splunkctl 0.9.0__tar.gz → 0.10.0__tar.gz

{splunkctl-0.9.0 → splunkctl-0.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: splunkctl
-Version: 0.9.0
+Version: 0.10.0
 Summary: CLI tool for Splunk Enterprise SIEM operations.
 Author: dannyota
 License-Expression: Apache-2.0
@@ -101,8 +101,10 @@ ingest. Built for humans and LLM agents alike: deterministic flags,
   envelopes.
 - **Playbooks as code** — `soar playbooks export --unpack` / `import`
   round-trips playbook tgz bundles (the first such tool anywhere);
-  `soar playbooks run --wait` drives and polls runs to completion;
-  `soar actions run --wait` does the same for connector actions.
+  `soar playbooks delete` removes them through the Web UI route (no
+  REST deletion exists); `soar playbooks run --wait` drives and polls
+  runs to completion; `soar actions run --wait` does the same for
+  connector actions.
 - **SIEM-to-SOAR ingest** — `soar ingest --spl` runs a SIEM search and
   creates SOAR containers + typed CEF artifacts using the official CIM-to-CEF
   field map, with SDI dedup, severity mapping, and last-artifact automation
@@ -265,7 +267,7 @@ splunkctl mcp install              # register in .mcp.json
 splunkctl mcp serve                # start stdio MCP server
 ```
 
-The MCP server auto-generates 237 typed tools from the Click command tree
+The MCP server auto-generates 229 typed tools from the Click command tree
 (SIEM + SOAR) with progressive discovery -- agents start with 5 meta-tools
 (`help`, `usage`, `focus`, `unfocus`, `run`) and dynamically load typed
 schemas per command group. Subgroup-granular focus works for nested groups

{splunkctl-0.9.0 → splunkctl-0.10.0}/README.md

@@ -63,8 +63,10 @@ ingest. Built for humans and LLM agents alike: deterministic flags,
   envelopes.
 - **Playbooks as code** — `soar playbooks export --unpack` / `import`
   round-trips playbook tgz bundles (the first such tool anywhere);
-  `soar playbooks run --wait` drives and polls runs to completion;
-  `soar actions run --wait` does the same for connector actions.
+  `soar playbooks delete` removes them through the Web UI route (no
+  REST deletion exists); `soar playbooks run --wait` drives and polls
+  runs to completion; `soar actions run --wait` does the same for
+  connector actions.
 - **SIEM-to-SOAR ingest** — `soar ingest --spl` runs a SIEM search and
   creates SOAR containers + typed CEF artifacts using the official CIM-to-CEF
   field map, with SDI dedup, severity mapping, and last-artifact automation
@@ -227,7 +229,7 @@ splunkctl mcp install              # register in .mcp.json
 splunkctl mcp serve                # start stdio MCP server
 ```
 
-The MCP server auto-generates 237 typed tools from the Click command tree
+The MCP server auto-generates 229 typed tools from the Click command tree
 (SIEM + SOAR) with progressive discovery -- agents start with 5 meta-tools
 (`help`, `usage`, `focus`, `unfocus`, `run`) and dynamically load typed
 schemas per command group. Subgroup-granular focus works for nested groups

{splunkctl-0.9.0 → splunkctl-0.10.0}/splunkctl/__init__.py

@@ -1,3 +1,3 @@
 """CLI tool for Splunk Enterprise and Splunk SOAR operations."""
 
-__version__ = "0.9.0"
+__version__ = "0.10.0"

{splunkctl-0.9.0 → splunkctl-0.10.0}/splunkctl/client.py

@@ -15,6 +15,7 @@ from typing import Any
 import click
 import requests
 import splunklib.client as splunk_client
+import urllib3
 
 from splunkctl import config as cfg_mod
 
@@ -186,6 +187,10 @@ class _WebSession:
         self._timeout = timeout
         self._session = requests.Session()
         self._session.verify = verify
+        if not verify:
+            # verify=false is an explicit config choice (lab/self-signed);
+            # without this every request spams InsecureRequestWarning.
+            urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
         self._csrf_token: str | None = None
         self._logged_in = False
 

{splunkctl-0.9.0 → splunkctl-0.10.0}/splunkctl/commands/es.py

@@ -57,7 +57,7 @@ def _status_to_int(value: str) -> str:
     key = value.strip().lower()
     if key in _STATUS_MAP:
         return _STATUS_MAP[key]
-    if value.isdigit():
+    if value.isascii() and value.isdigit():
         return value
     known = ", ".join(_STATUS_MAP)
     raise click.BadParameter(f"'{value}' is not a known status ({known}, or 0-5)")

{splunkctl-0.9.0 → splunkctl-0.10.0}/splunkctl/mcp/server.py

@@ -26,6 +26,7 @@ from splunkctl.mcp.tools import (
     group_summary,
     group_tools,
     has_subgroups,
+    leaf_count,
     subgroup_names,
 )
 
@@ -46,21 +47,35 @@ _FORCE_FLAGS = ["--json"]
 _STRIP_PARAMS = SKIP_PARAMS
 
 
+def _decode_stream(data: bytes) -> str:
+    """Decode subprocess output, tolerating binary payloads.
+
+    Commands like ``soar playbooks export`` emit raw bytes (a tgz) on
+    stdout when ``--out`` is omitted — surface a hint instead of dying
+    on a UTF-8 decode error.
+    """
+    try:
+        return data.decode()
+    except UnicodeDecodeError:
+        return f"(binary output: {len(data)} bytes — pass --out FILE to save it)"
+
+
 def _exec_cli(args: list[str]) -> str:
     """Run ``splunkctl <args>`` as a subprocess and return output."""
     cmd = [sys.executable, "-m", "splunkctl", *args, *_FORCE_FLAGS]
     result = subprocess.run(  # noqa: S603
         cmd,
         capture_output=True,
-        text=True,
         timeout=120,
     )
-    out = result.stdout.strip()
-    err = result.stderr.strip()
+    out = _decode_stream(result.stdout).strip()
+    err = _decode_stream(result.stderr).strip()
     if result.returncode != 0:
         return err or out or f"Command failed with exit code {result.returncode}"
     if err and out:
-        return f"{out}\n\n{err}"
+        # stderr carries the guard banner / info lines — they precede
+        # the payload semantically, so keep them first.
+        return f"{err}\n\n{out}"
     return out or err or "(no output)"
 
 
@@ -103,10 +118,15 @@ def _build_cli_args(entry: ToolEntry, params: dict[str, Any]) -> list[str]:
             items = value if isinstance(value, list) else [value]
             positional[pname] = [str(v) for v in items]
             continue
-        flag = f"--{pname.replace('_', '-')}"
+        # Renamed Click options (--severity → severity_override) make the
+        # schema name diverge from the CLI flag; the entry's flag map is
+        # authoritative.
+        flag = entry.flags.get(pname, f"--{pname.replace('_', '-')}")
         if isinstance(value, bool):
             if value:
                 args.append(flag)
+            elif pname in entry.neg_flags:
+                args.append(entry.neg_flags[pname])
         elif isinstance(value, list):
             for item in value:
                 args.extend([flag, str(item)])
@@ -180,7 +200,7 @@ def create_server() -> FastMCP:
             for s in sg:
                 sub_cmd = top_cmd.commands[s]
                 desc = (sub_cmd.help or "").split("\n")[0]
-                n = len(sub_cmd.commands) if isinstance(sub_cmd, click.Group) else 0
+                n = leaf_count(sub_cmd) if isinstance(sub_cmd, click.Group) else 0
                 lines.append(f"  {grp} {s:16s} {desc} ({n} cmds)")
             if dc:
                 lines.append(f"\n{grp} direct commands:")
@@ -342,6 +362,19 @@ def create_server() -> FastMCP:
     async def run_tool(command: str, yes: bool = False) -> str:
         """Execute a raw splunkctl command string."""
         tokens = _split_command(command)
+        # The tool's yes parameter is the only mutation switch — a --yes
+        # smuggled inside the command string must not bypass the guard.
+        # Reject rather than silently strip: after shlex a quoted option
+        # VALUE of '-y' is indistinguishable from the flag, and eating
+        # it would shift arguments or corrupt the value.
+        if any(t in ("--yes", "-y") for t in tokens):
+            return (
+                "Error: '--yes'/'-y' is not accepted inside the command "
+                "string — the tool's yes parameter is the only mutation "
+                "switch. Remove it and pass yes=true to apply. If you "
+                "need the literal value '-y', use a focused typed tool "
+                "instead."
+            )
         if yes:
             tokens.append("--yes")
         result = _exec_cli(tokens)
@@ -352,9 +385,17 @@ def create_server() -> FastMCP:
         if tool_name in all_tools and not any(
             tool_name in names for names in focused.values()
         ):
+            if len(tokens) >= 2 and tokens[1] in subgroup_names(cli, tokens[0]):
+                suggestion = f'focus "{tokens[0]} {tokens[1]}"'
+            elif has_subgroups(cli, tokens[0]):
+                # Bare focus on a nested group is refused; point at usage
+                # for direct commands instead.
+                suggestion = f'usage "{" ".join(tokens[:2])}"'
+            else:
+                suggestion = f"focus {tokens[0]}"
             result += (
-                f"\n\nTip: run `focus {tokens[0]}` to load typed tools "
-                f"with validated schemas for this group."
+                f"\n\nTip: run `{suggestion}` to load a typed tool "
+                f"with a validated schema for this command."
             )
         return result
 

{splunkctl-0.9.0 → splunkctl-0.10.0}/splunkctl/mcp/tools.py

@@ -6,22 +6,10 @@ import click
 
 from splunkctl.guard import is_guarded
 
-SKIP_PARAMS = frozenset(
-    {
-        "help",
-        "json",
-        "use_json",
-        "fmt",
-        "format",
-        "fields",
-        "out",
-        "debug",
-        "timeout",
-        "config",
-        "profile",
-        "yes",
-    }
-)
+# Global flags live on the root group only (main._CLI hoists them from
+# the token stream) — leaf commands never carry them, so the only names
+# to skip are Click's own help and the guard's yes (re-added per schema).
+SKIP_PARAMS = frozenset({"help", "yes"})
 
 _YES_PROP: dict[str, Any] = {
     "type": "boolean",
@@ -32,7 +20,7 @@ _YES_PROP: dict[str, Any] = {
 
 def _param_schema(p: click.Parameter) -> dict[str, Any] | None:
     """Convert a Click parameter to a JSON Schema property."""
-    if p.name in SKIP_PARAMS or p.name == "help":
+    if p.name in SKIP_PARAMS:
         return None
     if isinstance(p, click.Option) and p.hidden:
         return None
@@ -88,6 +76,8 @@ class ToolEntry:
         "guarded",
         "positional",
         "arg_order",
+        "flags",
+        "neg_flags",
     )
 
     def __init__(  # noqa: D107
@@ -100,6 +90,8 @@ class ToolEntry:
         guarded: bool = False,
         positional: frozenset[str] = frozenset(),
         arg_order: tuple[str, ...] = (),
+        flags: dict[str, str] | None = None,
+        neg_flags: dict[str, str] | None = None,
     ) -> None:
         self.name = name
         self.description = description
@@ -108,6 +100,8 @@ class ToolEntry:
         self.guarded = guarded
         self.positional = positional
         self.arg_order = arg_order
+        self.flags = flags or {}
+        self.neg_flags = neg_flags or {}
 
 
 def _tool_name(path: list[str]) -> str:
@@ -115,26 +109,51 @@ def _tool_name(path: list[str]) -> str:
     return "_".join(seg.replace("-", "_") for seg in path)
 
 
+def _long_flag(p: click.Option) -> str | None:
+    """Return the option's canonical long CLI flag (``--like-this``)."""
+    longs = [o for o in p.opts if o.startswith("--")]
+    if longs:
+        return longs[0]
+    return p.opts[0] if p.opts else None
+
+
 def _make_entry(cmd: click.Command, path: list[str]) -> ToolEntry:
     """Build a ToolEntry (schema, positional order, guard) for one command."""
     properties: dict[str, Any] = {}
     required: list[str] = []
     pos: list[str] = []
+    flags: dict[str, str] = {}
+    neg_flags: dict[str, str] = {}
     for p in cmd.params:
         if p.name is None:
             continue
         prop = _param_schema(p)
         if prop is None:
             continue
+        # Schema names come from the Python param name; a trailing
+        # underscore (keyword-avoidance like ``wait_``) is stripped for
+        # callers — the flag map below keeps invocation correct either way.
         pname = p.name.replace("-", "_")
-        properties[pname] = prop
+        display = pname.rstrip("_") or pname
+        if display in properties:
+            display = pname
+        properties[display] = prop
         if isinstance(p, click.Argument):
-            required.append(pname)
-            pos.append(pname)
-        elif isinstance(p, click.Option) and (p.required or p.prompt):
-            # prompt=True options would hang the MCP subprocess waiting
-            # for TTY input, so force callers to always supply them.
-            required.append(pname)
+            required.append(display)
+            pos.append(display)
+            continue
+        if isinstance(p, click.Option):
+            flag = _long_flag(p)
+            if flag is not None:
+                flags[display] = flag
+            if p.secondary_opts:
+                neg = [o for o in p.secondary_opts if o.startswith("--")]
+                if neg:
+                    neg_flags[display] = neg[0]
+            if p.required or p.prompt:
+                # prompt=True options would hang the MCP subprocess waiting
+                # for TTY input, so force callers to always supply them.
+                required.append(display)
 
     guarded = is_guarded(cmd)
     if guarded:
@@ -160,6 +179,8 @@ def _make_entry(cmd: click.Command, path: list[str]) -> ToolEntry:
         guarded=guarded,
         positional=frozenset(pos),
         arg_order=tuple(pos),
+        flags=flags,
+        neg_flags=neg_flags,
     )
 
 
@@ -235,6 +256,17 @@ def has_subgroups(root: click.Group, group: str) -> bool:
     return bool(subgroup_names(root, group))
 
 
+def leaf_count(cmd: click.Command) -> int:
+    """Count leaf commands, recursing into nested subgroups.
+
+    Matches the number of typed tools a full focus of the group would
+    load — a nested subgroup counts its commands, not itself.
+    """
+    if not isinstance(cmd, click.Group):
+        return 1
+    return sum(leaf_count(c) for c in cmd.commands.values())
+
+
 def direct_commands(root: click.Group, group: str) -> list[str]:
     """Return direct (non-group) command names under a top-level group."""
     top = root.commands.get(group)
@@ -264,7 +296,7 @@ def group_summary(root: click.Group) -> list[dict[str, str]]:
                 "group": name,
                 "description": desc,
                 "subcommands": ", ".join(sorted(subs)),
-                "count": str(len(subs)),
+                "count": str(leaf_count(cmd)),
             }
             sg = subgroup_names(root, name)
             if sg:

{splunkctl-0.9.0 → splunkctl-0.10.0}/splunkctl/soar/client.py

@@ -1,14 +1,9 @@
 """SOAR REST API client — requests-based, lazy, normalizing.
 
-Speaks the Django REST API on Splunk SOAR (on-prem / cloud). All
-response-shape quirks (envelope variants, ``succeeded`` vs ``success``,
-``action_run_id`` vs ``id``, ``failed:true`` on HTTP 200) are
-normalized here so command code never sees them.
-
 Auth: ``ph-auth-token`` header preferred; automatic Basic fallback for
-DELETE (server refuses tokens on DELETE except ``decided_list``). A
-token-only config attempting a non-decided_list DELETE raises
-:class:`SOARError` with kind ``auth``.
+DELETE (server refuses tokens on DELETE except ``decided_list``).
+Web UI session (cookie-based) used for operations the REST API lacks
+(e.g. playbook deletion).
 """
 
 from __future__ import annotations
@@ -18,6 +13,7 @@ from collections.abc import Iterator
 from typing import Any
 
 import requests
+import urllib3
 
 from splunkctl.errors import kind_for_status
 
@@ -117,6 +113,14 @@ class SOARClient:
         self._verify = verify
         self._session = requests.Session()
         self._session.verify = verify
+        if not verify:
+            # verify=false is an explicit config choice (lab/self-signed);
+            # without this every request spams InsecureRequestWarning.
+            urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+
+        # Separate session for Django-view-only operations (e.g. delete).
+        self._web_session: requests.Session | None = None
+        self._web_csrf: str | None = None
 
     # -- URL helpers --------------------------------------------------------
 
@@ -296,6 +300,14 @@ class SOARClient:
             body["id"] = body.pop("playbook_run_id")
         return body
 
+    # -- Web UI session (Django views) ----------------------------------------
+
+    def web_delete_playbooks(self, ids: list[int]) -> dict[str, Any]:
+        """Delete playbooks via the Django Web UI handler (see soar/web.py)."""
+        from splunkctl.soar import web
+
+        return web.delete_playbooks(self, ids)
+
     # -- Public API ---------------------------------------------------------
 
     def get(

splunkctl-0.10.0/splunkctl/soar/web.py

@@ -0,0 +1,137 @@
+"""SOAR Django Web UI session — operations the REST API lacks.
+
+Playbook deletion has no working REST route on SOAR 8.5
+(``DELETE /rest/playbook/<id>`` → 405; ``POST`` with
+``{"delete": true}`` → silent no-op), so the client logs into the Web
+UI the way a browser does (csrftoken cookie + AJAX login) and posts
+the same request the ``/playbooks`` page sends. Requires
+username/password — the Web UI refuses token auth.
+"""
+
+from __future__ import annotations
+
+import json
+from typing import TYPE_CHECKING, Any
+
+import requests
+
+from splunkctl.errors import kind_for_status
+
+if TYPE_CHECKING:
+    from splunkctl.soar.client import SOARClient
+
+
+def ensure_web_login(client: SOARClient) -> requests.Session:
+    """Authenticate to the SOAR Django Web UI (cookie-based session).
+
+    The session and CSRF token are cached on *client* — repeated calls
+    reuse the login. Raises :class:`SOARError` (kind ``auth``) without
+    username/password credentials or on a refused login.
+    """
+    from splunkctl.soar.client import SOARError
+
+    if client._web_session is not None:  # noqa: SLF001
+        return client._web_session  # noqa: SLF001
+
+    if not client._has_basic():  # noqa: SLF001
+        raise SOARError(
+            "Playbook deletion requires username/password credentials "
+            "(the SOAR Web UI does not accept token auth).",
+            kind="auth",
+        )
+
+    sess = requests.Session()
+    sess.verify = client._verify  # noqa: SLF001
+    base = f"https://{client._host}:{client._port}"  # noqa: SLF001
+
+    # GET login page to obtain csrftoken cookie.
+    sess.get(f"{base}/login", timeout=15)
+    csrf = sess.cookies.get("csrftoken")
+    if not csrf:
+        raise SOARError(
+            "Could not obtain CSRF token from SOAR login page.",
+            kind="error",
+        )
+
+    # POST login (AJAX-style).
+    resp = sess.post(
+        f"{base}/login",
+        data={
+            "username": client._username,  # noqa: SLF001
+            "password": client._password,  # noqa: SLF001
+        },
+        headers={
+            "X-CSRFToken": csrf,
+            "X-Requested-With": "XMLHttpRequest",
+            "Referer": f"{base}/login",
+        },
+        timeout=15,
+    )
+    try:
+        body = resp.json()
+    except (ValueError, json.JSONDecodeError):
+        raise SOARError(
+            f"SOAR Web login failed: HTTP {resp.status_code}",
+            kind="auth",
+            http_status=resp.status_code,
+        ) from None
+    if not body.get("authenticated"):
+        raise SOARError(
+            "SOAR Web login failed: invalid credentials.",
+            kind="auth",
+        )
+
+    client._web_csrf = sess.cookies.get("csrftoken") or csrf  # noqa: SLF001
+    client._web_session = sess  # noqa: SLF001
+    return sess
+
+
+def delete_playbooks(client: SOARClient, ids: list[int]) -> dict[str, Any]:
+    """Delete playbooks via the Django Web UI handler.
+
+    Uses the same route the browser calls (``POST /playbooks`` with
+    ``{ids, delete: true}``). The handler answers with a
+    ``{done_count, fail_count, changes, errors}`` envelope (captured
+    live on SOAR 8.5); anything else raises rather than being misread
+    as "nothing deleted".
+    """
+    from splunkctl.soar.client import SOARError
+
+    sess = ensure_web_login(client)
+    base = f"https://{client._host}:{client._port}"  # noqa: SLF001
+
+    resp = sess.post(
+        f"{base}/playbooks",
+        json={"ids": ids, "delete": True},
+        headers={
+            "X-CSRFToken": client._web_csrf or "",  # noqa: SLF001
+            "Referer": f"{base}/playbooks",
+        },
+        timeout=30,
+    )
+
+    try:
+        body: dict[str, Any] = resp.json()
+    except (ValueError, json.JSONDecodeError):
+        raise SOARError(
+            f"Playbook delete failed: HTTP {resp.status_code}",
+            kind=kind_for_status(resp.status_code),
+            http_status=resp.status_code,
+        ) from None
+
+    if resp.status_code >= 400 or body.get("failed"):
+        msg = body.get("message", f"HTTP {resp.status_code}")
+        is_http_err = resp.status_code >= 400
+        raise SOARError(
+            msg,
+            kind=kind_for_status(resp.status_code) if is_http_err else "error",
+            http_status=resp.status_code if is_http_err else None,
+        )
+
+    if "done_count" not in body and "fail_count" not in body:
+        raise SOARError(
+            "Unexpected response from the SOAR Web UI delete handler "
+            f"(no done_count/fail_count): {str(body)[:200]}",
+            kind="error",
+        )
+    return body

{splunkctl-0.9.0 → splunkctl-0.10.0}/splunkctl.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: splunkctl
-Version: 0.9.0
+Version: 0.10.0
 Summary: CLI tool for Splunk Enterprise SIEM operations.
 Author: dannyota
 License-Expression: Apache-2.0
@@ -101,8 +101,10 @@ ingest. Built for humans and LLM agents alike: deterministic flags,
   envelopes.
 - **Playbooks as code** — `soar playbooks export --unpack` / `import`
   round-trips playbook tgz bundles (the first such tool anywhere);
-  `soar playbooks run --wait` drives and polls runs to completion;
-  `soar actions run --wait` does the same for connector actions.
+  `soar playbooks delete` removes them through the Web UI route (no
+  REST deletion exists); `soar playbooks run --wait` drives and polls
+  runs to completion; `soar actions run --wait` does the same for
+  connector actions.
 - **SIEM-to-SOAR ingest** — `soar ingest --spl` runs a SIEM search and
   creates SOAR containers + typed CEF artifacts using the official CIM-to-CEF
   field map, with SDI dedup, severity mapping, and last-artifact automation
@@ -265,7 +267,7 @@ splunkctl mcp install              # register in .mcp.json
 splunkctl mcp serve                # start stdio MCP server
 ```
 
-The MCP server auto-generates 237 typed tools from the Click command tree
+The MCP server auto-generates 229 typed tools from the Click command tree
 (SIEM + SOAR) with progressive discovery -- agents start with 5 meta-tools
 (`help`, `usage`, `focus`, `unfocus`, `run`) and dynamically load typed
 schemas per command group. Subgroup-granular focus works for nested groups

{splunkctl-0.9.0 → splunkctl-0.10.0}/splunkctl.egg-info/SOURCES.txt

@@ -58,6 +58,7 @@ splunkctl/mcp/tools.py
 splunkctl/soar/__init__.py
 splunkctl/soar/cimcef.py
 splunkctl/soar/client.py
+splunkctl/soar/web.py
 tests/test_client.py
 tests/test_config.py
 tests/test_guard.py

{splunkctl-0.9.0 → splunkctl-0.10.0}/tests/test_guard.py

@@ -191,3 +191,36 @@ def test_check_missing_profile_propagates(tmp_path: Path) -> None:
 
     with pytest.raises(cfg_mod.ProfileNotFoundError):
         guard.check(ctx, "Delete index 'main'")
+
+
+def test_every_checked_command_is_marked_guarded() -> None:
+    """A callback that calls the guard check must carry the @guarded marker.
+
+    The MCP layer derives the tool's `yes` parameter and [guarded] tag from
+    the marker alone — a command that dry-runs at runtime but lacks the
+    marker can never be applied through its typed MCP tool.
+    """
+    import inspect
+    import re
+
+    from splunkctl.main import cli
+
+    check_call = re.compile(r"\b(?:guard\.check|soar_check|check)\(ctx")
+    unmarked: list[str] = []
+
+    def walk(group: click.Group, path: list[str]) -> None:
+        for name, cmd in group.commands.items():
+            if isinstance(cmd, click.Group):
+                walk(cmd, [*path, name])
+                continue
+            if cmd.callback is None:
+                continue
+            try:
+                src = inspect.getsource(inspect.unwrap(cmd.callback))
+            except (OSError, TypeError):
+                continue
+            if check_call.search(src) and not guard.is_guarded(cmd):
+                unmarked.append(" ".join([*path, name]))
+
+    walk(cli, [])
+    assert not unmarked, f"guard-checked commands missing @guarded: {unmarked}"

{splunkctl-0.9.0 → splunkctl-0.10.0}/tests/test_version.py

@@ -4,4 +4,4 @@ from splunkctl import __version__
 
 
 def test_version() -> None:
-    assert __version__ == "0.9.0"
+    assert __version__ == "0.10.0"