Smooth mirror onboarding: entire repo mirror create wizard

[toothbrush]

https://entire.io/gh/entireio/cli/trails/660

Adds an interactive onboarding flow and modernizes mirror creation.

User impact

• entire repo mirror create (no args) → interactive wizard: pick repos, pick regions, watch Docker-style per-mirror progress (processing → ready), then a summary table with clone URLs.
• Clone readiness now polls the new Mirror.status API instead of probing smart-HTTP info/refs — faster, and surfaces failed/suspended directly.
• Regions come from GET /api/v1/clusters; the wizard's default selection is jurisdiction-aware (from /me).
• New hidden entire auth token prints the active control-plane bearer for scripting/curl.

Unchanged

• One-shot entire repo mirror create <github-url> [cluster-host] keeps its fixed default cluster and behavior; remove/collaborators untouched.

Stacked on #1518 (OpenAPI refresh) — retarget to main once that merges.

🤖 Generated with Claude Code

---

Note

Medium Risk
Large user-facing change to mirror create (parallel API calls, new polling semantics) plus a hidden command that prints live bearer tokens; behavior is well-guarded (TLS, empty stdout on failure) but affects control-plane onboarding paths.

Overview
Adds interactive mirror onboarding when entire repo mirror create runs with no arguments: onboardable repos from the API, regions from GET /api/v1/clusters, jurisdiction-aware default region selection from /me, then parallel (repo × region) creates with per-line progress and a summary table plus clone URLs.

Clone readiness no longer probes smart-HTTP info/refs or mints repo-scoped tokens for the wait loop. One-shot and wizard paths share createAndAwaitMirror, which polls control-plane Mirror.status via awaitMirrorReady and surfaces ready, failed, and suspended consistently; suspended placements now point users at support instead of an internal admin command.

Also adds hidden entire auth token (same bearer resolution as the API client, stdout-only for scripting), extends auth profile with jurisdiction, and treats cancelled wizard contexts as clean exits in handleFormCancellation. The explicit create <github-url> [cluster-host] form keeps a fixed default cluster; catalog-based region picking is wizard-only.

^{Reviewed by Cursor Bugbot for commit e5692a0. Configure here.}

[Copilot]

Pull request overview

This PR smooths mirror onboarding by adding a zero-argument interactive wizard for entire repo mirror create, and updates clone-readiness waiting to use the control-plane Mirror.status lifecycle instead of probing the data-plane smart-HTTP endpoint. It also adds a hidden entire auth token helper for scripting/curl access.

Changes:

• Add an interactive repo mirror create wizard to select repos and regions and create mirrors in parallel with live progress + a results table.
• Replace clone readiness probing with GET /mirrors/{id} status polling (processing → ready / failed / suspended).
• Add hidden entire auth token command and document it.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
cmd/entire/cli/repo_mirror.go	Routes repo mirror create to wizard when no args; refactors create+wait into shared helpers and updates one-shot output.
cmd/entire/cli/repo_mirror_test.go	Replaces old probe/finish-create tests with status-polling and one-shot reporting tests.
cmd/entire/cli/repo_mirror_probe.go	Implements awaitMirrorReady polling against Mirror.status and updates suspension messaging helper.
cmd/entire/cli/repo_mirror_create_wizard.go	New interactive wizard: repo/region selection, parallel create+poll, live progress, and summary reporting.
cmd/entire/cli/repo_mirror_create_wizard_test.go	Unit tests for wizard helpers (selection filtering, host parsing, ordering, progress non-TTY).
cmd/entire/cli/repo_mirror_collaborators.go	Updates example invocation for collaborators add.
cmd/entire/cli/auth.go	Adds hidden entire auth token command and includes jurisdiction in auth profile for wizard defaults.
cmd/entire/cli/auth_token_test.go	Tests env-token printing and not-logged-in behavior for entire auth token.
CLAUDE.md	Documents the hidden auth token command in the CLI command layout.

[toothbrush]

Addressed the review findings in 7a0ca5c:

• Wizard skips huh conventions (Cursor) — added an interactive.CanPromptInteractively() gate (clear message pointing at the non-interactive create <github-url> [cluster-host] form), and switched both pickers to form.RunWithContext(ctx).
• Empty mirrors skip suspension check (Cursor) — createAndAwaitMirror now does one GetMirror for an existing empty placement and surfaces suspended + resume guidance instead of the benign "nothing to clone" (restores the old finishMirrorCreate behavior; fresh creates can't be suspended, so they're skipped).
• Wizard treats cancel as failures (Cursor) — a cancelled run (Ctrl+C) now exits quietly via SilentError instead of reporting in-flight mirrors as "N mirror(s) failed".
• Suspended/failed lack mirror id + guidance (Copilot) — wizard results for suspended/failed now carry the mirror id and resume command, matching the one-shot's explainSuspendedMirror.
• auth token HTTPS enforcement (Copilot) — now enforces api.RequireSecureURL on the core URL unless --insecure-http-auth, like auth status.

Not changed — false positive: Copilot flagged the for i, t := range targets { g.Go(...) } goroutine as capturing shared loop vars. This repo is Go 1.26 (per-iteration loop variables since 1.22), so the capture is safe — the copyloopvar linter actually removed the explicit i, t := i, t copy earlier as redundant.

Added tests for the TTY gate and non-TTY progress; mise run check green.

[toothbrush]

@cursor review

[toothbrush]

@cursor review

[toothbrush]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e5692a0. Configure here.}