CoreAPI Command Output and Mirror Improvements

Codex·GPT-5.5·Soph·3mo ago·1min·12 Checkpoints·45 file changes·+3967/-1607
c32e06bcoreapi commands: human tables by default, --json to opt out The list/get commands dumped the raw wire model as JSON — noisy (installationId, jurisdiction, ULIDs) and, for mirrors, missing the one field a person actually wants: the clone URL. Default them to a compact, aligned table of the actionable columns; add a persistent --json flag (inherited by nested subcommands like `entire repo mirror list`) for the full model when scripting. corecmd.go gains the shared machinery: addJSONFlag / jsonRequested, a tabwriter-based printTable + printFields, and runCoreList / runCoreObject that branch on --json. Each resource defines one columns + row mapper reused by both its list (table) and get (vertical field view). Mirror output now synthesises the clone URL (entire://<cluster>/gh/<owner>/<repo>) the list API doesn't return, and drops installationId/jurisdiction/createdAt from the human view — so `repo mirror list` leads with repo, cluster, and the URL you'd clone. Scope is the read commands (org/project/repo/grant list, repo+mirror get); create/add still echo the new object as JSON so the new id is easy to capture, and mirror create keeps its interactive clone-wait output. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Entire-Checkpoint: ad6864b8ff39+160/-11
bfcf231repo mirror list: drop the redundant CLUSTER column The cluster host is already embedded in the clone URL (entire://<cluster>/gh/<owner>/<repo>), so a separate CLUSTER column just repeated it. The human view is now REPO / CLONE URL / PRIVATE. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Entire-Checkpoint: aba37fc3d99c+8/-7
2c80e98coreapi tables: color headers and cells like activity/session Style the human table/field views with the same palette the activity and session views use: gray ("8") bold headers, the primary first column in white ("7"), secondary columns in gray. So `repo mirror list` reads with gray REPO/CLONE URL/PRIVATE headers, the repo name white, and the clone URL + yes/no in gray. Gated by shouldUseColor (NO_COLOR + TTY check), so piped output and tests stay plain. The renderer now aligns columns on plain-text width and applies the lipgloss style after padding — ANSI escapes don't perturb the layout the way they did under text/tabwriter, which counted the escape bytes as width. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Entire-Checkpoint: 901ebe15e595+110/-13
7a800fbcoreapi tables: make clone URLs OSC 8 hyperlinks Custom-scheme URLs like entire://… aren't recognized by terminals' URL matchers, so a click or double-click breaks at the "://" and the entire: prefix is left out of the selection. Wrap URL cells (any value containing "://") in an OSC 8 hyperlink so the terminal treats the whole string — scheme included — as one clickable/selectable unit. The wrap is applied after column widths are measured on the plain text, so the escape sequence doesn't perturb alignment, and only when color is enabled (TTY, NO_COLOR off) so piped output stays a bare URL for scripting. Uses termenv.Hyperlink (already a dependency). corecmd_test.go covers the three cases: a URL gets the OSC 8 wrapper, a non-URL doesn't, and the disabled (piped) path passes through plain. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Entire-Checkpoint: 114879e30651+67/-9
a9958a5coreapi: decode 201/204 responses, and default the mirror cluster Two fixes to `entire repo mirror create`, which failed with "decode response: default (code 201): unexpected Content-Type: application/json". 1. 201/204 decode (control-plane-wide). The spec declares only 200 for each operation, but the server answers 201 Created on POSTs and 204 No Content on DELETEs. ogen routed those unenumerated codes to the error decoder (which expects problem+json), so every create/delete broke on a successful response. The normalizer now collapses each operation's success to a single "2XX" range response, which matches whatever 2xx the server returns and decodes it as the success type. ogen surfaces the actual code via a *…StatusCode wrapper, so the command fetch closures unwrap .Response; that adaptation stays in the closures and isn't visible to users. 2. Default cluster host. `mirror create` / `mirror remove` now take the <cluster-host> positional optionally, defaulting to aws-us-east-2.entire.io, so the common case is just `entire repo mirror create github.com/owner/repo`. A single-region default for now — multi-cluster selection should later come from config/context rather than a constant. Verified live: create (idempotent re-run) now decodes the 201 and prints the existing mirror; create without a cluster arg targets the default. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Entire-Checkpoint: 6e4f9286de7c+3135/-1478
3ae90b4normalize: document the transforms as spec-bug workarounds to retire Reframe the normalizer's doc comment: both transforms exist only to compensate for bugs in the upstream OpenAPI document, and the goal is to delete the whole command once the spec is fixed at the source and ogen generates straight from core.openapi.json. Each transform now names the exact spec fix that retires it — non-nullable arrays for the type-union collapse, real per-operation success codes (201/204/200) for the 2XX collapse — and notes that fixing the response codes also removes the *…StatusCode wrapper the 2XX range forces. Comment-only; regenerating produces an identical core.gen.json. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Entire-Checkpoint: c63782f44a08+23/-13
fc8f2f6repo mirror: re-mint clone-probe token on expiry; clarify delete + auth Addresses three review findings on the mirror create/remove path: 1. (real) The clone-readiness wait minted one repo-scoped token and reused it for the whole wait. Those tokens are short-lived (minutes) but the default wait is 30m, so a long clone outlived the token and the wait failed with a 401. The probe now returns the HTTP status and the loop re-mints from the (long-lived) login token whenever it sees 401, then re-probes — so the wait survives arbitrarily long clones. 2. (clarification, not a bug) remove passes the by-mirror lookup's repoId to DeleteMirror, whose param is named mirrorId. They're the same ULID: server-side FindMirrorByCoords returns MirrorRepoID, which create echoes as mirrorId and DELETE /mirrors/{id} resolves. Added a comment citing that so the field-name mismatch doesn't read as a bug. 3. (documented) RepoScopedToken reads the stored login token directly rather than via the refresh-aware tokenmanager. Documented why: device- flow login stores no refresh token, so there's nothing to refresh that this path can't use (an expired login token fails either way), and going direct keeps the exchange wire-form (audience-only, no resource) byte-for-byte what the data plane already accepts. Noted the path to route through the manager if refresh tokens are added later. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Entire-Checkpoint: 2041e23ce617+76/-33
ad19794repo mirror remove: record the repoId==mirrorId verification Follow-up on the by-mirror-repoId-to-DeleteMirror ambiguity. Confirmed live that the by-mirror lookup's repoId is byte-identical to the same repo's mirrorId from list, so DeleteMirror(repoId) is correct. Expanded the comment to note (a) the generated API offers no delete-by-coords route, so the lookup is the only id source — the invariant is unavoidable, not a choice; (b) it's verified live; and (c) the client-contract ambiguity dissolves upstream if the lookup response names the field mirrorId or a delete-by-coords route is added. A unit test can't assert a server invariant and a network test doesn't belong in the offline suite, so the durable backing is the verification note plus the named upstream fix. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Entire-Checkpoint: 48b3a1d0c1ca+11/-6
d27d3c9coreapi: collect upstream API fixes into one checklist The "fix this in the control-plane spec/surface" notes were scattered across code comments. Consolidate them into internal/coreapi/UPSTREAM.md as a running checklist, each entry naming the symptom, the upstream fix, and the workaround it lets us delete here: 1. nullable arrays as type-union shorthand → emit non-nullable arrays 2. operations declaring only 200 but returning 201/204 → declare real success codes 3. by-mirror lookup returns repoId while delete takes mirrorId → name the field mirrorId or add a delete-by-coords route Point the normalize.go header and the repo_mirror.go remove comment at the file so they don't drift. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Entire-Checkpoint: 8edbe9f47559+65/-3
b090ceacoreapi commands: unit-test the pure helpers The OpenAPI-first rewrite ported no tests from entiredb's command tree. Most of those tests covered functionality we dropped (data-plane content verbs, the mirror-use local-remote rewrite, handle resolution, the cross-juris 421 path, the cluster-positional parser), so they don't apply. But a few covered logic we carried over or wrote fresh and left untested — close that gap: - parseGitHubURL: port entiredb's TestParseGitHubURL verbatim (the function was copied verbatim, so its test should come too). - mirrorRow: clone-URL synthesis + private yes/no. - clusterArg: explicit vs defaulted cluster host (and drop the unused idx parameter unparam flagged — the cluster is always args[1]). - parseProjectOwnerType: org/account mapping + rejection. - printTable / printFields: the plain (non-TTY) table and field layout. Still uncovered by design: the HTTP-bound probe loop / 401 re-mint (integration-shaped, needs a fake server) — noted as a follow-up rather than faked here. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Entire-Checkpoint: 7148f3d40923+183/-7
273826dAddress PR review: visible errors, scoped login hint, ctrl-c, licenses PR #1299 review fixes: - SilentError swallowed API errors. renderCoreError, parseProjectOwnerType, and the mirror create/remove invalid-URL paths returned NewSilentError, which main.go skips printing — so a 409 conflict or bad flag produced no output at all. Return plain errors (with SilenceUsage already set), which main.go prints. SilentError is now reserved for the genuinely-quiet case. - BearerAuth showed "run entire login" for every auth failure. Gate the hint on errors.Is(err, auth.ErrNotLoggedIn); other failures (STS rejection, network, bad config) now surface verbatim. Also pass the exchange resource through api.OriginOnly. - Ctrl+C during a mirror clone-wait printed "timed out…: context canceled". Map context.Canceled to a SilentError so cancellation exits quietly; a real deadline still reports. Also use a single time.Ticker instead of allocating a timer per loop iteration. - --insecure-http-auth wasn't wired for the control-plane commands, so plain-HTTP dev cores were unusable. Add it as a hidden persistent group flag; runCore calls auth.EnableInsecureHTTP() before building the client. - grant doc comment claimed repo has add/list/remove; it only has add (the Core API exposes no repo-grant list/revoke). Corrected. - License check: go-licenses reports github.com/segmentio/asm as "Unknown" though it's MIT. Add a .license-overrides file (module -> SPDX) and teach mise lint:licenses to apply it (portable to bash 3.2). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Entire-Checkpoint: 1fb181087a92+122/-24
43308c0license: record segmentio/asm as MIT-0, not MIT segmentio/asm is licensed MIT-0 ("MIT No Attribution") — standard MIT minus the attribution clause, hence strictly more permissive. go-licenses reports Unknown because the clause-trimmed text doesn't clear the classifier's MIT template threshold (and MIT-0 isn't matched either). The earlier override mapped it to MIT, which passed but mislabeled it. Record the accurate SPDX: add MIT-0 to .allowed-licenses (it imposes no obligations, clearly acceptable) and point the override at MIT-0. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Entire-Checkpoint: cfb343645c69+7/-3