Repository navigation
feat(cli): [FDE-2950] sync the API spec, lock command names and add finding actions to CLI and MCP - #172
Open
tim-thacker-nullify wants to merge 11 commits into
Open
feat(cli): [FDE-2950] sync the API spec, lock command names and add finding actions to CLI and MCP#172tim-thacker-nullify wants to merge 11 commits into
tim-thacker-nullify wants to merge 11 commits into
Conversation
…ommand names The generator never deleted output, so a service that left the spec kept its old file and redeclared every model type it shared. A path with an unmapped prefix was dropped without notice, and a command name depended on its siblings, so a new route renamed an existing command. Generation now removes its own previous output, fails on an unmapped prefix, and reads command names from spec/command-names.lock. A locked name stays when siblings change or when its route leaves the spec. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Generated output only: spec/, internal/api, internal/commands and new rows in spec/command-names.lock. It moves SPEC_REF from the 26 May pin to the newest commit that updated the bundle. Hand-written code that follows the new API is in the next commit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…nds working Latent could not allowlist or unallowlist CSPM findings from the CLI or MCP, and nothing protected customers from a dropped command. - Add internal/findings: one per-type table and one verb table that both the CLI and the MCP server use. It replaces the MCP-only table and adds CSPM allowlist, unallowlist, archive, mark false positive and triage, plus bug hunt unallowlist. - Add nullify findings subcommands and MCP tools for those verbs and for feedback. Allowlist requires a reason and a user-submittable type; raw nullify api commands still follow the spec. - nullify findings list accepts cspm and scpm, reports returned and truncated, and exits non-zero on no access. Fix the wrong API values for secrets, bughunt and scpm. - nullify fix and nullify_fix_finding share one flow and stop calling removed routes. - Add spec/command-surface.tsv with a test and scripts/commandsurface. Record each moved or removed command in internal/commands/surface_decisions.go; moved commands stay as deprecated aliases. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…equest - CI fails when generated output does not match the spec or a command in the base branch disappears without a recorded decision. - spec-drift.yml opens a draft pull request when the pin is behind the monorepo bundle. It runs on a free runner, never merges and does not release. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…k MCP tools - nullify fix and nullify_fix_finding carry the terminal state and fail on a failed or still-running run, and report only a pull request of this run. - Add secrets_sensitive_data, and accept the type value of a listed finding. - Send the unallowlistType that the secrets routes require. - Move archive, unarchive, mark, unmark and delete ticket to the findings-write tool set, and annotate every MCP tool as read-only or destructive. - Restore exit code 3 for API access failures. - Lock MCP tool names in spec/mcp-tools.tsv and record list_escalations as removed. - nullify fix waits up to 50 minutes with --timeout, and --no-wait starts the run and exits 0. nullify_fix_finding starts the run and returns. Add fix-status and fix-diff. A failed diff read keeps the pull request in the result. - The MCP tool lock also records annotations and tool sets. - nullify fix refreshes an expired token during the wait, and prints run_id, state and check_with when it cannot. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Mint a read-only token for nullify and a separate write token for cli, with no token in the environment while Go runs. - Fail first with one message when the app key is missing, and run weekly. - Read the app key from the spec-sync environment, which only main can deploy to. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…-nullify-token - Move the timeout to internal/client, so that api.NewClient and NewRefreshingHTTPClient read the same setting. - Prove that nullify fix never replaces --nullify-token with stored credentials. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
tim-thacker-nullify
marked this pull request as ready for review
November 4, 2026 11:33
…n ci gate - bughunt, sca_dependencies and sca_containers return a warning, because the server may not record the required allowlist type. Remove the SCA marks when the spec moves past monorepo #17588. - Accept the monorepo FindingType names secrets_credentials, dast_bughunt and dast_pentest. - ci gate --type accepts scpm and secrets_sensitive_data through the unified search. The default set does not change. - get_findings_for_repo reports truncation and no longer searches cloud findings by repository. - Keep the open pull request when a run ends in failed_iteration, and remove the duplicated StillRunning field. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The CLI's API spec was five months old, so customers such as Latent could not allowlist CSPM findings from the CLI or MCP, and a plain re-sync failed to build and dropped commands (FDE-2950).
Merging releases to customers. Do not merge without Tim's go-ahead.
Generator:
asset-graph.goandinfrastructure.gocaused the 10 duplicate models (reproduced).spec/command-names.lockandspec/mcp-tools.tsvhold names; CI fails on any drop or rename without a recorded decision.Spec sync to bundle
1b9c3dd: 504 commands become 1013.31b87fcb97ae. They could only return 404 or similar. Listed inCHANGELOG.md.Finding actions in CLI and MCP, from one verb table:
nullify findingsgains get, triage, allowlist, unallowlist, archive, false-positive, ticket, feedback. All finding types, including cspm, scpm and sensitive-data secrets.findings listreportsreturnedandtruncated. Access failures return an error, not an empty list.findings-write).fix-statusandfix-diffadded. Every tool is annotated.Behaviour changes:
nullify fixnow waits up to 50 minutes and exits non-zero on a failed run. Use--no-waitfor the old fast return.ci gateis unchanged. It is still wrong, but the unified search would make it fail open: FDE-2973.findings listreturns triaged findings only, and repository filters match the exact stored name.create_pr.list_escalationsis removed; its route is gone.Drift job:
go run.spec-syncexists (monorepo PR) andSPEC_SYNC_GITHUB_APP_KEYis set. App 359904 install is unconfirmed, and a dedicated app is the better long-term choice.Not verified:
demo.dev.nullify.ai.Overlap: #170 conflicts in
writeBaseClientandroot.go; regenerateinternal/api/client.goafter rebase. #166 needsmake command-surfaceafter rebase.Generated code is alone in f3f27ce.
🤖 Generated with Claude Code