[Epic] CLI code-audit follow-ups (2026-07)

[Bccorb]

Tracking issue for findings from an internal code audit of the CLI (2026-07). Grouped by priority; each item links a discrete issue that a PR will close.

P0 — correctness blockers (managed flow)

• [P0] seamless check is not managed-aware (crashes on managed projects) #78 seamless check is not managed-aware (crashes on managed projects)
• [P0] Managed init silently scaffolds a local project when the session is expired or unreachable #79 Managed init silently scaffolds local when the session is expired/unreachable
• [P0] Service token is rotated before files are written — a mid-scaffold failure can brick a deployed app #80 Service token rotated before files are written — mid-scaffold failure can brick a deployed app
• [P0] .env writer emits unquoted values — special characters corrupt generated .env #81 .env writer emits unquoted values

P1 — crashes & correctness

• [P1] adminMode: "source" scaffolds a broken stack — admin/ is never created #82 adminMode: "source" scaffolds a broken stack (no admin/)
• [P1] Prompt cancellation (Ctrl-C) is mishandled across init/oauth/bootstrap prompts #83 Prompt cancellation (Ctrl-C) mishandled across prompts
• [P1] init leaves a partial/orphaned project directory on error #84 init leaves a partial project dir on error
• [P1] Login misclassifies server/expired-token failures as "wrong code" and burns attempts #85 Login misclassifies server/expired-token failures as "wrong code"
• [P1] Email-OTP prompt hardcodes an exactly-6-letter code format #86 Email-OTP prompt hardcodes a 6-letter format
• [P1] users list --limit/--offset are never sent to the server (paging broken) #87 users list --limit/--offset never sent to the server
• [P1] CI never runs the unit test suite — releases can publish untested #88 CI never runs the unit test suite

P2 — robustness

• [P2] Token refresh robustness (contract, headless rotation, single-flight, 401 surfacing) #89 Token refresh robustness
• [P2] config set JSON-coerces string values and skips the WRITABLE_KEYS filter #90 config set JSON-coerces string values
• [P2] Admin org/member errors discard the server's reason #91 Admin org/member errors discard the server's reason
• [P2] "Enable Docker?" confirm is ignored; non-docker success output is unreachable #92 "Enable Docker?" confirm ignored; non-docker output unreachable
• [P2] Bootstrap-secret parser matches commented / inline-comment lines #93 Bootstrap-secret parser matches commented lines

P3 — consistency & docs

• [P3] Docs drift in README and AGENTS.md #94 Docs drift in README and AGENTS.md
• [P3] Add --json to whoami and sessions list for scripting parity #95 Add --json to whoami and sessions list
• [P3] Guard unknown commands and render non-Error throws safely #96 Guard unknown commands + render non-Error throws safely
• [P3] isLocalInstanceUrl doesn't recognize 0.0.0.0 / LAN hosts #97 isLocalInstanceUrl misses 0.0.0.0 / LAN hosts

P4 — cleanup & hardening

• [P4] Remove dead code #98 Remove dead code
• [P4] Wire token redaction into logged server responses #99 Wire token redaction into logged responses
• [P4] Build/test hygiene: clean before build, add http.ts unit test #100 Build/test hygiene (clean before build, http.ts test)