fix: adopt cli-engine 0.2.0 fail-closed auth; mark local commands no_auth

[jpage-godaddy]

Context

cli-engine 0.2.0 changes authentication to be fail-closed by default: every command is AuthRequirement::Required unless it opts out, and the engine resolves a credential before the handler runs. This PR upgrades gddy to 0.2.0 and annotates the commands that must not authenticate.

Stacked on rust-port (#49); targets that branch since main is still the TypeScript CLI.

Changes

• Dependency: cli-engine 0.1.3 → 0.2.0 (removed the local [patch.crates-io] dev override).
• no_auth(true) on local-only commands so they keep running without auth:
  • env: list, get, set, info (read/write ~/.gdenv)
  • actions: list, describe (local action-contract catalog)
  • api: list, describe, search (local API catalog — api call stays Required)
  • application: validate and the add subcommands (edit local godaddy.toml)
• Backend commands stay Required (default): application list/info/init/update/enable/disable/archive/release/deploy, api call, webhook events. A forgotten annotation now over-prompts rather than running unauthenticated.
• Credential reads use the lazy ctx.credential().await? accessor.

Why these annotations matter

The fail-closed default is intentionally safe: forgetting no_auth only causes an unnecessary auth prompt. The riskier mistake is marking a backend command no_auth(true) — so the new tests guard the boundary in both directions.

Tests

• env::tests::env_list_runs_without_auth — local command succeeds with no provider registered.
• application::commands::tests::application_list_requires_auth — backend command fails closed with no provider (no network call).
• Full suite: 116 passing; cargo fmt --check and cargo clippy --all-targets -D warnings clean.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates the Rust gddy CLI to cli-engine 0.2.0, adopting its fail-closed authentication model and explicitly opting local-only commands out of auth so they continue to work without an auth provider.

Changes:

• Upgraded cli-engine dependency to 0.2.x and updated credential access to ctx.credential().await?.
• Marked local-only commands as no_auth(true) (env/actions/api-catalog/application validate + add subcommands).
• Added regression tests to ensure local commands run without auth and backend commands remain fail-closed.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
rust/src/webhook/mod.rs	Switches from optional token to fail-closed ctx.credential().await? for authenticated webhook API call.
rust/src/env/mod.rs	Adds no_auth(true) to env commands and introduces a test ensuring env list runs with no auth provider.
rust/src/application/commands/mod.rs	Uses lazy credential accessor, adds no_auth(true) to local-only subcommands, and adds a fail-closed auth test.
rust/src/api_explorer/mod.rs	Marks API catalog commands no_auth(true); keeps api call authenticated and updates token retrieval.
rust/src/actions_catalog/mod.rs	Marks action catalog commands no_auth(true).
rust/Cargo.toml	Bumps cli-engine from 0.1.3 to 0.2.x.
rust/Cargo.lock	Locks cli-engine to 0.2.0 and updates transitive dependencies.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated no new comments.