feat(config): socket login now configures socket-patch — socket-cli config.json fallback + SOCKET_CLI_* aliases

[Mikola Lysenko (mikolalysenko)]

Summary

Aligns socket-patch's configuration with the JS Socket CLI so one socket login configures every Socket tool — without adding any new config file. Design record: docs/design/configuration.md.

Per-key resolution for the three auth settings:

--api-token / --org / --api-url
  1. CLI flag
  2. Canonical env       SOCKET_API_TOKEN / SOCKET_ORG_SLUG / SOCKET_API_URL
  3. Peer alias env      SOCKET_CLI_API_TOKEN / SOCKET_CLI_ORG_SLUG / SOCKET_CLI_API_BASE_URL
                         (silent in-process promotion; canonical wins)
  4. socket-cli config   <data dir>/socket/settings/config.json — READ-ONLY
                         (apiToken, defaultOrg [alias org], apiBaseUrl)
  5. Built-in default    no token → public proxy; org → auto-resolve; api.socket.dev

What's in here

• New socket_patch_core::utils::socket_cli_config: mirrors socket-cli's getSocketAppDataPath (on macOS also probes the legacy ~/.local/share location older socket-cli releases wrote — real logins exist there); lenient base64→JSON decode with plain-JSON fallback; allowlist copy (unknown keys / non-string values ignored); OnceLock disk cache with the SOCKET_NO_CONFIG gate checked per call. The file is never written — apiProxy/enforcedOrgs/skipAskToPersistDefaultOrg are deliberately ignored.
• Client integration (get_api_client_with_overrides): config layer between env and defaults; SOCKET_NO_API_TOKEN (alias SOCKET_CLI_NO_API_TOKEN) vetoes ambient tokens while an explicit --api-token still wins; --debug prints provenance (source only, never values); the no-token notice now suggests socket login.
• Telemetry: resolve_telemetry_endpoint shares resolve_api_base_url() with client construction so a config apiBaseUrl applies to both (e2e-pinned).
• Enabler: --api-url/--proxy-url drop their clap defaults (Option<String>); documented default URLs now apply at client construction. Observable behavior unchanged unless a socket-cli login exists.
• Failure semantics: missing file silent; corrupt/unreadable file warns once on stderr and is ignored — never fatal, --json stdout stays clean.
• Docs: docs/design/configuration.md (settled model, explicitly-rejected alternatives incl. .env loading and repo-level endpoint/credential sources — now a CLI_CONTRACT property — and the deferred env-cleanup list), README "Configuration sources", CLI_CONTRACT sections, CHANGELOG.

Test hermeticity (important for reviewers)

A developer's real socket login must never authenticate a test run. The workspace .cargo/config.toml now exports SOCKET_NO_CONFIG=1 for every cargo-run process; the e2e env-scrub loops deliberately skip that variable so the guard survives into spawned binaries, and targeted token scrubs also drop SOCKET_CLI_API_TOKEN. Tests exercising the layer re-enable it with SOCKET_NO_CONFIG=0 on the child.

Testing

• Full workspace suite green — run on a machine with a real socket login on disk, doubling as the leak-proof for the hermeticity guard.
• New tests/cli_config_fallback.rs (9 e2e cases): config token/apiBaseUrl authenticate; defaultOrg skips org auto-resolve with telemetry following the config host+token; env-beats-config per key; alias honored, canonical wins; corrupt config warns while --json stdout parses; both toggles; --api-token survives the veto; missing file silent.
• Unit tests: path candidates per platform (incl. empty-env-is-unset), decode variants, allowlist, gates, peer-alias promotion (silent, canonical wins), client veto behavior.
• Manual smoke against a real login: --debug provenance shows token + org from socket-cli config; SOCKET_NO_CONFIG=1 reproduces pre-PR behavior; --offline still refuses up front.

🤖 Generated with Claude Code