[P0] /v1/me via configured API origin (CLI audit P0-4)

[echobt]

Summary

Fixes CLI audit P0-4: the TUI runner no longer sends the stored bearer to a hard-coded https://api.cortex.foundation/auth/me before the first frame (staging tokens were leaking to production, and /auth/me is not the product path).

• CodeAgentClient::fetch_me calls GET {base}/v1/me on the same origin resolver as device login and turns (CORTEX_API_URL).
• The request is capped at 3s including body parse, and applied on the event-loop tick, so startup no longer blocks the render path.
• cortex whoami is a live /v1/me check, honours CORTEX_HOME (does not fall back to $HOME/.cortex), and exits non-zero on 401 with the cortex login recovery copy.
• /v1/me client and TUI apply helpers live in dedicated modules so code_agent.rs, state.rs, and event_loop/core.rs do not grow past their existing line-count caps.
• No chrome or lock-screenshot changes (CLI_100_CHROME_LOCK_SIGNED).

Rebase: replayed onto origin/main 9154266 (#49 Cloud-default + #51 green lock packs). Only conflict: src/cortex-engine/src/client/mod.rs (two commits). Kept both mod computer / DISCONNECTED_RUNTIME from #49 and the /v1/me me module exports. New HEAD: 3d178068add022ad1f36698390ec1d22c9b19fbc. GitHub now reports mergeable=MERGEABLE. Leave squash-merge to Oding.

Test plan

• cargo fmt --all -- --check (post-rebase)
• Clippy on -p cortex-engine -p cortex-cli -p cortex-tui --all-targets with the CI allow list (-D warnings)
• Targeted tests (post-rebase):
  • cargo test --locked -p cortex-engine --lib -- fetch_me me_url
  • cargo test --locked -p cortex-engine --test runtime_contract_client (Cloud-default from [P0] default Code runtime to Cloud (CLI audit P0-1) #49)
  • cargo test --locked -p cortex-cli --test whoami_me --test exec_runtime
  • cargo test --locked -p cortex-tui -- apply_me_profile snapshot_motd_shows_org ux_contract_me_profile me_profile_request_url
• Schema regen not required (python3 scripts/readiness/schema.py --write not needed)
• cargo audit — cargo-audit is not installed in this environment (CI Security Audit is green)
• Source/dependency policy: over-limit files stay at or below their main sizes
• Local functional/security QA of this change: wiremock proves the bearer goes only to CORTEX_API_URL /v1/me

Attestation (required)

I attest that:

• Security reviewed — the bearer is sent only to the configured API origin (CORTEX_API_URL / CodeAgentClient base). Isolated CORTEX_HOME does not inherit $HOME/.cortex. No secrets, tokens, or keyring dumps are in the change.
• Product-facing errors — 401/timeout use Cortex product copy (cortex login / The coding service is temporarily unavailable). No raw provider, SDK, or transport names.
• TUI verified — identity apply is covered by a unit test plus a headless MOTD snapshot at two sizes and an event-loop ux-contract test. No TTY run in this environment. No chrome/lock edits.
• Tests added — wiremock proves /v1/me is the only host contacted; stalled body times out inside 3s; whoami against a 401 fixture prints the login copy and exits non-zero. No mock-success.
• No secrets — no API keys, WorkOS secrets, R2/AWS credentials, or .env files are included.

Risk

Auth/API-contract: identity and whoami now depend on live GET /v1/me. A staging CORTEX_API_URL no longer forwards the bearer to production. Slow /v1/me no longer freezes TUI open (org may stay Personal until the background fetch lands).

  

[greptile-apps]

Greptile Summary

This PR moves identity lookup to GET /v1/me on the configured API origin, applies TUI identity asynchronously, and converts cortex whoami into a live identity check. The configured-origin routing is consistent, but three correctness issues remain:

• The three-second timeout does not cover successful response-body consumption.
• whoami can fall back outside CORTEX_HOME and use the default profile.
• The new subprocess/Wiremock tests block the runtime needed to serve their fixtures.

Confidence Score: 2/5

The PR is not yet safe to merge because its timeout contract, CORTEX_HOME credential isolation, and new integration tests are broken in realistic execution paths.

A slow successful response body can bypass the intended three-second cap, whoami can select credentials from the default profile despite an isolated CORTEX_HOME, and the new Wiremock tests can starve their own server by blocking a single-thread Tokio runtime.

Files Needing Attention: src/cortex-engine/src/client/me.rs, src/cortex-cli/src/cli/handlers.rs, src/cortex-cli/tests/whoami_me.rs

Important Files Changed

Filename	Overview
src/cortex-engine/src/client/me.rs	Adds configured-origin /v1/me fetching and profile parsing, but scopes the three-second timeout too narrowly.
src/cortex-cli/src/cli/handlers.rs	Makes whoami perform a live identity request, but its final credential fallback bypasses CORTEX_HOME.
src/cortex-cli/tests/whoami_me.rs	Adds configured-origin and unauthorized-response integration tests whose blocking subprocess calls starve their current-thread Wiremock runtime.
src/cortex-tui/src/runner/app_runner/runner.rs	Replaces the hard-coded pre-render identity request with a background request using the provider manager's configured origin.
src/cortex-tui/src/runner/event_loop/me.rs	Polls and applies the completed identity task without awaiting an unfinished request on the render path.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    Config[CORTEX_API_URL] --> Client[CodeAgentClient]
    Token[Resolved bearer] --> Client
    Client -->|GET /v1/me| API[Configured API origin]
    API -->|Headers| HeaderTimeout[3-second timeout ends]
    HeaderTimeout -->|Body parsing currently outside timeout| Profile[MeProfile]
    Profile --> CLI[cortex whoami output]
    Profile --> Task[TUI background task]
    Task --> Tick[Event-loop tick]
    Tick --> State[Apply identity and rerender]

Loading

_{Reviews (1): Last reviewed commit: "refactor: extract /v1/me to keep file-le..." | Re-trigger Greptile}