@jacebenson/jsn 3.4.3 → 4.0.1

package/src/commands/docs/search.js

@@ -1,7 +1,7 @@
 // CLI search against the docs SQLite database.
 
 import fs from 'node:fs';
-import { DatabaseSync } from 'node:sqlite';
+import Database from 'better-sqlite3';
 import { getDocsDbPath, hasEmbeddings } from './db.js';
 import { encodeText, similarity, bytesToPhases, DEFAULT_DIM } from './hrr.js';
 
@@ -24,7 +24,7 @@ export function searchDocs(opts = {}) {
     throw new Error(`Database not found: ${dbPath}. Run "jsn docs sync" first.`);
   }
 
-  const db = new DatabaseSync(dbPath, { readOnly: true });
+  const db = new Database(dbPath, { readonly: true });
   const limit = Math.min(parseInt(opts.limit, 10) || 20, 1000);
   const offset = parseInt(opts.offset, 10) || 0;
   const bundle = opts.bundle ? String(opts.bundle) : null;
@@ -46,7 +46,7 @@ export function searchDocs(opts = {}) {
 
   // Total matching docs (for pagination)
   const total = db
-    .prepare(`SELECT COUNT(*) AS n FROM docs_fts WHERE docs_fts MATCH @q${where}`)
+    .prepare(`SELECT COUNT(*) AS n FROM docs_fts JOIN docs d ON d.id = docs_fts.rowid WHERE docs_fts MATCH @q${where}`)
     .get({ q, ...(bundle && { bundle }), ...(docType && { docType }) }).n;
 
   let rows;

package/src/commands/docs/serve.js

@@ -4,7 +4,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import http from 'node:http';
 import { URL } from 'node:url';
-import { DatabaseSync } from 'node:sqlite';
+import Database from 'better-sqlite3';
 import { getDocsDbPath, hasEmbeddings } from './db.js';
 import { encodeText, similarity, bytesToPhases, DEFAULT_DIM } from './hrr.js';
 
@@ -72,7 +72,7 @@ export function serveDocs(opts = {}) {
     throw new Error(`Database not found: ${dbPath}. Run "jsn docs sync" first.`);
   }
 
-  const db = new DatabaseSync(dbPath, { readOnly: true });
+  const db = new Database(dbPath, { readonly: true });
   const hasEmb = hasEmbeddings(db);
   const hrrDim = (() => {
     try {

package/src/commands/grouproles.js

@@ -1,4 +1,4 @@
-import { formatRecordForDisplay, getStringField, resolveFieldsParam } from '../helpers.js';
+import { formatRecordForDisplay, getStringField, resolveFieldsParam, assertSafeExactMatch } from '../helpers.js';
 
 export function groupRolesCmd(wrap) {
   return {
@@ -42,6 +42,8 @@ export function groupRolesCmd(wrap) {
           handler: wrap(async (argv, app) => {
             const groupName = argv.group;
             const roleName = argv.role;
+            assertSafeExactMatch(groupName);
+            assertSafeExactMatch(roleName);
 
             // Resolve group sys_id
             const isGroupSysID = groupName.length === 32 && /^[0-9a-fA-F]+$/.test(groupName);
@@ -100,6 +102,8 @@ export function groupRolesCmd(wrap) {
           handler: wrap(async (argv, app) => {
             const groupName = argv.group;
             const roleName = argv.role;
+            assertSafeExactMatch(groupName);
+            assertSafeExactMatch(roleName);
 
             // Resolve group sys_id
             const isGroupSysID = groupName.length === 32 && /^[0-9a-fA-F]+$/.test(groupName);

package/src/commands/groups.js

@@ -1,4 +1,4 @@
-import { formatRecordForDisplay, getStringField, interactiveList, resolveFieldsParam } from '../helpers.js';
+import { formatRecordForDisplay, getStringField, interactiveList, resolveFieldsParam, assertSafeExactMatch } from '../helpers.js';
 
 export function groupsCmd(wrap) {
   return {
@@ -32,13 +32,13 @@ export function groupsCmd(wrap) {
                 cp.set('sysparm_query', `group=${sysID}`); cp.set('sysparm_limit', '0'); cp.set('sysparm_fields', 'sys_id');
                 const members = await app.sdk.list('sys_user_grmember', cp);
                 memberCount = members.length;
-              } catch {}
+              } catch { /* non-critical */ }
               try {
                 const rp = new URLSearchParams();
                 rp.set('sysparm_query', `group=${sysID}`); rp.set('sysparm_limit', '0'); rp.set('sysparm_fields', 'sys_id');
                 const roles = await app.sdk.list('sys_group_has_role', rp);
                 roleCount = roles.length;
-              } catch {}
+              } catch { /* non-critical */ }
 
               picked._context = { instance_url: app.getEffectiveInstance(), table: 'sys_user_group' };
               return app.ok(picked, {
@@ -72,6 +72,7 @@ export function groupsCmd(wrap) {
           describe: 'Show a group by name or sys_id',
           handler: wrap(async (argv, app) => {
             const id = argv.name;
+            assertSafeExactMatch(id);
             const isSysID = id.length === 32 && /^[0-9a-fA-F]+$/.test(id);
             const params = new URLSearchParams();
             params.set('sysparm_query', isSysID ? `sys_id=${id}` : `name=${id}`);
@@ -117,6 +118,7 @@ export function groupsCmd(wrap) {
             .option('data', { type: 'string', demandOption: true, describe: 'JSON data to update' }),
           handler: wrap(async (argv, app) => {
             const id = argv.name;
+            assertSafeExactMatch(id);
             const recordData = JSON.parse(argv.data);
             const isSysID = id.length === 32 && /^[0-9a-fA-F]+$/.test(id);
             const params = new URLSearchParams();
@@ -142,6 +144,7 @@ export function groupsCmd(wrap) {
           describe: 'Delete a group by name or sys_id',
           handler: wrap(async (argv, app) => {
             const id = argv.name;
+            assertSafeExactMatch(id);
             const isSysID = id.length === 32 && /^[0-9a-fA-F]+$/.test(id);
             const params = new URLSearchParams();
             params.set('sysparm_query', isSysID ? `sys_id=${id}` : `name=${id}`);

package/src/commands/records.js

@@ -1,4 +1,4 @@
-import { formatRecordForDisplay, buildQuerySuffix, parseDataArg, getStringField, interactiveList, resolveFieldsParam, checkDerivedFields } from '../helpers.js';
+import { formatRecordForDisplay, buildQuerySuffix, parseDataArg, getStringField, interactiveList, resolveFieldsParam, checkDerivedFields, confirmDelete } from '../helpers.js';
 
 const tableDefaultColumns = {
   incident: ['number', 'short_description', 'priority', 'state', 'assigned_to'],
@@ -115,6 +115,7 @@ export function recordsCmd(wrap) {
             .option('sys-id', { type: 'string', demandOption: true, describe: 'Record sys_id' })
             .option('columns', { alias: ['c', 'fields'], type: 'string', describe: 'Comma-separated columns (e.g. "number,short_description")' }),
           handler: wrap(async (argv, app) => {
+            assertSafeExactMatch(argv['sys-id']);
             const params = new URLSearchParams();
             params.set('sysparm_query', `sys_id=${argv['sys-id']}`);
             params.set('sysparm_limit', '1');
@@ -169,8 +170,10 @@ export function recordsCmd(wrap) {
           describe: 'Delete a record',
           builder: (y) => y
             .option('table', { type: 'string', demandOption: true, describe: 'Table name' })
-            .option('sys-id', { type: 'string', demandOption: true, describe: 'Record sys_id' }),
+            .option('sys-id', { type: 'string', demandOption: true, describe: 'Record sys_id' })
+            .option('force', { type: 'boolean', default: false, describe: 'Skip confirmation' }),
           handler: wrap(async (argv, app) => {
+            await confirmDelete(app, argv, `Delete record from ${argv.table} (${argv['sys-id']})`);
             await app.sdk.delete(argv.table, argv['sys-id']);
             app.ok({ message: 'Record deleted', table: argv.table, sys_id: argv['sys-id'] }, { summary: `Deleted record from ${argv.table}` });
           }),

package/src/commands/requests.js

@@ -1,5 +1,5 @@
 import { buildTicketCommands } from './_ticket.js';
-import { getStringField } from '../helpers.js';
+import { getStringField, assertSafeExactMatch } from '../helpers.js';
 
 const requestDefaultColumns = ['number', 'short_description', 'stage', 'assigned_to'];
 
@@ -25,6 +25,7 @@ export function requestsCmd(wrap) {
 
 async function enrichedShowHandler(argv, app) {
   const number = argv.number;
+  assertSafeExactMatch(number);
   const params = new URLSearchParams();
   params.set('sysparm_query', `number=${number}`);
   params.set('sysparm_display_value', 'all');

package/src/commands/setup.js

@@ -1,10 +1,13 @@
-import readline from 'node:readline';
-import { getEffectiveInstance, normalizeInstanceURL, saveConfig, setProfile } from '../config.js';
+import { loginWizard } from './auth.js';
 
+// `jsn setup` is kept as a hidden compatibility alias for `jsn auth login`.
+// The wizard lives in auth.js (loginWizard) so there is exactly ONE code path
+// for first-run onboarding — this command can never drift out of sync.
 export function setupCmd(wrap) {
   return {
     command: 'setup',
-    describe: 'Interactive first-time setup',
+    describe: 'Interactive first-time setup (use "jsn auth login")',
+    hidden: true, // legacy alias for `jsn auth login` — works but hidden from help
     builder: (yargs) => {
       return yargs
         .option('read-only', {
@@ -13,87 +16,10 @@ export function setupCmd(wrap) {
           default: false,
         });
     },
-    handler: wrap(async (_argv, app) => {
-      const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-      const ask = (q) => new Promise((resolve) => rl.question(q, resolve));
-
-      console.log('Welcome to JSN - ServiceNow CLI');
-      console.log();
-
-      let instance = getEffectiveInstance(app.config);
-      if (!instance) {
-        instance = await ask('ServiceNow instance URL (e.g., dev12345.service-now.com): ');
-        instance = normalizeInstanceURL(instance);
-      }
-      console.log(`Instance: ${instance}`);
-
-      // Warn if another profile already uses this instance URL
-      const existing = Object.entries(app.config.profiles || {}).find(([, p]) => p.instance_url === instance);
-      if (existing) {
-        console.log(`Note: instance is also used by profile "${existing[0]}".`);
-      }
-
-      const profileName = (await ask('Profile name (default): ')) || 'default';
-      const profile = { instance_url: instance };
-      if (_argv['read-only']) {
-        profile.read_only = true;
-      }
-
-      const authMethod = await ask('Authentication method (OAuth/Basic) [OAuth]: ');
-      const useBasic = authMethod.toLowerCase().startsWith('b');
-
-      if (useBasic) {
-        const username = await ask('Username: ');
-        rl.close(); // Close outer readline before askHidden creates its own
-        const { loadCredentials, askHidden } = await import('../auth.js');
-        const existing = loadCredentials(instance) || loadCredentials(instance, username);
-        if (existing && existing.auth_method === 'basic') {
-          console.log(`Using existing credentials for ${instance}`);
-        } else {
-          const password = await askHidden('Password: ');
-          const { saveCredentials } = await import('../auth.js');
-          saveCredentials(instance, { auth_method: 'basic', username, password }, username);
-          profile.username = username;
-          console.log('Basic auth credentials saved');
-        }
-        profile.auth_method = 'basic';
-      } else {
-        profile.auth_method = 'oauth';
-      }
-
-      await setProfile(app.config, profileName, profile);
-      // Set as active profile so subsequent commands know which instance to use
-      app.config.activeProfile = profileName;
-      app.config.defaultProfile = profileName;
-      saveConfig(app.config);
-
-      if (!useBasic) {
-        const loginNow = await ask('Login now? [Y/n]: ');
-        if (!loginNow || loginNow.toLowerCase() !== 'n') {
-          await app.auth.login(instance);
-          // Re-save credentials under <user>@<instance> after verifying username
-          try {
-            const { SDKClient } = await import('./sdk.js');
-            const sdk = new SDKClient(instance, app.auth);
-            const user = await sdk.getCurrentUser();
-            if (user && user.user_name) {
-              const { loadCredentials, saveCredentials } = await import('../auth.js');
-              const stored = loadCredentials(instance);
-              if (stored && stored.access_token) {
-                stored.username = user.user_name;
-                saveCredentials(instance, stored, user.user_name);
-              }
-              profile.username = user.user_name;
-            }
-          } catch {
-            // Non-fatal — token saved, username will be set on next auth login
-          }
-          console.log('Login successful!');
-        }
-      }
-
-      rl.close();
-      app.ok({ setup: true, instance, profile: profileName }, { summary: 'Setup complete' });
+    handler: wrap(async (argv, app) => {
+      console.log('Note: "jsn setup" is now "jsn auth login". Running the same wizard...\n');
+      const result = await loginWizard(app, argv);
+      app.ok({ setup: true, ...result }, { summary: 'Setup complete' });
     }),
   };
 }

package/src/commands/skill.js

@@ -14,7 +14,7 @@ const SKILL_REPO_PATH = path.join(
   '..', '..', 'skills', SKILL_NAME, 'SKILL.md'
 );
 
-const SKILL_RAW_URL = 'https://raw.githubusercontent.com/jacebenson/jsn/nodejs/skills/servicenow/SKILL.md';
+const SKILL_RAW_URL = 'https://raw.githubusercontent.com/jacebenson/jsn/main/skills/servicenow/SKILL.md';
 
 /**
  * Resolve the user's real home directory, even when Hermes overrides $HOME.
@@ -39,7 +39,10 @@ function realHomeDir() {
  * profile directory, falling back to ~/.hermes/skills/ (legacy symlink path).
  */
 function hermesSkillDir() {
-  const base = path.join(realHomeDir(), '.hermes');
+  // JSN_HERMES_BASE_DIR lets tests point at a temp .hermes tree.
+  // realHomeDir() deliberately bypasses $HOME (Hermes overrides it to a
+  // sandbox dir), so tests can't control the base via HOME.
+  const base = process.env.JSN_HERMES_BASE_DIR || path.join(realHomeDir(), '.hermes');
   const profileEnv = process.env.HERMES_PROFILE;
   let profileName = profileEnv;
 
@@ -59,11 +62,6 @@ function hermesSkillDir() {
   return path.join(base, 'skills', SKILL_NAME);
 }
 
-/** Resolve the installed SKILL.md path for Hermes. */
-function hermesSkillPath() {
-  return path.join(hermesSkillDir(), 'SKILL.md');
-}
-
 // Known agent skill directories (personal/user-level)
 // Keyed by agent name for the --target flag
 // Each value is the directory for the <name>/SKILL.md file

package/src/commands/tickets.js

@@ -1,4 +1,4 @@
-import { formatRecordForDisplay, getStringField, buildQuerySuffix, resolveFieldsParam } from '../helpers.js';
+import { formatRecordForDisplay, getStringField, buildQuerySuffix, resolveFieldsParam, assertSafeExactMatch } from '../helpers.js';
 
 export function ticketsCmd(wrap) {
   return {
@@ -60,6 +60,7 @@ export function ticketsCmd(wrap) {
           aliases: ['get'],
           describe: 'Show a ticket',
           handler: wrap(async (argv, app) => {
+            assertSafeExactMatch(argv.number);
             const params = new URLSearchParams();
             params.set('sysparm_query', `number=${argv.number}`);
             params.set('sysparm_limit', '1');
@@ -87,6 +88,7 @@ export function ticketsCmd(wrap) {
           builder: (y) => y.option('data', { type: 'string', demandOption: true, describe: 'JSON fields (e.g. \'{"state":"2","priority":"1"}\')' }),
           handler: wrap(async (argv, app) => {
             const recordData = JSON.parse(argv.data);
+            assertSafeExactMatch(argv.number);
             const findParams = new URLSearchParams();
             findParams.set('sysparm_query', `number=${argv.number}`);
             findParams.set('sysparm_limit', '1');
@@ -103,6 +105,7 @@ export function ticketsCmd(wrap) {
           command: 'delete <number>',
           describe: 'Delete a ticket',
           handler: wrap(async (argv, app) => {
+            assertSafeExactMatch(argv.number);
             const findParams = new URLSearchParams();
             findParams.set('sysparm_query', `number=${argv.number}`);
             findParams.set('sysparm_limit', '1');

package/src/commands/users.js

@@ -1,4 +1,4 @@
-import { formatRecordForDisplay, getStringField, interactiveList, resolveFieldsParam } from '../helpers.js';
+import { formatRecordForDisplay, getStringField, interactiveList, resolveFieldsParam, assertSafeExactMatch } from '../helpers.js';
 
 export function usersCmd(wrap) {
   return {
@@ -57,6 +57,7 @@ export function usersCmd(wrap) {
           describe: 'Show a user by user_name or sys_id',
           handler: wrap(async (argv, app) => {
             const id = argv.identifier;
+            assertSafeExactMatch(id);
             const isSysID = id.length === 32 && /^[0-9a-fA-F]+$/.test(id);
             const params = new URLSearchParams();
             params.set('sysparm_query', isSysID ? `sys_id=${id}` : `user_name=${id}`);
@@ -104,6 +105,7 @@ export function usersCmd(wrap) {
             .option('data', { type: 'string', demandOption: true, describe: 'JSON data to update' }),
           handler: wrap(async (argv, app) => {
             const id = argv.identifier;
+            assertSafeExactMatch(id);
             const recordData = JSON.parse(argv.data);
             const isSysID = id.length === 32 && /^[0-9a-fA-F]+$/.test(id);
             const params = new URLSearchParams();
@@ -130,6 +132,7 @@ export function usersCmd(wrap) {
           describe: 'Delete a user by user_name or sys_id',
           handler: wrap(async (argv, app) => {
             const id = argv.identifier;
+            assertSafeExactMatch(id);
             const isSysID = id.length === 32 && /^[0-9a-fA-F]+$/.test(id);
             const params = new URLSearchParams();
             params.set('sysparm_query', isSysID ? `sys_id=${id}` : `user_name=${id}`);

package/src/config.js

@@ -168,3 +168,12 @@ export function setProfile(cfg, name, profile) {
   cfg.profiles[name] = profile;
   return saveConfig(cfg);
 }
+
+export function setActiveProfile(cfg, name) {
+  if (!cfg.profiles || !cfg.profiles[name]) {
+    throw new Error(`Profile not found: ${name}`);
+  }
+  cfg.defaultProfile = name;
+  cfg.activeProfile = name;
+  return saveConfig(cfg);
+}

package/src/errors.js

@@ -126,3 +126,29 @@ export function asError(err) {
 export function isErrorCode(err, code) {
   return err instanceof AppError && err.code === code;
 }
+
+/**
+ * Format a safety-guard failure (mutation guard middleware in cli.js).
+ * In JSON mode writes the documented error envelope to stdout so piped
+ * consumers (`jsn ... --json | jq`) get a structured error instead of a
+ * raw stderr message. Otherwise writes human text to stderr.
+ * Always exits non-zero via guardExit.
+ */
+export function guardError(argv, { code, message, hint = '' }) {
+  if (argv?.format === 'json') {
+    return {
+      stream: 'stdout',
+      text: JSON.stringify({ ok: false, error: message, code, hint }) + '\n',
+    };
+  }
+  let text = `Error: ${message}\n`;
+  if (hint) text += `\n${hint}\n`;
+  return { stream: 'stderr', text };
+}
+
+export function guardExit(argv, opts) {
+  const { stream, text } = guardError(argv, opts);
+  if (stream === 'stdout') process.stdout.write(text);
+  else process.stderr.write(text);
+  process.exit(1);
+}

package/src/help.js

@@ -107,10 +107,8 @@ const DATA_COMMANDS = [
 ];
 
 const CONFIG_COMMANDS = [
-  { name: 'setup', desc: 'Interactive first-time setup' },
-  { name: 'auth', desc: 'OAuth authentication' },
-  { name: 'profiles', alias: 'profile', desc: 'Instance profiles' },
-  { name: 'updatesets', desc: 'Update sets (set, yolo, export, import)' },
+  { name: 'auth', desc: 'Authentication (login, status, switch, refresh, logout, remove)' },
+  { name: 'updatesets', desc: 'Update sets (set, create, export)' },
   { name: 'scopes', desc: 'Application scopes' },
 ];
 

package/src/helpers.js

@@ -1,8 +1,47 @@
 // Shared helper utilities
 
 import fs from 'node:fs';
+import readline from 'node:readline';
 import { paginatedSearch } from './paginated-search.js';
 import { isTTY, FormatAuto } from './output.js';
+import { getActiveProfile } from './config.js';
+
+/**
+ * Confirm a destructive action before executing.
+ *
+ * Default posture is ASK: interactive terminals get a y/N prompt;
+ * non-interactive invocation (pipes, scripts, AI agents) is rejected
+ * unless --force is passed. A profile can opt out entirely with the
+ * per-instance `skip_confirmations` flag (set via `auth login
+ * --skip-confirmations`).
+ *
+ * @param {object} app — app instance (reads active profile from app.config)
+ * @param {object} argv — parsed args (checks argv.force)
+ * @param {string} question — e.g. `Delete incident INC0010001?`
+ * @returns {Promise<boolean>} true when the action may proceed
+ * @throws when confirmation is required but denied/unavailable
+ */
+export async function confirmDelete(app, argv, question) {
+  const profile = getActiveProfile(app.config);
+  if (profile?.skip_confirmations === true) return true;
+  if (argv.force) return true;
+  if (isTTY(process.stdout) && isTTY(process.stdin)) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await new Promise((resolve) => {
+      rl.question(`${question} (y/N): `, resolve);
+    });
+    rl.close();
+    const response = answer.trim().toLowerCase();
+    if (response !== 'y' && response !== 'yes') {
+      throw new Error('Deletion cancelled');
+    }
+    return true;
+  }
+  throw new Error(
+    `${question} — confirmation required. Pass --force to skip, or set skip_confirmations on the profile to disable prompts.`
+  );
+}
+
 
 export function getStringField(record, field) {
   if (!record || typeof record !== 'object') return '';
@@ -74,6 +113,29 @@ export function resolveFieldsParam(columns) {
   return ['sys_id', ...columns].join(',');
 }
 
+// ServiceNow encoded-query metacharacters. In sysparm_query, `^` is the
+// AND-separator (^OR starts an OR clause), `= < > ~ !` are operators,
+// and `,` is used by IN lists. An identifier containing any of these
+// silently broadens an exact-match lookup — with sysparm_limit=1 the
+// wrong record wins (issue #143 finding #5). Exact-match identifiers
+// (numbers, sys_ids, names) never legitimately contain them.
+const QUERY_METACHARS = /[\^=<>~!,]/;
+
+/**
+ * Validate that an identifier is safe to use in an exact-match encoded
+ * query (field=value). Throws when the value contains characters that
+ * would change the query semantics.
+ * @param {string} value — identifier (number, sys_id, name)
+ */
+export function assertSafeExactMatch(value) {
+  if (value && QUERY_METACHARS.test(value)) {
+    throw new Error(
+      `Unsafe identifier for exact-match lookup: contains ServiceNow query characters (^ = < > ~ ! ,). ` +
+      `Refusing to build a query that could match more than the named record.`
+    );
+  }
+}
+
 /**
  * Shared interactive list helper with search-as-you-type.
  * All list commands that want an interactive TTY picker should use this.
@@ -89,12 +151,7 @@ export function resolveFieldsParam(columns) {
  * @param {string} opts.labelField — field used to match selection (default: 'name')
  * @returns {Promise<void>|null} null if no selection made or non-interactive
  */
-function vowelArticle(word) {
-  const first = word.charAt(0).toLowerCase();
-  return first === 'a' || first === 'e' || first === 'i' || first === 'o' || first === 'u' ? 'an' : 'a';
-}
-
-export async function interactiveList({ app, table, singular, columns, limit = 50, query = '', formatLabel, labelField = 'name' }) {
+export async function interactiveList({ app, table, singular, columns, limit = 50, _query = '', formatLabel, labelField = 'name' }) {
   app.requireInstance();
   const effectiveFormat = app.output.getFormat() === FormatAuto ? (isTTY(process.stdout) ? FormatAuto : FormatAuto) : app.output.getFormat();
   if (effectiveFormat !== FormatAuto || !isTTY(process.stdout) || !isTTY(process.stdin)) {
@@ -105,7 +162,7 @@ export async function interactiveList({ app, table, singular, columns, limit = 5
   const pickerFields = pickerColumns.join(',');
 
   // Get total count
-  let totalCount = 0;
+  let totalCount;
   try {
     totalCount = await app.sdk.aggregateCount(table, '');
   } catch {
@@ -114,7 +171,7 @@ export async function interactiveList({ app, table, singular, columns, limit = 5
   if (totalCount === 0) return null;
 
   // Paginated source adapter: (term, offset, { signal }) => choices[]
-  async function serverSource(term, offset, { signal } = {}) {
+  async function serverSource(term, offset, { signal: _signal } = {}) {
     try {
       const params = new URLSearchParams();
       params.set('sysparm_limit', String(limit));

package/src/mutations.js

@@ -2,6 +2,29 @@
 // Used by the read-only profile middleware to block mutation commands.
 // Each entry is a command path array matching argv._ tokens.
 
+// Dev commands that expose create/update/delete via buildDevCmd.
+// Each generates the root form (`jsn <name> create`) and the legacy dev form
+// (`jsn dev <name> create`), so read-only profiles block both spellings.
+const DEV_CRUD_COMMANDS = [
+  'actions', 'includes', 'rules', 'clientscripts', 'uiactions', 'uipolicies',
+  'tables', 'uipages', 'appmenu', 'acls', 'roles', 'properties', 'relationships',
+  'appmodules', 'listcontrols', 'views', 'privileges', 'uxscripts',
+  'catalogscripts', 'scriptactions', 'scheduledjobs', 'asyncrules', 'triggers',
+  'email', 'restmethods', 'restmessage', 'soapmessages', 'uimacros',
+  'cataloguipolicies', 'aliases', 'columns', 'flows', 'scrapi',
+];
+
+function devCrudPaths(name) {
+  return [
+    [name, 'create'],
+    [name, 'update'],
+    [name, 'delete'],
+    ['dev', name, 'create'],
+    ['dev', name, 'update'],
+    ['dev', name, 'delete'],
+  ];
+}
+
 export const MUTATION_COMMANDS = [
   // Incidents
   ['incidents', 'create'],
@@ -37,18 +60,26 @@ export const MUTATION_COMMANDS = [
   ['groups', 'delete'],
   // Catalog
   ['catalog', 'create-item'],
-  // Dev flows
-  ['dev', 'flows', 'create'],
-  ['dev', 'flows', 'update'],
-  ['dev', 'flows', 'delete'],
-  // Dev scopes
+  // Dev CRUD commands (root + `jsn dev` forms)
+  ...DEV_CRUD_COMMANDS.flatMap(devCrudPaths),
+  // Dev eval (no sub-action) — both spellings must be gated:
+  // `jsn eval` (root) and legacy `jsn dev eval`
+  ['eval'],
+  ['dev', 'eval'],
+  // Raw REST passthrough — can hit any endpoint with any method,
+  // so the whole command is a mutation surface on read-only profiles
+  ['rest'],
+  ['dev', 'rest'],
+  // Scopes: create + set (root + dev forms)
+  ['scopes', 'create'],
+  ['scopes', 'set'],
   ['dev', 'scopes', 'create'],
   ['dev', 'scopes', 'set'],
-  // Dev eval
-  ['dev', 'eval'],
-  // Dev updatesets
-  ['dev', 'updatesets', 'set'],
+  // Update sets: create + set (root + dev forms)
+  ['updatesets', 'create'],
+  ['updatesets', 'set'],
   ['dev', 'updatesets', 'create'],
+  ['dev', 'updatesets', 'set'],
 ];
 
 /**

package/src/output.js

@@ -200,12 +200,15 @@ export class OutputWriter {
           // Show lock icon for read-only profiles
           const lockIcon = p.read_only ? ' 🔒' : '';
 
+          // Show confirmations-off badge for skip_confirmations profiles
+          const confirmBadge = p.skip_confirmations ? ' ⚡' : '';
+
           if (p.name) {
-            this.writer.write(`${prefix}${authIcon} ${p.name} — ${p.instance}${lockIcon}${verifiedStr}${staleStr}\n`);
+            this.writer.write(`${prefix}${authIcon} ${p.name} — ${p.instance}${lockIcon}${confirmBadge}${verifiedStr}${staleStr}\n`);
           } else if (p.username) {
-            this.writer.write(`${prefix}${authIcon} ${p.instance} (as ${p.username})${lockIcon}${verifiedStr}${staleStr}\n`);
+            this.writer.write(`${prefix}${authIcon} ${p.instance} (as ${p.username})${lockIcon}${confirmBadge}${verifiedStr}${staleStr}\n`);
           } else {
-            this.writer.write(`${prefix}${authIcon} ${p.instance}${lockIcon}${verifiedStr}${staleStr}\n`);
+            this.writer.write(`${prefix}${authIcon} ${p.instance}${lockIcon}${confirmBadge}${verifiedStr}${staleStr}\n`);
           }
         }
       }

package/src/paginated-search.js

@@ -43,7 +43,7 @@ export const paginatedSearch = createPrompt((config, done) => {
           setActive(0);
           setStatus('done');
         }
-      } catch (err) {
+      } catch {
         if (!controller.signal.aborted) {
           setStatus('done');
           setChoices([]);

package/src/records/inspect.js

@@ -1,4 +1,4 @@
-import { isHexString, getStringField } from '../helpers.js';
+import { isHexString, getStringField, assertSafeExactMatch } from '../helpers.js';
 
 export async function resolveIdentifier(app, table, identifier) {
   // If it looks like a sys_id (32 hex chars), use it directly
@@ -7,6 +7,7 @@ export async function resolveIdentifier(app, table, identifier) {
   }
 
   // Otherwise, assume it's a record number — query the table
+  assertSafeExactMatch(identifier);
   const params = new URLSearchParams();
   params.set('sysparm_query', `number=${identifier}`);
   params.set('sysparm_limit', '1');