GeezerVison

…ve in core

api_url/proxy_url become Option<String> with no default_value so
api_client_overrides() forwards None when neither flag nor env var is
set. get_api_client_with_overrides already owns env → default
resolution, and this makes room for the socket-cli config fallback
layer between env and the built-in defaults. Parse-time contract tests
now pin None; the documented URLs stay pinned in core's resolver tests.

Co-Authored-By: Claude Fable 5 <[email protected]>

…ayer

New socket_patch_core::utils::socket_cli_config reads the JS socket-cli
login state (<data dir>/socket/settings/config.json, base64 JSON,
read-only) and exposes it as the resolution layer below env vars and
above built-in defaults for apiToken/defaultOrg/apiBaseUrl. One
'socket login' now configures socket-patch too.

- get_api_client_with_overrides: flag > env > config > default per key;
  SOCKET_NO_API_TOKEN vetoes ambient tokens (env+config, explicit
  --api-token still wins); SOCKET_NO_CONFIG disables the layer.
- telemetry: resolve_telemetry_endpoint now shares
  resolve_api_base_url() with client construction so the two can't
  disagree about the API host.
- env_compat: SOCKET_CLI_API_TOKEN / SOCKET_CLI_ORG_SLUG /
  SOCKET_CLI_API_BASE_URL / SOCKET_CLI_NO_API_TOKEN accepted as silent
  peer aliases (canonical SOCKET_* names win; no deprecation warning).
- corrupt/unreadable config warns once on stderr and is ignored; missing
  file is silent; --json stdout purity unaffected.

Co-Authored-By: Claude Fable 5 <[email protected]>

…ck layer

- .cargo/config.toml [env] exports SOCKET_NO_CONFIG=1 so a developer's
  real 'socket login' can never authenticate a test run; every env
  scrub loop in the e2e harnesses now skips SOCKET_NO_CONFIG so the
  guard survives into spawned binaries, and targeted token scrubs also
  drop SOCKET_CLI_API_TOKEN.
- new tests/cli_config_fallback.rs (9 cases): config token/apiBaseUrl
  authenticate, defaultOrg skips org auto-resolve with telemetry
  following the config host+token, per-key env-beats-config, alias
  honored + canonical wins, corrupt config warns on stderr with --json
  stdout still parseable, SOCKET_NO_CONFIG gate, SOCKET_NO_API_TOKEN
  veto incl. --api-token surviving it, missing file silent.
- client.rs unit tests for the veto (ambient suppressed, override wins).

Co-Authored-By: Claude Fable 5 <[email protected]>

- docs/design/configuration.md: the settled configuration model —
  per-key precedence (flag > env > SOCKET_CLI_* alias > socket-cli
  config.json > default), read-only pledge, rejected alternatives
  (.env loading, new config file, repo-level endpoints/credentials),
  and deferred items (manifest setup.defaults, the env cleanup sweep,
  token-file/keychain sourcing).
- README: 'Configuration sources' subsection under Global Options.
- CLI_CONTRACT: peer-alias paragraph, config-layer toggles table, and
  a 'Persisted configuration' section with contract properties incl.
  'repo-level files never carry endpoints/credentials/interlocks'.
- CHANGELOG: Unreleased Added + Changed entries.

Co-Authored-By: Claude Fable 5 <[email protected]>

Older socket-cli releases wrote the Linux-style data dir on every
platform — real macOS logins exist at ~/.local/share/socket/settings/
config.json (verified on a dev machine where ~/Library/Application
Support/socket/settings/ exists but is empty). With XDG_DATA_HOME unset,
macOS now probes the native Application Support path first and the
legacy path second; first existing file wins, and a corrupt preferred
file stops the probe rather than silently resurrecting older
credentials from the fallback location.

Co-Authored-By: Claude Fable 5 <[email protected]>

…config-alignment

Conflict: cli_parse_apply.rs defaults comment — kept main's --yes example
(--break-lock is gone) and this branch's api_url/proxy_url None pins.

Co-Authored-By: Claude Fable 5 <[email protected]>