healthcloud-cli 3.7.1__tar.gz → 3.7.3__tar.gz

{healthcloud_cli-3.7.1 → healthcloud_cli-3.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: healthcloud-cli
-Version: 3.7.1
+Version: 3.7.3
 Summary: Command-line interface for the HealthCloud MCP gateway, generated from the shared MCP tool manifest.
 Project-URL: Issues, https://github.com/healthcloudservices/healthcloud-services/issues
 Project-URL: Repository, https://github.com/healthcloudservices/healthcloud-services
@@ -316,6 +316,27 @@ otherwise it prompts (with hidden password input). It stores only the email,
 tenant/environment binding, access/refresh tokens and expiry in the strict
 owner-only `~/.healthcloud/cli/ams-session.json`; it never stores the password.
 
+By default (`pretty`) these three commands print readable lines — never a raw
+JSON blob and never a token:
+
+```text
+$ hc login --environment dev --tenant-id TENANT_ID
+saved session: dev / TENANT_ID
+email: admin@example.test
+expires_at: 2026-11-02T01:42:29Z
+$ hc logout
+saved session removed: true
+server session revoked: false
+```
+
+`hc login --status` prints the same three lines for the saved session, and a
+second `hc logout` reports `saved session removed: false`. `--output json` (and
+`--output raw`, which these commands treat as JSON) prints exactly the objects
+they have always printed: `{"schema_version": 1, "ok": true, "session":
+{"schema_version": 1, "environment", "tenant_id", "email", "expires_at"}}`
+for `login`/`--status`, and `{"schema_version": 1, "ok": true, "removed":
+true|false, "server_session_revoked": false}` for `logout`.
+
 For CI and agents, log in non-interactively: pass `--email` and pipe the password
 to `--password-stdin` (read as exactly one stdin line, never echoed, never a
 flag value — there is no `--password` option):
@@ -545,11 +566,33 @@ explicitly that
 fields — a disabled agent can still be selected by those paths — and that
 in-flight runs, WSS sessions and schedules are untouched by this route.
 
-Pre-checks refuse with exit 1 and **no write**: a missing `--confirm` (exit 2
-usage error, before login), an agent outside the explicit tenant, an already
-in-effect state, an unsupported `archived`/`draft` target (named as having no
-supported reversible transition here), or a `config_version` that no longer
-matches `--expected-config-version`. That version check is a local best-effort
+Default `pretty` output prints those facts as labelled lines — `transition`,
+`requested`, `evidence` (`saved`, `side_effects`, `runtime`), `eligibility`,
+`mutation_replayed: false` — and closes with a `verification:` block, so a
+deactivate reads `transition: deactivate`, then
+`evidence: / saved: / status: confirmed`, then `verification: / saved_state:
+confirmed`, `side_effects: unverified`, `runtime: unverified`; it is never one
+raw JSON line. `--output json` prints the full envelope above, byte-identical to
+before. An unknown outcome still prints its one-line `error:` plus the
+reconciliation on stderr.
+
+Without `--confirm` the command is a **preview**: it re-reads the agent exactly
+once (the same one bounded `GET`), runs the same local pre-checks, prints
+`preview: --confirm was not passed, so nothing has been sent.` and then the
+resolved change to stderr — the target (`agent_id`, `name`, `type`,
+`config_version`), `status` and `active` before -> after, and
+`one PUT /agents/{agent_id} with body keys: status, active` — and exits 2 having
+sent nothing. With `--confirm` the write path is unchanged: it re-reads before
+the single `PUT`, so a preview is never an approval token. The preview text is
+suppressed under `--output json`/`raw` (the same rule the confirmed path's
+review follows) so those modes keep stderr machine-parsable.
+
+Pre-checks refuse with exit 1 and **no write**: an agent outside the explicit
+tenant, an already in-effect state, an unsupported `archived`/`draft` target
+(named as having no supported reversible transition here), or a
+`config_version` that no longer matches `--expected-config-version` — all of
+these are also enforced by the preview, which still sends nothing. A missing
+`--confirm` exits 2. That version check is a local best-effort
 guard only: the route has no `If-Match` and the server never compares the
 version, so it cannot prove atomicity and a request could still race between
 the read and the PUT.
@@ -615,20 +658,34 @@ server audit log records an `UPDATE` with the payload. Runtime enforcement of
 the new references is unobservable: no serving readback route exists, so this
 command never claims it.
 
+Default `pretty` output prints the same facts as labelled lines: `agent_id`,
+`changed` (each field with `before`/`after`/`added`/`removed`),
+`config_version: {before, after}`, `evidence` (`saved`, `side_effects`,
+`runtime`), `mutation_replayed: false`, and a closing `verification:` block.
+`--output json` prints the full envelope described here, unchanged.
+
 `tool_ids` and `data_source_ids` address **unscoped global catalogs** by design;
 the server checks tenant scope only for the department, team, skill, policy and
 guardrail references. This command does not imply otherwise, and it does not
 re-implement the server's reference checks.
 
-Pre-checks refuse with exit 1 and **no write**: a missing `--confirm` (exit 2
-usage error, before login and before any request), no assignment option at all
+Without `--confirm` the command is a **preview**: it reads the agent exactly once
+(the same one bounded `GET`), computes the same reviewed diff and runs the same
+local pre-checks, prints `preview: --confirm was not passed, so nothing has been
+sent.` followed by the reviewed diff, and exits 2 having sent no `PUT`. With
+`--confirm` the write path is unchanged: it re-reads before the single `PUT`, so
+a preview is never an approval token. The preview text is suppressed under
+`--output json`/`raw`, like the confirmed path's review.
+
+Pre-checks refuse with exit 1 and **no write**: no assignment option at all
 (exit 2), setting and clearing the same family together (exit 2), an agent
 outside the explicit tenant, a request where every reference already equals the
 read state ("already in effect"), or a `config_version` that no longer matches
-`--expected-config-version`. That version check is a local best-effort guard
-only: the route has no `If-Match` and the server never compares the version, so
-it cannot prove atomicity and a request could still race between the read and
-the PUT. Operation-specific approval here is the CLI's own `--confirm` plus the
+`--expected-config-version` — all of these are also enforced by the preview,
+which still sends nothing. A missing `--confirm` exits 2. That version check is
+a local best-effort guard only: the route has no `If-Match` and the server never
+compares the version, so it cannot prove atomicity and a request could still
+race between the read and the PUT. Operation-specific approval here is the CLI's own `--confirm` plus the
 reviewed diff, deliberately separate from the tuning/plan-apply approval path;
 the server enforces tenant isolation, reference existence and the audit log, and
 it has **no** assignment approval or consent entity.
@@ -689,10 +746,24 @@ of restore and has no `--force`, no `--dry-run`, no interactive prompt and no
 `--expected-config-version` — the route has no `If-Match` or version check, so a
 version flag would advertise protection the server does not offer.
 
-Refusals claim nothing and send nothing extra: a missing `--confirm` is an exit
-2 usage error before login or any request; an agent outside the explicit tenant,
-the tenant identity mismatch and a delete target that no longer exists are
-refused before the `DELETE`; a `409` is a `conflict` refusal naming the referring
+Default `pretty` output prints the result as labelled lines next to the stderr
+disclosure: `agent_id`, `deleted: true`, `target`, `disclosure`, `evidence`
+(`deleted`/`side_effects`/`runtime`), `mutation_replayed: false`, and a closing
+`verification:` block. `--output json` prints the full envelope, unchanged. The
+reviewed target and disclosure above are still printed to stderr in `pretty`
+mode only; `--output json`/`raw` keep stderr machine-parsable.
+
+Without `--confirm` the command is a **preview**: it reads the agent exactly once
+(the same one bounded `GET`), prints `preview: --confirm was not passed, so
+nothing has been sent.` plus the resolved destructive target and the whole
+disclosure block to stderr, and exits 2 having sent no `DELETE`. With `--confirm`
+the sequence above is unchanged: it re-reads before the single `DELETE`, so a
+preview is never an approval token. The preview text is suppressed under
+`--output json`/`raw`, like the confirmed path's review.
+
+Refusals claim nothing and send nothing extra: an agent outside the explicit
+tenant, the tenant identity mismatch and a delete target that no longer exists
+are refused before the `DELETE` (the preview reports the same `not_found`); a `409` is a `conflict` refusal naming the referring
 schedules; a `404` from the `DELETE` is `not_found`; and a `405` is the server's
 refusal (`unsupported`). None of them is retried.
 
@@ -997,6 +1068,14 @@ uv run --frozen hc ams sessions messages add --environment dev --tenant-id TENAN
   "continuation": null}`). `get` emits `operation: "sessions.get"` and
   `data.session`. The projections never include the session's protected
   `initial_prompt`, tenant or user identity, or arbitrary response fields.
+- Default `pretty` output prints `list` as a table with honest headers —
+  `ID`, `AGENT ID`, `OPERATION`, `STATUS`, `EXPIRES AT` for sessions and `ID`,
+  `ROLE`, `MODE`, `PLAN ID`, `CREATED AT` for messages — followed by an entry
+  count (`1 entry` / `N entries`), and `(no entries)` for an empty list. These
+  projections carry no `name`, so no `NAME` column is invented and the `id` is
+  always shown. `get`, `create` and `messages add` print `key: value` lines.
+  `--output json` prints the full envelope exactly as before; pretty output is
+  additive and never changes the envelope.
 - `create` and `messages add` require a saved `hc login` session (env-var
   credentials are not accepted for writes). Each write is sent exactly once and
   the envelope carries the server's authoritative readback:
@@ -1169,6 +1248,12 @@ uv run --frozen hc ams sessions plans reconcile --environment dev --tenant-id TE
   (create: reference counts by kind) and finding counts. No prompt,
   instructions, greeting, summary, message content or plan value is printed to
   stdout, stderr, a diagnostic or an error string.
+- Default `pretty` output renders `generate`, `get`, `apply`, `rollback` and
+  `reconcile` as labelled lines — `plan:` with the bounded metadata, then
+  `evidence:` (`saved`/`side_effects`/`runtime`) and `mutation_replayed: false`
+  where the command reports them, and a closing `verification:` block for the
+  writes. A write is never printed as a raw JSON blob in the default mode.
+  `--output json` prints the full envelope, unchanged.
 - The prompt is protected free text and never comes from argv: `--prompt-file`
   reads one owner-only regular text file (no symlinks, at most 20000
   characters) and sends it once. `--prompt-file` is optional — the server falls
@@ -1423,8 +1508,12 @@ and `hc ams organization hierarchy`) render in two modes (`--output` on the root
 `hc` command; `pretty` is the default):
 
 - **`pretty`** (default): a compact human view. Lists print an `ID`/`NAME`
-  table with an entry count; a single record prints `key: value` lines; the
-  organization hierarchy prints an indented tree. Each failed AMS command
+  table with an entry count; a collection whose rows have no `name` (sessions,
+  messages, attachments) prints a table of that command's own columns plus the
+  count, and `(no entries)` when empty. A single record prints `key: value`
+  lines, the organization hierarchy prints an indented tree, and write or
+  reconciliation evidence prints labelled `key: value` lines (the write's
+  `verification:` block included) instead of JSON. Each failed AMS command
   prints one stderr line, `error: <message> (<category>)` (flag/argument
   usage errors from Click print Click's standard usage message instead).
 - **`json`**: the stable result envelope (below) on stdout. When stdout is not

{healthcloud_cli-3.7.1 → healthcloud_cli-3.7.3}/README.md

@@ -298,6 +298,27 @@ otherwise it prompts (with hidden password input). It stores only the email,
 tenant/environment binding, access/refresh tokens and expiry in the strict
 owner-only `~/.healthcloud/cli/ams-session.json`; it never stores the password.
 
+By default (`pretty`) these three commands print readable lines — never a raw
+JSON blob and never a token:
+
+```text
+$ hc login --environment dev --tenant-id TENANT_ID
+saved session: dev / TENANT_ID
+email: admin@example.test
+expires_at: 2026-11-02T01:42:29Z
+$ hc logout
+saved session removed: true
+server session revoked: false
+```
+
+`hc login --status` prints the same three lines for the saved session, and a
+second `hc logout` reports `saved session removed: false`. `--output json` (and
+`--output raw`, which these commands treat as JSON) prints exactly the objects
+they have always printed: `{"schema_version": 1, "ok": true, "session":
+{"schema_version": 1, "environment", "tenant_id", "email", "expires_at"}}`
+for `login`/`--status`, and `{"schema_version": 1, "ok": true, "removed":
+true|false, "server_session_revoked": false}` for `logout`.
+
 For CI and agents, log in non-interactively: pass `--email` and pipe the password
 to `--password-stdin` (read as exactly one stdin line, never echoed, never a
 flag value — there is no `--password` option):
@@ -527,11 +548,33 @@ explicitly that
 fields — a disabled agent can still be selected by those paths — and that
 in-flight runs, WSS sessions and schedules are untouched by this route.
 
-Pre-checks refuse with exit 1 and **no write**: a missing `--confirm` (exit 2
-usage error, before login), an agent outside the explicit tenant, an already
-in-effect state, an unsupported `archived`/`draft` target (named as having no
-supported reversible transition here), or a `config_version` that no longer
-matches `--expected-config-version`. That version check is a local best-effort
+Default `pretty` output prints those facts as labelled lines — `transition`,
+`requested`, `evidence` (`saved`, `side_effects`, `runtime`), `eligibility`,
+`mutation_replayed: false` — and closes with a `verification:` block, so a
+deactivate reads `transition: deactivate`, then
+`evidence: / saved: / status: confirmed`, then `verification: / saved_state:
+confirmed`, `side_effects: unverified`, `runtime: unverified`; it is never one
+raw JSON line. `--output json` prints the full envelope above, byte-identical to
+before. An unknown outcome still prints its one-line `error:` plus the
+reconciliation on stderr.
+
+Without `--confirm` the command is a **preview**: it re-reads the agent exactly
+once (the same one bounded `GET`), runs the same local pre-checks, prints
+`preview: --confirm was not passed, so nothing has been sent.` and then the
+resolved change to stderr — the target (`agent_id`, `name`, `type`,
+`config_version`), `status` and `active` before -> after, and
+`one PUT /agents/{agent_id} with body keys: status, active` — and exits 2 having
+sent nothing. With `--confirm` the write path is unchanged: it re-reads before
+the single `PUT`, so a preview is never an approval token. The preview text is
+suppressed under `--output json`/`raw` (the same rule the confirmed path's
+review follows) so those modes keep stderr machine-parsable.
+
+Pre-checks refuse with exit 1 and **no write**: an agent outside the explicit
+tenant, an already in-effect state, an unsupported `archived`/`draft` target
+(named as having no supported reversible transition here), or a
+`config_version` that no longer matches `--expected-config-version` — all of
+these are also enforced by the preview, which still sends nothing. A missing
+`--confirm` exits 2. That version check is a local best-effort
 guard only: the route has no `If-Match` and the server never compares the
 version, so it cannot prove atomicity and a request could still race between
 the read and the PUT.
@@ -597,20 +640,34 @@ server audit log records an `UPDATE` with the payload. Runtime enforcement of
 the new references is unobservable: no serving readback route exists, so this
 command never claims it.
 
+Default `pretty` output prints the same facts as labelled lines: `agent_id`,
+`changed` (each field with `before`/`after`/`added`/`removed`),
+`config_version: {before, after}`, `evidence` (`saved`, `side_effects`,
+`runtime`), `mutation_replayed: false`, and a closing `verification:` block.
+`--output json` prints the full envelope described here, unchanged.
+
 `tool_ids` and `data_source_ids` address **unscoped global catalogs** by design;
 the server checks tenant scope only for the department, team, skill, policy and
 guardrail references. This command does not imply otherwise, and it does not
 re-implement the server's reference checks.
 
-Pre-checks refuse with exit 1 and **no write**: a missing `--confirm` (exit 2
-usage error, before login and before any request), no assignment option at all
+Without `--confirm` the command is a **preview**: it reads the agent exactly once
+(the same one bounded `GET`), computes the same reviewed diff and runs the same
+local pre-checks, prints `preview: --confirm was not passed, so nothing has been
+sent.` followed by the reviewed diff, and exits 2 having sent no `PUT`. With
+`--confirm` the write path is unchanged: it re-reads before the single `PUT`, so
+a preview is never an approval token. The preview text is suppressed under
+`--output json`/`raw`, like the confirmed path's review.
+
+Pre-checks refuse with exit 1 and **no write**: no assignment option at all
 (exit 2), setting and clearing the same family together (exit 2), an agent
 outside the explicit tenant, a request where every reference already equals the
 read state ("already in effect"), or a `config_version` that no longer matches
-`--expected-config-version`. That version check is a local best-effort guard
-only: the route has no `If-Match` and the server never compares the version, so
-it cannot prove atomicity and a request could still race between the read and
-the PUT. Operation-specific approval here is the CLI's own `--confirm` plus the
+`--expected-config-version` — all of these are also enforced by the preview,
+which still sends nothing. A missing `--confirm` exits 2. That version check is
+a local best-effort guard only: the route has no `If-Match` and the server never
+compares the version, so it cannot prove atomicity and a request could still
+race between the read and the PUT. Operation-specific approval here is the CLI's own `--confirm` plus the
 reviewed diff, deliberately separate from the tuning/plan-apply approval path;
 the server enforces tenant isolation, reference existence and the audit log, and
 it has **no** assignment approval or consent entity.
@@ -671,10 +728,24 @@ of restore and has no `--force`, no `--dry-run`, no interactive prompt and no
 `--expected-config-version` — the route has no `If-Match` or version check, so a
 version flag would advertise protection the server does not offer.
 
-Refusals claim nothing and send nothing extra: a missing `--confirm` is an exit
-2 usage error before login or any request; an agent outside the explicit tenant,
-the tenant identity mismatch and a delete target that no longer exists are
-refused before the `DELETE`; a `409` is a `conflict` refusal naming the referring
+Default `pretty` output prints the result as labelled lines next to the stderr
+disclosure: `agent_id`, `deleted: true`, `target`, `disclosure`, `evidence`
+(`deleted`/`side_effects`/`runtime`), `mutation_replayed: false`, and a closing
+`verification:` block. `--output json` prints the full envelope, unchanged. The
+reviewed target and disclosure above are still printed to stderr in `pretty`
+mode only; `--output json`/`raw` keep stderr machine-parsable.
+
+Without `--confirm` the command is a **preview**: it reads the agent exactly once
+(the same one bounded `GET`), prints `preview: --confirm was not passed, so
+nothing has been sent.` plus the resolved destructive target and the whole
+disclosure block to stderr, and exits 2 having sent no `DELETE`. With `--confirm`
+the sequence above is unchanged: it re-reads before the single `DELETE`, so a
+preview is never an approval token. The preview text is suppressed under
+`--output json`/`raw`, like the confirmed path's review.
+
+Refusals claim nothing and send nothing extra: an agent outside the explicit
+tenant, the tenant identity mismatch and a delete target that no longer exists
+are refused before the `DELETE` (the preview reports the same `not_found`); a `409` is a `conflict` refusal naming the referring
 schedules; a `404` from the `DELETE` is `not_found`; and a `405` is the server's
 refusal (`unsupported`). None of them is retried.
 
@@ -979,6 +1050,14 @@ uv run --frozen hc ams sessions messages add --environment dev --tenant-id TENAN
   "continuation": null}`). `get` emits `operation: "sessions.get"` and
   `data.session`. The projections never include the session's protected
   `initial_prompt`, tenant or user identity, or arbitrary response fields.
+- Default `pretty` output prints `list` as a table with honest headers —
+  `ID`, `AGENT ID`, `OPERATION`, `STATUS`, `EXPIRES AT` for sessions and `ID`,
+  `ROLE`, `MODE`, `PLAN ID`, `CREATED AT` for messages — followed by an entry
+  count (`1 entry` / `N entries`), and `(no entries)` for an empty list. These
+  projections carry no `name`, so no `NAME` column is invented and the `id` is
+  always shown. `get`, `create` and `messages add` print `key: value` lines.
+  `--output json` prints the full envelope exactly as before; pretty output is
+  additive and never changes the envelope.
 - `create` and `messages add` require a saved `hc login` session (env-var
   credentials are not accepted for writes). Each write is sent exactly once and
   the envelope carries the server's authoritative readback:
@@ -1151,6 +1230,12 @@ uv run --frozen hc ams sessions plans reconcile --environment dev --tenant-id TE
   (create: reference counts by kind) and finding counts. No prompt,
   instructions, greeting, summary, message content or plan value is printed to
   stdout, stderr, a diagnostic or an error string.
+- Default `pretty` output renders `generate`, `get`, `apply`, `rollback` and
+  `reconcile` as labelled lines — `plan:` with the bounded metadata, then
+  `evidence:` (`saved`/`side_effects`/`runtime`) and `mutation_replayed: false`
+  where the command reports them, and a closing `verification:` block for the
+  writes. A write is never printed as a raw JSON blob in the default mode.
+  `--output json` prints the full envelope, unchanged.
 - The prompt is protected free text and never comes from argv: `--prompt-file`
   reads one owner-only regular text file (no symlinks, at most 20000
   characters) and sends it once. `--prompt-file` is optional — the server falls
@@ -1405,8 +1490,12 @@ and `hc ams organization hierarchy`) render in two modes (`--output` on the root
 `hc` command; `pretty` is the default):
 
 - **`pretty`** (default): a compact human view. Lists print an `ID`/`NAME`
-  table with an entry count; a single record prints `key: value` lines; the
-  organization hierarchy prints an indented tree. Each failed AMS command
+  table with an entry count; a collection whose rows have no `name` (sessions,
+  messages, attachments) prints a table of that command's own columns plus the
+  count, and `(no entries)` when empty. A single record prints `key: value`
+  lines, the organization hierarchy prints an indented tree, and write or
+  reconciliation evidence prints labelled `key: value` lines (the write's
+  `verification:` block included) instead of JSON. Each failed AMS command
   prints one stderr line, `error: <message> (<category>)` (flag/argument
   usage errors from Click print Click's standard usage message instead).
 - **`json`**: the stable result envelope (below) on stdout. When stdout is not

{healthcloud_cli-3.7.1 → healthcloud_cli-3.7.3}/healthcloud_cli/ams/agents/commands.py

@@ -7,7 +7,7 @@ from pathlib import Path
 import click
 
 from ..context import AmsDependencies, pass_ams, preflight_agents
-from ..errors import run_domain
+from ..errors import run_domain, run_preview
 from ..session import resolve_tenant_target
 from .operations import (
     ASSIGNMENT_FAMILIES,
@@ -16,6 +16,9 @@ from .operations import (
     export_agent,
     get_agent,
     list_agents,
+    preview_assignments,
+    preview_delete,
+    preview_lifecycle,
     set_assignments,
     set_lifecycle,
 )
@@ -37,6 +40,34 @@ def _agent(function):
     return click.option("--agent-id", required=True)(function)
 
 
+def _preview_then_refuse(
+    invocation,
+    operation: str,
+    target_data: dict,
+    preview,
+    refusal: str,
+    *,
+    login_hint: str,
+) -> None:
+    """Read the target once, print the reviewed change, then refuse with exit 2.
+
+    Nothing is written before the refusal, and the preview is still a read: a
+    failed read (not logged in, wrong tenant, 404, transport) keeps the bounded
+    error envelope instead of escaping as a traceback. The confirmed run
+    re-reads before its single write, so a preview is never an approval token.
+    """
+
+    def read() -> None:
+        _require_login(login_hint)
+        target = resolve_tenant_target(target_data["environment"], target_data["tenant_id"])
+        target_data.update(environment=target.environment, tenant_id=target.tenant_id)
+        preflight_agents(invocation, target, methods=("get_agent",))
+        preview(target)
+
+    run_preview(operation, target_data, read)
+    raise click.UsageError(refusal)
+
+
 def _require_login(hint: str = LOGIN_HINT) -> None:
     """Agent writes need a saved `hc login` session, not env-var credentials."""
 
@@ -71,7 +102,8 @@ def create_lifecycle_command(dependencies: AmsDependencies, transition: str) ->
         "--confirm",
         is_flag=True,
         default=False,
-        help="Required acknowledgement of the exact target and state; without it nothing is sent.",
+        help="Required acknowledgement of the exact target and state; without it the command reads the "
+        "target, prints the change and sends nothing.",
     )
     @pass_ams
     def command(
@@ -82,14 +114,27 @@ def create_lifecycle_command(dependencies: AmsDependencies, transition: str) ->
         expected_config_version: int,
         confirm: bool,
     ) -> None:
-        if not confirm:
-            raise click.UsageError("--confirm is required; no lifecycle write was sent.")
         target_data = {
             "environment": environment,
             "tenant_id": tenant_id,
             "agent_id": agent_id,
             "expected_config_version": expected_config_version,
         }
+        if not confirm:
+            _preview_then_refuse(
+                invocation,
+                f"agents.{transition}",
+                target_data,
+                lambda target: preview_lifecycle(
+                    dependencies,
+                    target,
+                    agent_id,
+                    transition=transition,
+                    expected_config_version=expected_config_version,
+                ),
+                "--confirm is required; no lifecycle write was sent. Re-run with --confirm to send it.",
+                login_hint=LOGIN_HINT,
+            )
 
         def execute():
             _require_login()
@@ -123,13 +168,21 @@ def create_delete_command(dependencies: AmsDependencies) -> click.Command:
         "--confirm",
         is_flag=True,
         default=False,
-        help="Required acknowledgement of the printed target and disclosure block; without it nothing is sent.",
+        help="Required acknowledgement of the printed target and disclosure block; without it the command "
+        "prints both and sends nothing.",
     )
     @pass_ams
     def command(invocation, environment: str | None, tenant_id: str | None, agent_id: str, confirm: bool) -> None:
-        if not confirm:
-            raise click.UsageError("--confirm is required; no delete was sent.")
         target_data = {"environment": environment, "tenant_id": tenant_id, "agent_id": agent_id}
+        if not confirm:
+            _preview_then_refuse(
+                invocation,
+                "agents.delete",
+                target_data,
+                lambda target: preview_delete(dependencies, target, agent_id),
+                "--confirm is required; no delete was sent. Re-run with --confirm to send it.",
+                login_hint=DELETE_LOGIN_HINT,
+            )
 
         def execute():
             _require_login(DELETE_LOGIN_HINT)
@@ -221,7 +274,10 @@ CONFIG_VERSION_HELP = (
     "The config_version read before the write. A local best-effort guard only: the route has no "
     "If-Match, so it never proves atomicity."
 )
-CONFIRM_HELP = "Required acknowledgement of the target and the printed reviewed diff; without it nothing is sent."
+CONFIRM_HELP = (
+    "Required acknowledgement of the target and the printed reviewed diff; without it the command prints "
+    "the diff and sends nothing."
+)
 
 
 def _assignment_changes(values: dict, cleared: dict) -> dict:
@@ -320,8 +376,6 @@ def create_assignments_set_command(dependencies: AmsDependencies) -> click.Comma
         clear_data_source_ids: bool,
         confirm: bool,
     ) -> None:
-        if not confirm:
-            raise click.UsageError("--confirm is required; no assignment write was sent.")
         changes = _assignment_changes(
             {
                 "department_id": department_id,
@@ -351,6 +405,21 @@ def create_assignments_set_command(dependencies: AmsDependencies) -> click.Comma
             "expected_config_version": expected_config_version,
             "changed_fields": sorted(changes),
         }
+        if not confirm:
+            _preview_then_refuse(
+                invocation,
+                "agents.assignments.set",
+                target_data,
+                lambda target: preview_assignments(
+                    dependencies,
+                    target,
+                    agent_id,
+                    changes,
+                    expected_config_version=expected_config_version,
+                ),
+                "--confirm is required; no assignment write was sent. Re-run with --confirm to send it.",
+                login_hint=ASSIGNMENT_LOGIN_HINT,
+            )
 
         def execute():
             _require_login(ASSIGNMENT_LOGIN_HINT)