feat(profile): add safe account removal lifecycle

[mohanagy]

Part of #204.

Adds one guarded profile-removal lifecycle through the CLI and Console.

• reassigns only explicit durable references: default, routing rules, routing-plugin bindings, and configured profile locks
• refuses last-profile removal and any native OAuth-bound profile
• never resolves or deletes secrets, provider caches, token caches, OS-vault data, or active client sessions
• writes intent and completion lifecycle records; restores the exact original configuration if final required auditing fails
• adds strict Console API, CSRF coverage, confirmation UX, package/runtime coverage, and documentation

Validation:

• npm test
• npm run test:core
• npm run test:coverage
• npm run lint
• npm run typecheck
• npm run build
• npm run smoke:cli
• npm run check:pack
• npm run test:package

Local review: manual security review completed. Local Claude CLI review was attempted in plan/read-only mode but did not return within the bounded window and was terminated without any file changes.

Summary by CodeRabbit

• New Features

  • Added account/profile removal through the CLI and Console dashboard.
  • Supports selecting a replacement account when durable references require one.
  • Provides confirmation, validation, audit tracking, recovery backups, and safe failure handling.
  • Prevents removal of the final account or accounts with native OAuth bindings.
  • Preserves underlying secrets, token caches, and active sessions.

• Documentation

  • Added CLI usage, API reference, and account-removal guidance.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds guarded profile removal with durable-reference reassignment, audit recovery, CLI and Console API support, dashboard controls, validation, documentation, and end-to-end tests.

Changes

Profile removal lifecycle

Layer / File(s)	Summary
Removal planning and audited persistence src/setup/profile-removal-onboarding.ts, src/utils/errors.ts, tests/profile-removal-onboarding.test.ts	Validates removal constraints, reassigns durable references, records audited changes, restores failed writes, and covers these behaviors.
CLI command and documentation src/cli/*, README.md, docs/cli.md, tests/cli-*.test.ts, tests/package-contract.test.ts, tests/readme-product-contract.test.ts	Adds miftah profile remove, --replacement-profile, exit mappings, help output, integration coverage, and usage documentation.
Console service and HTTP integration src/console/console-application-service.ts, src/console/console-dashboard-application-service.ts, src/console/console-server.ts, docs/console-api.md, tests/console-application-service.test.ts, tests/console-dashboard-application-service.test.ts, tests/console-server.test.ts	Adds typed service delegation, strict request validation, CSRF-protected routing, error responses, selection reset, auditing, and API coverage.
Dashboard removal controls src/console/console-assets.ts, tests/console-server.test.ts	Adds account and replacement selectors, confirmation controls, removal submission, refresh handling, and UI assertions.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ConsoleUser
  participant ConsoleAssets
  participant LocalConsoleServer
  participant ConsoleDashboardApplicationService
  participant ConsoleApplicationService
  participant runProfileRemoval
  ConsoleUser->>ConsoleAssets: confirm account removal
  ConsoleAssets->>LocalConsoleServer: POST /api/v1/profiles/remove
  LocalConsoleServer->>ConsoleDashboardApplicationService: validate and forward request
  ConsoleDashboardApplicationService->>ConsoleApplicationService: removeProfile(request)
  ConsoleApplicationService->>runProfileRemoval: execute audited removal
  runProfileRemoval-->>ConsoleApplicationService: removal report
  ConsoleApplicationService-->>ConsoleDashboardApplicationService: normalized report
  ConsoleDashboardApplicationService-->>LocalConsoleServer: JSON result
  LocalConsoleServer-->>ConsoleAssets: removal response
  ConsoleAssets->>LocalConsoleServer: refresh dashboard

Loading

Possibly related PRs

• mohanagy/miftah#58: Related CLI command registration and profile-removal error mapping infrastructure.
• mohanagy/miftah#103: Related README removal guidance and product-contract assertions.
• mohanagy/miftah#206: Related Console dashboard active-configuration lifecycle and selection reset behavior.

Poem

I’m a rabbit with profiles to prune,
Moving durable paths beneath the moon.
Audit trails thump, backups stay near,
OAuth-bound accounts remain clear.
Click, confirm—then hop away!

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Docstring Coverage	❌ Error	Docstring coverage is 10.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the main change: adding a guarded profile-removal lifecycle.
Description check	✅ Passed	The description covers the summary, security impact, and validation commands; it is mostly complete despite missing the exact template headings and detailed results.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/204-profile-removal

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/profile-removal-onboarding.test.ts`:
- Around line 164-213: Add a direct happy-path test for runProfileRemoval with a
resolving audit.record, asserting the returned report has changed: true, write:
true, the requested profile, and a defined backupPath; verify audit intent and
successful record calls, and confirm the rewritten configuration removes the
profile. Clean up the temporary directory in a finally block.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e09068ff-3ced-4c9f-b6e8-12e6c9c80f44

📥 Commits

Reviewing files that changed from the base of the PR and between 444a447 and a9d51c2.

📒 Files selected for processing (20)

• README.md
• docs/cli.md
• docs/console-api.md
• src/cli/exit-codes.ts
• src/cli/main.ts
• src/cli/parse.ts
• src/console/console-application-service.ts
• src/console/console-assets.ts
• src/console/console-dashboard-application-service.ts
• src/console/console-server.ts
• src/setup/profile-removal-onboarding.ts
• src/utils/errors.ts
• tests/cli-exit-codes.test.ts
• tests/cli-parse.test.ts
• tests/console-application-service.test.ts
• tests/console-dashboard-application-service.test.ts
• tests/console-server.test.ts
• tests/package-contract.test.ts
• tests/profile-removal-onboarding.test.ts
• tests/readme-product-contract.test.ts

[mohanagy]

CodeRabbit is rate-limited on current head 435d22a. Its check is passing with Review rate limited, so I used the documented fallback review.

Local Claude Fable completed a read-only review of the current pull-request diff with NO BLOCKERS. It independently verified durable-reference coverage, native OAuth refusal, guarded audit rollback, Console CSRF and schema safety, browser path redaction, stale trusted-source fail-closed behavior, and secret/cache boundaries.

It noted only a non-blocking pre-existing sibling-pattern gap: no test currently forces external interference during the rollback comparator path. The new direct successful runProfileRemoval audit-path test addresses the actual CodeRabbit request, and the original CodeRabbit thread is no longer unresolved after the update.

Dismissed because CodeRabbit is rate limited on the current head. Its one actionable test gap was addressed in 435d22a; there are no unresolved review threads, all current-head CI checks are green, and a bounded local Claude Fable read-only review found no blockers.