[Epic] CLI code-audit follow-ups (2026-07)

[Bccorb]

Tracking issue for findings from an internal code audit of the CLI (2026-07). Grouped by priority; each item links a discrete issue that a PR will close.

P0 — correctness blockers (managed flow)

• [P0] seamless check is not managed-aware (crashes on managed projects) #78 seamless check is not managed-aware (crashes on managed projects)
• [P0] Managed init silently scaffolds a local project when the session is expired or unreachable #79 Managed init silently scaffolds local when the session is expired/unreachable
• [P0] Service token is rotated before files are written — a mid-scaffold failure can brick a deployed app #80 Service token rotated before files are written — mid-scaffold failure can brick a deployed app
• [P0] .env writer emits unquoted values — special characters corrupt generated .env #81 .env writer emits unquoted values

P1 — crashes & correctness

• [P1] adminMode: "source" scaffolds a broken stack — admin/ is never created #82 adminMode: "source" scaffolds a broken stack (no admin/)
• [P1] Prompt cancellation (Ctrl-C) is mishandled across init/oauth/bootstrap prompts #83 Prompt cancellation (Ctrl-C) mishandled across prompts
• [P1] init leaves a partial/orphaned project directory on error #84 init leaves a partial project dir on error
• [P1] Login misclassifies server/expired-token failures as "wrong code" and burns attempts #85 Login misclassifies server/expired-token failures as "wrong code"
• [P1] Email-OTP prompt hardcodes an exactly-6-letter code format #86 Email-OTP prompt hardcodes a 6-letter format
• [P1] users list --limit/--offset are never sent to the server (paging broken) #87 users list --limit/--offset never sent to the server
• [P1] CI never runs the unit test suite — releases can publish untested #88 CI never runs the unit test suite

P2 — robustness

• [P2] Token refresh robustness (contract, headless rotation, single-flight, 401 surfacing) #89 Token refresh robustness
• [P2] config set JSON-coerces string values and skips the WRITABLE_KEYS filter #90 config set JSON-coerces string values
• [P2] Admin org/member errors discard the server's reason #91 Admin org/member errors discard the server's reason
• [P2] "Enable Docker?" confirm is ignored; non-docker success output is unreachable #92 "Enable Docker?" confirm ignored; non-docker output unreachable
• [P2] Bootstrap-secret parser matches commented / inline-comment lines #93 Bootstrap-secret parser matches commented lines

P3 — consistency & docs

• [P3] Docs drift in README and AGENTS.md #94 Docs drift in README and AGENTS.md
• [P3] Add --json to whoami and sessions list for scripting parity #95 Add --json to whoami and sessions list
• [P3] Guard unknown commands and render non-Error throws safely #96 Guard unknown commands + render non-Error throws safely
• [P3] isLocalInstanceUrl doesn't recognize 0.0.0.0 / LAN hosts #97 isLocalInstanceUrl misses 0.0.0.0 / LAN hosts

P4 — cleanup & hardening

• [P4] Remove dead code #98 Remove dead code
• [P4] Wire token redaction into logged server responses #99 Wire token redaction into logged responses
• [P4] Build/test hygiene: clean before build, add http.ts unit test #100 Build/test hygiene (clean before build, http.ts test)

[Bccorb]

Progress on this epic, plus one item that turned out to be obsolete.

Obsolete

• [P2] Bootstrap-secret parser matches commented / inline-comment lines #93 (bootstrap-secret parser) closed. src/core/bootstrapSecret.ts was deleted in 15b487a when the bootstrap-admin flow was replaced by the OWNER_EMAIL grant, and SEAMLESS_BOOTSTRAP_SECRET no longer exists anywhere in the CLI.

PRs open

Issue	PR
#82 adminMode: "source" scaffolds a broken stack	#176
#85 Login misclassifies server/expired-token failures	#175
#86 Email-OTP prompt hardcodes a 6-letter format	#174
#87 users list --limit/--offset never sent	#173
#89 Token refresh robustness	#181
#90 config set JSON-coerces string values	#179
#91 Admin org/member errors discard the reason	#178
#92 "Enable Docker?" confirm ignored	#180

That is every P1 and every P2 on this list except #79, #80, #83 and #88.

Three findings worth recording

#85's premise needs a correction. The issue suggests not spending an attempt on a 401. Checked against the API, 401 is exactly how a wrong code answers (verifyLoginEmail returns 401 {"error":"Not allowed"}), and an expired ephemeral token is also 401, from verifyBearerAuth. They are not separable by status, so 401 has to stay an attempt. The fix stops on 403, 423, 400 and 5xx instead, which are the answers retyping cannot help.

#90 exposed drift in WRITABLE_KEYS. SystemConfigPatchSchema is .strict() and accepts four keys the CLI omitted: authenticator_policy, session_idle_ttl, max_concurrent_sessions, magic_link_redirect_uris. So config apply had been silently dropping them, and adding the set guard the issue asks for would have turned a silent drop into a hard rejection. Both are fixed together in #179.

#89 is more serious than "fragility". /refresh rotates the refresh token on every call and refreshSession treats a second use of a spent one as theft, calling revokeSessionChain. So the missing single-flight guard does not merely race: two concurrent 401s revoke the session. The same applies to the headless SEAMLESS_REFRESH_TOKEN path, where the next run re-sent an already-spent token.

Related: #136 (#177) was reshaped by the same bootstrap-admin removal. With bootstrapAdmin gone, scrubTokens had no callers at all, so the systemConfig echo was the only live path left.