| name | cli-output-and-safety |
| description | Use when working on cmd/piv or internal/cli/app, especially for commands, flags, formatting, JSON output, trace routing, config handling, or destructive-operation safety. Helps keep stdout/stderr contracts stable and preserves dry-run and confirmation behavior. |
CLI Output And Safety
Use this skill when the task changes CLI behavior, output shape, or operator
safety.
Workflow
- Identify whether the change belongs in
cmd/piv/ wiring or
internal/cli/app/ behavior.
- Check whether the command supports
--json, tracing, config defaults,
prompts, or destructive mutations.
- Preserve the output contract:
- JSON goes to stdout only
- warnings, prompts, summaries, and trace lines go to stderr
- For state-changing commands, verify whether
--dry-run, --yes, and
--non-interactive behavior must be updated together.
- Add or update command-level tests before finishing.
Repo Patterns
- Root and global flag wiring lives in
cmd/piv/root.go.
- Rendering and error output live in
internal/cli/app/formatter.go.
- Confirmation planning lives in
internal/cli/app/planner.go.
- Config-backed defaults live in
internal/cli/app/config.go and related
helpers.
Test Expectations
- Prefer tests similar to
cmd/piv/cli_test.go.
- Assert stdout and stderr separately.
- For JSON commands, unmarshal the envelope and assert the result payload
instead of comparing raw strings.
