@bussolabs/closeyourit-cli 0.24.1 → 0.24.2

package/README.md

@@ -272,6 +272,9 @@ CLOSEYOURIT_TOKEN=cyi_u_… CLOSEYOURIT_API_URL=https://www.closeyour.it \
 | `workload promote <action-id> --project <id\|key> [--title] [--description] [--kind] [--status] [--priority]` | Generate a ticket from the action and link it back. |
 
 Every command accepts `--json` for machine-readable output and `--help` for usage details.
+Every command also accepts `--yes`: the server refuses a write that goes through a dangerous
+permission (deleting a project, importing or deleting secrets, …) with `R422-CONFIRM-001` until you
+confirm it, and `--yes` is that confirmation. Reads never need it.
 `--project` accepts either a project UUID or its key (matched case-insensitively).
 
 `kb publish` needs a backend exposing the atomic Knowledge publication route; an older one fails with

package/dist/base.d.ts

@@ -1,4 +1,5 @@
 import { Command, type Interfaces } from '@oclif/core';
+import type { ArgOutput, FlagOutput, Input, ParserOutput } from '@oclif/core/lib/interfaces/parser';
 import { type CliConfig } from './lib/config';
 import { CliApi } from './lib/api';
 import { type TicketLookup } from './lib/ticket-lookup';
@@ -28,9 +29,20 @@ export declare function paginationError(opts: {
 }): string | undefined;
 export declare abstract class BaseCommand extends Command {
     static enableJsonFlag: boolean;
+    /**
+     * `--yes` on every command (CYCL-53): the server asks an explicit confirmation for writes that pass
+     * through a dangerous permission key (`R422-CONFIRM-001`, CYRA-728). Which keys are dangerous is
+     * the server's catalogue, not ours, so the flag is global instead of being sprinkled on the
+     * commands we believe are risky today. Harmless elsewhere: the parameter is simply ignored.
+     */
+    static baseFlags: {
+        yes: Interfaces.BooleanFlag<boolean>;
+    };
     protected cfg: CliConfig;
     protected api: CliApi;
     init(): Promise<void>;
+    /** Parse as oclif does, then hand `--yes` to the api client before any request leaves. */
+    protected parse<F extends FlagOutput, B extends FlagOutput, A extends ArgOutput>(options?: Input<F, B, A>, argv?: string[]): Promise<ParserOutput<F, B, A>>;
     /**
      * Resolve a project reference (UUID passes through; otherwise matched by key, case-insensitive).
      * Walks every page of `/cli/v1/projects`: a key can live past the first page, so a single-page

package/dist/base.js

@@ -38,6 +38,15 @@ function paginationError(opts) {
 }
 class BaseCommand extends core_1.Command {
     static enableJsonFlag = true;
+    /**
+     * `--yes` on every command (CYCL-53): the server asks an explicit confirmation for writes that pass
+     * through a dangerous permission key (`R422-CONFIRM-001`, CYRA-728). Which keys are dangerous is
+     * the server's catalogue, not ours, so the flag is global instead of being sprinkled on the
+     * commands we believe are risky today. Harmless elsewhere: the parameter is simply ignored.
+     */
+    static baseFlags = {
+        yes: core_1.Flags.boolean({ description: 'Confirm a dangerous action the server would otherwise refuse (R422-CONFIRM-001)', default: false }),
+    };
     cfg;
     api;
     async init() {
@@ -45,6 +54,13 @@ class BaseCommand extends core_1.Command {
         this.cfg = (0, config_1.loadConfig)();
         this.api = new api_1.CliApi(this.cfg);
     }
+    /** Parse as oclif does, then hand `--yes` to the api client before any request leaves. */
+    async parse(options, argv) {
+        const parsed = await super.parse(options, argv);
+        if (this.api)
+            this.api.confirm = parsed.flags.yes === true;
+        return parsed;
+    }
     /**
      * Resolve a project reference (UUID passes through; otherwise matched by key, case-insensitive).
      * Walks every page of `/cli/v1/projects`: a key can live past the first page, so a single-page

package/dist/lib/api.d.ts

@@ -23,6 +23,8 @@ export interface UploadFile {
     data: Blob;
 }
 type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+/** Error code the server answers when a dangerous write arrives without the confirm gesture (CYRA-728). */
+export declare const CONFIRMATION_REQUIRED_CODE = "R422-CONFIRM-001";
 export declare class CliApi {
     private readonly config;
     /**
@@ -32,6 +34,14 @@ export declare class CliApi {
      * commands (CYCL-11). The instance is per-command, so this is that command's last response.
      */
     lastMeta?: Record<string, unknown>;
+    /**
+     * The user confirmed dangerous actions (`--yes`, CYCL-53). The server (CYRA-728) refuses any
+     * write through a `dangerous` permission key without the `confirm` parameter and answers
+     * `R422-CONFIRM-001`: not a permission problem, a missing gesture. `BaseCommand.parse` sets it;
+     * `request()` then adds `confirm=1` to every writing call — in the query string, so DELETE
+     * without a body is covered too. Reads never carry it: looking is not executing.
+     */
+    confirm: boolean;
     constructor(config: CliConfig);
     request<T = unknown>(method: HttpMethod, path: string, opts?: RequestOptions): Promise<Envelope<T>>;
     /**
@@ -39,6 +49,8 @@ export declare class CliApi {
      * The boundary Content-Type is derived by fetch from the FormData body — never set it by hand.
      */
     upload<T = unknown>(method: 'POST' | 'PUT', path: string, files: UploadFile[], opts?: RequestOptions): Promise<Envelope<T>>;
+    /** Add `confirm=1` to a writing request when the user passed `--yes`; reads are left alone. */
+    private withConfirmation;
     private resolveUrl;
     /** Build the shared Accept + Authorization headers; throws (before any fetch) if an authed call has no token. */
     private authHeaders;

package/dist/lib/api.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CliApi = exports.ApiRequestError = void 0;
+exports.CliApi = exports.CONFIRMATION_REQUIRED_CODE = exports.ApiRequestError = void 0;
 const error_codes_1 = require("../errors/error-codes");
 /** Error carrying the HTTP status and the structured code from the backend envelope (R/G prefix) or a local C-prefix fallback. */
 class ApiRequestError extends Error {
@@ -16,6 +16,9 @@ class ApiRequestError extends Error {
     }
 }
 exports.ApiRequestError = ApiRequestError;
+/** Error code the server answers when a dangerous write arrives without the confirm gesture (CYRA-728). */
+exports.CONFIRMATION_REQUIRED_CODE = 'R422-CONFIRM-001';
+const READ_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
 class CliApi {
     config;
     /**
@@ -25,13 +28,21 @@ class CliApi {
      * commands (CYCL-11). The instance is per-command, so this is that command's last response.
      */
     lastMeta;
+    /**
+     * The user confirmed dangerous actions (`--yes`, CYCL-53). The server (CYRA-728) refuses any
+     * write through a `dangerous` permission key without the `confirm` parameter and answers
+     * `R422-CONFIRM-001`: not a permission problem, a missing gesture. `BaseCommand.parse` sets it;
+     * `request()` then adds `confirm=1` to every writing call — in the query string, so DELETE
+     * without a body is covered too. Reads never carry it: looking is not executing.
+     */
+    confirm = false;
     constructor(config) {
         this.config = config;
     }
     async request(method, path, opts = {}) {
         const headers = this.authHeaders(opts.auth !== false);
         headers['Content-Type'] = 'application/json';
-        const url = this.resolveUrl(path);
+        const url = this.resolveUrl(this.withConfirmation(method, path));
         let res;
         try {
             res = await fetch(url, {
@@ -70,6 +81,12 @@ class CliApi {
         }
         return this.handleResponse(res);
     }
+    /** Add `confirm=1` to a writing request when the user passed `--yes`; reads are left alone. */
+    withConfirmation(method, path) {
+        if (!this.confirm || READ_METHODS.has(method))
+            return path;
+        return `${path}${path.includes('?') ? '&' : '?'}confirm=1`;
+    }
     resolveUrl(path) {
         return this.config.apiUrl.replace(/\/+$/, '') + path;
     }
@@ -102,7 +119,12 @@ class CliApi {
         if (!res.ok) {
             const envelope = (json ?? {});
             const error = envelope.error ?? {};
-            throw new ApiRequestError(res.status, error.code ?? `C${res.status}-API-000`, error.message ?? res.statusText ?? `Request failed (${res.status})`, error.details);
+            let message = error.message ?? res.statusText ?? `Request failed (${res.status})`;
+            // The server names the gesture it wants but not the flag that makes it: say it here, once.
+            if (error.code === exports.CONFIRMATION_REQUIRED_CODE && !message.includes('--yes')) {
+                message = `${message} Re-run with --yes to confirm this dangerous action.`;
+            }
+            throw new ApiRequestError(res.status, error.code ?? `C${res.status}-API-000`, message, error.details);
         }
         const envelope = (json ?? {});
         this.lastMeta = envelope.meta;