feat(cli): execute generated public API operations - #40
Merged
Conversation
Rationale: Agents and users need every PUBLIC OpenAPI operation executable without handwritten endpoints. The generated static dispatcher keeps requests, successes, structured status errors, anonymous authentication, and streaming responses aligned with the specification. Rejected: Runtime OpenAPI reflection, dynamic property dispatch, provider-specific commands, and a handwritten endpoint map because they erase operation types or drift from OpenAPI. Risk: The generated executor is large and changes with the public specification. Drift checks, completeness tests, strict schema decoding, and reproducible Effect patches constrain that risk. Tested: BUN_INSTALL_CACHE_DIR=<empty temporary directory> bun install --frozen-lockfile Tested: mise run generate:check Tested: mise run check (135 tests, 0 failures, 695 assertions) Tested: git diff --check Tested: production source invariant scan for Promise/async/await/raw throw/TypeScript assertions Not-tested: Live production mutation endpoints were not invoked; deterministic Fetch test layers cover request and response contracts.
Rationale: Anonymous PUBLIC operations must follow the OpenAPI security contract without resolving or leaking local credentials. Operation security now overrides root security, absent operation security inherits the root, and empty or anonymous alternatives remain unauthenticated. Rejected: Allowing optional token attachment on anonymous operations because it reads user configuration unnecessarily and can make public calls fail or disclose credentials. Risk: Future OpenAPI security changes alter generated command authentication metadata. Generator tests cover root inheritance, operation overrides, explicit empty security, and anonymous requirement alternatives. Tested: bun test test/generate-commands.test.ts test/generated-command.test.ts Tested: mise run build Tested: mise run check (143 tests, 0 failures, 708 assertions) Tested: Effect v4 production source scans Tested: git diff --check Not-tested: Live production API endpoints were not invoked; injected Fetch transport tests verify request headers and config isolation.
Rationale: The default login is a browser/device authorization flow; help must not imply that users need a pre-issued token. Risk: Copy-only change in the human help view. Tested: mise run check
Rationale: agents need executable help at the exact command they are about to run, rather than a generic home screen. Risk: help routing changes only; command execution remains unchanged. Tested: bun test test/cli.test.ts; bun run build; mise run check.
This was referenced Aug 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #40. Makes every representable PUBLIC OpenAPI operation executable through the provider-neutral
akuaCLI.--input -|<file>request partitions (path,query,headers,body) with strict generated-schema validation and redacted diagnostics.Verification
bun install --frozen-lockfilefrom an empty cachemise run generate:checkmise run check— 143 tests, 0 failuresRemaining contract dependency
agentEvents.streamis currently published as an untyped SSE 200 response. A separate Cnap producer fix is in progress; this PR does not add an endpoint-specific workaround.