fix: unify credential resolution across all commands

- Add resolveBaseURL() and resolveAPIKey() helpers to config.go
- Update exec, cp, and push commands to use shared helpers
- All commands now consistently use: flag > env > config file
- WebSocket commands no longer bypass cli.yaml configuration

Author: rgarcia

pkg/cmd/config.go

@@ -7,6 +7,7 @@ import (
 	"github.com/knadh/koanf/parsers/yaml"
 	"github.com/knadh/koanf/providers/file"
 	"github.com/knadh/koanf/v2"
+	"github.com/urfave/cli/v3"
 )
 
 // CLIConfig holds CLI configuration loaded from cli.yaml
@@ -44,3 +45,32 @@ func loadCLIConfig() *CLIConfig {
 	_ = k.Unmarshal("", cfg)
 	return cfg
 }
+
+// resolveBaseURL returns the effective base URL with precedence:
+// CLI flag > env var > config file > default.
+func resolveBaseURL(cmd *cli.Command) string {
+	if u := cmd.Root().String("base-url"); u != "" {
+		return u
+	}
+	if u := os.Getenv("HYPEMAN_BASE_URL"); u != "" {
+		return u
+	}
+	cfg := loadCLIConfig()
+	if cfg.BaseURL != "" {
+		return cfg.BaseURL
+	}
+	return "http://localhost:8080"
+}
+
+// resolveAPIKey returns the effective API key with precedence:
+// env var > config file.
+func resolveAPIKey() string {
+	if k := os.Getenv("HYPEMAN_BEARER_TOKEN"); k != "" {
+		return k
+	}
+	if k := os.Getenv("HYPEMAN_API_KEY"); k != "" {
+		return k
+	}
+	cfg := loadCLIConfig()
+	return cfg.APIKey
+}

pkg/cmd/cp.go

@@ -145,18 +145,12 @@ func handleCp(ctx context.Context, cmd *cli.Command) error {
 		return err
 	}
 
-	// Get base URL and API key
-	baseURL := cmd.Root().String("base-url")
-	if baseURL == "" {
-		baseURL = os.Getenv("HYPEMAN_BASE_URL")
-	}
-	if baseURL == "" {
-		baseURL = "http://localhost:8080"
-	}
+	// Get base URL and API key (flag > env > config file)
+	baseURL := resolveBaseURL(cmd)
 
-	apiKey := os.Getenv("HYPEMAN_API_KEY")
+	apiKey := resolveAPIKey()
 	if apiKey == "" {
-		return fmt.Errorf("HYPEMAN_API_KEY environment variable required")
+		return fmt.Errorf("API key required: set HYPEMAN_API_KEY or configure api_key in ~/.config/hypeman/cli.yaml")
 	}
 
 	archive := cmd.Bool("archive")

pkg/cmd/exec.go

@@ -145,18 +145,12 @@ func handleExec(ctx context.Context, cmd *cli.Command) error {
 		return fmt.Errorf("failed to marshal request: %w", err)
 	}
 
-	// Get base URL and API key
-	baseURL := cmd.Root().String("base-url")
-	if baseURL == "" {
-		baseURL = os.Getenv("HYPEMAN_BASE_URL")
-	}
-	if baseURL == "" {
-		baseURL = "http://localhost:8080"
-	}
+	// Get base URL and API key (flag > env > config file)
+	baseURL := resolveBaseURL(cmd)
 
-	apiKey := os.Getenv("HYPEMAN_API_KEY")
+	apiKey := resolveAPIKey()
 	if apiKey == "" {
-		return fmt.Errorf("HYPEMAN_API_KEY environment variable required")
+		return fmt.Errorf("API key required: set HYPEMAN_API_KEY or configure api_key in ~/.config/hypeman/cli.yaml")
 	}
 
 	// Build WebSocket URL

pkg/cmd/push.go

@@ -35,13 +35,7 @@ func handlePush(ctx context.Context, cmd *cli.Command) error {
 		targetName = args[1]
 	}
 
-	baseURL := cmd.String("base-url")
-	if baseURL == "" {
-		baseURL = os.Getenv("HYPEMAN_BASE_URL")
-	}
-	if baseURL == "" {
-		baseURL = "http://localhost:8080"
-	}
+	baseURL := resolveBaseURL(cmd)
 
 	parsedURL, err := url.Parse(baseURL)
 	if err != nil {
@@ -71,10 +65,7 @@ func handlePush(ctx context.Context, cmd *cli.Command) error {
 		return fmt.Errorf("invalid target: %w", err)
 	}
 
-	token := os.Getenv("HYPEMAN_BEARER_TOKEN")
-	if token == "" {
-		token = os.Getenv("HYPEMAN_API_KEY")
-	}
+	token := resolveAPIKey()
 
 	// Use custom transport that always sends Basic auth header
 	transport := &authTransport{