@bussolabs/closeyourit-cli 0.23.1 → 0.24.2

package/README.md

@@ -272,6 +272,9 @@ CLOSEYOURIT_TOKEN=cyi_u_… CLOSEYOURIT_API_URL=https://www.closeyour.it \
 | `workload promote <action-id> --project <id\|key> [--title] [--description] [--kind] [--status] [--priority]` | Generate a ticket from the action and link it back. |
 
 Every command accepts `--json` for machine-readable output and `--help` for usage details.
+Every command also accepts `--yes`: the server refuses a write that goes through a dangerous
+permission (deleting a project, importing or deleting secrets, …) with `R422-CONFIRM-001` until you
+confirm it, and `--yes` is that confirmation. Reads never need it.
 `--project` accepts either a project UUID or its key (matched case-insensitively).
 
 `kb publish` needs a backend exposing the atomic Knowledge publication route; an older one fails with

package/dist/base.d.ts

@@ -1,4 +1,5 @@
 import { Command, type Interfaces } from '@oclif/core';
+import type { ArgOutput, FlagOutput, Input, ParserOutput } from '@oclif/core/lib/interfaces/parser';
 import { type CliConfig } from './lib/config';
 import { CliApi } from './lib/api';
 import { type TicketLookup } from './lib/ticket-lookup';
@@ -28,9 +29,20 @@ export declare function paginationError(opts: {
 }): string | undefined;
 export declare abstract class BaseCommand extends Command {
     static enableJsonFlag: boolean;
+    /**
+     * `--yes` on every command (CYCL-53): the server asks an explicit confirmation for writes that pass
+     * through a dangerous permission key (`R422-CONFIRM-001`, CYRA-728). Which keys are dangerous is
+     * the server's catalogue, not ours, so the flag is global instead of being sprinkled on the
+     * commands we believe are risky today. Harmless elsewhere: the parameter is simply ignored.
+     */
+    static baseFlags: {
+        yes: Interfaces.BooleanFlag<boolean>;
+    };
     protected cfg: CliConfig;
     protected api: CliApi;
     init(): Promise<void>;
+    /** Parse as oclif does, then hand `--yes` to the api client before any request leaves. */
+    protected parse<F extends FlagOutput, B extends FlagOutput, A extends ArgOutput>(options?: Input<F, B, A>, argv?: string[]): Promise<ParserOutput<F, B, A>>;
     /**
      * Resolve a project reference (UUID passes through; otherwise matched by key, case-insensitive).
      * Walks every page of `/cli/v1/projects`: a key can live past the first page, so a single-page

package/dist/base.js

@@ -38,6 +38,15 @@ function paginationError(opts) {
 }
 class BaseCommand extends core_1.Command {
     static enableJsonFlag = true;
+    /**
+     * `--yes` on every command (CYCL-53): the server asks an explicit confirmation for writes that pass
+     * through a dangerous permission key (`R422-CONFIRM-001`, CYRA-728). Which keys are dangerous is
+     * the server's catalogue, not ours, so the flag is global instead of being sprinkled on the
+     * commands we believe are risky today. Harmless elsewhere: the parameter is simply ignored.
+     */
+    static baseFlags = {
+        yes: core_1.Flags.boolean({ description: 'Confirm a dangerous action the server would otherwise refuse (R422-CONFIRM-001)', default: false }),
+    };
     cfg;
     api;
     async init() {
@@ -45,6 +54,13 @@ class BaseCommand extends core_1.Command {
         this.cfg = (0, config_1.loadConfig)();
         this.api = new api_1.CliApi(this.cfg);
     }
+    /** Parse as oclif does, then hand `--yes` to the api client before any request leaves. */
+    async parse(options, argv) {
+        const parsed = await super.parse(options, argv);
+        if (this.api)
+            this.api.confirm = parsed.flags.yes === true;
+        return parsed;
+    }
     /**
      * Resolve a project reference (UUID passes through; otherwise matched by key, case-insensitive).
      * Walks every page of `/cli/v1/projects`: a key can live past the first page, so a single-page

package/dist/commands/coverage/show.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../base';
+export default class CoverageShow extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        branch: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/coverage/show.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_1 = require("../../base");
+const core_1 = require("@oclif/core");
+// CYSK-26 — l'estratto di copertura pubblicato dalla CI, riletto senza rigirare la suite: è il dato
+// su cui lo scanner del codice non usato decide se la misura è credibile prima di fidarsene.
+class CoverageShow extends base_1.BaseCommand {
+    static description = 'Show the coverage extract the CI published for a project (last snapshot per branch, never the history)';
+    static examples = [
+        '<%= config.bin %> coverage show --project closeyourit-rails',
+        '<%= config.bin %> coverage show -p CYRA --branch main',
+        '<%= config.bin %> coverage show -p CYRA --json',
+    ];
+    static flags = {
+        ...base_1.projectFlag,
+        branch: core_1.Flags.string({ description: 'Only the extract of this branch' }),
+    };
+    async run() {
+        const { flags } = await this.parse(CoverageShow);
+        const projectId = await this.resolveProjectId(flags.project);
+        const query = flags.branch ? `?branch=${encodeURIComponent(flags.branch)}` : '';
+        const res = await this.api.get(`/cli/v1/projects/${projectId}/coverage${query}`);
+        if (!this.jsonEnabled()) {
+            const reports = res.data ?? [];
+            if (reports.length === 0) {
+                this.log('No coverage extract published yet: the CI pushes it from the default branch.');
+            }
+            else {
+                for (const report of reports) {
+                    this.log(`${report.branch ?? '?'}  line ${report.line_covered_percent ?? '-'}%  branch ${report.branch_covered_percent ?? '-'}%  ` +
+                        `files ${report.files_count ?? '-'}  never_loaded ${report.never_loaded_count ?? '-'}  ` +
+                        `sha ${report.sha ?? '-'}  captured ${report.captured_at ?? '-'}`);
+                }
+            }
+        }
+        return res;
+    }
+}
+exports.default = CoverageShow;

package/dist/commands/tickets/clarifications.d.ts

@@ -0,0 +1,21 @@
+import { BaseCommand } from '../../base';
+/**
+ * Lo stato del ciclo di chiarimenti di un ticket, chiesto al sistema (CYRA-628).
+ *
+ * È il canale che sostituisce il ri-parsing della discussione: la skill di triage e l'automator
+ * leggevano un marcatore HTML nel testo dei commenti e provavano a indovinare se una domanda fosse
+ * pendente e a che giro. Una riga scritta dal sistema stesso bastava a farlo ripartire.
+ *
+ * Sola lettura: le domande le scrive il server quando il triage le consegna, non un chiamante esterno.
+ */
+export default class TicketsClarifications extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/tickets/clarifications.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+const ticket_clarifications_1 = require("../../lib/ticket-clarifications");
+/**
+ * Lo stato del ciclo di chiarimenti di un ticket, chiesto al sistema (CYRA-628).
+ *
+ * È il canale che sostituisce il ri-parsing della discussione: la skill di triage e l'automator
+ * leggevano un marcatore HTML nel testo dei commenti e provavano a indovinare se una domanda fosse
+ * pendente e a che giro. Una riga scritta dal sistema stesso bastava a farlo ripartire.
+ *
+ * Sola lettura: le domande le scrive il server quando il triage le consegna, non un chiamante esterno.
+ */
+class TicketsClarifications extends base_1.BaseCommand {
+    static args = {
+        id: core_1.Args.string({ description: 'Ticket id or code (e.g. DRFL-3)', required: true }),
+    };
+    static description = 'Show the clarification cycle state of a ticket (rounds, reply, escalation)';
+    static examples = [
+        '<%= config.bin %> tickets clarifications <ticket-id> --project acme-api',
+        '<%= config.bin %> tickets clarifications DRFL-3 -p acme-api --json',
+    ];
+    static flags = { ...base_1.projectFlag };
+    async run() {
+        const { args, flags } = await this.parse(TicketsClarifications);
+        const projectId = await this.resolveProjectId(flags.project);
+        const path = `/cli/v1/projects/${encodeURIComponent(projectId)}/tickets/${encodeURIComponent(args.id)}/clarifications`;
+        const res = await this.api.get(path);
+        if (!this.jsonEnabled()) {
+            this.log((0, ticket_clarifications_1.renderClarificationState)(res.data ?? {}));
+        }
+        return res;
+    }
+}
+exports.default = TicketsClarifications;

package/dist/commands/usage/list.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../base';
+export default class UsageList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        kind: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        environment: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        page: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/usage/list.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_1 = require("../../base");
+const core_1 = require("@oclif/core");
+// CYSK-29 — i simboli VISTI in esecuzione (l'insieme positivo). Il verdetto «inutilizzato» lo
+// calcola lo scanner con l'inventario statico del repo, mai questo comando.
+class UsageList extends base_1.BaseCommand {
+    static description = 'List the usage symbols the product reported as actually executed (routes as Controller#action, jobs, custom keys)';
+    static examples = [
+        '<%= config.bin %> usage list --project CYRA',
+        '<%= config.bin %> usage list -p CYRA --kind route --environment production',
+        '<%= config.bin %> usage list -p CYRA --json',
+    ];
+    static flags = {
+        ...base_1.projectFlag,
+        kind: core_1.Flags.string({ description: 'Only this kind (route, job, custom)' }),
+        environment: core_1.Flags.string({ description: 'Only this environment' }),
+        page: core_1.Flags.integer({ description: 'Page number', default: 1 }),
+    };
+    async run() {
+        const { flags } = await this.parse(UsageList);
+        const projectId = await this.resolveProjectId(flags.project);
+        const query = new URLSearchParams({ page: String(flags.page) });
+        if (flags.kind)
+            query.set('kind', flags.kind);
+        if (flags.environment)
+            query.set('environment', flags.environment);
+        const res = await this.api.get(`/cli/v1/projects/${projectId}/usage?${query.toString()}`);
+        if (!this.jsonEnabled()) {
+            const rows = res.data ?? [];
+            if (rows.length === 0) {
+                this.log('No usage reported yet: the SDK flushes every ~5 minutes once deployed.');
+            }
+            else {
+                for (const row of rows) {
+                    this.log(`${row.kind ?? '?'}  ${row.symbol ?? '?'}  last_seen ${row.last_seen_at ?? '-'}  hits ~${row.hits_count ?? '-'}  (${row.environment ?? '-'})`);
+                }
+            }
+        }
+        return res;
+    }
+}
+exports.default = UsageList;

package/dist/commands/usage/reporters.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../base';
+export default class UsageReporters extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        kind: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/usage/reporters.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_1 = require("../../base");
+const core_1 = require("@oclif/core");
+// CYSK-29 — chi sta mandando usage e da quando: la risposta a «rotta mai chiamata o SDK mai
+// deployato?». Lo scanner la legge PRIMA di giudicare qualunque kind; `truncated_last_window`
+// squalifica il kind.
+class UsageReporters extends base_1.BaseCommand {
+    static description = 'List the usage reporters: which SDK is sending usage of each kind, and since when';
+    static examples = [
+        '<%= config.bin %> usage reporters --project CYRA',
+        '<%= config.bin %> usage reporters -p CYRA --kind route',
+    ];
+    static flags = {
+        ...base_1.projectFlag,
+        kind: core_1.Flags.string({ description: 'Only this kind (route, job, custom)' }),
+    };
+    async run() {
+        const { flags } = await this.parse(UsageReporters);
+        const projectId = await this.resolveProjectId(flags.project);
+        const query = flags.kind ? `?kind=${encodeURIComponent(flags.kind)}` : '';
+        const res = await this.api.get(`/cli/v1/projects/${projectId}/usage/reporters${query}`);
+        if (!this.jsonEnabled()) {
+            const rows = res.data ?? [];
+            if (rows.length === 0) {
+                this.log('No usage reporter yet: without one, "never seen" only means "SDK not deployed".');
+            }
+            else {
+                for (const row of rows) {
+                    this.log(`${row.kind ?? '?'}  ${row.sdk_name ?? '?'}@${row.sdk_version ?? '-'}  since ${row.first_reported_at ?? '-'}  last ${row.last_reported_at ?? '-'}  truncated ${row.truncated_last_window ? 'YES' : 'no'}  (${row.environment ?? '-'})`);
+                }
+            }
+        }
+        return res;
+    }
+}
+exports.default = UsageReporters;

package/dist/lib/api.d.ts

@@ -23,6 +23,8 @@ export interface UploadFile {
     data: Blob;
 }
 type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+/** Error code the server answers when a dangerous write arrives without the confirm gesture (CYRA-728). */
+export declare const CONFIRMATION_REQUIRED_CODE = "R422-CONFIRM-001";
 export declare class CliApi {
     private readonly config;
     /**
@@ -32,6 +34,14 @@ export declare class CliApi {
      * commands (CYCL-11). The instance is per-command, so this is that command's last response.
      */
     lastMeta?: Record<string, unknown>;
+    /**
+     * The user confirmed dangerous actions (`--yes`, CYCL-53). The server (CYRA-728) refuses any
+     * write through a `dangerous` permission key without the `confirm` parameter and answers
+     * `R422-CONFIRM-001`: not a permission problem, a missing gesture. `BaseCommand.parse` sets it;
+     * `request()` then adds `confirm=1` to every writing call — in the query string, so DELETE
+     * without a body is covered too. Reads never carry it: looking is not executing.
+     */
+    confirm: boolean;
     constructor(config: CliConfig);
     request<T = unknown>(method: HttpMethod, path: string, opts?: RequestOptions): Promise<Envelope<T>>;
     /**
@@ -39,6 +49,8 @@ export declare class CliApi {
      * The boundary Content-Type is derived by fetch from the FormData body — never set it by hand.
      */
     upload<T = unknown>(method: 'POST' | 'PUT', path: string, files: UploadFile[], opts?: RequestOptions): Promise<Envelope<T>>;
+    /** Add `confirm=1` to a writing request when the user passed `--yes`; reads are left alone. */
+    private withConfirmation;
     private resolveUrl;
     /** Build the shared Accept + Authorization headers; throws (before any fetch) if an authed call has no token. */
     private authHeaders;

package/dist/lib/api.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CliApi = exports.ApiRequestError = void 0;
+exports.CliApi = exports.CONFIRMATION_REQUIRED_CODE = exports.ApiRequestError = void 0;
 const error_codes_1 = require("../errors/error-codes");
 /** Error carrying the HTTP status and the structured code from the backend envelope (R/G prefix) or a local C-prefix fallback. */
 class ApiRequestError extends Error {
@@ -16,6 +16,9 @@ class ApiRequestError extends Error {
     }
 }
 exports.ApiRequestError = ApiRequestError;
+/** Error code the server answers when a dangerous write arrives without the confirm gesture (CYRA-728). */
+exports.CONFIRMATION_REQUIRED_CODE = 'R422-CONFIRM-001';
+const READ_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
 class CliApi {
     config;
     /**
@@ -25,13 +28,21 @@ class CliApi {
      * commands (CYCL-11). The instance is per-command, so this is that command's last response.
      */
     lastMeta;
+    /**
+     * The user confirmed dangerous actions (`--yes`, CYCL-53). The server (CYRA-728) refuses any
+     * write through a `dangerous` permission key without the `confirm` parameter and answers
+     * `R422-CONFIRM-001`: not a permission problem, a missing gesture. `BaseCommand.parse` sets it;
+     * `request()` then adds `confirm=1` to every writing call — in the query string, so DELETE
+     * without a body is covered too. Reads never carry it: looking is not executing.
+     */
+    confirm = false;
     constructor(config) {
         this.config = config;
     }
     async request(method, path, opts = {}) {
         const headers = this.authHeaders(opts.auth !== false);
         headers['Content-Type'] = 'application/json';
-        const url = this.resolveUrl(path);
+        const url = this.resolveUrl(this.withConfirmation(method, path));
         let res;
         try {
             res = await fetch(url, {
@@ -70,6 +81,12 @@ class CliApi {
         }
         return this.handleResponse(res);
     }
+    /** Add `confirm=1` to a writing request when the user passed `--yes`; reads are left alone. */
+    withConfirmation(method, path) {
+        if (!this.confirm || READ_METHODS.has(method))
+            return path;
+        return `${path}${path.includes('?') ? '&' : '?'}confirm=1`;
+    }
     resolveUrl(path) {
         return this.config.apiUrl.replace(/\/+$/, '') + path;
     }
@@ -102,7 +119,12 @@ class CliApi {
         if (!res.ok) {
             const envelope = (json ?? {});
             const error = envelope.error ?? {};
-            throw new ApiRequestError(res.status, error.code ?? `C${res.status}-API-000`, error.message ?? res.statusText ?? `Request failed (${res.status})`, error.details);
+            let message = error.message ?? res.statusText ?? `Request failed (${res.status})`;
+            // The server names the gesture it wants but not the flag that makes it: say it here, once.
+            if (error.code === exports.CONFIRMATION_REQUIRED_CODE && !message.includes('--yes')) {
+                message = `${message} Re-run with --yes to confirm this dangerous action.`;
+            }
+            throw new ApiRequestError(res.status, error.code ?? `C${res.status}-API-000`, message, error.details);
         }
         const envelope = (json ?? {});
         this.lastMeta = envelope.meta;

package/dist/lib/ticket-clarifications.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Lo stato del ciclo di chiarimenti, come lo racconta il SERVER (CYRA-628).
+ *
+ * Fino a qui quello stato viveva nel testo della discussione: un marcatore HTML che tre repository
+ * ri-parsavano per conto loro. Bastava che il sistema stesso scrivesse una riga qualsiasi — «resoconto
+ * aggiornato alla versione 2» — perché chi legge la scambiasse per una risposta e facesse ripartire un
+ * ticket a cui non aveva risposto nessuno. Intanto l'archivio continuava a dire «in attesa»: due parti
+ * dello stesso prodotto raccontavano cose diverse sullo stesso ticket, e decideva quella che sapeva meno.
+ *
+ * Il LIMITE di giri non compare qui e non compare nella risposta: il server espone i fatti — quanti
+ * giri, se è arrivata una risposta — e quando chiamare una persona resta policy di chi legge.
+ */
+export declare function renderClarificationState(stato: Record<string, unknown>): string;

package/dist/lib/ticket-clarifications.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderClarificationState = renderClarificationState;
+const output_1 = require("./output");
+/**
+ * Lo stato del ciclo di chiarimenti, come lo racconta il SERVER (CYRA-628).
+ *
+ * Fino a qui quello stato viveva nel testo della discussione: un marcatore HTML che tre repository
+ * ri-parsavano per conto loro. Bastava che il sistema stesso scrivesse una riga qualsiasi — «resoconto
+ * aggiornato alla versione 2» — perché chi legge la scambiasse per una risposta e facesse ripartire un
+ * ticket a cui non aveva risposto nessuno. Intanto l'archivio continuava a dire «in attesa»: due parti
+ * dello stesso prodotto raccontavano cose diverse sullo stesso ticket, e decideva quella che sapeva meno.
+ *
+ * Il LIMITE di giri non compare qui e non compare nella risposta: il server espone i fatti — quanti
+ * giri, se è arrivata una risposta — e quando chiamare una persona resta policy di chi legge.
+ */
+function renderClarificationState(stato) {
+    const rounds = Array.isArray(stato.rounds) ? stato.rounds : [];
+    const testa = `── ${(0, output_1.sanitize)(stato.state ?? '?')} · giri: ${(0, output_1.sanitize)(stato.cycles ?? 0)} · risposta: ${stato.has_reply ? 'sì' : 'no'}`;
+    if (rounds.length === 0)
+        return `${testa}\nNessuna domanda in corso.`;
+    const corpo = rounds.map((round) => {
+        const quando = round.answered_at ? `risposto ${(0, output_1.sanitize)(round.answered_at)}` : 'senza risposta';
+        return [
+            `\n· giro ${(0, output_1.sanitize)(round.cycle ?? '?')} — ${quando}`,
+            (0, output_1.sanitizeMultiline)(round.questions ?? ''),
+            round.response ? (0, output_1.sanitizeMultiline)(round.response) : '',
+        ].filter(Boolean).join('\n');
+    });
+    return [testa, ...corpo].join('\n');
+}