feat(setup): add safe environment account profiles

[mohanagy]

Part of #204

Summary

• add a guided CLI and local Console path for another named account in a deliberately narrow, existing local STDIO environment-credential configuration
• save only a distinct environment-variable reference; never accept, read, store, log, or return a credential value
• preserve guarded config replacement, fail-closed audit intent/finalization, and rollback when final audit recording fails
• update CLI, Console API, README, CLI docs, and contract coverage

Safety boundary

This flow refuses remote HTTP/SSE transports, native OAuth configurations, reviewed provider adapters, named/multiple upstreams, arbitrary profile overrides, repeated credential references, and any input that is not a simple local TARGET: "${SOURCE}" binding. It does not launch the upstream or perform a generic readiness call.

Validation

• focused onboarding, CLI, Console, documentation, and exit-code tests: 161 passed, 1 platform skip
• npm test: 1,601 passed, 27 platform skips
• npm run test:core: 415 passed, 22 platform skips
• npm run lint
• npm run typecheck
• npm run build
• npm run smoke:cli
• npm run check:pack
• npm run test:package: 24 passed

npm run test:coverage has an existing timing-sensitive full-suite failure tracked in #122. The exact cases pass under coverage in isolation, and the exact current development base independently fails full coverage in a different timing-sensitive integration test. No timeout, test, coverage, or runtime behavior was relaxed.

Summary by CodeRabbit

• New Features

  • Added guided onboarding for additional local, environment-backed account profiles through the CLI and local Console.
  • Profiles can reference separate credential environment variables without exposing secret values.
  • Added optional durable-default selection and clear validation for supported configurations.

• Bug Fixes

  • Unsupported or unsafe configurations are now rejected safely, including remote HTTP setups and invalid credential inputs.
  • Added fail-closed behavior with configuration recovery if finalization fails.

• Documentation

  • Updated CLI, Console API, README, and changelog documentation with workflow requirements and limitations.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds guarded environment-backed account profile onboarding for compatible local stdio configurations through CLI and Console flows, with validation, audit-backed atomic writes, fail-closed recovery, API/UI wiring, error mappings, tests, and documentation.

Changes

Environment-backed profile onboarding

Layer / File(s)	Summary
Guarded profile mutation src/setup/environment-profile-onboarding.ts, src/utils/errors.ts, tests/environment-profile-onboarding.test.ts	Validates compatible configurations, creates isolated environment-backed profiles, prevents reused bindings, records audit events, and restores original configuration bytes when final audit recording fails.
CLI account-addition flow src/cli/setup.ts, src/cli/setup-environment-profile.ts, src/cli/parse.ts, src/cli/exit-codes.ts, tests/cli-*.test.ts, tests/setup-command.test.ts	Classifies provider versus environment-backed additions, collects required inputs, rejects incompatible flags, skips verification for environment-backed profiles, and maps new errors to configuration exit codes.
Console account-addition flow src/console/console-application-service.ts, src/console/console-dashboard-application-service.ts, src/console/console-config-metadata.ts, src/console/console-server.ts, src/console/console-assets.ts, tests/console-*.test.ts	Adds authentication metadata, dashboard and application-service wiring, a CSRF-protected API endpoint, and a Console editor for environment-backed profile creation.
Product and API contract updates README.md, docs/cli.md, docs/console-api.md, CHANGELOG.md, tests/readme-product-contract.test.ts	Documents supported boundaries, refusal cases, input semantics, verification rules, and the equivalent local dashboard workflow.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related issues

• Issue 204 — Directly covers the shared CLI/Console environment-backed multi-account onboarding flow implemented here.

Possibly related PRs

• mohanagy/miftah#58 — Establishes the CLI error-code mapping extended by this change.
• mohanagy/miftah#183 — Introduces the local Console control-plane API extended with environment-profile management.
• mohanagy/miftah#213 — Overlaps with the setup command’s verification handling and its rejection for environment-backed additions.

Sequence Diagram(s)

sequenceDiagram
  participant Operator
  participant MiftahCLI
  participant EnvironmentProfileOnboarding
  participant ConfigFile
  Operator->>MiftahCLI: setup --add-profile --credential-env
  MiftahCLI->>EnvironmentProfileOnboarding: runEnvironmentProfileAddition
  EnvironmentProfileOnboarding->>ConfigFile: validate and write profile
  ConfigFile-->>EnvironmentProfileOnboarding: guarded write report
  EnvironmentProfileOnboarding-->>MiftahCLI: addition result
  MiftahCLI-->>Operator: success and verification not-applicable

Loading

Poem

A rabbit hops where new profiles grow,
With env-name strings, but secrets stay low.
The audit bells ring, the backups guard,
Unsafe paths meet a firm discard.
CLI and Console share the trail—
Safe little accounts in a carrot-bright tale.

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Docstring Coverage	❌ Error	Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: adding safe environment account profiles to setup.
Description check	✅ Passed	The description covers summary, security boundaries, and validation, with concrete test results and notes on the existing coverage issue.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/204-generic-safe-authoring

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/cli/setup-environment-profile.ts`:
- Around line 82-109: Update runEnvironmentProfileSetup’s prompt flow to handle
SIGINT and EOF reliably, ensuring each prompt settles and reaches the existing
cancelled CliUsageError path instead of hanging. Mirror the cancellation-race
handling used by confirmReadiness(), or pass an AbortSignal through the
line.question calls, while preserving normal answers and the finally cleanup.

In `@src/setup/environment-profile-onboarding.ts`:
- Around line 197-201: Update the security-setting mutation in the onboarding
flow to compare each existing value before forcing
requireProfileSwitchConfirmation and requireExplicitSelectionForDestructive to
true. When either value changes, add a corresponding entry to plan.actions so
the CLI/Console reports the mutation; avoid recording actions when the values
are already true.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 252962fe-8cf4-41b5-9244-46963b9d12da

📥 Commits

Reviewing files that changed from the base of the PR and between 1a59efb and 059aa2e.

📒 Files selected for processing (24)

• CHANGELOG.md
• README.md
• docs/cli.md
• docs/console-api.md
• src/cli/exit-codes.ts
• src/cli/parse.ts
• src/cli/setup-environment-profile.ts
• src/cli/setup.ts
• src/console/console-application-service.ts
• src/console/console-assets.ts
• src/console/console-config-metadata.ts
• src/console/console-dashboard-application-service.ts
• src/console/console-server.ts
• src/setup/environment-profile-onboarding.ts
• src/utils/errors.ts
• tests/cli-exit-codes.test.ts
• tests/cli-parse.test.ts
• tests/console-application-service.test.ts
• tests/console-config-metadata.test.ts
• tests/console-dashboard-application-service.test.ts
• tests/console-server.test.ts
• tests/environment-profile-onboarding.test.ts
• tests/readme-product-contract.test.ts
• tests/setup-command.test.ts

Dismissed as stale: both actionable threads were resolved in 633d23c, and CodeRabbit is rate-limited for a fresh review. Full local validation and current-head CI are required before merge.