nullkey
5adcedf170
Cross-cutting findings surfaced by the branch-completion review. Perf bug: - Factory.Client closure was not memoized. Factory.ResolveKB internally calls f.Client() to resolve --kb name → id, then the command's RunE calls f.Client() again. Two SDK clients, two keyring reads, two AuthRetryTransport allocations per name-resolved invocation, with *independent* token state (a refresh in one was invisible to the other). Switched to sync.Once like Secrets already does. Silent bug bait: - cmdutil.NormalizeHost docstring claimed CodeInputMissingFlag for the empty case; code returned CodeInputInvalidArgument. Aligned doc to code (present-but-empty is a bad value, not a missing flag). Agent contract gaps: - Five user-facing subcommands lacked SetAgentHelp: auth login / logout / list / status and chat. Added concise strings with error- code call-outs so agents can branch without parsing human strings. Helper extraction (≥3 callers): - text.KnowledgeDisplayName(fileName, title, id) — byte-identical formatter that was in both cmd/doc/list.go and cmd/search/docs.go. Takes fields directly so internal/text stays SDK-free. - cmdutil.WrapHTTP(cause, fmt, args...) *Error — replaces the `Wrapf(ClassifyHTTPError(err), err, ...)` pattern across 24 SDK call sites. Sed-driven migration; off-pattern shapes in chat.go (used streamErr) and cmdutil/kb.go (in-package) hand-edited. Contract test gains a comment update: post-migration the dominant pattern is WrapHTTP which the AST scanner skips entirely (only NewError/Wrapf selectors inspected); ClassifyHTTPErrorOutputs() bridge still covers the dynamic codes those paths can yield. UX consistency: - cmd/doc/list.go --page-size help now reads "Items per page (1..1000)" matching cmd/session/list.go. The bounds validation already enforced 1..1000; the help text was the last drift. Comment-discipline sweep: - Deleted the WHAT-only "*Options captures `weknora ...` flag state" docstring across 23 files (context, kb, auth, doc, session, search, chat, doctor, link). Where the line carried a real WHY clause (kb/delete, doc/delete, session/delete, kb/edit), kept the WHY and dropped only the leading WHAT phrase. - Stripped third-party project-name attribution from inline comments and one user-visible flag-help string across ~40 files in cli/cmd and cli/internal (plus 4 test-file comments). Removed phrases like "Mirrors `gh X`", "borrowed from lark-cli", "kubectl-style", "gcloud `--project`", "Stripe pattern", and the embedded GitHub URLs pointing at those projects. Behavioral descriptions and the WHY behind each comment are preserved; only the upstream-name attribution is gone. Inspiration / north-star references belong in cli/AGENTS.md (the design doc) and commit messages, not scattered through every file. Triggered by an audit round that surfaced several false / fragile parity claims (e.g. "Mirrors `gh repo edit`" — gh repo edit has no --name flag; "matches gcloud `--project` id-or-name" — gcloud's --project accepts ID only). Rather than fix them one by one, the whole category of in-comment external-project references was stripped uniformly.
57 lines
2.0 KiB
Go
57 lines
2.0 KiB
Go
package cmdutil
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
|
|
"github.com/Tencent/WeKnora/cli/internal/iostreams"
|
|
"github.com/Tencent/WeKnora/cli/internal/prompt"
|
|
)
|
|
|
|
// ConfirmDestructive guards a destructive operation (delete, force-overwrite)
|
|
// behind explicit user approval. Behavior matrix:
|
|
//
|
|
// yes=true → proceed (explicit user opt-in via -y/--yes)
|
|
// non-TTY OR jsonOut → return CodeInputConfirmationRequired (exit 10);
|
|
// no UI to prompt, agent/CI must re-invoke with -y
|
|
// after the human explicitly approves
|
|
// TTY + interactive → prompt; user-yes proceeds, user-no returns
|
|
// CodeUserAborted ("Aborted." to stderr)
|
|
// prompter error → returns CodeInputMissingFlag (rare; stdin closed
|
|
// mid-prompt)
|
|
//
|
|
// The non-TTY branch is the destructive-write protocol: high-risk writes
|
|
// always require explicit confirmation in scripted contexts, never silent
|
|
// proceed. See cli/AGENTS.md "Exit codes".
|
|
//
|
|
// `yes` should be sourced from the persistent global -y/--yes flag.
|
|
//
|
|
// On exit-10 path, the returned *Error carries OperationRisk so the envelope
|
|
// printer attaches `risk: {level: "high-risk-write", action: ...}`.
|
|
func ConfirmDestructive(p prompt.Prompter, yes, jsonOut bool, what, id string) error {
|
|
if yes {
|
|
return nil
|
|
}
|
|
risk := &OperationRisk{Level: "high-risk-write", Action: fmt.Sprintf("delete %s %s", what, id)}
|
|
if !iostreams.IO.IsStdoutTTY() || jsonOut {
|
|
e := NewError(
|
|
CodeInputConfirmationRequired,
|
|
fmt.Sprintf("delete %s %s requires explicit confirmation: re-run with -y/--yes", what, id),
|
|
)
|
|
var typed *Error
|
|
if errors.As(e, &typed) {
|
|
typed.OperationRisk = risk
|
|
}
|
|
return e
|
|
}
|
|
ok, err := p.Confirm(fmt.Sprintf("Delete %s %s? This cannot be undone.", what, id), false)
|
|
if err != nil {
|
|
return Wrapf(CodeInputMissingFlag, err, "confirm delete")
|
|
}
|
|
if !ok {
|
|
fmt.Fprintln(iostreams.IO.Err, "Aborted.")
|
|
return NewError(CodeUserAborted, "delete aborted")
|
|
}
|
|
return nil
|
|
}
|