3 Commits

Author	SHA1	Message	Date
nullkey	2ee9741fa1	refactor(cli): finish context→profile cascade + post-review hardening (BREAKING) ... Post-review polish on the v0.7 wire / surface contract. Bundles five follow-ups that landed after the main BREAKING feat commit: 1. Complete context→profile cascade (internal API + YAML schema) The prior commit renamed only the user-visible surface (commands / flags / env / project link / envelope field). The internal Go API and on-disk config schema were still half-renamed — an L-25 self-consistency violation flagged by post-merge review. Closed here: Internal Go API: - config.Context → config.Profile - config.Config.CurrentContext → CurrentProfile - config.Config.Contexts → Profiles - LoginOptions.Context → LoginOptions.Profile - clearContextSecrets() → clearProfileSecrets() - saveContextRef() → saveProfileRef() - secrets.Store: param name `context` → `profile` (interface + FileStore + KeyringStore + MemStore) - cmdutil.LoadSecret(store, context, key) → LoadSecret(store, profile, key) - cmdutil.RefreshAndPersist's ctxName → profileName - Local var `ctx := &config.Profile{...}` → `prof := &config.Profile{...}` in auth/login.go to eliminate the visual collision with Go stdlib context.Context that motivated the whole rename in the first place. On-disk config.yaml schema: - current_context: → current_profile: - contexts: → profiles: - Pre-1.0 break, no compat alias. Users on v0.6 dogfooded configs must delete ~/.config/weknora/config.yaml or hand-rename the two keys (CHANGELOG migration note added). Tests / fixtures / golden files: - factory_test.go YAML fixture + assertion updated. - acceptance/e2e/e2e_test.go writeContextYAML → writeProfileYAML, fixture YAML keys updated. - acceptance/testdata/wire/doctor.error_network.json golden updated ("active context" → "active profile" in hint string). User-visible prose sweep: - cmd/mcp/serve.go --help Long: "active context (or --context)" → "active profile (or --profile)" — most-visible miss. - cmd/{kb/list, search/kb, session/list, api/api} Short/Long help. - cmd/auth/login.go stdout: `(context=%s)` → `(profile=%s)`. - cmd/auth/logout.go error: `"no current context"` → `"no current profile"`. - cmd/doctor/doctor.go hint string (also the wire golden above). - cmd/auth/refresh.go error: `"refresh token missing for context"` → `"refresh token missing for profile"`. - README.md: `## Multi-context` H2 → `## Multi-profile`; code-block comment `# current context` → `# current profile`. Code-comment / docstring sweep across cli/cmd/auth/ and cli/internal/cmdutil/. Comments referencing Go stdlib context.Context, the RAG / LLM "context window" concept, and historical CHANGELOG entries for v0.4 / v0.5 were left alone. CHANGELOG v0.7 BREAKING entry gains the on-disk-schema bullet under the existing "context → profile" item. 2. Profile name validation (shell-injection guard) `envelope.error.retry_command` is a single shell-string field. An AI agent that exec()s it via `sh -c <retry_command>` was injectable through a maliciously-named profile: weknora auth logout --name 'x; rm -rf ~' # would produce: retry_command = "weknora auth logout --name x; rm -rf ~ -y" `cmd/profile/add.go` already enforced an alphanumeric + `-_.` allowlist via `validateName`. The `auth login` and `auth logout` paths bypassed it. - Moved validation from `cmd/profile/add.go` to `cli/internal/cmdutil/profilename.go` as exported `ValidateProfileName` (cmdutil is the import-cycle-safe home; internal/config can't depend on cmdutil). - `auth login` runs the validator before any persist call. - `auth logout` runs the validator on `opts.Name` before constructing `retry_command`. - Unit tests (`profilename_test.go`) cover the allowlist, empty rejection, path-traversal, shell metacharacters (`;`, `&`, `|`, `$()`, backticks, quotes, whitespace, glob, redirects), and the user-facing hint text. The shell-metachar test exists as a regression guard. Wire shape (`retry_command` string → `retry_command_argv []string`) remains a v0.8 additive change per ROADMAP — this fix removes the practical exploit path without touching the wire contract. 3. AI-agent terminology disambiguation "agent" has three referents in this codebase: (a) WeKnora's server-side Custom Agent resource, (b) the removed `agent invoke` verb, (c) external LLM/automation consumers. Per project memory feedback_no_meta_disambiguation_in_docs, the fix is full-term naming, not "X has N meanings" prose. Surgical changes at section headers + ambiguous prose: - AGENTS.md: "Agent decision shortcuts" → "AI agent decision shortcuts"; "agent-callable surface" → "AI-agent-callable surface". - README.md: "Designed to be agent-first" → "AI-agent-first"; "Other agent ergonomics" → "Other AI-agent ergonomics"; "in agent contexts" → "in AI-agent contexts"; "for CI / agents" → "for CI / AI agents". Anaphoric "agents" inside paragraphs that already established "AI agents" was left alone — full substitution everywhere would have been prose noise without clarity gain. 4. Wire-contract review follow-ups Real findings from a second-pass review of the v0.7 envelope / streaming / surface design. Per project memory feedback_check_in_domain_anchor_first, candidate findings were first verified against the in-domain peer CLI explicitly cited as the envelope anchor; two earlier-flagged issues turned out to be in-pattern and were withdrawn. Surviving fixes: - AGENTS.md success-envelope example rewritten. The prior example showed `has_more: false` / `_notice: {}` as if they were always present, but both fields are `omitempty` and never serialize when zero / nil. Replaced with three realistic shapes (list / single resource / mutation with no payload) and added a note that optional fields are omitted when empty. - cmd/chat/chat.go Args: MinimumNArgs(1) → ExactArgs(1). v0.6 silently joined `weknora chat hello world` into `"hello world"`. v0.7 now rejects multi-arg with exit 2, matching `weknora session ask`. BREAKING; CHANGELOG entry added under v0.7 BREAKING. - internal/output/envelope.go extracts NewEnvelope(data, meta, profile) constructor. The jq-filter path in cmdutil.FormatOptions.Emit was manually rebuilding the envelope literal alongside the canonical WriteEnvelope path — drift risk when fields are added. Single construction point now. - internal/cmdutil/factory.go adds AddKBFlag(cmd) helper. Five files (chat, doc/list, doc/upload, doc/create, doc/fetch) had verbatim-identical `cmd.Flags().String("kb", ...)` declarations. Centralised so flag name + help text stay in sync with Factory.ResolveKB. Docstring reordering + gofmt fixup landed in the same edit to keep ResolveKB's own godoc attached to its function. 5. OSS-readiness comment / doc sweep Pre-publication scrub of code, comments, and shipped Markdown to remove references that only make sense in the development repo: - AGENTS.md "Deliberate deviations + mainstream alignments" section: removed peer-project name-drops from the comparison table; rewrote as five flagged design decisions with rationale but no specific competitor named. The four rows that previously contrasted against a named peer CLI now state WeKnora's choice + rationale directly. Section header renamed to "Design decisions worth flagging" since it is no longer a deviation/alignment matrix. - CHANGELOG v0.7 BREAKING rationales: three references to a named peer CLI removed; the context→profile rationale now cites only mainstream multi-credential CLIs by category (AWS / Stripe / OpenAI / Anthropic), and the `api -d/--data` removal rationale cites only `gh api` / `curl`. `chat` BREAKING entry rationale similarly simplified. - 35 cross-references to design-spec section numbers (§4.1 / §4.5 / §5.3 etc.) removed from Go doc comments and test comments across 13 files. The referenced spec lives outside the shipped tree; readers of the public repo cannot resolve them. Each reference replaced with a self-contained semantic description (e.g. "the batch envelope" / "AGENTS.md section on the success path"). - Mixed-language strings translated to English: - Four Go comments: internal/cmdutil/exit.go:213,215, internal/cmdutil/errors.go:156, internal/output/batch_test.go:90, internal/output/envelope_test.go:27. - One CHANGELOG section title: `v0.7 — Agent-first wire contract + 命令面集中清理` → `... + command-surface cleanup`. - CJK test fixtures (internal/text/truncate_test.go CJK truncation cases, cmd/session/list_test.go Chinese session title, acceptance/e2e/e2e_test.go Chinese RAG corpus) retained — they are intentional test inputs, not stray prose. - Makefile help comment: `golangci-lint added in PR-9` → `golangci-lint planned`. Internal PR numbering should not surface in shipped Makefile prose. Build green, 28/28 packages, +5 new ValidateProfileName tests. go vet / gofmt / go mod verify / go mod tidy all clean. Rationale for the cascade: pre-1.0 is the cheapest moment to close L-25 self-consistency (L-26). The half-finished internal rename would have perpetuated the very `context` vs `context.Context` ambiguity that motivated v0.7's user-visible rename in the first place.	2026-05-27 10:56:34 +08:00
nullkey	2ce348d020	feat(cli): --format json default + NDJSON event stream + context→profile cascade + help calibration + docs (BREAKING) ... D1 — --format default flipped to json regardless of TTY: - v0.6: smart default (text on TTY, json on pipe). - v0.7: always json; TTY only affects indent (compact in pipe). Enum values unchanged (text | json | ndjson). - Typed FormatMode enum replaces untyped string consts. - --format / --jq promoted to persistent root flags so unknown- subcommand paths still reach the typed-envelope guard (per-command registration in v0.6 would have rejected --format on unknown commands as cobra-prose exit 2). - WEKNORA_FORMAT env var added; precedence --format > env > default. Invalid env values silently ignored. D2 — chat / session ask default to NDJSON event-stream: - New cli/internal/output/ndjson_stream.go: InitEvent struct + EmitInit / EmitSDKEvent / WriteNDJSONLine helpers. EmitInit doc encodes the must-be-first-line invariant agents key on. - chat / session ask: --format json AND --format ndjson both emit one JSON event per line (no envelope wrapping). CLI injects exactly one `init` event at stream head carrying session_id + optional kb_id / agent_id / profile. Subsequent events pass through verbatim from the SDK (passthrough discipline per spec §5.1). - --format text keeps the SSE-style live renderer. context → profile full cascade: - Command group: cli/cmd/context/ → cli/cmd/profile/ (git mv; package contextcmd → profilecmd). - Global flag --context → --profile. Factory.ContextOverride → ProfileOverride. WEKNORA_PROFILE env var honored (--profile flag > env > config.CurrentContext). When --profile or WEKNORA_PROFILE references a missing profile, the error is input.invalid_argument with hint "weknora profile list" — not the destructive local.config_corrupt path (which would have told users to delete their config file). - Binding file .weknora/project.yaml field context: → profile: (no backwards-compat alias; re-run weknora link). - profile use JSON fields current_context / previous_context → current_profile / previous_profile. - weknora link JSON field context → profile. - CodeLocalContextNotFound → CodeLocalProfileNotFound (typed code rename). - Envelope top-level profile field populated via globalProfile (set by root PersistentPreRunE from Factory.ActiveProfile). chat / session ask NDJSON init event carries the same profile. - Rationale: "context" collided with LLM context window / RAG context / Go context.Context; mainstream multi-credential CLIs (AWS / Stripe / OpenAI / Anthropic / lark) all use "profile". H2/C1' help calibration: - AgentHelp gains Warnings []string; single SetAgentHelp helper routes on WEKNORA_AGENT_HELP=1 (emits JSON blob including warnings) vs human help (appends "AI agents:" block from same source). Warnings surface as both a structured JSON field and visible help-text addendum without drift. - 9 destructive commands carry warnings: kb / doc / agent / session / chunk delete; profile remove; kb / agent edit; auth logout. - weknora doc wait dedups ids at entry; SIGINT mid-wait returns silently (root signal handler maps to exit 130) instead of being miscategorised as operation.timeout / operation.failed. A4 — docs: - cli/AGENTS.md gains four agent-facing sections: Wire contract for AI agents (stdout / stderr / NDJSON / _notice evolution / SDK contract boundary); Deliberate deviations + mainstream alignments; Pre-1.0 breaking policy; Exit-10 anti-patterns. ERROR_REFERENCE table extended. - cli/README.md adds Agent quick start under Wire contract. - cli/CHANGELOG.md v0.7 section: BREAKING entries with migration notes, Added (WEKNORA_FORMAT / WEKNORA_PROFILE / retry_command / retry_after_seconds / risk / _notice reserved infra / meta.count / meta.has_more / doc fetch / doc create / session ask / doc delete --all / NDJSON init), Changed (docs additions), Deprecated (none — pre-release one-shot breaking). Spec: docs/superpowers/specs/2026-05-20-weknora-cli-v0.7-design.md §3 / §4 / §5 / §6 / §11	2026-05-27 10:56:34 +08:00
nullkey	ad150c7126	refactor(cli): envelope sweep — Emit shape, batch ops, MCP StructuredContent, api flag cleanup ... Sweep every CLI output path through the v0.7 envelope contract. FormatOptions.Emit signature changes to (w, data, meta *output.Meta) so list commands surface meta.count / has_more in the wire envelope. TTY indent decision plumbed via FormatOptions.TTY (set by ResolveDefault). --format and --jq promoted to persistent root flags so unknown-subcommand paths still reach the typed-envelope guard (per-command registration would have rejected --format on unknown commands as cobra-prose exit 2). WEKNORA_FORMAT env-var fallback honored before TTY-resolved default. AddFormatFlag retained for the per-command --jq field-hint Long-text addendum. ~55 production Emit call sites swept across cli/cmd/**: list paths populate meta.count; mutation paths pass nil meta; envelope.profile threaded via globalProfile. Existing JSON-shape tests migrated to decode the envelope wrapper. Multi-target batch operations get a unified shape via new helpers: - output.BatchItem + output.WriteBatchEnvelope (§4.5 per-item ok pattern; data:[{id, ok, result?|error?}], meta:{count, successes*, failures*}; Successes/Failures *int so explicit zero survives omitempty in all-fail case). - cmdutil.RunBatch + cmdutil.EmitBatch + cmdutil.DeletedAtNow + cmdutil.ClassifyContextErr collapse the three previously-duplicated multi-delete pipelines (doc / chunk / session) into one call site pattern. doc upload --recursive uses the same helpers with a per- file resultFn. Summary error sets Silent:true so the stderr envelope path doesn't duplicate the stdout batch detail (exit 1 preserved via Code → ExitCode). ConfirmDestructive / ConfirmDestructiveBatch extended with action + retryCmd parameters. Every destructive command (kb delete, kb edit, doc delete, doc delete --all, agent delete, agent edit, session delete, chunk delete, auth logout, api -X DELETE) now attaches error.risk.{level:"destructive", action:"<noun.verb>"} + error.retry_command on the exit-10 envelope. kb edit / agent edit also gain the destructive guard wiring (CHANGELOG listed them as gated but they were silently executing without -y). MCP tool handlers' 31 error paths return CallToolResult with IsError + Content text fallback + StructuredContent (envelope.error shape via cmdutil.ErrorToDetail). Handler Out type changed from typed *sdk.X to any so the go-sdk auto-marshal doesn't overwrite StructuredContent with a zero-struct on error returns. Success path manually populates CallToolResult.StructuredContent via successResult helper. weknora api cleanup: - -d/--data flag removed; body via --input <file> or --input - (stdin) only. Aligns with gh / curl convention. - HTTP method whitelist removed; any non-empty method accepted. - HTTP Retry-After header → cmdutil.Error.RetryAfterSeconds → envelope.error.retry_after_seconds. - runAPIPaginated raw-passthrough fallback now wraps response in envelope so --paginate never emits bare JSON to stdout. Test sweep: ~60 cmd/** tests migrated to decode envelope shape. 9 wire-contract goldens updated under cli/acceptance/testdata/wire/. Spec: docs/superpowers/specs/2026-05-20-weknora-cli-v0.7-design.md §4 / §5	2026-05-27 10:56:34 +08:00