docs: sync AGENTS.md + README.md to CLI v0.7.0

[ord669]

Summary

Syncs the webhook-starter-kit's AI-agent docs to CLI v0.7.0 source-of-truth. Docs-only; src/index.js (the kit code) is unchanged because the forwarder signs JSON.stringify(body) and V8 JSON.stringify is deterministic — parsed+restringified on the kit side is byte-equivalent (see forwarder/src/webhook/webhook.service.ts:251-254).

Based on a 38-gap audit (/tmp/hookmyapp-skills-audit.md — 38 gaps identified against CLI v0.7.0).

AGENTS.md

• Add hookmyapp login --code <bootstrap> zero-browser alternative to step 2.
• Replace 3→5 env-key mapping prose with an explicit table in Production step 4.
• Document hookmyapp webhook set <waba-id> --verify-token <token> in step 5.
• Rewrite the signature-verification section: the customer-facing contract is a SINGLE shape (X-HookMyApp-Signature-256 keyed on VERIFY_TOKEN) in both sandbox and production. The previous guidance that production uses X-Hub-Signature-256 keyed on Meta's APP_SECRET was wrong — the forwarder verifies Meta's signature internally and re-signs with the customer's VERIFY_TOKEN in both environments.
• Add sandbox listen --verbose and --reinstall-tunnel-binary to the troubleshooting table.
• Add billing and config to the "Going further" command surface list.
• Fix --env to local|staging|production.
• Soften unverifiable ~/.hookmyapp/ creds-path claim.

README.md

• Soften step 2 "wizard auto-chains into `hookmyapp sandbox listen`" — the actual default is a "Next steps" print; `hookmyapp login --next sandbox` triggers explicit auto-chain.

Paired with https://github.com/hookmyapp/agent-skills (separate PR) for the matching SKILL.md rewrite.

Caveat: The 3→5 env-key mapping (WABA_ID, ACCESS_TOKEN, PHONE_NUMBER_ID) was not verified against a live `hookmyapp env ` output against a staging WABA during drafting — verify before merge.

Test plan

• Read AGENTS.md top-to-bottom; confirm signature section no longer recommends an `APP_SECRET` verification branch.
• Spot-check every `hookmyapp` command in the file against `hookmyapp --help` on v0.7.0.
• Confirm `src/index.js`, `.env.example`, `package.json` are unchanged.

Summary by CodeRabbit

Documentation

• Clarified login workflow and added a non‑browser code-paste login option for CI/AI contexts.
• Reworked production environment mapping guidance and which values should be set vs. emitted.
• Made webhook setup clearer, including explicit guidance on verify tokens and signature handling.
• Unified guidance for signed webhook shape and correct request-body handling.
• Added troubleshooting for missing request bodies and tunnel/cloud issues.
• Updated Quick Start CLI wizard guidance and next‑steps instructions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: faf5d08e-57d8-40b6-a75d-07f1b4bccea5

📥 Commits

Reviewing files that changed from the base of the PR and between 5a452c1 and 7f58126.

📒 Files selected for processing (1)

• AGENTS.md

✅ Files skipped from review due to trivial changes (1)

• AGENTS.md

---

📝 Walkthrough

Walkthrough

Documentation-only updates to AGENTS.md and README.md clarifying the login human-in-the-loop flow with a code-based non-browser option, revising env-variable mapping and production webhook flags (including --verify-token), and expanding signature-verification and troubleshooting guidance.

Changes

Cohort / File(s)	Summary
Authentication & CLI Flow AGENTS.md, README.md	Clarified human-in-the-loop login; added non-browser alternative hookmyapp login --code <bootstrap> and --next behavior; updated Quick Start to instruct hookmyapp login --next sandbox instead of automatic chaining.
Environment Mapping AGENTS.md	Reworked hookmyapp env <waba-id> docs: now describes three emitted keys that must be expanded into the kit’s five .env entries; explicitly instructs hardcoding WHATSAPP_API_URL and setting VERIFY_TOKEN/PORT per kit/SIG requirements.
Webhook Configuration & Signatures AGENTS.md	Added --verify-token <your-chosen-token> to production webhook command; explained VERIFY_TOKEN use for X-HookMyApp-Signature-256 and behavior when omitted; unified signed webhook shape for sandbox/production; clarified correct body handling (express.json() vs express.raw(...)) and removed prior guidance about a Meta APP_SECRET-based verification branch.
Troubleshooting & CLI Surface AGENTS.md	Expanded troubleshooting rows (missing request bodies, tunnel/cloudflared issues); updated CLI help surface and global flag enum (`--env local

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• Add AGENTS.md + cross-tool redirects for AI coding agents #1: Earlier PR that introduced AGENTS.md; this PR refines that documentation (login flow, env mapping, webhook config, signature verification).

Poem

🐰 I nibble notes and polish prose,
Bootstrap codes where the bright wind blows,
Tokens tucked and webhooks signed,
Docs aligned, no steps left blind,
Hooray — the rabbit hops, well-timed! 🥕✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: syncing documentation files to align with CLI v0.7.0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/sync-cli-0.7.0

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}