fix: harden login env-validation, Inf/NaN schema inference, and log-scanner buffer (bug-hunt MED)

[LukasWodka]

Summary

MED-severity hardening fixes from the 2026-07-09 adversarial bug-hunt of the CLI ingest/submit/auth paths. Independent fixes grouped as one PR (per the cli#199 batch-finding precedent).

Rebased onto develop (2026-07-10).#185/#210 landed the di#349 tabular-inference mirror, whose float grammar already rejects Inf/NaN — so fix#2's production change is now redundant and was dropped on rebase, kept only as a regression test (§2). Fix#3 was reworked per @saadqbal's review (§3) — a bigger buffer only moved the threshold; the real fix is to keep draining.

1. fix(auth) — reject unknown --env/$CLIENT_ENV at login

BaseURL falls unknown/typo env values back to prod (a lenient library default), so login --env staging or CLIENT_ENV=prd silently targeted productionand persisted it as the active session env for every later command. This is the class behind the earlier "did I hit dev or prod?" confusion.

login is where a human picks the session env, so a typo must fail there. Added api.IsKnownEnv (dev/stg/prod, case-insensitive) and validate the resolved env at runLogin entry, before any network call. ResolveEnv still maps empty→prod, so the no-flag default is unaffected; BaseURL's unknown→prod fallback is deliberately unchanged (TestBaseURL asserts it).

2. test(push) — pin Inf/NaN → not FLOAT (regression only, after #210)

Go's strconv.ParseFloat accepts "Inf"/"Infinity"/"NaN", so a naive inference would type such a column FLOAT — but the ingestor's FLOAT cast (DataValidator's non-finite guard) rejects it, so the cluster would refuse the auto-inferred schema only after the upload.

#185/#210's di#349 floatRE grammar pre-screens the token before ParseFloat, so inf/NaN already fall through to VARCHAR. The original production fix is therefore redundant and was dropped on rebase — kept as TestInferSchema_NonFiniteIsNotFloat, since no parity-fixture case covers non-finite.

3. fix(submit) — drain past ErrTooLong so a giant tqdm line can't force a false exit 9

tqdm (a data-ingestors dep) redraws its progress bar with \r and no \n, so a whole ingestion phase's redraws are one newline-delimited "line" that grows for the life of the run. Once it outgrows the display scanner's buffer, the scanner returns bufio.ErrTooLong.

The tee that feeds the summary parser is pulled only by that display scanner (thanks @saadqbal for catching this — the original "the parser is fed separately, so this cap never affects the verdict" premise was wrong). So an ErrTooLong bail stops the parser from ever seeing the rest of the stream, including the closing banner. A still-running Job then couldn't be confirmed terminal in the 30s finalJobStatus poll → watch returned a false exit 9 on a healthy large ingestion. Simply raising the cap only moves that threshold.

Fix: extracted the display/parse loop into streamDisplayAndParse; on bufio.ErrTooLong it drains the rest of the stream through the tee (io.Copy → io.Discard) so the parser still resolves the summary, and treats the over-long display line as non-fatal — the Job status poll is the verdict's source of truth. Genuine read failures (network drop / ctx cancel) still propagate. 16 MB is kept as generous display headroom, but the drain (not the cap) is the correctness guarantee.

Test plan

• go build ./..., go vet ./..., go test ./... — all green (rebased on develop).
• auth: TestIsKnownEnv + TestResolveEnv (api) — known/unknown env classification; ResolveEnv empty→prod default unchanged.
• push: TestInferSchema_NonFiniteIsNotFloat — a non-finite column infers VARCHAR, not FLOAT.
• submit: TestStreamDisplayAndParse_DrainsPastOversizedLineSoParserSeesBanner — an oversized \r-line + the real ingestor banner → the parser still resolves the summary (no false exit 9); ..._GenuineReadErrorPropagates — a real mid-stream read error stays fatal.

🤖 Generated with Claude Code

[saadqbal]

Solid PR — auth env-validation and the Inf/NaN demotion both look right (checked the other ResolveEnv callers; they fail safe). One non-blocking note inline on the scanner-buffer bump.

[LukasWodka]

Pushed + rebased onto develop. Two changes since your review:

1. Fix Promote kubeconfig flags (--kubeconfig/--context/--namespace) to persistent on root #3 (the one you flagged) — you were right that 16 MB just moves the threshold. The tee is pulled only by the display scanner, so an ErrTooLong bail truncates the parser's view and the banner is lost → the same false exit 9. Now streamDisplayAndParse drains the rest of the stream through the tee on ErrTooLong (non-fatal; Job status is the source of truth), with tests for both the drain and the genuine-read-error path. Details in the inline thread.
2. Fix Phase 2: kubeconfig discovery + parent release detection + SA token #2 (Inf/NaN) — data ingest: collect + confirm the data schema for all tabular tasks (RFC-0002) #185/feat(data ingest): confirm the inferred tabular schema (#185) #210 landed the di#349 inference mirror, whose floatRE grammar already rejects Inf/NaN, so the production change is now redundant. Dropped it on rebase and kept it only as a regression test (no parity-fixture case covered non-finite).

Net PR is now: auth env-validation + the submit drain fix + the Inf/NaN regression test. All green — ready for another look.