[feature] nine CLIs that patchbay refused to verify are now verified

[YJack0000]

probe.rs:47-49 states the contract: "Handing back a command for the user to paste is not an answer — if a CLI has to be invoked, patchbay invokes it." Nine probes were violating it, each answering verify with "patchbay does not run X yet" and a command to paste. The excuses were "it's a network call" and "that CLI is slow to start"; neither survives the fact that verify is tier 2 and only runs when the user presses the button.

probe	command	success returns
wrangler	wrangler whoami	token kind + email + account names
vercel	vercel whoami	username (banner is on stderr; stdout-only parse)
neon	neon me --output json	email, login, plan
supabase	supabase projects list --output json	project count + names + org slug
flyctl	fly auth whoami --json	email
doctl	doctl account get -o json --context <ctx>	email, team, status
huggingface	hf auth whoami --format json	user + orgs
stripe	stripe whoami --format json	display name, account id, device, key expiry
firebase	firebase login:list --non-interactive	primary + additional accounts

New private module probes/cli_verify.rs holds what all nine needed: a real headline() (first line — CmdOutput::message() joins with ; , which is the bug gcloud's author hit), and a failure classifier that checks transport evidence FIRST. A DNS/TLS/timeout failure returns "could not reach X, so the credential was not tested" — never Invalid. An unreachable network must not be reported as a dead login.

verify_profile is implemented where the CLI has a real per-invocation selector: doctl --context, stripe --project-name, firebase by checking the named account against the list.

Two hang hazards found and closed. neon me with no credential opens an OAuth browser flow and waits — that state is now answered from the tier-1 read with nothing executed. fly auth whoami offers an interactive login unless the literal --json flag is passed; that flag is there to prevent the hang, not for the parse.

stripe's command changed from the plan. stripe config --list prints the config file back including test_mode_api_key in plaintext and makes no API call. stripe whoami --format json is the same local read with a documented schema, an authenticated boolean, and no key material in the output. STRIPE_CLI_TELEMETRY_OPTOUT=1 avoids a 3s telemetry beacon on exit.

Two verifies are local reads and say so. stripe's whoami and firebase's login:list name the credential the CLI would use without exercising it; both carry that caveat inline rather than letting a green tick imply more. firebase projects:list --json was tested as the network alternative and rejected — it writes firebase-debug.log into the working directory and its failure text is just a pointer to that file.

Research corrected two assumptions: hf auth whoami exits 1 when logged out, and its default --format auto sniffs env vars for an AI-agent harness and changes shape (pinned); doctl -o json writes errors to stdout as {"errors":[…]}, hoisted out by surface_error.

581 lib tests (up from 532) — each probe gets success-parse, logged-out, rejected-vs-offline, garbage-output and binary-absent cases, plus 7 for the classifier. fmt + clippy -D warnings + cargo test --workspace --locked clean.

Live read-only runs for the four installed here: wrangler, vercel, neon, firebase all return the identity as designed. The other five are unit-tested against source-verified output shapes only.

Not done: doctl's --http-retry-max 0 (would fail fast when offline instead of retrying ~6 times) — the flag could not be tested here and a wrong flag name would break every doctl verify.

Lands after the note/expiry type refactor; will rebase.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud