Repository navigation
fix(contract): deny-keys does not count sign-in and sign-out as keyed writes - #373
Merged
Merged
Conversation
… writes A read-only CLI whose only remote writes are `session start` and `account remove` (gmeet-cli) failed deny-keys with "no command that writes to the service names a permission key". Sign-in and sign-out have no permission key on purpose (cli-base WC-PERM-5). cli-core marks these commands with `logsInOrOut`, but the mark lives only in-process and is not in `commands --json`. Every marked command in cli-core, tg-cli, max-cli, zoom-cli and gmeet-cli sits at `session start`, `session end`, `account remove` or `setup`, so the check leaves those paths out of the write count. Any other remote write still needs a key. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merged
leemour
added a commit
that referenced
this pull request
Nov 14, 2026
Releases #373: `deny-keys` no longer counts sign-in and sign-out as keyed writes. gmeet-cli's `contracts:check` needs it. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Task
A read-only CLI with an OAuth sign-in (gmeet-cli) fails
deny-keyswith "no command that writes to the service names a permission key in its --dry-run": the contract countssession startandaccount removeas writes, though sign-in and sign-out carry no permission key on purpose (WC-PERM-5).What
deny-keysleaves sign-in and sign-out out of that count. A CLI with no other write passes; a real write without a key still fails. Regression tests for both.Testing
Deny tests 15/15, full suite 175 pass. Against gmeet-cli's
contracts/plan.json: 10/10 with the fix;deny-keysfails with 0.7.1.🤖 Generated with Claude Code