feat(cli): add whoami command

[Prashansa-K]

What and why

Adds supabase whoami, a read-only command that fetches the active user's Management API profile. Text output presents clear user-facing labels, while JSON and stream-JSON expose the stable id, email, and username fields instead of leaking API-specific field names.

Linear: CLI-1280

Usage

$ supabase whoami
USER ID                               USERNAME  EMAIL
00000000-0000-0000-0000-000000000000 example   user@example.com

$ supabase whoami --output-format json
{"id":"00000000-0000-0000-0000-000000000000","email":"user@example.com","username":"example"}

Stream-JSON emits the same identity object under a standard result.data envelope.

Testing strategy

Handler integration coverage exercises the Management API request, all output modes, transport/status/decoding failures, unsupported legacy output flags, machine-mode progress behavior, and telemetry flushing. Focused formatter unit coverage protects text rendering, with the full CLI unit and integration suites covering workspace interactions.

Review

The complete branch diff was reviewed for correctness, test coverage and failure behavior, and scope and maintainability. Follow-up findings were closed by removing externally mutating live coverage, tightening machine-output and failure assertions, documenting inherited filesystem/environment/telemetry behavior, and normalizing the public JSON contract.

[github-actions]

Superseded by a newer AI review

🤖 AI Review

Both independent reviews completed. Claude reported five findings and Codex reported none. After verification, four findings are confirmed as minor/nit quality concerns; the external docs-sidebar finding remains uncertain because this checkout cannot establish whether the required companion entry already exists. No critical or major defects were found.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	apps/cli/src/commands/whoami/whoami.command.ts:17	test-coverage	claude	The command-wrapper override allowing all global -o values is not exercised, so removing it would make -o table and -o csv produce the generic wrapper error without failing the current tests.
🟡 MINOR	apps/cli/src/commands/whoami/whoami.handler.ts:20	error-handling	claude	A well-formed but expired or invalid token receives a generic 401 status message without guidance to run supabase login.
⚪ NIT	apps/cli/src/commands/whoami/whoami.handler.ts:51	consistency	claude	Whoami manually emits JSON and stream events instead of using output.success, making its --output-format success payload omit the message field used by comparable Management API commands.
⚪ NIT	apps/cli/src/commands/whoami/whoami.integration.test.ts:1	test-coverage	claude	The new Management API command has no black-box live or e2e golden-path test covering real command wiring and the real /v1/profile response.
⚪ NIT	apps/cli/src/docs/docs-spec.tables.ts:80	documentation	claude	Publishing the new command also requires a common-cli-sections.json entry in the separate supabase/supabase repository; otherwise its generated page is omitted from the docs site.

Stats

Claude findings: 5 · Codex findings: 0 · Confirmed: 4 · Refuted: 0 · Uncertain: 1

---

Models: claude-opus-5 + gpt-5.6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

[Prashansa-K]

/ai-review

[github-actions]

🤖 AI Review

Both independent reviews completed. Their overlapping formatter-test finding was merged. Four findings are confirmed: two minor quality concerns and two nits; no critical or major defects were found.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	apps/cli/src/commands/whoami/whoami.format.unit.test.ts:17	test-coverage	claude+codex	The text-output tests do not independently verify that the username value is rendered in its own table cell.
🟡 MINOR	apps/cli/src/commands/whoami/whoami.handler.ts:40	consistency	claude	The command duplicates global machine-result framing outside the shared Output implementation to produce its message-free contract.
⚪ NIT	apps/cli/src/commands/whoami/whoami.handler.ts:69	duplication	claude	The unsupported -o/--output message pattern is duplicated across four command handlers instead of using a shared builder.
⚪ NIT	apps/cli/src/command-internal/http-errors.ts:105	style	claude	authenticationFailedStatusMessage is a zero-argument function that always returns the same constant string.

Stats

Claude findings: 4 · Codex findings: 1 · Confirmed: 4 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5 + gpt-5.6-sol · Trigger: manual · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.