@jacebenson/jsn 4.0.0 → 4.0.1

package/src/commands/docs/community.js

@@ -0,0 +1,343 @@
+// Fetch ServiceNow Community pages, convert them to markdown, and index them
+// into the local docs DB alongside the ServiceNowDocs clone.
+//
+// Community content is written to <cache>/servicenow-cli/docs/community/ as
+// markdown with frontmatter, then picked up by ingest/refresh via walkDocs().
+
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import TurndownService from 'turndown';
+import matter from 'gray-matter';
+import Database from 'better-sqlite3';
+import { getDocsCommunityDir, getDocsDbPath, docsDbExists } from './db.js';
+import { refreshDocs } from './refresh.js';
+import { ingestDocs } from './ingest.js';
+
+const DEFAULT_SOURCES_FILE = path.join(import.meta.dirname, 'community-sources.json');
+const UA = 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36';
+
+const turndown = new TurndownService({
+  headingStyle: 'atx',
+  codeBlockStyle: 'fenced',
+  bulletListMarker: '-',
+});
+
+// --- Extraction helpers (pure, exported for tests) ---
+
+export function extractBodyHtml(html) {
+  const marker = 'lia-message-body-content';
+  const start = html.indexOf(marker);
+  if (start === -1) return null;
+  const open = html.indexOf('>', start) + 1;
+  if (open <= 0) return null;
+  // Depth-count the <div> nesting from the body content element.
+  let depth = 1;
+  let i = open;
+  while (i < html.length && depth > 0) {
+    const nextOpen = html.indexOf('<div', i);
+    const nextClose = html.indexOf('</div>', i);
+    if (nextOpen === -1 && nextClose === -1) break;
+    if (nextClose === -1 || (nextOpen !== -1 && nextOpen < nextClose)) {
+      depth++;
+      i = nextOpen + 4;
+    } else {
+      depth--;
+      i = nextClose + 6;
+    }
+  }
+  return html.slice(open, i);
+}
+
+export function extractMeta(html) {
+  const title = (() => {
+    const h1 = html.match(/<h1[^>]*>([\s\S]*?)<\/h1>/);
+    if (h1) return stripTags(h1[1]).trim();
+    const t = html.match(/<title>([\s\S]*?)<\/title>/);
+    return t ? t[1].trim().replace(/\s*-\s*ServiceNow Community\s*$/i, '') : null;
+  })();
+
+  const author = (() => {
+    const m = html.match(/<span\s+content="([^"]+)"\s+itemprop="name"[^>]*>/);
+    return m ? m[1] : null;
+  })();
+
+  const authorUrl = (() => {
+    const m = html.match(/class="[^"]*lia-user-name-link[^"]*"[^>]*href="([^"]+)"/);
+    return m ? m[1] : null;
+  })();
+
+  return { title, author, authorUrl };
+}
+
+export function stripTags(s) {
+  return decodeEntities(String(s).replace(/<[^>]*>/g, ''));
+}
+
+function decodeEntities(s) {
+  return s
+    .replace(/&amp;/g, '&')
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'")
+    .replace(/&nbsp;/g, ' ');
+}
+
+// --- HTML -> markdown ---
+
+export function htmlToMarkdown(html) {
+  return turndown.turndown(html).replace(/\n{3,}/g, '\n\n').trim() + '\n';
+}
+
+// --- Community page fetch ---
+
+async function fetchPage(url, { retries = 3, timeoutMs = 30000 } = {}) {
+  let lastErr;
+  for (let attempt = 0; attempt <= retries; attempt++) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      const res = await fetch(url, {
+        headers: { 'user-agent': UA, accept: 'text/html' },
+        signal: controller.signal,
+        redirect: 'follow',
+      });
+      if (res.status === 429) {
+        const wait = 5000 * (attempt + 1);
+        process.stderr.write(`  rate limited (429), waiting ${wait / 1000}s...\n`);
+        await sleep(wait);
+        continue;
+      }
+      if (res.status >= 400) {
+        lastErr = new Error(`HTTP ${res.status} for ${url}`);
+        continue;
+      }
+      return await res.text();
+    } catch (err) {
+      lastErr = err;
+      if (attempt < retries) await sleep(1500 * (attempt + 1));
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  throw lastErr;
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// --- Link extraction for --expand ---
+
+export function extractCommunityLinks(html, baseUrl) {
+  const bodyHtml = extractBodyHtml(html) || html;
+  const out = new Set();
+  const re = /href="([^"]+)"/g;
+  let m;
+  while ((m = re.exec(bodyHtml))) {
+    let u = m[1].replace(/&amp;/g, '&');
+    if (u.startsWith('#')) continue;
+    try {
+      u = new URL(u, baseUrl).toString();
+    } catch {
+      continue;
+    }
+    // Only new Khoros community article/blog pages: /community/<section>/<slug>/t[abdp]-p/<id>
+    const km = u.match(/^https?:\/\/www\.servicenow\.com\/community\/[a-z0-9-]+\/[^/]+\/t[abdp]-p\/\d+/);
+    if (!km) continue;
+    // Strip query/hash for dedupe.
+    const clean = km[0];
+    if (/\/user\/|viewprofilepage|notifymoderator|kudos|printpage|\/s\//.test(clean)) continue;
+    out.add(clean);
+  }
+  return [...out];
+}
+
+// --- File naming ---
+
+export function slugify(title, fallback = 'untitled') {
+  const s = String(title || '')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 80);
+  return s || fallback;
+}
+
+function frontmatter(body, data) {
+  return matter.stringify(body, data);
+}
+
+// --- Write a community doc to disk ---
+
+export function writeCommunityDoc({ author, title, url, bodyMd, docType, sourceUrl, published, fetchedAt, communityDir } = {}) {
+  const baseDir = communityDir || getDocsCommunityDir();
+  const authorDir = path.join(baseDir, slugify(author, 'unknown'));
+  fs.mkdirSync(authorDir, { recursive: true });
+  // Include the post id (t[abdp]-p/<id>) so identical titles across posts
+  // never collide on disk. e.g. 456-articles-blogs-videos.../ba-p/2292127
+  const id = (url.match(/\/(t[abdp]-p\/\d+)\/?$/) || [])[1] || null;
+  const idPart = id ? id.replace(/[^a-z0-9]+/g, '-') : null;
+  const titleSlug = slugify(title, 'untitled');
+  const slug = idPart ? `${titleSlug}-${idPart}` : titleSlug;
+  const rel = path.join(authorDir, `${slug}.md`);
+  const fm = {
+    title,
+    author,
+    bundle: 'community',
+    doc_type: docType,
+    canonical_url: url,
+    ...(sourceUrl ? { source_url: sourceUrl } : {}),
+    ...(published ? { published } : {}),
+    ...(fetchedAt ? { fetched_at: fetchedAt } : {}),
+  };
+  const md = frontmatter(bodyMd, fm);
+  fs.writeFileSync(rel, md);
+  return { file: rel, rel: path.relative(baseDir, rel).split(path.sep).join('/') };
+}
+
+// --- Sync entry points ---
+
+function loadSources(sourcesFile) {
+  const file = sourcesFile || DEFAULT_SOURCES_FILE;
+  if (!fs.existsSync(file)) {
+    throw new Error(`Community sources file not found: ${file}`);
+  }
+  const data = JSON.parse(fs.readFileSync(file, 'utf8'));
+  if (!Array.isArray(data.sources)) {
+    throw new Error(`Invalid community sources file ${file}: expected { "sources": [...] }`);
+  }
+  return data.sources;
+}
+
+export async function syncCommunity(opts = {}) {
+  const sources = loadSources(opts.sourcesFile);
+  const expand = opts.expand === true;
+  const force = opts.force === true;
+  const delayMs = opts.delayMs != null ? opts.delayMs : 500;
+  const dbPath = opts.dbPath || getDocsDbPath();
+
+  const results = { hubs: [], articles: [], skipped: [], errors: [] };
+
+  for (const source of sources) {
+    const url = source.url || source.hub_url;
+    if (!url) {
+      results.errors.push({ source: source.name || '?', error: 'missing url' });
+      continue;
+    }
+    process.stderr.write(`Fetching hub: ${url}\n`);
+    try {
+      const html = await fetchPage(url);
+      const meta = extractMeta(html);
+      const title = meta.title || source.name || url;
+      const author = meta.author || source.author || 'ServiceNow Community';
+      const authorUrl = meta.authorUrl || source.author_url;
+      const bodyHtml = extractBodyHtml(html);
+      if (!bodyHtml) {
+        results.errors.push({ url, error: 'no article body found' });
+        continue;
+      }
+      const bodyMd = htmlToMarkdown(bodyHtml);
+      const written = writeCommunityDoc({
+        author,
+        title,
+        url,
+        bodyMd,
+        docType: 'hub',
+        fetchedAt: new Date().toISOString(),
+      });
+      results.hubs.push({ title, author, authorUrl, url, file: written.rel });
+
+      if (expand) {
+        const links = extractCommunityLinks(html, url);
+        const urlIndex = buildUrlIndex();
+        process.stderr.write(`  ${links.length} linked article(s) found\n`);
+        for (const link of links) {
+          // Skip already-downloaded files unless --force.
+          const existing = findExisting(link, urlIndex);
+          if (existing && !force) {
+            results.skipped.push({ url: link, reason: 'already downloaded' });
+            continue;
+          }
+          process.stderr.write(`  Fetching: ${link}\n`);
+          try {
+            const pageHtml = await fetchPage(link);
+            const pageMeta = extractMeta(pageHtml);
+            const pageBody = extractBodyHtml(pageHtml);
+            if (!pageBody) {
+              results.skipped.push({ url: link, reason: 'no article body' });
+              continue;
+            }
+            const md = htmlToMarkdown(pageBody);
+            const wrote = writeCommunityDoc({
+              author: pageMeta.author || author,
+              title: pageMeta.title || link,
+              url: link,
+              bodyMd: md,
+              docType: 'article',
+              sourceUrl: url,
+              fetchedAt: new Date().toISOString(),
+            });
+            results.articles.push({ title: pageMeta.title, url: link, file: wrote.rel });
+          } catch (err) {
+            results.errors.push({ url: link, error: err.message });
+          }
+          if (delayMs > 0) await sleep(delayMs);
+        }
+      }
+      if (delayMs > 0) await sleep(delayMs);
+    } catch (err) {
+      results.errors.push({ url, error: err.message });
+    }
+  }
+
+  // Refresh the index so new community docs are searchable. Fall back to a
+  // full ingest when no DB exists yet.
+  const refreshResult = docsDbExists()
+    ? refreshDocs({ dbPath })
+    : ingestDocs({ dbPath, roots: [{ dir: getDocsCommunityDir(), prefix: 'community/' }], embed: true });
+
+  return { ...results, refresh: refreshResult };
+}
+
+function buildUrlIndex() {
+  const communityDir = getDocsCommunityDir();
+  if (!fs.existsSync(communityDir)) return new Map();
+  const index = new Map();
+  const walk = (dir) => {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else if (entry.name.toLowerCase().endsWith('.md')) {
+        try {
+          const parsed = matter(fs.readFileSync(full, 'utf8'));
+          if (parsed.data.canonical_url) index.set(parsed.data.canonical_url, full);
+        } catch { /* ignore */ }
+      }
+    }
+  };
+  walk(communityDir);
+  return index;
+}
+
+function findExisting(url, urlIndex) {
+  if (!urlIndex) return null;
+  return urlIndex.get(url) || null;
+}
+
+export function listCommunityDocs({ dbPath } = {}) {
+  const dbFile = dbPath || getDocsDbPath();
+  if (!fs.existsSync(dbFile)) return { total: 0, docs: [] };
+  const db = new Database(dbFile, { readonly: true });
+  const rows = db
+    .prepare(`SELECT id, path, title, doc_type, frontmatter FROM docs WHERE bundle = 'community' ORDER BY path`)
+    .all()
+    .map((r) => {
+      let fm = {};
+      try { fm = JSON.parse(r.frontmatter || '{}'); } catch { /* ignore */ }
+      return { id: r.id, path: r.path, title: r.title || fm.title, doc_type: r.doc_type, author: fm.author, canonical_url: fm.canonical_url };
+    });
+  db.close();
+  return { total: rows.length, docs: rows };
+}

package/src/commands/docs/db.js

@@ -28,12 +28,48 @@ export function getDocsSourceMarkdownDir() {
   return path.join(getDocsSourceDir(), 'markdown');
 }
 
+export function getDocsCommunityDir() {
+  return path.join(getDocsCacheDir(), 'community');
+}
+
 export function ensureDocsCacheDir() {
   const dir = getDocsCacheDir();
   fs.mkdirSync(dir, { recursive: true });
   return dir;
 }
 
+/**
+ * Walk one or more markdown source roots, yielding { file, rel } pairs.
+ * `rel` is the path stored in the docs table (unique). Roots are passed as
+ * { dir, prefix } so community content can live under a `community/` prefix
+ * without colliding with the ServiceNowDocs markdown tree.
+ */
+export function* walkDocs(roots) {
+  function* walk(dir, root, prefix) {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        yield* walk(full, root, prefix);
+      } else if (entry.isFile() && entry.name.toLowerCase().endsWith('.md')) {
+        const rel = prefix + path.relative(root, full).split(path.sep).join('/');
+        yield { file: full, rel };
+      }
+    }
+  }
+  for (const root of roots) {
+    if (!fs.existsSync(root.dir)) continue;
+    yield* walk(root.dir, root.dir, root.prefix || '');
+  }
+}
+
+export function defaultDocsRoots(opts = {}) {
+  const communityDir = opts.communityDir || getDocsCommunityDir();
+  return [
+    { dir: opts.docsDir || getDocsSourceMarkdownDir(), prefix: '' },
+    { dir: communityDir, prefix: 'community/' },
+  ];
+}
+
 export function openDocsDb(opts = {}) {
   const dbPath = opts.dbPath || getDocsDbPath();
   ensureDocsCacheDir();

package/src/commands/docs/docs.js

@@ -13,6 +13,7 @@ import { refreshDocs } from './refresh.js';
 import { embedDocs } from './embed.js';
 import { searchDocs } from './search.js';
 import { serveDocs } from './serve.js';
+import { syncCommunity, listCommunityDocs } from './community.js';
 
 function formatBytes(n) {
   if (n == null) return '-';
@@ -226,6 +227,45 @@ export function docsCmd(wrap) {
             const result = refreshDocs({ docsDir: getDocsSourceMarkdownDir() });
             app.ok(result, { summary: `Refresh complete: +${result.added} ~${result.updated} -${result.removed} =${result.unchanged}` });
           }),
+        })
+        .command({
+          command: 'community <action>',
+          describe: 'Sync ServiceNow Community articles into the searchable docs index',
+          builder: (y) => y
+            .command({
+              command: 'sync',
+              describe: 'Fetch community hub pages (+ linked articles with --expand) and index them',
+              builder: (yy) => yy
+                .option('expand', { type: 'boolean', describe: 'Also fetch every linked community article found on the hub pages' })
+                .option('force', { type: 'boolean', describe: 'Re-fetch articles already downloaded' })
+                .option('sources', { type: 'string', describe: 'Path to a community-sources.json (default: bundled)' })
+                .option('delay-ms', { type: 'number', describe: 'Delay between article fetches (default: 500)' }),
+              handler: wrap(async (argv, app) => {
+                const result = await syncCommunity({
+                  sourcesFile: argv.sources,
+                  expand: argv.expand === true,
+                  force: argv.force === true,
+                  delayMs: argv['delay-ms'],
+                });
+                app.ok(result, {
+                  summary: `Community sync: ${result.hubs.length} hub(s), ${result.articles.length} article(s), ${result.skipped.length} skipped, ${result.errors.length} error(s)`,
+                });
+              }),
+            })
+            .command({
+              command: 'list',
+              describe: 'List community docs currently in the index',
+              handler: wrap(async (argv, app) => {
+                const result = listCommunityDocs();
+                const lines = result.docs.map((d) => `[${d.id}] ${d.title || d.path} (${d.doc_type})`);
+                app.ok({
+                  _formatted: lines.length ? lines.join('\n') : '(no community docs indexed yet)',
+                  total: result.total,
+                  docs: result.docs,
+                }, { summary: `${result.total} community doc(s) indexed` });
+              }),
+            })
+            .demandCommand(1, 'Specify an action: sync or list'),
         });
     },
     handler: () => {
@@ -236,6 +276,7 @@ export function docsCmd(wrap) {
       process.stdout.write('  search    Full-text + semantic search across the local docs index\n');
       process.stdout.write('  show      Display a full documentation page by id or path\n');
       process.stdout.write('  serve     Start a local web UI for browsing and searching docs\n');
+      process.stdout.write('  community Sync ServiceNow Community articles (hubs + linked posts) into the index\n');
       process.stdout.write('\n');
       process.stdout.write('Tip: use "jsn docs serve --expose" to bind to 0.0.0.0 and share on your network.\n');
       process.stdout.write('\n');

package/src/commands/docs/ingest.js

@@ -1,20 +1,15 @@
 // Ingest ServiceNow markdown docs into a SQLite database with FTS5 full-text search.
 
 import fs from 'node:fs';
-import path from 'node:path';
 import { createHash } from 'node:crypto';
 import matter from 'gray-matter';
-import { openDocsDb, closeDocsDb, initDocsSchema, getDocsDbPath } from './db.js';
+import { openDocsDb, closeDocsDb, initDocsSchema, getDocsDbPath, walkDocs, defaultDocsRoots } from './db.js';
 import { encodeText, phasesToBytes, docSurface, DEFAULT_DIM } from './hrr.js';
 
 export function ingestDocs(opts = {}) {
-  const docsDir = opts.docsDir;
   const dbPath = opts.dbPath || getDocsDbPath();
   const embed = opts.embed !== false;
-
-  if (!fs.existsSync(docsDir)) {
-    throw new Error(`Docs directory not found: ${docsDir}`);
-  }
+  const roots = opts.roots || defaultDocsRoots(opts);
 
   // Fresh build each run.
   if (fs.existsSync(dbPath)) fs.rmSync(dbPath);
@@ -27,20 +22,12 @@ export function ingestDocs(opts = {}) {
     VALUES (@path, @title, @release, @bundle, @doc_type, @locale, @frontmatter, @body, @size, @mtime, @hash, @hrr_vector)
   `);
 
-  function* walk(dir) {
-    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-      const full = path.join(dir, entry.name);
-      if (entry.isDirectory()) yield* walk(full);
-      else if (entry.isFile() && entry.name.toLowerCase().endsWith('.md')) yield full;
-    }
-  }
-
   let count = 0;
   let errors = 0;
   const startedAt = Date.now();
 
   db.exec('BEGIN');
-  for (const file of [...walk(docsDir)]) {
+  for (const { file, rel } of walkDocs(roots)) {
     try {
       const stat = fs.statSync(file);
       const raw = fs.readFileSync(file, 'utf8');
@@ -58,7 +45,7 @@ export function ingestDocs(opts = {}) {
         ? phasesToBytes(encodeText(docSurface(data.title ?? null, body), DEFAULT_DIM))
         : null;
       insert.run({
-        path: path.relative(docsDir, file).split(path.sep).join('/'),
+        path: rel,
         title: data.title ?? null,
         release: data.release ?? null,
         bundle: data.bundle ?? null,

package/src/commands/docs/refresh.js

@@ -2,22 +2,18 @@
 // after a ServiceNow docs update (e.g. `git pull` in the docs repo).
 
 import fs from 'node:fs';
-import path from 'node:path';
 import { createHash } from 'node:crypto';
 import matter from 'gray-matter';
-import { openDocsDb, closeDocsDb, getDocsDbPath } from './db.js';
+import { openDocsDb, closeDocsDb, getDocsDbPath, walkDocs, defaultDocsRoots } from './db.js';
 import { encodeText, phasesToBytes, docSurface, DEFAULT_DIM } from './hrr.js';
 
 export function refreshDocs(opts = {}) {
-  const docsDir = opts.docsDir;
   const dbPath = opts.dbPath || getDocsDbPath();
+  const roots = opts.roots || defaultDocsRoots(opts);
 
   if (!fs.existsSync(dbPath)) {
     throw new Error(`Database not found: ${dbPath}. Run "jsn docs sync" first for the initial build.`);
   }
-  if (!fs.existsSync(docsDir)) {
-    throw new Error(`Docs directory not found: ${docsDir}`);
-  }
 
   const db = openDocsDb({ dbPath });
   db.exec('PRAGMA journal_mode = WAL');
@@ -34,14 +30,6 @@ export function refreshDocs(opts = {}) {
     && db.prepare('SELECT COUNT(*) AS n FROM docs').get().n > 0;
   const setHash = db.prepare('UPDATE docs SET hash = ? WHERE id = ?');
 
-  function* walk(dir) {
-    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-      const full = path.join(dir, entry.name);
-      if (entry.isDirectory()) yield* walk(full);
-      else if (entry.isFile() && entry.name.toLowerCase().endsWith('.md')) yield full;
-    }
-  }
-
   const existing = new Map();
   for (const row of db.prepare('SELECT id, path, hash FROM docs').all()) {
     existing.set(row.path, { id: row.id, hash: row.hash });
@@ -60,12 +48,11 @@ export function refreshDocs(opts = {}) {
   const seen = new Set();
   const started = Date.now();
 
-  const files = [...walk(docsDir)];
+  const files = [...walkDocs(roots)];
 
   db.exec('BEGIN');
-  for (const file of files) {
+  for (const { file, rel } of files) {
     try {
-      const rel = path.relative(docsDir, file).split(path.sep).join('/');
       seen.add(rel);
       const raw = fs.readFileSync(file, 'utf8');
       const hash = createHash('sha256').update(raw).digest('hex');

package/src/commands/docs/search.js

@@ -46,7 +46,7 @@ export function searchDocs(opts = {}) {
 
   // Total matching docs (for pagination)
   const total = db
-    .prepare(`SELECT COUNT(*) AS n FROM docs_fts WHERE docs_fts MATCH @q${where}`)
+    .prepare(`SELECT COUNT(*) AS n FROM docs_fts JOIN docs d ON d.id = docs_fts.rowid WHERE docs_fts MATCH @q${where}`)
     .get({ q, ...(bundle && { bundle }), ...(docType && { docType }) }).n;
 
   let rows;

package/src/commands/grouproles.js

@@ -1,4 +1,4 @@
-import { formatRecordForDisplay, getStringField, resolveFieldsParam } from '../helpers.js';
+import { formatRecordForDisplay, getStringField, resolveFieldsParam, assertSafeExactMatch } from '../helpers.js';
 
 export function groupRolesCmd(wrap) {
   return {
@@ -42,6 +42,8 @@ export function groupRolesCmd(wrap) {
           handler: wrap(async (argv, app) => {
             const groupName = argv.group;
             const roleName = argv.role;
+            assertSafeExactMatch(groupName);
+            assertSafeExactMatch(roleName);
 
             // Resolve group sys_id
             const isGroupSysID = groupName.length === 32 && /^[0-9a-fA-F]+$/.test(groupName);
@@ -100,6 +102,8 @@ export function groupRolesCmd(wrap) {
           handler: wrap(async (argv, app) => {
             const groupName = argv.group;
             const roleName = argv.role;
+            assertSafeExactMatch(groupName);
+            assertSafeExactMatch(roleName);
 
             // Resolve group sys_id
             const isGroupSysID = groupName.length === 32 && /^[0-9a-fA-F]+$/.test(groupName);

package/src/commands/groups.js

@@ -1,4 +1,4 @@
-import { formatRecordForDisplay, getStringField, interactiveList, resolveFieldsParam } from '../helpers.js';
+import { formatRecordForDisplay, getStringField, interactiveList, resolveFieldsParam, assertSafeExactMatch } from '../helpers.js';
 
 export function groupsCmd(wrap) {
   return {
@@ -32,13 +32,13 @@ export function groupsCmd(wrap) {
                 cp.set('sysparm_query', `group=${sysID}`); cp.set('sysparm_limit', '0'); cp.set('sysparm_fields', 'sys_id');
                 const members = await app.sdk.list('sys_user_grmember', cp);
                 memberCount = members.length;
-              } catch {}
+              } catch { /* non-critical */ }
               try {
                 const rp = new URLSearchParams();
                 rp.set('sysparm_query', `group=${sysID}`); rp.set('sysparm_limit', '0'); rp.set('sysparm_fields', 'sys_id');
                 const roles = await app.sdk.list('sys_group_has_role', rp);
                 roleCount = roles.length;
-              } catch {}
+              } catch { /* non-critical */ }
 
               picked._context = { instance_url: app.getEffectiveInstance(), table: 'sys_user_group' };
               return app.ok(picked, {
@@ -72,6 +72,7 @@ export function groupsCmd(wrap) {
           describe: 'Show a group by name or sys_id',
           handler: wrap(async (argv, app) => {
             const id = argv.name;
+            assertSafeExactMatch(id);
             const isSysID = id.length === 32 && /^[0-9a-fA-F]+$/.test(id);
             const params = new URLSearchParams();
             params.set('sysparm_query', isSysID ? `sys_id=${id}` : `name=${id}`);
@@ -117,6 +118,7 @@ export function groupsCmd(wrap) {
             .option('data', { type: 'string', demandOption: true, describe: 'JSON data to update' }),
           handler: wrap(async (argv, app) => {
             const id = argv.name;
+            assertSafeExactMatch(id);
             const recordData = JSON.parse(argv.data);
             const isSysID = id.length === 32 && /^[0-9a-fA-F]+$/.test(id);
             const params = new URLSearchParams();
@@ -142,6 +144,7 @@ export function groupsCmd(wrap) {
           describe: 'Delete a group by name or sys_id',
           handler: wrap(async (argv, app) => {
             const id = argv.name;
+            assertSafeExactMatch(id);
             const isSysID = id.length === 32 && /^[0-9a-fA-F]+$/.test(id);
             const params = new URLSearchParams();
             params.set('sysparm_query', isSysID ? `sys_id=${id}` : `name=${id}`);

package/src/commands/records.js

@@ -1,4 +1,4 @@
-import { formatRecordForDisplay, buildQuerySuffix, parseDataArg, getStringField, interactiveList, resolveFieldsParam, checkDerivedFields } from '../helpers.js';
+import { formatRecordForDisplay, buildQuerySuffix, parseDataArg, getStringField, interactiveList, resolveFieldsParam, checkDerivedFields, confirmDelete } from '../helpers.js';
 
 const tableDefaultColumns = {
   incident: ['number', 'short_description', 'priority', 'state', 'assigned_to'],
@@ -115,6 +115,7 @@ export function recordsCmd(wrap) {
             .option('sys-id', { type: 'string', demandOption: true, describe: 'Record sys_id' })
             .option('columns', { alias: ['c', 'fields'], type: 'string', describe: 'Comma-separated columns (e.g. "number,short_description")' }),
           handler: wrap(async (argv, app) => {
+            assertSafeExactMatch(argv['sys-id']);
             const params = new URLSearchParams();
             params.set('sysparm_query', `sys_id=${argv['sys-id']}`);
             params.set('sysparm_limit', '1');
@@ -169,8 +170,10 @@ export function recordsCmd(wrap) {
           describe: 'Delete a record',
           builder: (y) => y
             .option('table', { type: 'string', demandOption: true, describe: 'Table name' })
-            .option('sys-id', { type: 'string', demandOption: true, describe: 'Record sys_id' }),
+            .option('sys-id', { type: 'string', demandOption: true, describe: 'Record sys_id' })
+            .option('force', { type: 'boolean', default: false, describe: 'Skip confirmation' }),
           handler: wrap(async (argv, app) => {
+            await confirmDelete(app, argv, `Delete record from ${argv.table} (${argv['sys-id']})`);
             await app.sdk.delete(argv.table, argv['sys-id']);
             app.ok({ message: 'Record deleted', table: argv.table, sys_id: argv['sys-id'] }, { summary: `Deleted record from ${argv.table}` });
           }),

package/src/commands/requests.js

@@ -1,5 +1,5 @@
 import { buildTicketCommands } from './_ticket.js';
-import { getStringField } from '../helpers.js';
+import { getStringField, assertSafeExactMatch } from '../helpers.js';
 
 const requestDefaultColumns = ['number', 'short_description', 'stage', 'assigned_to'];
 
@@ -25,6 +25,7 @@ export function requestsCmd(wrap) {
 
 async function enrichedShowHandler(argv, app) {
   const number = argv.number;
+  assertSafeExactMatch(number);
   const params = new URLSearchParams();
   params.set('sysparm_query', `number=${number}`);
   params.set('sysparm_display_value', 'all');