if the code clearly
requires a distinct condition.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 80cdb6df-b0dc-4d6e-816c-69d95472af2c

📥 Commits

Reviewing files that changed from the base of the PR and between 45d06e8 and 1020636.

📒 Files selected for processing (43)

• CHANGELOG.md
• README.md
• docs/cli.md
• docs/console-api.md
• docs/provider-adapters.md
• src/audit/audit-types.ts
• src/cli/init.ts
• src/cli/main.ts
• src/cli/parse.ts
• src/cli/setup.ts
• src/config/provider-adapters.ts
• src/console/console-application-service.ts
• src/console/console-assets.ts
• src/console/console-config-metadata.ts
• src/console/console-dashboard-application-service.ts
• src/console/console-server.ts
• src/plugins/plugin-registry.ts
• src/policy/policy-types.ts
• src/policy/risk-classifier.ts
• src/runtime/create-runtime.ts
• src/runtime/resolve-runtime-config.ts
• src/secrets/external-secret-providers.ts
• src/secrets/secret-process-runner.ts
• src/secrets/secret-provider.ts
• src/secrets/secret-resolver.ts
• src/setup/profile-readiness.ts
• src/upstream/upstream-process-manager.ts
• tests/cli-parse.test.ts
• tests/console-application-service.test.ts
• tests/console-config-metadata.test.ts
• tests/console-server.test.ts
• tests/fixtures/fake-upstream-bundled.mjs
• tests/fixtures/fake-upstream-runtime.mjs
• tests/oauth-console-threat-model-docs-contract.test.ts
• tests/plugin-api.test.ts
• tests/preset-docs-contract.test.ts
• tests/provider-adapter-contract.test.ts
• tests/readme-product-contract.test.ts
• tests/runtime-config-resolution.test.ts
• tests/secret-providers.test.ts
• tests/setup-command.test.ts
• tests/setup-profile-readiness.test.ts
• tests/upstream-manager.test.ts

Dismissed under the documented rate-limit exception: CodeRabbit reviewed 1020636 and raised two findings; both were fixed in 1786cc6 with a focused regression, and both review threads are resolved. Current-head CI is green across Linux, macOS, and Windows. The current-head CodeRabbit status reports Review rate limited. A narrow local Claude fallback exited with an execution error and produced no review result; it is not being treated as approval.