docs+test+skill: cobra tests for new commands, README, CHANGELOG, skill content

- cmd/whoami_test.go, cmd/status_test.go, cmd/init_test.go, cmd/use_test.go
- Skill content rewritten to teach AI hosts how to operate praxis (always
  --json, run `praxis login` yourself, exit-code semantics, what's safe
  to call without auth, multi-profile support).
- README rewritten: AI-prompt-first onboarding, profiles section,
  multi-deployment support engineer flow.
- CHANGELOG entry for v0.4.0.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: anshulsao

CHANGELOG.md

@@ -6,7 +6,53 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
-(Empty — see 0.3.0 below.)
+(Empty — see 0.4.0 below.)
+
+## [0.4.0] — 2026-05-06
+
+### Added
+- `praxis login` — browser-callback authentication. Opens the user's
+  default browser to create an API key, captures the new key via a
+  one-shot localhost listener, validates against `/ai-api/auth/me`,
+  saves credentials. Supports `--profile`, `--url`, `--token`,
+  `--timeout` flags.
+- `praxis whoami` — live identity check against `/ai-api/auth/me`.
+- `praxis status` — read-only local snapshot (active profile, URL,
+  login state, installed skills) — designed for AI hosts to inspect.
+- `praxis init` — idempotent first-run bootstrap: installs the praxis
+  skill into all detected AI hosts and reports state as JSON.
+- `praxis use <profile>` — kubectl-style: persist active profile to
+  `~/.praxis/config`.
+- Multi-profile credentials store at `~/.praxis/credentials` in INI
+  format matching `~/.facets/credentials`. Profile resolution
+  priority: `--profile` flag > `PRAXIS_PROFILE` env > `~/.praxis/config`
+  active-profile pointer > literal `default` section. Single-profile
+  users see no behavior change.
+- Browser-callback flow on the agent-factory side
+  (PR Facets-cloud/agent-factory#1048): the API-key create modal
+  reads `cli_callback`, `cli_session`, `suggested_name` query params,
+  auto-opens with the name pre-filled, POSTs the new key to the
+  localhost listener after creation, redirects to `/ui/ai/cli-success`.
+- Named exit codes (`internal/exitcode`): 3 = auth missing/expired,
+  4 = no config, 5 = network, 6 = no AI host. Pinned in tests.
+- Structured `--json` output mode + auto-non-TTY default
+  (`internal/render`).
+- Skill content rewrite — the placeholder `praxis` skill now teaches
+  AI hosts how to operate the CLI (always `--json`, run `praxis login`
+  yourself, exit-code semantics, etc.).
+
+### Changed (breaking)
+- `~/.praxis/credentials` format changed from a single JSON object to
+  an INI profile map. Existing v0.3 single-credential files are not
+  auto-migrated; re-run `praxis login`.
+- `praxis logout` now takes `--profile X` (default: active profile)
+  or `--all` (wipe everything + active-profile pointer).
+
+### Removed
+- `internal/config` package. URL is now stored per-profile inside
+  `~/.praxis/credentials`. The legacy `~/.praxis/config.json` (if any)
+  is ignored; `~/.praxis/config` (no .json) takes its place as the
+  active-profile pointer file.
 
 ## [0.3.0] — 2026-05-06
 

README.md

@@ -1,92 +1,112 @@
 # Praxis CLI
 
-> Bring your organization's Praxis cloud to any local AI host —
-> Claude Code, Cursor, Gemini CLI — without ever putting AWS, kubeconfig,
-> or Terraform credentials on your laptop.
-
-## What it does
-
-```
-  Your laptop                            Praxis cloud
-  ───────────                            ────────────
-  PRAXIS_TOKEN  ─────────────────────►   Validate per-call
-                                         AssumeRole into your org's AWS
-  Claude Code  ─ shells out to ─►        Execute the MCP function
-  praxis CLI                             Audit
-                ◄─── JSON response ───
-```
-
-`praxis` exposes Praxis MCP functions and skills as a single-binary CLI.
-Your AI host calls `praxis mcp …` for any infra operation; the server
-runs it under the org's managed credentials and returns the result.
+> Bring your Praxis cloud to any local AI host (Claude Code, Codex,
+> Gemini CLI). Operated by your AI; you (the human) only install the
+> binary and click one button during login.
 
 ## Install
 
 ```bash
 brew install Facets-cloud/tap/praxis
-# or
-curl -fsSL https://install.askpraxis.ai | sh
 ```
 
-Verify:
+Or direct binary:
 
 ```bash
-praxis version
-praxis doctor
+curl -fsSL https://install.askpraxis.ai | sh   # planned
+# or grab a release directly:
+# https://github.com/Facets-cloud/praxis-cli/releases/latest
 ```
 
-## Verify
+## Set up — paste this prompt into your AI
 
-```bash
-praxis version
-praxis completion zsh > "${fpath[1]}/_praxis"
-```
+Open Claude Code, Codex, Gemini CLI, or any AI host that can run
+shell commands. Paste:
 
-The skill / MCP commands aren't shipped yet — see "Coming in subsequent
-releases" below.
+> I just installed the `praxis` CLI on my machine. Please set it up
+> end-to-end:
+>
+> 1. Run `praxis init` to install the praxis skill into every AI host
+>    on this machine. The skill teaches you how to use praxis.
+> 2. Run `praxis login`. A browser will open; I'll click "Create Key"
+>    once. You handle the rest.
+> 3. Run `praxis status --json` and tell me what you see.
+>
+> If I have a custom Praxis deployment, use `praxis login --url <url>`.
+> Otherwise the default `https://askpraxis.ai` is fine.
+>
+> Always pass `--json` to praxis from now on. Read exit codes — they
+> tell you what to do next.
 
-## Surface today (v0.3.x)
+That's it. Your AI now operates praxis on your behalf. Daily use:
+
+> "Show me what's deployed in prod."
+> *(your AI runs `praxis mcp …` once those commands land)*
+
+> "Debug my failed release."
+> *(your AI sources the release-debugging skill from praxis cloud
+> and walks the diagnosis with you)*
+
+## Surface today (v0.4.x)
 
 ```
-praxis install-skill        install the praxis skill into every detected
-                             AI host (Claude Code, Codex, Gemini CLI).
-                             User-scope only — Cursor has no user-level
-                             skill dir.
-praxis uninstall-skill      remove from every host where installed
-praxis list-skills          show what's installed and where
-praxis refresh-skills       rewrite installed SKILL.md files with current
-                             content (called automatically by `praxis
-                             update`)
-praxis version              build version, commit, date, runtime
-praxis update               self-update + auto-refresh installed skills
-praxis completion <shell>   bash | zsh | fish | powershell
-praxis logout               delete ~/.praxis/credentials
-praxis --help / -v
+praxis init                       install skill into AI hosts +
+                                   report state JSON
+praxis login                      browser-callback authentication
+                                   --profile X | --url Y | --token Z
+praxis whoami                     live identity check via /auth/me
+praxis status                     local snapshot (no network call)
+praxis logout                     remove credentials
+                                   --profile X | --all
+praxis use <profile>              kubectl-style: set active profile
+praxis install-skill              write the praxis skill into all
+                                   detected AI hosts (Claude Code,
+                                   Codex, Gemini CLI; user-scope only)
+praxis uninstall-skill            remove from every host
+praxis list-skills                what's installed and where
+praxis refresh-skills             rewrite SKILL.md files (auto-called
+                                   by `praxis update`)
+praxis version | update | completion | logout | --help
 ```
 
-## Try it
+## Multiple deployments (internal-support engineers)
 
 ```bash
-brew install Facets-cloud/tap/praxis
-praxis install-skill          # writes the praxis skill to your AI hosts
-praxis list-skills            # confirm where it landed
+praxis login                                            # → "default"
+praxis login --profile acme --url https://acme.console.facets.cloud
+praxis login --profile vymo --url https://vymo.console.facets.cloud
+
+praxis use acme                # all subsequent commands use acme
+praxis whoami                  # → reports acme's identity
+praxis status                  # → reports acme's URL + auth state
+
+# One-shot overrides (no `use` needed):
+praxis whoami --profile vymo
+PRAXIS_PROFILE=vymo praxis status
 ```
 
-## Coming in subsequent releases
+Single-profile users never see this — `praxis login` writes "default"
+and everything resolves there silently.
+
+### Files
 
 ```
-v0.2   login | whoami | mcp list | mcp <mcp> | mcp <mcp> <fn> [--arg val …]
-       Server-driven skill catalog (skill list / show <name>); per-repo
-       Cursor install. The placeholder "praxis" skill gets replaced with
-       real catalogued skills (release-debugging, k8s-investigation,
-       terraform-plan-explain, …).
+~/.praxis/credentials   INI format, matches ~/.facets/credentials
+                         [default]  url, username, token
+                         [acme]     url, username, token
+                         …
+                         (chmod 0600)
+
+~/.praxis/config        Active-profile pointer, set by `praxis use`.
+                         Doesn't exist until first `use` call.
+                         (chmod 0600)
 ```
 
-## Why a CLI (and not an MCP server)?
+## Why a CLI
 
-CLIs run anywhere: any AI host, CI, cron, shell pipelines, your own scripts.
-MCP support varies by tool; `bash -c "praxis …"` doesn't. The CLI also makes
-auth and audit one-per-invocation, so every call is attributable.
+CLIs run anywhere: any AI host, CI, cron, shell pipelines. MCP support
+varies by tool; `bash -c "praxis …"` doesn't. The CLI also makes auth
+and audit per-invocation, so every call is attributable.
 
 ## Develop
 
@@ -95,14 +115,15 @@ Requirements: Go 1.21+.
 ```bash
 git clone https://github.com/Facets-cloud/praxis-cli.git
 cd praxis-cli
-make build           # ./praxis with version stamp
-./praxis --help
-make test
+make build           # builds ./praxis with version stamp
+make test            # go test -race ./...
 make lint            # gofmt + vet + test
+go test -cover ./... # coverage
 ```
 
 Releases are cut by tagging `v*.*.*` and pushing — GitHub Actions runs
-goreleaser, publishes the release, and updates the brew tap.
+goreleaser, publishes the GitHub Release, and updates the Brew tap
+formula automatically.
 
 ## License
 

cmd/init_test.go

@@ -0,0 +1,112 @@
+package cmd
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Facets-cloud/praxis-cli/internal/credentials"
+	"github.com/Facets-cloud/praxis-cli/internal/harness"
+	"github.com/Facets-cloud/praxis-cli/internal/skillinstall"
+)
+
+func resetInitFlags() {
+	initProfile = ""
+	initJSON = false
+}
+
+func TestInitCmd_NoHostsDetected(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("PRAXIS_PROFILE", "")
+	resetInitFlags()
+
+	withSeams(t,
+		func() []harness.Harness { return nil }, // no hosts
+		nil, nil, nil,
+	)
+
+	var buf bytes.Buffer
+	initCmd.SetOut(&buf)
+	if err := initCmd.RunE(initCmd, nil); err != nil {
+		t.Fatalf("RunE err = %v", err)
+	}
+	out := buf.String()
+	if !strings.Contains(out, `"hosts_detected": null`) && !strings.Contains(out, `"hosts_detected": []`) {
+		t.Errorf("expected empty hosts_detected, got %q", out)
+	}
+	if !strings.Contains(out, `"logged_in": false`) {
+		t.Errorf("not logged in → expected logged_in: false, got %q", out)
+	}
+	if !strings.Contains(out, "praxis login") {
+		t.Errorf("expected next-steps to mention praxis login, got %q", out)
+	}
+}
+
+func TestInitCmd_HostsDetected_InstallSkillCalled(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("PRAXIS_PROFILE", "")
+	resetInitFlags()
+
+	withSeams(t,
+		func() []harness.Harness {
+			return []harness.Harness{
+				{Name: "claude-code", Detected: true, SkillDir: "/fake/c"},
+				{Name: "codex", Detected: true, SkillDir: "/fake/x"},
+			}
+		},
+		func(name string, hosts []harness.Harness) ([]skillinstall.Installation, error) {
+			out := make([]skillinstall.Installation, 0, len(hosts))
+			for _, h := range hosts {
+				out = append(out, skillinstall.Installation{
+					SkillName:   name,
+					Harness:     h.Name,
+					Path:        h.SkillDir + "/" + name + "/SKILL.md",
+					InstalledAt: time.Now(),
+				})
+			}
+			return out, nil
+		},
+		nil, nil,
+	)
+
+	var buf bytes.Buffer
+	initCmd.SetOut(&buf)
+	if err := initCmd.RunE(initCmd, nil); err != nil {
+		t.Fatalf("RunE err = %v", err)
+	}
+	out := buf.String()
+	for _, want := range []string{`"claude-code"`, `"codex"`, `"hosts_detected"`, `"skills_installed"`} {
+		if !strings.Contains(out, want) {
+			t.Errorf("output missing %q\nfull: %s", want, out)
+		}
+	}
+}
+
+func TestInitCmd_LoggedIn_NoNextSteps(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("PRAXIS_PROFILE", "")
+	resetInitFlags()
+
+	_ = credentials.Put("default", credentials.Profile{
+		URL: "https://x.test", Token: "sk_live", Username: "u@x",
+	})
+
+	withSeams(t,
+		func() []harness.Harness { return nil },
+		nil, nil, nil,
+	)
+
+	var buf bytes.Buffer
+	initCmd.SetOut(&buf)
+	if err := initCmd.RunE(initCmd, nil); err != nil {
+		t.Fatalf("RunE err = %v", err)
+	}
+	out := buf.String()
+	if !strings.Contains(out, `"logged_in": true`) {
+		t.Errorf("expected logged_in: true, got %q", out)
+	}
+	if strings.Contains(out, "praxis login") {
+		t.Errorf("logged-in profile should NOT trigger 'praxis login' next-step, got %q", out)
+	}
+}