feat(tb-lf): full share + alias CRUD (M3)

[trogulja]

Summary

Adds the full share + alias CRUD surface to tb-lf — manages DevPortal Shares and their per-user pretty aliases (/u/<user_id>/<slug>) entirely from the terminal. Skills and recurring-report workflows can now upload, list, rename, retire, and alias shares without opening the browser.

Depends on devportal #292 — the alias endpoints (/spa_api/share_aliases) and the /u/<user_id>/<slug> viewer route land there. The share CRUD endpoints (/spa_api/shares) landed back in M2 already, so the share-CRUD-via-CLI piece technically doesn't need #292 — but they ship together since they're the same release. Don't merge until #292 is in master and deployed.

Bumps tb-lf to 0.8.0 (release tag created post-merge per the standard workflow).

What's new

Aliases (new in M3)

tb-lf share alias set weekly-report <token>
tb-lf share alias set weekly-report https://devportal.productive.io/s/<token>
tb-lf share alias list
tb-lf share alias rm weekly-report

Share CRUD (filled in during QA — previously queued, bundled into this PR)

tb-lf share list                                                  # your shares + URLs
tb-lf share update <token-or-url> --title "Q4 review"             # rename
tb-lf share update <token-or-url> --visibility unlisted            # flip visibility
tb-lf share rm <token-or-url>                                     # soft-delete (background purge)

<token-or-url> works the same in both share alias set and share update / rm — bare token OR /s/:token URL (full or bare).

Asymmetric escalation gates (CLI mirrors SPA AlertDialogs)

share alias set into an unlisted target (INV-5):

• TTY → [y/N] prompt with the chunk #49 / #62 copy.
• Non-TTY → exit non-zero; --force to override.
• De-escalation (unlisted → private repoint) → single stderr notice.
• Server does NOT enforce this — the CLI gate IS the surface.

share update --visibility unlisted on a currently-private share:

• TTY → [y/N] prompt with the SPA EditShareSheet's verbatim copy ("Anyone with this URL will be able to view it without logging in. Continue?").
• Non-TTY → exit non-zero; --force to override.
• De-escalation (unlisted → private) → single stderr notice.
• Same-side updates (private→private, unlisted→unlisted) → silent.

GET-first orchestration for alias set

No upsert endpoint on the server (REST stays pure). The CLI does:

1. GET /spa_api/shares → resolve the token to the user's own share (server pre-scopes to created_by).
2. GET /spa_api/share_aliases → look up an existing row by slug.
3. Evaluate the INV-5 gate (using the GET responses to compute was_unlisted and becomes_unlisted).
4. Branch: POST /spa_api/share_aliases (create) or PATCH /spa_api/share_aliases/:id (repoint).

Two roundtrips on create; one on repoint. Race window in single-user shell is acceptable.

What shipped

• 7ead34c tb-lf #67: share alias set / list / rm. New tb_lf::share_alias pure-logic module (slug regex/reserved port, token-or-URL parser, OptInGate decision matrix). Four devportal_* JSON helpers on DevPortalClient for the bare-URL endpoints (existing patch/delete target /spa_api/ai, alias + share endpoints are off the bare URL).
• e8b9940 bump version to 0.8.0.
• 4990bff QA Pass 1 cleanup. Renamed ShareAliasUpdatePayload→ShareAliasRepointPayload and dropped the dead slug field. Fixed an error message that referenced a non-existent --visibility flag. Removed a duplicate test (repoint_from_private_to_unlisted_prompts and create_branch_into_unlisted_target_prompts both called opt_in_gate(false, true)).
• b6d7c8a tb-lf: share list / update / rm. Pulled the previously-queued share CRUD into this release after manual smoke flagged the alias-without-share asymmetry. New tb_lf::share module (sister to share_alias) with ShareVisibilityChange matrix + share_url formatter. Asymmetric escalation gate mirrors M2's EditShareSheet AlertDialog.

Test plan

Automated coverage:

• cargo test -p tb-lf — 33 tests, 0 failures (15 unit + 13 alias orchestration + 5 slug parity).
• cargo fmt --check -p tb-lf — clean.
• cargo clippy -p tb-lf -- -D warnings — clean.

Manual smoke (against a local devportal running feat/shares-aliases, or staging after #292 merges):

• Round-trip on a private share: upload → alias set <slug> <token> → alias list → alias set <slug> <different-token> (repoint) → alias rm <slug>.
• Round-trip on share itself: upload → list (row appears) → update <token> --title "Rename" (title changes) → rm <token> (row disappears).
• Slug normalization stderr notice: tb-lf share alias set " Weekly-Report " <token> → "note: normalized slug Weekly-Report → weekly-report".
• Local validation before HTTP: tb-lf share alias set foo--bar <token> → rejected without a network call. Same for new (reserved).
• share update local validation: tb-lf share update <token> (no flags) → rejected locally with "nothing to update". --visibility public → rejected.
• INV-5 TTY (alias): tb-lf share alias set <slug> <unlisted-token> shows the [y/N] prompt with the chunk #49 copy. n aborts; y creates.
• INV-5 non-TTY (alias): tb-lf share alias set <slug> <unlisted-token> </dev/null exits non-zero with "Not a TTY — pass --force". Adding --force succeeds silently.
• Visibility escalation (share): tb-lf share update <private-token> --visibility unlisted shows the [y/N] prompt with the EditShareSheet copy. Same --force non-TTY semantics.
• De-escalation toast (share): tb-lf share update <unlisted-token> --visibility private succeeds silently + emits "non-logged-in viewers will lose access" stderr notice.
• URL form: tb-lf share alias set my-deck https://devportal.productive.io/s/<token> (with or without trailing slash, with or without bundle subpath) works. Same for share update https://devportal.productive.io/s/<token> --title "X".

Where to look hardest if reviewing

• Slug regex parity between server and CLI. Server uses Ruby's lookahead (\A(?!.*--)…); CLI does it rule-by-rule (no lookahead in Rust regex). The parity test in crates/tb-lf/tests/share_alias_slug_validation.rs mirrors the Ruby spec cases verbatim — any drift fails loudly.
• INV-5 gate logic (tb_lf::share_alias::opt_in_gate + check_unlisted_opt_in in main.rs). Symmetry with the devportal SPA AlertDialog is the entire point — the UNLISTED_OPT_IN_COPY constant matches chunk #49 verbatim.
• Share visibility escalation gate (tb_lf::share::visibility_change + check_visibility_escalation in main.rs). Mirrors M2's EditShareSheet AlertDialog; SHARE_ESCALATION_COPY matches that verbatim too.
• TTY detection uses std::io::IsTerminal on stdin AND stderr. The --force flag is the only non-interactive escape; piped stdin (e.g. yes | ...) without --force MUST exit non-zero on both INV-5 and share-escalation paths.
• Bare-URL request family in crates/tb-lf/src/api.rs. Existing patch/delete target <devportal_url>/spa_api/ai (the Langfuse API base); the new devportal_* family targets <devportal_url> directly. There's duplication of the request-cycle pattern between the two families — see notes below.

Side effects

• tb-lf share upload (M1) unchanged. tb-lf share --help gains list, update, rm, alias.
• SKILL.md gains a ## Shares section with ### Manage existing shares + ### Aliases subsections.
• Release: tag tb-lf-v0.8.0 created post-merge on main per the existing cli-toolbox release workflow.

Out of scope

• CLI rename for aliases — set only repoints (changes share_id); renaming an existing alias means rm + set (or use the SPA Edit Sheet, which does both in one PATCH). The CLI's set lookup matches by slug — by construction the stored slug already equals the input.
• Token-lookup endpoint on devportal — not added; set and the share-update/rm verbs enumerate /spa_api/shares and find by token client-side. Bounded by the M2 100-share cap.
• HTTP mock-based orchestration tests — crate has no wiremock/mockito infra; decision points (token parsing, INV-5 matrix, slug validation, share visibility change matrix) live in pure functions and are exhaustively unit-tested. Adding mock HTTP infra for one feature was heavier than the value.

Known follow-ups (not blocking this PR)

• The four devportal_* API helpers duplicate the request-cycle pattern (build URL → Bearer header → send → status→error map → body→serde) shared with the existing get_raw / patch / delete methods. A raw_request helper would dedupe; not done because the refactor surface compounds with the next endpoint family.

🤖 Generated with Claude Code