doordash-cli 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,47 @@
+# Changelog
+
+All notable changes to `doordash-cli` will be documented in this file.
+
+- Versions follow [Semantic Versioning](https://semver.org/).
+- Release entries are generated from squash-merged conventional commits on `main`.
+- Git tags use the `vX.Y.Z` form.
+- Historical `doordash-cli-vX.Y.Z` tags are bridged locally during release automation.
+
+See [docs/releasing.md](docs/releasing.md) for the maintainer release flow.
+
+## 0.2.0 (2026-03-11)
+
+### Features
+
+* add direct DoorDash consumer API transport ([06b5194](https://github.com/LatencyTDH/doordash-cli/commit/06b5194f72e05547574b169cf9a56311309bb722))
+* add read-only existing-order tracking ([#9](https://github.com/LatencyTDH/doordash-cli/issues/9)) ([a4695e1](https://github.com/LatencyTDH/doordash-cli/commit/a4695e16fa7e267e265f5e4f5c3d5585657dc337)), closes [#6](https://github.com/LatencyTDH/doordash-cli/issues/6)
+* finish direct address enrollment and standalone nested add-ons ([#2](https://github.com/LatencyTDH/doordash-cli/issues/2)) ([d4a2f6a](https://github.com/LatencyTDH/doordash-cli/commit/d4a2f6a29b7dd407ee4444c78cb6af41f3981bc0))
+* ship direct session import and configurable item payloads ([360707c](https://github.com/LatencyTDH/doordash-cli/commit/360707c3504d19e424284eb4ac4ac8f7914e9031))
+* streamline install and npm packaging ([#11](https://github.com/LatencyTDH/doordash-cli/issues/11)) ([d6cec89](https://github.com/LatencyTDH/doordash-cli/commit/d6cec89ca5f4f239309ea48052072fc9ca944e5d))
+
+### Bug Fixes
+
+* bridge legacy release tags during release-it migration ([#22](https://github.com/LatencyTDH/doordash-cli/issues/22)) ([0360d90](https://github.com/LatencyTDH/doordash-cli/commit/0360d90a9f1fe0e42a61cc2a34051d714fd2891d))
+* keep release-please on the pre-v1 track ([7af23fa](https://github.com/LatencyTDH/doordash-cli/commit/7af23fa94301642f84802a791fa6f0b53d60371a))
+* make linked cli entrypoints usable ([6cd18e4](https://github.com/LatencyTDH/doordash-cli/commit/6cd18e4a9e8165d60cda5bc064aebb6b99b8bf20))
+* pin release-please initial version to 0.1.0 ([a679966](https://github.com/LatencyTDH/doordash-cli/commit/a679966ab51f9693eafecfe7fce9123b862d0aec))
+* reset direct cart id when switching stores ([4f0db85](https://github.com/LatencyTDH/doordash-cli/commit/4f0db85de3c1fe554cf4b479b2f225b7f1bf88cf))
+* validate cart-safe command surface ([f7bcb6c](https://github.com/LatencyTDH/doordash-cli/commit/f7bcb6cc41e6869de1dcbb3fb20f3e6052156efe))
+
+## 0.1.0 (2026-03-10)
+
+### Features
+
+* add direct DoorDash consumer API transport ([06b5194](https://github.com/LatencyTDH/doordash-cli/commit/06b5194f72e05547574b169cf9a56311309bb722))
+* add read-only existing-order tracking ([#9](https://github.com/LatencyTDH/doordash-cli/issues/9)) ([a4695e1](https://github.com/LatencyTDH/doordash-cli/commit/a4695e16fa7e267e265f5e4f5c3d5585657dc337))
+* finish direct address enrollment and standalone nested add-ons ([#2](https://github.com/LatencyTDH/doordash-cli/issues/2)) ([d4a2f6a](https://github.com/LatencyTDH/doordash-cli/commit/d4a2f6a29b7dd407ee4444c78cb6af41f3981bc0))
+* ship direct session import and configurable item payloads ([360707c](https://github.com/LatencyTDH/doordash-cli/commit/360707c3504d19e424284eb4ac4ac8f7914e9031))
+* streamline install and npm packaging ([#11](https://github.com/LatencyTDH/doordash-cli/issues/11)) ([d6cec89](https://github.com/LatencyTDH/doordash-cli/commit/d6cec89ca5f4f239309ea48052072fc9ca944e5d))
+
+### Bug Fixes
+
+* keep release-please on the pre-v1 track ([7af23fa](https://github.com/LatencyTDH/doordash-cli/commit/7af23fa94301642f84802a791fa6f0b53d60371a))
+* make linked cli entrypoints usable ([6cd18e4](https://github.com/LatencyTDH/doordash-cli/commit/6cd18e4a9e8165d60cda5bc064aebb6b99b8bf20))
+* pin release-please initial version to 0.1.0 ([a679966](https://github.com/LatencyTDH/doordash-cli/commit/a679966ab51f9693eafecfe7fce9123b862d0aec))
+* reset direct cart id when switching stores ([4f0db85](https://github.com/LatencyTDH/doordash-cli/commit/4f0db85de3c1fe554cf4b479b2f225b7f1bf88cf))
+* validate cart-safe command surface ([f7bcb6c](https://github.com/LatencyTDH/doordash-cli/commit/f7bcb6cc41e6869de1dcbb3fb20f3e6052156efe))

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 doordash-cli contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,131 @@
+# doordash-cli
+
+> Cart-safe DoorDash CLI for terminal workflows.
+
+`doordash-cli` is an unofficial CLI for the parts of DoorDash that work well in a shell: sign in once, set a delivery address, search restaurants, inspect menus and items, read existing orders, and manage a cart with JSON output.
+
+It stops before checkout.
+
+## Highlights
+
+- **Cart-safe by design** — browse, inspect existing orders, and manage a cart; no checkout, payment, or order mutation.
+- **Direct API first** — auth, discovery, existing-order, and cart commands use DoorDash consumer-web GraphQL/HTTP rather than DOM clicking.
+- **JSON-friendly** — every command prints structured output.
+- **Fail-closed** — unsupported commands, flags, or unsafe payload shapes are rejected.
+
+## Install
+
+### Install from npm
+
+```bash
+npm install -g doordash-cli
+```
+
+That installs both lowercase command names: `doordash-cli` and `dd-cli`.
+
+Package page: <https://www.npmjs.com/package/doordash-cli>
+
+For the full install and first-run guide, see [docs/install.md](docs/install.md).
+
+### Install from source instead
+
+If you want the latest unreleased work or a local checkout you can edit, use:
+
+```bash
+git clone https://github.com/LatencyTDH/doordash-cli.git
+cd doordash-cli
+npm install
+npm link
+```
+
+If you prefer to run from a checkout without linking:
+
+```bash
+npm run cli -- --help
+```
+
+### Browser prerequisite
+
+If you plan to use `auth-bootstrap`, install Playwright's Chromium build once:
+
+```bash
+doordash-cli install-browser
+# or, from a checkout without linking
+npm run install:browser
+```
+
+## First run
+
+```bash
+doordash-cli auth-bootstrap
+doordash-cli auth-check
+doordash-cli set-address --address "350 5th Ave, New York, NY 10118"
+doordash-cli search --query sushi
+```
+
+If you are running from a checkout without `npm link`, replace `doordash-cli` with `npm run cli --`.
+
+If you already have a compatible signed-in DoorDash browser session available, `auth-check` may reuse it instead of asking you to sign in again.
+
+## Command surface
+
+### Session
+
+- `install-browser`
+- `auth-check`
+- `auth-bootstrap`
+- `auth-clear`
+
+### Discovery
+
+- `set-address --address <text>`
+- `search --query <text> [--cuisine <name>]`
+- `menu --restaurant-id <id>`
+- `item --restaurant-id <id> --item-id <id>`
+
+### Existing orders
+
+- `orders [--limit <n>] [--active-only]`
+- `order --order-id <id>`
+
+### Cart
+
+- `add-to-cart --restaurant-id <id> (--item-id <id> | --item-name <name>)`
+- `update-cart --cart-item-id <id> --quantity <n>`
+- `cart`
+
+For configurable items and working command examples, see [docs/examples.md](docs/examples.md).
+
+## Safety
+
+The CLI allowlists browse, existing-order, and cart commands. It hard-blocks:
+
+- `checkout`
+- `place-order`
+- payment actions
+- order mutation or cancellation actions
+
+Safety is enforced in code:
+
+- unsupported commands hard-fail
+- unknown flags are rejected before DoorDash work runs
+- direct cart mutations use validated request shapes
+- unsupported nested option transports fail closed
+
+## Docs
+
+- [Install guide](docs/install.md)
+- [Examples](docs/examples.md)
+- [Release process](docs/releasing.md)
+- `man dd-cli`
+- `man doordash-cli`
+
+## Caveats
+
+- This is an unofficial integration against DoorDash consumer-web traffic.
+- DoorDash can change request shapes, anti-bot behavior, or session handling at any time.
+- Review results before trusting them for anything important.
+
+## License
+
+MIT

package/dist/bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { runCli } from "./cli.js";
+void runCli();

package/dist/cli.d.ts

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+export declare function version(): string;
+export declare function usage(): string;
+export declare function normalizeOptionToken(token: string): string;
+export declare function parseArgv(argv: string[]): {
+    command?: string;
+    flags: Record<string, string>;
+};
+export declare function main(argv?: string[]): Promise<void>;
+export declare function runCli(argv?: string[]): Promise<void>;
+export declare function isDirectExecution(argv1?: string | undefined, metaUrl?: string): boolean;

package/dist/cli.js

@@ -0,0 +1,180 @@
+#!/usr/bin/env node
+import { readFileSync, realpathSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+const UNICODE_DASH_PREFIX = /^[\u2012\u2013\u2014\u2015\u2212]+/u;
+const FLAG_BODY = /^[A-Za-z0-9][A-Za-z0-9-]*(=.*)?$/;
+const PACKAGE_JSON_PATH = new URL("../package.json", import.meta.url);
+const PACKAGE_VERSION = JSON.parse(readFileSync(PACKAGE_JSON_PATH, "utf8")).version;
+export function version() {
+    return PACKAGE_VERSION;
+}
+export function usage() {
+    return [
+        `doordash-cli v${version()}`,
+        "",
+        "Usage:",
+        "  dd-cli <command> [flags]",
+        "  doordash-cli <command> [flags]",
+        "",
+        "Meta:",
+        "  --help, -h",
+        "  --version, -v",
+        "",
+        "Safe commands:",
+        "  install-browser",
+        "  auth-check",
+        "  auth-bootstrap",
+        "  auth-clear",
+        '  set-address --address "350 5th Ave, New York, NY 10118"',
+        "  search --query sushi [--cuisine japanese]",
+        "  menu --restaurant-id 123456",
+        "  item --restaurant-id 123456 --item-id 7890",
+        "  orders [--limit 20] [--active-only]",
+        "  order --order-id 3f4c6d0e-1234-5678-90ab-cdef12345678",
+        "  add-to-cart --restaurant-id 123456 (--item-id 7890 | --item-name \"Spicy Tuna Roll\") [--quantity 2] [--special-instructions \"no wasabi\"] [--options-json '[{\"groupId\":\"703393388\",\"optionId\":\"4716032529\"}]']",
+        "  update-cart --cart-item-id abc123 --quantity 2",
+        "  cart",
+        "",
+        "Notes:",
+        "  - Run with no arguments to show this help.",
+        "  - Common Unicode long dashes are normalized for flags, so —help / –help work too.",
+        "  - Installed command names are lowercase only: dd-cli and doordash-cli.",
+        "  - install-browser downloads the matching Playwright Chromium build used by this package.",
+        "  - Manual pages ship with the project: man dd-cli or man doordash-cli.",
+        "  - Direct GraphQL/HTTP is the default path for auth-check, set-address, search, menu, item, orders, order, cart, add-to-cart, and update-cart.",
+        "  - auth-check can reuse an already-signed-in compatible DoorDash browser session when one is available.",
+        "  - set-address now uses DoorDash autocomplete/get-or-create plus addConsumerAddressV2 for brand-new address enrollment when needed.",
+        "  - configurable items require explicit --options-json selections.",
+        '  - standalone recommended add-ons that open a nested cursor step are supported via children, e.g. [{"groupId":"recommended_option_546935995","optionId":"546936011","children":[{"groupId":"780057412","optionId":"4702669757"}]}].',
+        "  - other non-recommended nested cursor trees still fail closed until DoorDash exposes a directly provable transport.",
+        "",
+        "Out-of-scope commands remain intentionally unsupported:",
+        "  checkout, place-order, payment actions, order mutation/cancellation",
+        "",
+        "Examples:",
+        "  dd-cli --help",
+        "  dd-cli install-browser",
+        "  dd-cli search --query sushi",
+        "  dd-cli orders --active-only",
+        "  doordash-cli order --order-id 3f4c6d0e-1234-5678-90ab-cdef12345678",
+        "  doordash-cli auth-check",
+        "",
+        "Allowed commands: install-browser, auth-check, auth-bootstrap, auth-clear, set-address, search, menu, item, orders, order, add-to-cart, update-cart, cart",
+    ].join("\n");
+}
+export function normalizeOptionToken(token) {
+    const prefix = token.match(UNICODE_DASH_PREFIX)?.[0];
+    if (!prefix) {
+        return token;
+    }
+    const body = token.slice(prefix.length);
+    if (!FLAG_BODY.test(body)) {
+        return token;
+    }
+    return `${body.length === 1 ? "-" : "--"}${body}`;
+}
+function looksLikeFlagToken(token) {
+    return token.startsWith("-") || normalizeOptionToken(token) !== token;
+}
+export function parseArgv(argv) {
+    const tokens = [...argv];
+    const flags = {};
+    let command;
+    if (tokens[0] !== undefined && !looksLikeFlagToken(tokens[0])) {
+        command = tokens.shift();
+    }
+    for (let i = 0; i < tokens.length; i += 1) {
+        const rawToken = tokens[i];
+        if (rawToken === undefined) {
+            throw new Error("Unexpected empty argument");
+        }
+        const token = normalizeOptionToken(rawToken);
+        if (token === "-h" || token === "--help") {
+            flags.help = "true";
+            continue;
+        }
+        if (token === "-v" || token === "--version") {
+            flags.version = "true";
+            continue;
+        }
+        if (!token.startsWith("--")) {
+            throw new Error(`Unexpected positional argument: ${rawToken}`);
+        }
+        const inlineEquals = token.indexOf("=");
+        if (inlineEquals !== -1) {
+            const key = token.slice(2, inlineEquals);
+            if (!key) {
+                throw new Error("Empty flag name");
+            }
+            flags[key] = token.slice(inlineEquals + 1);
+            continue;
+        }
+        const key = token.slice(2);
+        if (!key) {
+            throw new Error("Empty flag name");
+        }
+        const next = tokens[i + 1];
+        if (next === undefined || looksLikeFlagToken(next)) {
+            flags[key] = "true";
+            continue;
+        }
+        flags[key] = next;
+        i += 1;
+    }
+    return { command, flags };
+}
+export async function main(argv = process.argv.slice(2)) {
+    const { command, flags } = parseArgv(argv);
+    if (flags.version === "true") {
+        console.log(version());
+        return;
+    }
+    if (!command || command === "help" || flags.help === "true") {
+        console.log(usage());
+        return;
+    }
+    const lib = await import("./lib.js");
+    lib.assertSafeCommand(command);
+    const safeCommand = command;
+    try {
+        const result = await lib.runCommand(safeCommand, flags);
+        console.log(JSON.stringify(result, null, 2));
+        process.exitCode = 0;
+    }
+    finally {
+        await lib.shutdown();
+    }
+}
+export async function runCli(argv = process.argv.slice(2)) {
+    try {
+        await main(argv);
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        console.error(`\n${usage()}`);
+        try {
+            const { shutdown } = await import("./lib.js");
+            await shutdown().catch(() => { });
+        }
+        catch {
+            // Help/no-arg flows should work even if runtime deps are unavailable.
+        }
+        process.exitCode = 1;
+    }
+}
+export function isDirectExecution(argv1 = process.argv[1], metaUrl = import.meta.url) {
+    if (!argv1) {
+        return false;
+    }
+    const modulePath = fileURLToPath(metaUrl);
+    try {
+        return realpathSync(resolve(argv1)) === realpathSync(modulePath);
+    }
+    catch {
+        return resolve(argv1) === resolve(modulePath);
+    }
+}
+if (isDirectExecution()) {
+    void runCli();
+}

package/dist/cli.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cli.test.js

@@ -0,0 +1,154 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { chmodSync, readFileSync } from "node:fs";
+import { mkdtemp, rm, symlink } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+import { SAFE_COMMANDS, assertAllowedFlags, assertSafeCommand } from "./lib.js";
+import { parseArgv, version } from "./cli.js";
+const distDir = dirname(fileURLToPath(import.meta.url));
+const binPath = join(distDir, "bin.js");
+function runCli(args) {
+    return spawnSync(process.execPath, [binPath, ...args], {
+        encoding: "utf8",
+    });
+}
+async function runLinkedCli(linkName, args) {
+    chmodSync(binPath, 0o755);
+    const tempDir = await mkdtemp(join(tmpdir(), "doordash-cli-"));
+    const linkPath = join(tempDir, linkName);
+    try {
+        await symlink(binPath, linkPath);
+        return spawnSync(linkPath, args, {
+            encoding: "utf8",
+        });
+    }
+    finally {
+        await rm(tempDir, { recursive: true, force: true });
+    }
+}
+test("safe command allowlist stays cart-safe while adding install helpers", () => {
+    assert.deepEqual(SAFE_COMMANDS, [
+        "install-browser",
+        "auth-check",
+        "auth-bootstrap",
+        "auth-clear",
+        "set-address",
+        "search",
+        "menu",
+        "item",
+        "orders",
+        "order",
+        "add-to-cart",
+        "update-cart",
+        "cart",
+    ]);
+});
+test("dangerous and unsupported legacy commands are rejected", () => {
+    assert.throws(() => assertSafeCommand("checkout"), /Blocked command: checkout/);
+    assert.throws(() => assertSafeCommand("place-order"), /Blocked command: place-order/);
+    assert.throws(() => assertSafeCommand("track-order"), /Use `orders` or `order --order-id/);
+    assert.throws(() => assertSafeCommand("payment"), /Blocked command: payment/);
+});
+test("unsupported flags are rejected before network work runs", () => {
+    assert.throws(() => assertAllowedFlags("cart", { payment: "visa" }), /Unsupported flag\(s\) for cart/);
+    assert.throws(() => assertAllowedFlags("item", { query: "salmon" }), /Unsupported flag\(s\) for item/);
+    assert.throws(() => assertAllowedFlags("orders", { cuisine: "japanese" }), /Unsupported flag\(s\) for orders/);
+});
+test("argument parsing supports inline, spaced, and meta flags", () => {
+    assert.deepEqual(parseArgv(["search", "--query=sushi", "--cuisine", "japanese", "--version"]), {
+        command: "search",
+        flags: {
+            query: "sushi",
+            cuisine: "japanese",
+            version: "true",
+        },
+    });
+    assert.deepEqual(parseArgv(["-h", "-v"]), {
+        command: undefined,
+        flags: {
+            help: "true",
+            version: "true",
+        },
+    });
+    assert.deepEqual(parseArgv(["orders", "--limit=5", "--active-only"]), {
+        command: "orders",
+        flags: {
+            limit: "5",
+            "active-only": "true",
+        },
+    });
+});
+test("argument parsing normalizes common Unicode dash flags", () => {
+    assert.deepEqual(parseArgv(["—help"]), {
+        command: undefined,
+        flags: { help: "true" },
+    });
+    assert.deepEqual(parseArgv(["search", "—query=sushi", "–cuisine", "japanese"]), {
+        command: "search",
+        flags: {
+            query: "sushi",
+            cuisine: "japanese",
+        },
+    });
+});
+test("help output shows the direct read-only/cart-safe command surface", () => {
+    const result = runCli(["--help"]);
+    assert.equal(result.status, 0);
+    assert.match(result.stdout, new RegExp(`doordash-cli v${version().replace(".", "\\.")}`));
+    assert.match(result.stdout, /Usage:/);
+    assert.match(result.stdout, /dd-cli <command>/);
+    assert.match(result.stdout, /doordash-cli <command>/);
+    assert.match(result.stdout, /install-browser/);
+    assert.match(result.stdout, /auth-bootstrap/);
+    assert.match(result.stdout, /set-address --address/);
+    assert.match(result.stdout, /orders \[--limit 20\] \[--active-only\]/);
+    assert.match(result.stdout, /order --order-id/);
+    assert.match(result.stdout, /options-json/);
+    assert.match(result.stdout, /--version, -v/);
+    assert.match(result.stdout, /man dd-cli/);
+    assert.match(result.stdout, /Out-of-scope commands remain intentionally unsupported/);
+    assert.doesNotMatch(result.stdout, /Dd-cli/);
+});
+test("repository ships man pages for the supported lowercase command names", () => {
+    const ddManPath = join(distDir, "..", "man", "dd-cli.1");
+    const aliasManPath = join(distDir, "..", "man", "doordash-cli.1");
+    assert.match(readFileSync(ddManPath, "utf8"), /install-browser/);
+    assert.doesNotMatch(readFileSync(ddManPath, "utf8"), /Dd-cli/);
+    assert.equal(readFileSync(aliasManPath, "utf8").trim(), ".so man1/dd-cli.1");
+});
+test("-h and no-arg invocation both show usage", () => {
+    const shortHelp = runCli(["-h"]);
+    assert.equal(shortHelp.status, 0);
+    assert.match(shortHelp.stdout, /Usage:/);
+    const noArgs = runCli([]);
+    assert.equal(noArgs.status, 0);
+    assert.match(noArgs.stdout, /Usage:/);
+    assert.match(noArgs.stdout, /Run with no arguments to show this help/);
+});
+test("symlinked entrypoints print help for supported lowercase command names", async () => {
+    for (const commandName of ["dd-cli", "doordash-cli"]) {
+        const result = await runLinkedCli(commandName, ["--help"]);
+        assert.equal(result.status, 0, `${commandName} should exit 0`);
+        assert.match(result.stdout, /Usage:/, `${commandName} should print usage`);
+        assert.match(result.stdout, /dd-cli <command>/, `${commandName} should print command help`);
+    }
+});
+test("version flag prints the package version", () => {
+    const result = runCli(["--version"]);
+    assert.equal(result.status, 0);
+    assert.equal(result.stdout.trim(), version());
+});
+test("blocked commands fail immediately", () => {
+    const result = runCli(["checkout"]);
+    assert.equal(result.status, 1);
+    assert.match(result.stderr, /Blocked command: checkout/);
+    assert.match(result.stderr, /existing-order inspection only/);
+});
+test("safe commands reject unknown flags before touching DoorDash flows", () => {
+    const result = runCli(["cart", "--payment-method", "visa"]);
+    assert.equal(result.status, 1);
+    assert.match(result.stderr, /Unsupported flag\(s\) for cart: payment-method/);
+});