config --list-all: don't list the configured host as a firm

[michieldegezelle]

Summary

• listAuthorizedFirms() filtered defaultFirmIDs and partnerCredentials out of the firm list but not host, so config --list-all prints ["host", undefined] alongside real firms on every perfectly valid config.
• One-line fix: add host to the filter.

Unrelated to credential-file corruption handling - split out of a larger parked branch (see #270, #271) as its own small, real bug fix.

Test plan

• Added a failing test first (does not list the host key as a firm), watched it fail against current code, confirmed the fix turns it green
• npm test - 752/752 pass
• npm run lint - clean
• Version bumped 1.59.0 -> 1.59.1 (package.json, package-lock.json, CHANGELOG.md)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 46b84dea-f2cd-45f7-9f45-1a19dc4273ad

📥 Commits

Reviewing files that changed from the base of the PR and between d941a7e and 5f2b7bd.

⛔ Files ignored due to path filters (2)

• package-lock.json is excluded by !**/package-lock.json
• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (2)

• CHANGELOG.md
• package.json

🚧 Files skipped from review as they are similar to previous changes (1)

• package.json

Included review availability: 3 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

Walkthrough

The change excludes the configured host credential from listAuthorizedFirms, adds regression coverage, updates the changelog, and increments the package version to 1.60.1.

Changes

Authorized firm listing

Layer / File(s)	Summary
Filter host from authorized firms lib/api/firmCredentials.js, tests/lib/api/firmCredentials.test.js, tests/TESTS.md	listAuthorizedFirms excludes the configured host entry. Tests verify that numeric firm entries retain their ID and name.
Release metadata package.json, CHANGELOG.md	The package version changes to 1.60.1. The changelog documents the corrected behavior and the update-text-properties command.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 5f2b7

The fix excludes the configured host from firm listings and includes regression coverage; no merge-blocking risk is identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main fix: preventing the configured host from appearing as a firm in config --list-all.
Description check	✅ Passed	The description includes a clear summary, test plan, regression-test details, test results, lint results, and version information. It omits the template's issue reference and checklist sections, and i…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cli-fix-listauthorizedfirms-host-filter

---

_{Comment @coderabbitai help to get the list of available commands.}

[michieldegezelle]

/review-pr (dry run)

Scope: 6 files (1-line prod fix + test + version bump), 1 commit. No existing reviewer comments (CodeRabbit was still running at review time). 5 finders ran (correctness, regression, edgecases, architecture-cli, cli-conventions) — no security/error-handling signal.

No fixes needed — correctness, regression, and cli-conventions all came back clean (version bump, CHANGELOG format, and test verified correct).

Deliberately deferred (1 Suggestion, raised independently by 2 finders — architecture-cli and edgecases): listAuthorizedFirms()'s filter is a growing list of magic strings (defaultFirmIDs, partnerCredentials, host) rather than a shape-based check, so a future reserved key would reintroduce the same bug this PR fixes. Real observation, but generalizing the filter now — in response to a single-instance bug — is the exact pattern a related pivot on this branch's history exists to avoid. Logged, not implemented.

752/752 tests pass, lint clean.