adopts the remaining uncommitted work from the parallel session:
five new guardian test files (client-errors, device-import-template,
entity-id-guard, jwt-guard, option-hygiene) that lock in the error
taxonomy, id encoding, and cli option hygiene; an attachment file
cleaner in the agentic service; attachment controller and service
tests; a salt-type fix in the auth store; ci workflow typecheck step;
and the cli test report. 818 tests total across 37 files.
Co-Authored-By: Claude Code <noreply@anthropic.com>
alert point-profile fetches a single point's alert profile across its
peer cohort (the only dashboard alert endpoint not already covered by
the addgetanalysis factory). device import-template downloads the xlsx
bulk-import template shaped for a given driver and profile, writing
the binary to disk via the direct fetch seam since the json-decoding
client pipeline cannot carry spreadsheet bytes. also aligns the
package license with the repository (agpl-3.0-or-later).
Co-Authored-By: Claude Code <noreply@anthropic.com>
the core modules gain a proper error taxonomy (CliError with
kind/code/exitCode, classifyError for zod and commander bridges,
suppressFailureEnvelope for streaming commands), atomic config writes
(temp+fsync+rename with win32 acl tightening, lockfiles with stale
pid recovery, quarantine for corrupted files instead of silent reset),
a hardened transport client (rfc 7807 detail extraction, identity
mismatch warnings, epoch-guarded token renewal), credential store
security fixes (execfile without shell on all platforms, powershell
encodedcommand on win32, secret-tool stdin on linux), and 60 new
guardian tests covering every fix. 488 tests total.
Co-Authored-By: Claude Code <noreply@anthropic.com>
All transport goes through one shared http seam with a 30s abort timeout and network or auth error mapping, add replaces create as the verb with a one-release alias, login and logout stop swallowing auth and network failures, the global --profile and --format options are actually honored together with the persisted output_format setting, config set validates numeric input instead of poisoning the schema and a corrupt config now warns, backs itself up and never silently reverts to defaults, paging and url parameters are validated and encoded, and the dead crypto helper is gone. The contract is pinned by a dedicated test suite.
Mirror the backend checkstyle javadoc gate in eslint: exported
functions, interfaces, types and classes must carry jsdoc with
matching @param/@returns tags and descriptions. Backfill the full
cli surface so the gate starts green.
java headers are generated and enforced by spotless licenseHeader from
the root copyright file; the typescript surfaces had no such control -
dc3-cli carried zero headers across 32 files and dc3-web was missing
one hand-written file:
- add scripts/add-license-header.mjs (shared by both packages) that
reads the same root copyright and emits block comments for ts and
html-comment headers for vue, with a --check mode for ci
- wire headers / headers:check npm scripts; unplugin-generated ambient
d.ts files are exempt (the generator owns their file head)
- backfill all 32 dc3-cli sources and operation.ts / type.d.ts
verified: headers:check green on both packages, cli 67/67 tests +
build + lint, web 687/687 tests + lint + format
Revert the premature McpServer.vue change (implementation was not
requested). Record the onboarding UX contract in
token-unification-mcp-first-cli.md §4.1 instead, and rename the CLI
package back to dc3-cli per review.
Move the previously untracked TypeScript CLI into iot-dc3 as an
independently managed module next to dc3-web:
- pnpm workspace (pnpm@11.24.0) with esbuild build approval,
package renamed to iot-dc3-cli, npm lockfile dropped
- add eslint flat config; lint now runs green after removing
unused imports/vars and adding switch-case breaks in config.ts
- document CLI conventions and commands in AGENTS.md
