Warn when SF_HOST overrides the configured host

[michieldegezelle]

Related: #281, #282

Description

The deprecated SF_HOST environment variable takes precedence over the host stored with silverfin config --set-host, but the CLI never said so:

• --set-host printed "Host set to: …" while every following command kept using the SF_HOST host.
• The "Current host" line is hidden for the live default, so a live SF_HOST gave no visible clue at all.

This happened in practice: a colleague with export SF_HOST=https://live.getsilverfin.com in ~/.zshrc set the host to staging and ran add-shared-part -p 1 …. Both links were created on live partner 1, with no error.

This PR makes the host in use visible. Behaviour is unchanged (SF_HOST still wins); removing it is #281.

• Every command: warns when the host comes from SF_HOST, including when it's live.
• config --set-host: warns when SF_HOST overrides the host just set.
• config --get-host: says when the host comes from SF_HOST.
• Overwrite confirmation: now names the target host ("This will overwrite existing templates on https://…").
• Helper: new firmCredentials.isHostFromEnv().

Version bumped to 1.60.1, with a CHANGELOG entry and tests/TESTS.md rows.

Testing Instructions

Steps:

1. Use a throwaway home so your real config isn't touched: export H=$(mktemp -d)
2. HOME=$H SF_HOST=https://live.getsilverfin.com node bin/cli.js config --set-host https://bso-staging-beta.staging.getsilverfin.com → a warning that SF_HOST overrides it, plus the "Current host … from the deprecated SF_HOST" warning.
3. HOME=$H SF_HOST=https://live.getsilverfin.com node bin/cli.js config --get-host → Current host: https://live.getsilverfin.com (from the SF_HOST environment variable).
4. HOME=$H node bin/cli.js config --get-host → the staging host, no warning.
5. npx jest → 779/779 pass. The new logCurrentHost test fails if the isHostFromEnv() branch is disabled (mutation-checked).

Author Checklist

• Skip bumping the CLI version

Reviewer Checklist

• PR has a clear title and description
• Manually tested the changes that the PR introduces
• Changes introduced are covered by tests of acceptable quality

🤖 Generated with Claude Code

[coderabbitai]

Note

Some coding-guideline sources were skipped; the reason is listed next to each one. Other guidelines were applied as usual. On a public repository, sources from your configuration are listed without their names.

Skipped guideline sources (1)

a configured source — invalid entry; expected repo:path or owner/repo:path with a relative file path

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: c50849fe-e9a2-46fd-880e-a92d8d6bf49b

📥 Commits

Reviewing files that changed from the base of the PR and between e6b5645 and 3424dba.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (8)

• CHANGELOG.md
• bin/cli.js
• lib/api/firmCredentials.js
• lib/cli/utils.js
• package.json
• tests/TESTS.md
• tests/lib/api/firmCredentials.test.js
• tests/lib/cli/utils.test.js

Included review availability: This review used your included allowance. 1 included review remains after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: test (22.x)

🧰 Additional context used

📚 Code guidelines (1)

CLAUDE.md — auto-discovered

📓 Path-based instructions (3)

`lib/api/` must not touch the filesystem.

📄 CodeRabbit inference engine (CLAUDE.md)

Files:

• lib/api/firmCredentials.js

`bin/cli.js` must not call the API directly

📄 CodeRabbit inference engine (CLAUDE.md)

Files:

• bin/cli.js

Run `npm run lint && npm test` after code changes.

📄 CodeRabbit inference engine (CLAUDE.md)

Files:

• package.json
• tests/lib/api/firmCredentials.test.js
• tests/TESTS.md
• CHANGELOG.md
• bin/cli.js
• lib/api/firmCredentials.js
• tests/lib/cli/utils.test.js
• lib/cli/utils.js

---

Walkthrough

The CLI now reports when SF_HOST supplies the active host. Template-overwrite confirmations name the current host. The package version and changelog were updated to 1.60.1.

Changes

Host configuration

Layer / File(s)	Summary
Host source reporting lib/api/firmCredentials.js, lib/cli/utils.js, bin/cli.js, tests/lib/api/firmCredentials.test.js, tests/lib/cli/utils.test.js, tests/TESTS.md, CHANGELOG.md, package.json	FirmCredentials.isHostFromEnv() reports whether SF_HOST is set. Host messages identify when SF_HOST supplies the host, including the default host. Tests cover the helper and host reporting. The changelog records the release changes, and the package version is 1.60.1.
Host-aware overwrite confirmation lib/cli/utils.js, tests/lib/cli/utils.test.js, tests/TESTS.md	The confirmation prompt names the current host. Tests verify the prompt text and that a declined confirmation exits with code 1.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 3424d

The CLI identifies when SF_HOST supplies the active host, and overwrite confirmations name the current host. No material merge-blocking risk is evident in the reviewed changes.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 5 files. (3 skipped: 3…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: warning when SF_HOST overrides the configured host.
Description check	✅ Passed	The description includes the change summary, testing instructions, issue references, version details, and author and reviewer checklists. It is complete enough to meet the template requirements.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 5 files. (3 skipped: 3 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}