refactor(cli): cover login, logout, feedback and test with effect lint (CLI-2430)

[7ttp]

TL;DR

brings the account and a few smol command families under the effect lint, coverage goes from 381 to 424 files.

whats introduced?

effect lint applied to login, logout, feedback and test:

• one allow list entry per family in .oxlintrc.effect.json
• the only handler logic touched is login: the SUPABASE_PROFILE read stays a live process.env read behind a short alias, now pinned by a test; everything else is Effect.fail unwraps to yieldable errors, behavior identical
• cause assertions move to Cause.pretty, env tests onto the shared withEnvVar helper, and the profile persistence tests unset SUPABASE_HOME so an ambient value cannot write outside the temp root
• redaction scans keep their full json surface and gain a positive anchor, and the feedback delete gates pin their exact remediation text
• e2e files move onto the effect native harness with a shared scoped temp home, the live round trip teardown moves under Effect.ensuring, and test new moves onto the FileSystem/Path services

ref:

• closes: CLI-2430

[github-actions]

🤖 AI Review

Only Claude's independent review was available; the Codex review did not complete. All four reported findings were verified and confirmed, with two minor quality concerns and two nits. No user-facing correctness defect was identified.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	apps/cli/src/commands/login/login.handler.ts:51	maintainability	claude	The environment alias deliberately bypasses process-env-in-effect, so adding the login family to Effect lint does not enforce that rule for this read.
🟡 MINOR	apps/cli/src/commands/login/login.integration.test.ts:324	test-isolation	claude	SUPABASE_HOME isolation is limited to the profile-persistence tests, leaving earlier successful tests able to persist an ambient SUPABASE_PROFILE outside their per-test temporary root.
⚪ NIT	apps/cli/src/commands/logout/logout.e2e.test.ts:69	test-quality	claude	The logout E2E tests isolate ambient SUPABASE_ACCESS_TOKEN inconsistently, and the line-69 comment incorrectly says its absence is needed to produce the not-logged-in result.
⚪ NIT	apps/cli/src/commands/feedback/feedback.layers.unit.test.ts:55	test-coverage	claude	No test now exercises feedbackFetch with an undefined init argument because the default-GET test passes { signal }.

Findings outside the diff

• 🟡 MINOR apps/cli/src/commands/login/login.integration.test.ts:324 — SUPABASE_HOME isolation is limited to the profile-persistence tests, leaving earlier successful tests able to persist an ambient SUPABASE_PROFILE outside their per-test temporary root.

Stats

Claude findings: 4 · Codex findings: 0 · Confirmed: 4 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5 + gpt-5.6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

[jgoux]

Please address the Effect lint bypass in login and make the new temp-home cleanup failure policy explicit. The two inline findings concern Effect migration discipline; no production behavior regression was demonstrated.