feat: add YAML config file support via koanf

[rgarcia]

Summary

• Add ~/.config/hypeman/cli.yaml support so the CLI can read base_url and api_key from a config file instead of requiring environment variables
• Config precedence: CLI flags > env vars (HYPEMAN_BASE_URL, HYPEMAN_API_KEY) > config file
• Uses koanf for YAML parsing

Companion PR

• Server-side config migration: feat: migrate config system from dotenv to koanf/YAML hypeman#102

Context

This pairs with the server-side config migration in kernel/hypeman to enable a zero-config local experience: the install script generates both the server config.yaml and the CLI cli.yaml with a pre-authenticated token, so users can immediately run hypeman commands after installation without setting any environment variables.

Test plan

• Verify CLI reads base_url and api_key from ~/.config/hypeman/cli.yaml
• Verify env vars override config file values
• Verify --base-url flag overrides both env vars and config file
• Verify CLI works without config file (graceful fallback)

---

Note

Medium Risk
Introduces a new configuration-loading path (file + env overlay) and changes how auth/base URL are resolved across multiple commands, which could affect connectivity/auth behavior if precedence or parsing differs from prior env-only logic.

Overview
Adds YAML-based CLI configuration via ~/.config/hypeman/cli.yaml, loading base_url/api_key with precedence --base-url flag > HYPEMAN_ env vars > config file (defaulting base URL to http://localhost:8080).

Refactors request/client setup and the cp, exec, and push commands to use shared resolveBaseURL/resolveAPIKey helpers (including attaching API key automatically in getDefaultRequestOptions), and updates missing-key errors to mention config-file setup.

^{Written by Cursor Bugbot for commit b959cf4. This will update automatically on new commits. Configure here.}

[cursor]

Bugbot Autofix prepared fixes for 1 of the 1 bugs found in the latest run.

• ✅ Fixed: Auth env var precedence changed unexpectedly
  • Restored the push command's original HYPEMAN_BEARER_TOKEN-first precedence by checking it explicitly before falling back to the shared resolveAPIKey() resolver.

Or push these changes by commenting:

@cursor push 3bcb036975

Preview (3bcb036975)

diff --git a/pkg/cmd/push.go b/pkg/cmd/push.go
--- a/pkg/cmd/push.go
+++ b/pkg/cmd/push.go
@@ -65,7 +65,13 @@
 		return fmt.Errorf("invalid target: %w", err)
 	}
 
-	token := resolveAPIKey()
+	// push historically preferred HYPEMAN_BEARER_TOKEN over HYPEMAN_API_KEY.
+	// Check the legacy variable first to preserve backward compatibility for
+	// environments that export both.
+	token := os.Getenv("HYPEMAN_BEARER_TOKEN")
+	if token == "" {
+		token = resolveAPIKey()
+	}
 
 	// Use custom transport that always sends Basic auth header
 	transport := &authTransport{

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before Autofix could start.}

[cursor]

Push drops legacy token env fallback

Medium Severity

handlePush now reads auth only via resolveAPIKey(), which excludes the previous HYPEMAN_BEARER_TOKEN fallback. Existing environments that still set only HYPEMAN_BEARER_TOKEN will now push without credentials and fail authentication, creating a regression in push behavior.