feat: shared foundation for API-backed commands, and the api command

[alukach]

The shared base that the auth and product commands, and later ones, build on, plus its first user, the api command. Together with the Auth and Products PRs stacked on it, this supersedes #24, #40, #41 and #44, which mixed these concerns.

What

• src/api.rs: the source.coop API client (/api/v1), its errors (ApiError, with field errors and a sign-in hint on 401) and pages (Page, next_cursor).

• src/failure.rs and fail(e, json): under --json, a failure prints as {"error": {"code", "message", "status"?, "field_errors"?}} on stderr, and every command exits by kind:

  Code	Meaning
  3	Rejected input
  4	Not signed in, or not allowed
  5	Not found
  130	Interrupted
  1	Anything else

  Commands pass errors around as plain text (String), which drops the API's code, status and field errors. failure.rs recovers them; it's a deliberate bridge, marked with a ponytail: comment naming the proper fix: a typed error.

• output::json for --json output, and src/style.rs for color: only on a terminal, never with NO_COLOR, gray IDs, and ago().

• Prompting and interaction:

  • src/prompt.rs: a scriptable Prompter; Esc and q cancel (CANCELLED), Ctrl+C interrupts (exit 130); typed confirmation; a line editor Esc can cancel.
  • src/picker.rs: the -i list and full screen.
  • src/draft.rs: keeps your answers when a send fails.

• Conventions: AGENTS.md, imported by CLAUDE.md, covers commands, input, prompts, the picker, output, the JSON-output rules, stored data, testing and git.

• source-coop api: sends any /api/v1 request as the signed-in user (SOURCE_TOKEN overrides). Access tokens issued without an API audience are no longer sent, since they'd turn public reads into 401s.

• README: api, and JSON output and exit codes.

Modules no command uses yet are marked #[allow(dead_code)], with a comment. The Products PR removes the markers, since it uses every module.

Stack

• this PR → main
• Auth (auth login | status | logout | token) → this PR
• Products (product …, -i) → this PR

Auth and Products are independent. Whichever merges second needs a small rebase: both add to main.rs's module list, command enum and tests, and to the README. That union is verified: merging the two reproduces the combined code with all 103 tests passing.

Testing

• cargo test and cargo test --features staging: 51 passed, including every_command_is_in_the_readme.
• cargo clippy --all-targets -- -D warnings (both builds) and cargo fmt --check: clean.

🤖 Generated with Claude Code

[claude]

Claude finished @alukach's task in 21s —— View job

---

✅ No blocking issues — safe to merge.

I read the API client, api command, failure/exit-code bridge, session change and main.rs wiring. I didn't run the build or tests. I only skimmed prompt.rs, picker.rs, draft.rs and style.rs, so those are not reviewed in depth.

• Client::resolve handles the cases I traced. A full URL is rejected by the origin check. .. segments are rejected by the path-prefix check after join normalizes them. A leading // is stripped. The bearer token can't be sent to another host or path.
• The session.rs change (no access token without an audience) matches the new test.

Non-blocking notes:

• src/api.rs:51: the 401 hint says source-coop login, but AGENTS.md makes auth login the canonical name. Update it when the Auth PR lands.
• src/main.rs: when the session lookup fails, api_token warns and continues signed out. A broken keyring on a write call then shows up as a 401 with the hint. That is acceptable, since the warning is printed first.

Simplify (ponytail)

• src/failure.rs:29-37: the thread-local remember/classify text-matching bridge is a heuristic. It is already marked with ponytail: and names the typed-error fix, so leave it for now. Returning ApiError from the commands would delete this file.
• Cargo.toml / src/prompt.rs:8: dialoguer with the editor feature is kept for Select, Confirm, MultiSelect and Editor, while prompt.rs and picker.rs replace its text prompts and its list picker with their own. Check whether console alone covers the rest. If it does, drop dialoguer. Otherwise it's fine.
• src/main.rs:~15-30: the #[allow(dead_code)] markers on api, draft, output, picker, prompt and style are temporary. The description says the Products PR removes them.

---

💰 Estimated review cost: $0.18 · 0m21s · 9 turns