[milestone] CLI iteration 2

[JoshMock]

All post-MVP tasks that must be completed before a public rollout of CLI v1. Anything here that is currently unclaimed is up for grabs to any developers with free cycles!

[github-actions]

tl;dr: #71 should be treated as an umbrella milestone, and the next implementation priority should be #73 (env-var support for URL/credentials), because Kibana/docs iteration-2 scope is already present while credential sourcing is still config-file-only.

Recommendation

Prioritize #73 first and use #71 as a tracker that links and orders child tasks (#73, #76, #79, then remaining items). The strongest immediate gap is non-interactive auth/config via environment variables; it has clear code touchpoints and low ambiguity.

Findings

1. #71 is currently an umbrella with no concrete acceptance criteria.
   • Issue body is milestone-level only (#71: “second-iteration functionality…bugs found during early testing”), with no checklist/comments yet.
2. Some iteration-2 surface is already implemented (so not all child scope is missing).
   • Kibana dashboard command group exists: cmd/kb_dashboard.go:25-111.
   • Docs search command exists: cmd/docs_search.go:20-53.
3. Auth currently depends on context config fields only; no env fallback path exists.
   • internal/client/auth.go:11-22 reads only ctx.APIKey or ctx.Username/ctx.Password.
   • cmd/config_set_context.go:87-90 flags explicitly note credentials are stored in config file.
   • docs/auth.md:151-156 marks ELASTIC_API_KEY env fallback as future.
4. #75 appears partially addressed already.
   • Default config initialization is implemented: internal/config/config.go:148-179 and invoked on command startup in cmd/root.go:61-66.
5. #79 also appears open/unimplemented today.
   • No codegen terms in workflow files; only CI/release/docs-drift workflows currently exist (.github/workflows/ci.yml, .github/workflows/release.yml, .github/workflows/docs-drift.yml).

Verification

I ran targeted repository checks and the full Go test suite:

$ go test ./...
ok   github.com/elastic/cli/cmd                   0.040s
?    github.com/elastic/cli/cmd/elastic           [no test files]
ok   github.com/elastic/cli/internal/client       0.008s
ok   github.com/elastic/cli/internal/config       0.004s
?    github.com/elastic/cli/internal/mcpproxy     [no test files]
?    github.com/elastic/cli/internal/output       [no test files]
ok   github.com/elastic/cli/internal/telemetry    0.009s
ok   github.com/elastic/cli/tests/agentic         0.004s
?    github.com/elastic/cli/tests/agentic/harness [no test files]
```

```
$ rg -n "ELASTIC_API_KEY|ELASTICSEARCH_URL|ELASTIC_USERNAME|ELASTIC_PASSWORD" .
# matches in tests/docs only; no runtime credential env-var support path in CLI auth/config flow
```

```
$ rg -n "codegen|go:generate|oapi-codegen|openapi-generator|swagger" .github/workflows
# no matches

Detailed Action Plan

1. Convert #71 into an explicit tracker

   • Add a checklist in #71 linking #72-#79 with status/priority and dependency notes.

2. Implement #73 (recommended first delivery)

   • Extend context resolution to support env-var overlays before client construction.
   • Primary touchpoints:
     • cmd/root.go:39-67 (global pre-run config load/init entrypoint)
     • cmd/config_set_context.go:22-80 (validation assumptions currently requiring persisted creds)
     • internal/client/auth.go:11-22 (auth header source)
     • internal/config/config.go:22-34 (context schema and config loading)
   • Define and document precedence (flags/config vs env) and update docs in docs/auth.md.

3. Then implement #76 (input sanitization)

   • Add new sanitize command group and tests; keep transformations explicit and deterministic.

4. Then implement #79 (weekly codegen automation)

   • Add dedicated scheduled workflow under .github/workflows/ for generation + PR creation.

5. Reassess #75 scope and close/split if needed

   • Since config initialization exists (internal/config/config.go:148-179), narrow remaining asks (e.g., allow/deny defaults, stricter validation semantics) into a follow-up issue if distinct.

Related Items

Type	Link	Relevance
Issue	#71	Umbrella milestone under triage
Issue	#73	Highest-confidence concrete gap (env var support)
Issue	#75	Partially implemented already (default config creation exists)
Issue	#79	Likely still open (no codegen automation workflow detected)
Issue	#72	Kibana support request; dashboard commands already present
Issue	#77	Docs search request; command already present
File	internal/client/auth.go:11-22	Auth sources only from config context fields
File	cmd/config_set_context.go:87-90	Credentials described as config-file stored
File	internal/config/config.go:148-179	Default config initialization implementation
File	cmd/root.go:61-66	Init path that ensures config file exists
File	cmd/kb_dashboard.go:25-111	Existing Kibana dashboard command surface
File	cmd/docs_search.go:20-53	Existing docs search command surface
File	.github/workflows/ci.yml	Current CI workflow (no codegen step)
File	.github/workflows/release.yml	Release workflow (build/package only)
File	.github/workflows/docs-drift.yml	Existing scheduled workflow unrelated to codegen

Note

🔒 Integrity filtering filtered 1 item

Integrity filtering activated and filtered the following item during workflow execution.
This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.

• issue:#unknown (search_issues: has secrecy requirements that agent doesn't meet. The agent is not authorized to access private-scoped data.)

---

What is this? | From workflow: Issue Triage

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.