6d8c8650cd
Two intertwined agent safety nets that share the same files:
1. --dry-run flag for offline preview of mutation commands
2. Risk: metadata + SetRisk helper for destructive command surfaces
Coverage (19 mutation commands with --dry-run):
kb.create/edit/delete agent.create/edit/delete
doc.create/upload/fetch/delete doc.delete_all (special variant)
session.delete chunk.delete profile.add/remove
auth.refresh/logout link unlink
api.{post,put,patch,delete} (api.get + --dry-run rejected, exit 2)
Envelope additions (omitempty in non-dry-run paths):
meta.dry_run: bool true when --dry-run was used
meta.plan: map {action, args} per the per-command taxonomy
Risk: metadata
--------------
cmdutil.SetRisk(cmd, action) stamps cobra.Annotations with
risk.level=destructive + risk.action=<action> on the 9 destructive
commands. The SetAgentHelp wrapper prepends a "Risk: <action>
(destructive)" line in the default text help path so agents see a clear
warning before parsing Usage. WEKNORA_AGENT_HELP=1 JSON path stays
unchanged — structured agent-help already carries warnings[].
Validation parity with the live path
------------------------------------
Every pure-local validation (flag presence, mutual exclusion, enum
bounds, URL/regex format, ResolveKBLocal for KB resolution that does not
require an SDK call) runs BEFORE the dry-run gate. This matches the
industry-standard "preview shows what live would do" contract:
--dry-run accepts exactly the same invocations the live path accepts and
rejects exactly the same invocations the live path rejects, modulo the
side-effecting work itself.
The side-effecting work (SDK calls, file writes, keyring writes, server-
side name → id resolution) is what --dry-run actually gates. Each
mutation file pairs its RunE validation block with a regression test
under *_dry_run_test.go / dryrun_validation_test.go so future refactors
don't reintroduce the gap.
Helper surface
--------------
- HandleDryRun(cmd, dryRun, plan) extracts the early-return so the
19 RunE call sites stay 3 lines each.
- EmitDryRun routes through FormatOptions.Emit, inheriting _notice /
TTY indent / --jq filtering for free.
- ResolveKBLocal mirrors ResolveKB but never calls the SDK; dry-run
paths use it so the plan reports the raw --kb value (UUID or name)
without a name → id lookup.
Streaming commands (chat, session ask, session continue-stream) are
deliberately excluded: a buffered plan makes no sense for an event
stream.
Lock semantics in the dry-run path:
- destructive + --dry-run: exit 0, no exit-10 confirmation prompt
- --dry-run + -y: byte-identical envelope to --dry-run alone
- --dry-run + --jq: filter applies to the preview envelope normally
129 lines
4.7 KiB
Go
129 lines
4.7 KiB
Go
// Package-level note:
|
|
//
|
|
// AddDryRunFlag + EmitDryRun + DryRunPlan + HandleDryRun support the
|
|
// --dry-run contract for mutation commands:
|
|
// - Each mutation cobra command registers --dry-run via AddDryRunFlag.
|
|
// - RunE early-exits (BEFORE ConfirmDestructive / Factory.Client() /
|
|
// ResolveKB) when opts.DryRun is true, calling EmitDryRun with a
|
|
// DryRunPlan describing the would-be action.
|
|
// - The api command additionally rejects --dry-run on GET (FlagError).
|
|
//
|
|
// Side-effect suppression: the dry-run path must NOT call the SDK, write
|
|
// the keyring, write .weknora/project.yaml, or write download files.
|
|
package cmdutil
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
"io"
|
|
|
|
"github.com/spf13/cobra"
|
|
|
|
"github.com/Tencent/WeKnora/cli/internal/iostreams"
|
|
"github.com/Tencent/WeKnora/cli/internal/output"
|
|
)
|
|
|
|
// DryRunPlan describes the would-be action for envelope meta.plan.
|
|
// Field tags use omitempty for api-extra fields so mutation commands
|
|
// emit only {action, args} and api commands emit {action, method, path, body}.
|
|
type DryRunPlan struct {
|
|
Action string `json:"action"`
|
|
Args map[string]any `json:"args,omitempty"`
|
|
Method string `json:"method,omitempty"`
|
|
Path string `json:"path,omitempty"`
|
|
Body any `json:"body,omitempty"`
|
|
}
|
|
|
|
// AddDryRunFlag registers --dry-run on a cobra command, binding to a bool
|
|
// pointer. A bool is sufficient because the CLI is single-tenant and
|
|
// self-hosted — there is no client/server distinction to encode.
|
|
func AddDryRunFlag(cmd *cobra.Command, dest *bool) {
|
|
cmd.Flags().BoolVar(dest, "dry-run", false,
|
|
"Preview the action without executing (offline; no SDK calls, no file IO)")
|
|
}
|
|
|
|
// EmitDryRun writes the dry-run envelope to w via FormatOptions.Emit, so the
|
|
// envelope inherits the standard _notice injection, TTY indent, --jq filter,
|
|
// and profile fields like every other success envelope. fopts may be nil for
|
|
// callers that have no resolved FormatOptions (tests, error paths); a JSON-mode
|
|
// default is used in that case.
|
|
//
|
|
// The envelope shape is {ok:true, meta:{dry_run:true, plan:{...}}, ...}; data
|
|
// is intentionally omitted (omitempty on Envelope.Data) since dry-run produced
|
|
// no real data.
|
|
//
|
|
// Caller must ensure NO side effects occurred before this point: no SDK call,
|
|
// no file write, no keyring touch.
|
|
func EmitDryRun(w io.Writer, fopts *FormatOptions, plan DryRunPlan) error {
|
|
planMap, err := planToMap(plan)
|
|
if err != nil {
|
|
return fmt.Errorf("dry-run: encode plan: %w", err)
|
|
}
|
|
meta := &output.Meta{
|
|
DryRun: true,
|
|
Plan: planMap,
|
|
}
|
|
if fopts == nil {
|
|
fopts = &FormatOptions{Mode: FormatJSON}
|
|
}
|
|
// NDJSON mode is meaningless for a single dry-run envelope (the contract
|
|
// emits exactly one object). Fall back to JSON envelope shape so meta.plan
|
|
// is surfaced; this matches what every other mutation emit does.
|
|
if fopts.Mode == FormatNDJSON {
|
|
jsonOpts := *fopts
|
|
jsonOpts.Mode = FormatJSON
|
|
return jsonOpts.Emit(w, nil, meta)
|
|
}
|
|
return fopts.Emit(w, nil, meta)
|
|
}
|
|
|
|
// HandleDryRun bundles the dry-run preamble for mutation command RunE:
|
|
// FormatOptions resolution + envelope emit. Returns (handled, err) — when
|
|
// handled is true, RunE should return err immediately without doing any
|
|
// SDK / Factory.Client() / ResolveKB / ConfirmDestructive work.
|
|
//
|
|
// Pattern:
|
|
//
|
|
// if handled, err := cmdutil.HandleDryRun(cmd, opts.DryRun, cmdutil.DryRunPlan{
|
|
// Action: "kb.create",
|
|
// Args: map[string]any{"name": opts.Name},
|
|
// }); handled {
|
|
// return err
|
|
// }
|
|
//
|
|
// The helper invokes ONLY local config reads (CheckFormatFlag,
|
|
// IsStdoutTTY) — no SDK calls, no keyring writes, no file IO. Safe to
|
|
// call before any other RunE logic.
|
|
//
|
|
// The helper re-resolves FormatOptions internally so callsites stay
|
|
// single-statement; this is intentionally redundant with the outer
|
|
// CheckFormatFlag the non-dry-run success path still needs. The duplication
|
|
// is cheap (local flag read) and is the price of consolidating the dry-run
|
|
// preamble into one helper.
|
|
func HandleDryRun(cmd *cobra.Command, dryRun bool, plan DryRunPlan) (handled bool, err error) {
|
|
if !dryRun {
|
|
return false, nil
|
|
}
|
|
fopts, err := CheckFormatFlag(cmd)
|
|
if err != nil {
|
|
return true, err
|
|
}
|
|
fopts.ResolveDefault(iostreams.IO.IsStdoutTTY())
|
|
return true, EmitDryRun(iostreams.IO.Out, fopts, plan)
|
|
}
|
|
|
|
// planToMap converts a DryRunPlan to map[string]any so it can populate
|
|
// output.Meta.Plan (which is open-typed). Goes through json to honor the
|
|
// omitempty tags so api-only fields don't leak into mutation envelopes.
|
|
func planToMap(plan DryRunPlan) (map[string]any, error) {
|
|
b, err := json.Marshal(plan)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
var m map[string]any
|
|
if err := json.Unmarshal(b, &m); err != nil {
|
|
return nil, err
|
|
}
|
|
return m, nil
|
|
}
|