[roncodes]

Phase 0 (stabilise) of the Extensions Registry re-architecture, CLI side. Small, backwards-compatible fixes so developer accounts, the CLI and the registry are usable while the Registry Service is built.

Summary

• Config file: ~/.fleetbase/config.json holding { host, registry, tokens: { "<host>": "<token>" }, defaultOrganization }, created with mode 0600. FLEETBASE_HOME overrides the directory (used by tests).
• set-auth stores the token in the config file keyed by registry host (and by API host, plus saves host, when --host is given). It still writes <instance>/api/auth.json for Composer and no longer appends to <instance>/console/.npmrc. The token argument is optional when one is already stored.
• bundle --upload / bundle-upload read the token from --auth-token, then the config file. ~/.npmrc is no longer consulted. The error handler guards error.response?.data.
• --host <url>: global option plus per-command --host on install, uninstall, bundle, bundle-upload, search, register, verify, resend-verification, generate-token, login, set-auth. Precedence: flag > config file > https://api.fleetbase.io. All registry URLs are built from the host; the hard-coded packageLookupApi / bundleUploadApi / extensionsListApi constants are removed. Global options are positional so install-fleetbase --host keeps its own meaning.
• Host normalisation in one helper: existing scheme kept; http:// for localhost, 127.0.0.1 and hosts with a port; https:// otherwise.
• scaffold: fix the const reassignment crash when the target directory exists; remove the duplicate -n (namespace is --namespace only); --repo has no default so extension.json / package.json no longer point at the starter repo.
• login: accepts --host (used as the registry unless --registry is given); npm-cli-login is wrapped in a promise so failures are caught and exit non-zero. The package's default export is callback based and threw from inside async callbacks.
• Tokens are never printed by default: verify and generate-token save the token to the config file and show it masked; --show-token prints it.
• install / uninstall / scaffold exit 1 on failure.
• Tests: test/cli.test.js (plain node:assert, run by npm test) covers host normalisation, config read/write, token storage and lookup, host precedence and option registration.
• README updated for the config file, --host, and the set-auth / login / scaffold / bundle changes.

Behaviour changes to be aware of

• Bundle uploads no longer fall back to ~/.npmrc. A user who only ran flb login must run flb set-auth <token> once; the error message says so.
• scaffold -n now only means --name.
• -h, --host on register / verify / search is unchanged.

Verification

• npm test: 17/17 pass.
• Against a local mock API: verify masks and saves the token and --show-token prints it; bundle-upload sends the stored token and --auth-token overrides it; a 403 is reported cleanly with exit 1; install hits the lookup URL on the given host and exits 1 when pnpm fails; search uses the host from the config file; login against a closed port exits 1 with a clear error.