feat: elastic config command group + credential-safe project create (#216)

* feat: add `elastic config` command group for authoring contexts (#75)

New flag-driven command tree for creating and maintaining the config file
without hand-editing YAML:

  elastic config context list/add/edit/remove
  elastic config current-context get/set

`edit` supports both `--set key=value` patch mode and an `$EDITOR` round-trip.

Secrets are written to the OS keychain when available (macOS `security`,
Linux `secret-tool`/`pass`, Windows Credential Manager) via a new
`SecretStore` abstraction that shells out to the same tools the existing
read-side resolvers use. The YAML holds a `$(keychain:...)` resolver
expression rather than the raw secret, mirroring the read side. When no
keychain is available (or `--inline-secrets` is passed), values are written
inline and the file is chmod'd to 0600.

`loadConfig` now emits an stderr warning when a loaded config has inline
secrets at looser-than-0600 permissions, pointing at chmod 0600 or the new
`config context edit` migration path.

Skips the config-loading preAction hook for `config` descendants so the
commands tolerate the file being absent (they create it).

* feat: add --save-as / --credentials-file to serverless project create (#154)

`serverless {es,observability,security} projects create` and
`reset-credentials` gain three new flags to keep admin credentials off
stdout -- critical for agent/LLM workflows where captured output persists
into model context and transcripts.

  --save-as <name>          store returned creds in the OS keychain,
                            upsert a context bound to the new project's
                            endpoints, and redact stdout. Next command
                            runs as `elastic --use-context <name> ...`
                            with zero manual wiring.
  --credentials-file <path> write a standalone 0600 YAML config fragment
                            at <path> instead of mutating the main config.
  --force                   overwrite an existing context / file.

`reset-credentials --save-as <ctx>` updates the named context's auth in
place -- URLs preserved, only passwords rotate. Without either flag,
behaviour is unchanged.

Reuses the `SecretStore` abstraction from the `elastic config` commands so
a single keychain namespace covers both authored and auto-generated creds.

Author: MattDevy

README.md

@@ -67,6 +67,62 @@ Override `current_context` for a single command with `--use-context <name>`.
 Each context can have any combination of service blocks (`elasticsearch`, `kibana`, `cloud`).
 Authentication can also use `username` + `password` instead of `api_key`.
 
+### Authoring the config from the CLI
+
+Instead of hand-editing YAML, the `elastic config` command group creates and
+maintains contexts and stores secrets in the OS keychain when available
+(macOS Keychain, Linux libsecret, `pass`, Windows Credential Manager). The YAML
+then holds a `$(keychain:...)` / `$(secret_service:...)` / etc. resolver
+expression rather than the raw secret.
+
+```bash
+# Add a new context (API key goes to the keychain; YAML gets $(keychain:...))
+elastic config context add local \
+  --es-url http://localhost:9200 \
+  --es-api-key your-api-key
+
+# List contexts (the current one is marked)
+elastic config context list
+
+# Switch the active context
+elastic config current-context set staging
+
+# Flag-patch an existing context
+elastic config context edit local --es-url http://localhost:9201
+
+# Open the context as YAML in $EDITOR for free-form edits
+elastic config context edit local
+
+# Remove a context (keychain entries are cleaned up)
+elastic config context remove old-lab
+```
+
+If no OS keychain is available (or you pass `--inline-secrets`), the secret is
+written inline and the file is `chmod 0600`. A warning is emitted whenever a
+loaded config has inline secrets at looser-than-0600 permissions.
+
+### Credential-safe project creation
+
+For agent/LLM workflows, `serverless projects create` and `reset-credentials`
+accept `--save-as <context>` to avoid leaking admin credentials through stdout:
+
+```bash
+elastic cloud serverless es projects create --wait --save-as scratch \
+  --name scratch-es --region-id aws-us-east-1
+
+# stdout has endpoints + a `savedAs: scratch` marker, password is redacted.
+# The keychain now holds scratch:elasticsearch.auth.password etc.
+elastic --use-context scratch stack es indices list
+
+# Rotate creds; URL stays, only the password moves.
+elastic cloud serverless es projects reset-credentials --id <id> \
+  --save-as scratch --force
+```
+
+`--credentials-file <path>` is an alternative that writes a standalone YAML
+config fragment (0600) at `<path>` instead of mutating the main config. Either
+flag makes stdout safe to capture into an LLM transcript.
+
 ### External credentials
 
 Instead of storing secrets in plaintext, any string value in the config file can

src/cli.ts

@@ -37,6 +37,11 @@ program.hook('preAction', async (thisCommand, actionCommand) => {
   if (actionCommand.name() === 'version') return
   // docs commands use public elastic.co APIs — no config required
   if (actionCommand.parent?.name() === 'docs') return
+  // `config` commands author the config file itself — loading it would be
+  // circular (and must tolerate the absence of a file)
+  for (let c = actionCommand.parent; c != null; c = c.parent) {
+    if (c.name() === 'config') return
+  }
   const { configFile: configPath, useContext: contextName } = thisCommand.opts()
 
   if (configPath == null && contextName == null && earlyConfig?.ok === true) {
@@ -134,10 +139,17 @@ if (firstArg === 'docs') {
   program.addCommand(defineGroup({ name: 'docs', description: 'Search, read, and ask questions about Elastic documentation' }))
 }
 
+if (firstArg === 'config') {
+  const { registerConfigCommands } = await import('./config/commands.ts')
+  program.addCommand(registerConfigCommands())
+} else {
+  program.addCommand(defineGroup({ name: 'config', description: 'Author and maintain the elastic config file' }))
+}
 // Load config early so --help can hide blocked commands. Skip for commands
-// that don't need config (e.g. `version`) to avoid unnecessary file I/O.
+// that don't need config (e.g. `version`, or `config` which authors the file)
+// to avoid unnecessary file I/O and a confusing "no config found" path.
 // The result is cached in earlyConfig so the preAction hook can reuse it.
-if (firstArg !== 'version') {
+if (firstArg !== 'version' && firstArg !== 'config') {
   earlyConfig = await loadConfig({})
   if (earlyConfig.ok) {
     setResolvedConfig(earlyConfig.value)