feat(cli): add persistent configuration management commands

[tao-xiaoxin]

Closes#36

Summary by CodeRabbit

• New Features
  • Enhanced devspace config with effective configuration output and dedicated subcommands for host, port, domain/public URL, and owner password.
  • Improved configuration help under devspace --help config, plus clearer top-level version/help behavior.
• Bug Fixes
  • Owner password updates now reliably mask access credentials and clear persisted OAuth client/token data.
  • Strengthened validation and normalization for host/domain/public URL inputs.
• Documentation
  • Updated setup and configuration docs with new command examples, input rules, and restart requirements.
• Tests
  • Expanded CLI and end-to-end tests covering help/version output and config mutation behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 58632262-cf24-4982-a248-c625e70d0dd3

📥 Commits

Reviewing files that changed from the base of the PR and between c4c0df3 and d7a77b6.

📒 Files selected for processing (2)

• src/config-operations.test.ts
• src/config-operations.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• src/config-operations.test.ts
• src/config-operations.ts

---

📝 Walkthrough

Walkthrough

Adds persistent devspace config commands for showing and updating settings, separates server settings from OAuth parsing, clears OAuth state when the owner password changes, and updates CLI help, tests, and documentation.

Changes

Persistent Config Management Commands

Layer / File(s)	Summary
Config split and OAuth clearAll src/config.ts, src/oauth-store.ts	Adds ServerSettings and loadServerSettings() in config.ts, reworks loadConfig() to append OAuth parsing, and adds SqliteOAuthStore.clearAll() to delete OAuth tokens and clients in one transaction.
Config operations module src/config-operations.ts	Adds config show and update functions for effective config, host, port, domain, publicBaseUrl, and owner password, along with validation, normalization, and secret masking helpers.
CLI routing and help text src/cli.ts	Expands imports, routes top-level help and config help targets, rewrites config command handling for show/get/host/port/domain/key, and adds output helpers plus updated help/version text.
CLI and config operation tests src/config-operations.test.ts, src/cli.test.ts, package.json	Adds integration coverage for config operations, CLI version and help output, config subcommand behavior, masked access keys, password updates, invalid inputs, and broken-state error handling; updates the test script to include the new suite.
README and docs updates README.md, docs/configuration.md, docs/setup.md	Adds configuration management and CLI help sections to README.md, rewrites the configuration command reference, and updates the setup guide to use config domain for persistent public URLs.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Poem

🐇 I hopped through configs, neat and new,
Port, host, and domain all came in view.
The owner key got tucked away,
And old OAuth tokens lost their stay.
devspace config now sings to me!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately describes the main change: adding persistent configuration management commands.
Linked Issues check	✅ Passed	The changes implement the requested devspace config commands, masking, compatibility, help behavior, OAuth revocation, and documentation/tests.
Out of Scope Changes check	✅ Passed	The added code, tests, and docs are all directly tied to the configuration-management feature set.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/cli.ts`:
- Around line 281-289: The key handling in the cli.ts subcommand branch exposes
the Owner password when passed positionally, so update the key flow around
setConfigKey to support a safer input path. Use the existing `@clack/prompts`
import to prompt for the secret when no value is provided, and/or add stdin
reading as a fallback in the key command path; keep the current output logic in
place and document the non-positional prompt-based usage as the recommended
approach.
- Around line 52-60: `devspace help config` currently falls through to the
unknown-help-target error because the config-help branch in `src/cli.ts` only
accepts `--help`/`-h`. Update the help handling logic around `normalizeCommand`
and the `printConfigHelp` branch so the command `help` is treated the same as
`--help`/`-h` when the subcommand is `config`, while preserving the existing
behavior for other help targets and the final error path.
In `@src/config-operations.ts`:
- Around line 140-150: The validateHost function only checks the full hostname
string, so it can still accept invalid label patterns like empty labels,
leading/trailing hyphens, or labels over 63 characters. Update validateHost to
validate each hostname label separately after the existing
scheme/slash/whitespace checks, while still allowing valid IPs and localhost,
and keep the invalid-host errors consistent for the validateHost path.
- Around line 168-171: The maskSecret helper currently reveals partial secret
characters by returning the first 3 and last 2 characters for longer values,
which should not happen for human passwords. Update maskSecret in
config-operations.ts to always return a fixed masked/configured marker for any
present secret, while still returning the not-configured marker when the value
is missing. Keep the change localized to maskSecret so any config output using
this helper no longer exposes password material.
- Around line 88-103: The setConfigPublicBaseUrl function is incorrectly
delegating URL values to setConfigDomain, which only validates hostnames and
breaks valid publicBaseUrl entries like https://example.com. Update
setConfigPublicBaseUrl to validate and persist full URLs itself while keeping
setConfigDomain hostname-only, and use the existing
writeDevspaceConfig/loadDevspaceFiles flow so publicBaseUrl continues to be
stored correctly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c6cacc44-09e0-4dc9-8082-81ecdf0cf525

📥 Commits

Reviewing files that changed from the base of the PR and between 65be252 and fa1d24a.

📒 Files selected for processing (10)

• README.md
• docs/configuration.md
• docs/setup.md
• package.json
• src/cli.test.ts
• src/cli.ts
• src/config-operations.test.ts
• src/config-operations.ts
• src/config.ts
• src/oauth-store.ts

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/config-operations.ts`:
- Around line 102-106: The MCP URL generation in the config display/update flow
is dropping any existing path from legacy publicBaseUrl values. Update the
config-show output and the update message in src/config-operations.ts to use the
same path-preserving helper used by the publicBaseUrl normalization logic
instead of constructing the URL directly with new URL(MCP_PATH, publicBaseUrl).
Refer to normalizeConfiguredPublicBaseUrl and the message returned after
writeDevspaceConfig so both places preserve the persisted path segment.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 197a4dc8-d727-4758-bf0e-5fbb77451b34

📥 Commits

Reviewing files that changed from the base of the PR and between fa1d24a and c4c0df3.

📒 Files selected for processing (5)

• README.md
• src/cli.test.ts
• src/cli.ts
• src/config-operations.test.ts
• src/config-operations.ts

✅ Files skipped from review due to trivial changes (1)

• README.md

🚧 Files skipped from review as they are similar to previous changes (3)

• src/config-operations.test.ts
• src/cli.test.ts
• src/cli.ts