feat(cli): import/export verbs + Pathbase round-trip

[eliothedeman]

Summary

Collapse the external-boundary CLI surface to two symmetric verbs, with Pathbase as a peer source/target to claude, gemini, codex, opencode, pi, git, and github — not a privileged verb pair.

• path import <source> — ingest into ~/.toolpath/documents/<cache-id>.json
• path export <target> — emit from toolpath into external formats
• path cache ls | rm — list / remove cached documents

The Pathbase round-trip (asked for)

• path import pathbase <id-or-url> — GET /api/v1/traces/:id → cache
• path export pathbase --input <ref> — POST /api/v1/traces ← cache or file

<ref> accepted by export resolves as a bare cache id first, falling back to a filesystem path. Auth reuses the existing path auth login / ~/.toolpath/credentials.json flow.

Server endpoints don't exist yet. CLI surfaces a clean connection/404 error until they ship. Tracked separately.

New files

• crates/toolpath-cli/src/cmd_pathbase.rs — shared HTTP/session plumbing (extracted from cmd_auth.rs), plus traces_post / traces_get / require_session
• crates/toolpath-cli/src/cmd_cache.rs — cache directory (0700), file writes (0600), cache_ref resolver, ls/rm subcommands, slug generation
• crates/toolpath-cli/src/cmd_import.rs — per-source handlers (was cmd_derive.rs), plus Pathbase source
• crates/toolpath-cli/src/cmd_export.rs — Claude + Pathbase targets (supersedes cmd_incept.rs + cmd_project.rs)

Deprecations

One-release overlap; each prints a stderr warning and delegates into the new handler:

• path derive → path import (stdout preserved via implicit --no-cache)
• path incept → path export claude --project <dir>
• path project claude → path export claude

Ergonomics

• --no-cache on import sends JSON to stdout for shell composition with render | query | validate
• --force to overwrite an existing cache entry; default is error-on-exists for uniformity across every source
• $TOOLPATH_CONFIG_DIR overrides the cache root (already honored by the credentials helper)

Test plan

• cargo build --workspace (excl. toolpath-desktop)
• cargo test --workspace (excl. toolpath-desktop) — 33 binaries, 0 failures, 156 unit + 24 integration on toolpath-cli
• cargo clippy --workspace --all-targets -- -D warnings — clean (includes fix for a pre-existing needless_borrow in toolpath-convo/src/lib.rs:1026 and an #[allow(deprecated)] for the pre-existing assert_cmd::cargo_bin in render_md_snapshots.rs)
• All 12 example documents validate
• End-to-end smoke:
  • path import git --repo . --branch main writes cache + prints path
  • path cache ls surfaces the entry; path cache rm removes it
  • path import git --no-cache | path render md composes
  • path derive git still works and warns
  • path export pathbase --input <ref> without login errors with Not logged in. Run \path auth login`.`
  • path import pathbase <id> without login errors the same way

Follow-ups (out of scope)

• Server endpoints POST/GET /api/v1/traces[/:id]
• Projectors for gemini / codex / opencode / pi targets (each needs a ConversationProjector impl in the respective crate)
• Switch toolpath-desktop's upload stub to call cmd_pathbase::traces_post once the server is real
• path cache gc — size-based pruning
• Remove the derive / incept / project aliases one release later

[github-actions]

🔍 Preview deployed: https://69e3b4ef.toolpath.pages.dev