fix: make cloud operational help a successful terminal action

[seonghobae]

Purpose

Own the shipped operational CLI/process boundary for disksage-icloud-sync-health and disksage-provider-oauth: terminal help, host argument decoding, Windows/Linux/macOS home/data-home authority, native filesystem operands, selected-root admission, and real-process regressions. Provider-OAuth semantics remain #339-owned and reusable filesystem publication remains #344-owned.

Exact state — 2026-09-07 KST

• protected main: 0e90f9cebadbd7f59606baaec4ca1d2f178c899a;
• release prerequisite fix: verify Windows release artifact namespace #264: 3e33229b4157a084a1985a1c7e952f98a64f25e3;
• reusable filesystem owner security: restore object-bound private evidence publication #344: 736da6db1fb0918d998b3f4d240c63936c91b11d, exact Test 34050767861 terminal GREEN across Ubuntu test, Windows windows-home-resolution, and Ubuntu llm-engine-build;
• canonical provider-OAuth security: reject unknown OAuth connection authority fields #339 has now adopted current security: restore object-bound private evidence publication #344 by ordinary non-force ancestry at exact f8ddd5444b09496c893063dc806a95d478163cea; compare merge base is exactly 736da6db...;
• security: reject unknown OAuth connection authority fields #339 exact post-adoption Test 34053995024 is current and non-terminal, so security: reject unknown OAuth connection authority fields #339 is not yet GREEN;
• exact fix: make cloud operational help a successful terminal action #212 head remains 7f51536f22dc3605edfb8db2269c8f37a1dd4079, predating current security: reject unknown OAuth connection authority fields #339 and intentionally held.

#339 now inherits replacement-unavailable behavior, exact Unix 0600 connection-document publication, nonblocking and bounded final verification, exact path admission, bounded 8 MiB JSON serialization, the narrow core shim, and the Rust 1.98 Read::by_ref compile repair from current #344. #212 must not independently copy or restate those filesystem semantics.

The next legal sequence is now: terminal unchanged-head GREEN on #339 f8ddd544... → ordinary non-force #212 restack onto that exact consumer head → fresh #212 CLI/process/platform checks. Existing #212 Test 33976908562 belongs to 7f51536f... and does not transfer to any future restack.

Issue #342/#170 remain open for Windows native-handle parity, any future exact-source replacement, and broader cross-platform same-object Trash/deletion/recovery guarantees. Existing-record replacement unavailability is not CLI permission to fall back to delete-and-create or pathname mutation.

#264 remains blocked at the canonical .github CodeQL metadata-binding path. No administrative bypass, self-approval, force-push, destructive rebase, gate weakening, pathname fallback, copied owner source, or predecessor-evidence transfer.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/cli-help-batch-health-oauth-v1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head c2863b3e26c0b35fd2f9798b2ed391e8ab74b586.

• Head SHA: c2863b3e26c0b35fd2f9798b2ed391e8ab74b586

• Workflow run: 32148571848

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: test.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: test.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file (3 files)"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file (3 files)"]
  R2 --> V2["required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: c2863b3e26c0b35fd2f9798b2ed391e8ab74b586
• Workflow run: 32148571848
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head c2863b3e26c0b35fd2f9798b2ed391e8ab74b586.

• Head SHA: c2863b3e26c0b35fd2f9798b2ed391e8ab74b586

• Workflow run: 32148571848

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: test.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: test.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file (3 files)"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file (3 files)"]
  R2 --> V2["required checks"]

Loading

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

@OpenCode review current head 7f1ac61. The only failed required check was Strix attempt 1; logs show Caido bootstrap could not connect to 127.0.0.1:48080 after 10 attempts (runner infrastructure), not a repository finding. The exact job rerun is queued as job 96570913837; please reassess this head after its result.

[seonghobae]

Current head 7f1ac61 has all hosted checks passing, including exact-head OpenCode review workflow check from the current run. The only CHANGES_REQUESTED review is stale at c2863b3; @OpenCode review current head 7f1ac61 and publish a fresh approval.

[seonghobae]

@OpenCode review current exact head 7f1ac613e7eaa8faa6462bfe3beb55a351c5ebf8. The recorded REQUEST_CHANGES is bound to an older predecessor; current hosted checks report no failures. Re-run coverage/review evidence against this exact head only; do not transfer predecessor decisions.

Dismissing: this REQUEST_CHANGES was posted against commit c2863b3 where coverage-evidence failed. The PR's current head has coverage-evidence passing (verified via gh pr checks). No unresolved review threads remain. Re-request review to re-validate.

[seonghobae]

Fresh dependency-state correction — 2026-09-06 KST

Reusable filesystem owner #344 is now exact 10a81c69a09e09859a837e3c03ff79916f27ab92; its exact Test 34021030040 is non-terminal. Provider-OAuth #339 remains exact b0c523a822c39e6c44c4c0502e2c35abe919d930 on last terminal-GREEN #344 280a0059...; fresh compare against current owner has merge base 280a0059... and behind_by=10.

Therefore #212 exact 7f51536f22dc3605edfb8db2269c8f37a1dd4079 remains intentionally unchanged. Its next legal non-force restack point is #339 only after #339 adopts a GREEN current #344 and then earns its own exact-head GREEN. #212 owns no reusable publication/replacement primitive and must not copy or substitute pathname-based filesystem authority.

[seonghobae]

Dependency refresh — 2026-09-06 KST

#344 filesystem owner is now exact 6f934ebf87061432a0fb89ff3237aaefb687a367, but Test 34027050887 is non-terminal. #339 remains intentionally on last terminal-GREEN #344 280a0059... and is behind_by=19 relative to current owner. Current #344 also narrows no-policy create-new publication to a pre-existing exact-0700 parent instead of pathname provisioning. This #212 operational CLI/platform-adapter lane therefore stays unchanged: first #344 must earn unchanged-head GREEN, then #339 must adopt and adapt that owner contract by ordinary non-force ancestry and earn its own GREEN, and only then may #212 inherit the provider-domain decision. No filesystem primitive is copied into this lane and no predecessor evidence transfers.

[seonghobae]

Dependency refresh, 2026-09-07 KST: #212 remains held. Current filesystem owner #344 is 666cedae424454671e601a1117c3199e1bc2aaf9, 18 owner commits beyond the predecessor GREEN 20177e3a... currently inherited by #339. Exact #344 Test 34047647718 is still non-terminal because Ubuntu test/llm-engine-build have no assigned runner; Windows passed. Legal sequence remains unchanged: current #344 unchanged-head GREEN → #339 ordinary non-force adoption + its own GREEN → #212 ordinary non-force restack + fresh checks. No filesystem source copy or predecessor-evidence transfer.