[CLI] Fix review edge cases, and release each merge to main

[ilyazub]

Opus 5.5 Max wrote this:
Fix the edge cases that model reviews found on main before v0.3.0, and release each merge to main automatically once its tests pass. login could save the API key in the current directory or write it into another file. Ctrl-C could drop results that were already billed, or leave the terminal without echo. And merged fixes reached nobody until someone pushed a tag. Merged with the release:minor label, this PR releases v0.3.0. Follow-up of #17.

Main 7acfb80 is #17's merge and the planned v0.3.0. GPT-5.6 Sol Max and Claude Opus 5.5 Max reviewed it for edge cases, and GPT-5.6 Sol Max then reviewed the fixes twice. Each fix started as a failing test. The table runs the real binaries against a local fake SerpApi.

	main 7acfb80	this PR de6215b
login with HOME unset or HOME=.	key saved under the current directory	exit 2, nothing saved
login with config.toml.tmp symlinked to another file	key written into that file	that file untouched
login with a stale 0644 config.toml.tmp	config saved 0644	0600
Ctrl-C or SIGTERM at the hidden key prompt	exit 130 after 3.1 s, echo off	at once, echo on
Ctrl-D at the hidden key prompt	still waiting after 20 s	exit 2, "No API key given"
Ctrl-C on page 4 of --all-pages --jq	nothing printed	--jq result for pages 1–3
serpapi help nope	exit 0, usage as plain text on stderr	exit 2, one JSON line
hint on a large no_cache=true --all-pages result	the repeat "comes from the cache"	"a new, counted search for each page"
hint on a large zero_trace=true result	read the stored search for free	the search isn't stored
Control: main against itself, 120 commands	0 differ

Against main, 2 of the 120 matrix commands differ, --help and -h, which now say what zero_trace costs and that exit 130 means the run stopped before it finished. stderr stays JSON-only in all 120.

• Raw mode at the hidden prompt. The caller now sets and undoes it, so a reader that a signal leaves behind can't turn echo off again. With the reader forced to start after the restore, the earlier layout left echo off in 5 of 5 SIGTERM runs and this one in 0 of 5. Ctrl-C there is a key, so it stops the run as SIGINT would, even when typed with Enter in one read; nothing is saved. Cost: Ctrl-Z no longer suspends at that prompt.
• After a signal, --jq stops 2.25 s in. That is a quarter of the 3 s grace before the forced exit, both counted from the signal. Main doesn't run --jq on fetched pages at all. An earlier commit here let the forced exit fire first, and in 1 of 3 runs both printed an error line; now it's 1 line in 3 of 3.
• A signal after everything printed still exits 0. The output is complete, and 130 would tell a script to retry billed searches.
• ZeroTrace comes from server code, not a live call. serpapi/SerpApi's api_controller.rb sets no_cache = to_bool(zero_trace || params[:no_cache]), and its spec checks that a ZeroTrace search isn't saved. The hint reads both flags as the pinned Mongoid 7.5.4 does. A value in neither of Mongoid's true and false lists gets "may", unless the other flag settles it.
• Four commits can fail alone. 92590fb and 7ae9a22 fail go test -race on a test-only race that 81d84dd fixes. 46af5c5 and 54815f5 carry another, seen in 2 of 4 runs, that f849cf4 fixes. 7ae9a22 also dropped help completion, which 803cda6 restores. Squash-merge, or review commit by commit with that in mind.

Not covered: Windows compiles and vets, but the raw-mode prompt never ran on a Windows console. Three pre-existing gaps are left for later:

• a config directory that others can write isn't tightened;
• a failed save that can't remove its temp file doesn't say so;
• with stdin on a terminal and stderr redirected, the prompt goes into stderr.

Merges to main now release. v0.2.3 shipped on 2026-03-31; #7, #9, #15 and #17 merged after it, and none reached users. After both test legs and the live e2e pass on main, CI tags the merge commit with the next version and runs release.yml. The version is a patch, or a minor or major when any pull request merged since the last release has that release:* label. release:skip, or a merge where nothing that ships changed, releases nothing.

Merging	releases
this PR, labeled release:minor	v0.3.0, with .github/release-notes/v0.3.0.md as its notes
this PR, unlabeled	v0.2.4
a later PR that changes only docs, tests or CI	nothing

That table comes from dry runs of release-tag.sh on this repo's history, which made 7 read-only API lookups, and a 27-case harness that now runs in CI before any tag. The "Release preview" check shows the same for each PR.

• Guards. Outside pull requests a skipped live test fails CI. The tag must point at the tested commit. An existing tag, or one older than the newest release, is refused. One locked job builds from the exact tag, uploads and updates Homebrew, and runs on main wait their turn (queue: max). A published version is never rebuilt with a newer Go: a complete release only refreshes Homebrew, and a partial one is fixed forward with the next version.
• Labels: release:minor, release:major and release:skip now exist, and this PR has release:minor. Before relying on it, maintainers should decide on a ruleset that blocks updating or deleting v* tags, and on immutable releases: today neither is set, so someone with write access could move a tag after CI checked it.
• Not run yet: the tag and release jobs first run for real on this merge. GoReleaser 2.18.3 ran with the same flags on 8f1c581 with --skip=publish: 5 archives, checksums 5 of 5. If publishing fails before any upload, re-run it; after a partial upload, release the next version.

Merging releases: with release:minor, CI tags the merge commit v0.3.0 and publishes it. Then check the 5 archives, the tap's serpapi-cli 0.3.0 commit and brew test serpapi-cli, as AGENTS.md says.

Checks and reviews

Opus 5.5 Max checks on de6215b (macOS arm64, fake SerpApi on localhost, base main 7acfb80); the 11 commits after it change only CI and release files, and check.sh passes again on 8f1c581:

check.sh                gofmt, vet, staticcheck ok; 322 package tests passed;
                        tests/: 2 passed, 10 skipped (live, no key)
go1.25.0 -race ./...    324 passed, 10 skipped, 0 failed
-race, 20 times         pkg/cmd and pkg/config: 3,800 runs, 0 failures
each of the 17 commits  vet, staticcheck, go test -race ./pkg/... alone: 15 pass;
                        92590fb and 7ae9a22 fail on the test-only race above
windows/amd64, linux    vet ok; 11 of 11 test binaries compile
matrix, 120 commands    main vs main: 0 differ; main vs this PR: 2 (--help, -h)
PTY probes              hidden prompt: key, backspace, ^C at once and after 0.3 s,
                        Enter and ^C in one write, ^D, SIGTERM, ^C with stderr a
                        full pipe; [y/N] prompt: ^C
release-tag.sh          shellcheck clean; 27-case harness with a stub gh; dry runs
                        on this history, 7 read-only API lookups
workflows               actionlint clean but for queue: max, which it doesn't know;
                        e2e skip guard run locally: no key, exit 1
goreleaser 2.18.3       8f1c581, --skip=publish, flags as in release.yml: 5
                        archives, checksums 5/5, formula test 5/5, govulncheck 0

Reviews: GPT-5.6 Sol Max (main, then this series in two passes; the last confirmed all 5 of its second-pass findings closed) and Claude Opus 5.5 Max (main). GPT-6 Astra advised (effort not exposed). Found and left for the roadmap: completion bogus exits 0, and version and --version differ when SERPAPI_TIMEOUT is invalid.