[GH-ISSUE #185] Add confirmation for destructive rea policy revoke command #130

New issue

Closed

opened 2026-10-15 18:21:26 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:21:26 +00:00

Owner

Originally created by @morluto on GitHub (Jul 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/185

Environment

Local repo: /root/rea
Commit: current workspace HEAD
Area: CLI policy commands

Current behavior

rea policy revoke <grant-id> immediately deletes matching grants after a single read of the project store.

grant value is required only by CLI validation (src/cliPolicyCommands.ts line 69)
matching grant is written out with no confirmation step or dry-run mode

Impact

A typoed grant id or accidental command execution can revoke the wrong grant (or all if multiple calls are made) with no safety net.

Suggested fix

Add an explicit confirmation prompt by default, with an explicit --yes/-y flag for automation.
Optionally add a --if-match <grant-id-prefix> check to reduce accidental revocation.

Originally created by @morluto on GitHub (Jul 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/185 ## Environment - Local repo: `/root/rea` - Commit: current workspace HEAD - Area: CLI policy commands ## Current behavior `rea policy revoke <grant-id>` immediately deletes matching grants after a single read of the project store. - `grant` value is required only by CLI validation (`src/cliPolicyCommands.ts` line 69) - matching grant is written out with no confirmation step or dry-run mode ## Impact A typoed grant id or accidental command execution can revoke the wrong grant (or all if multiple calls are made) with no safety net. ## Suggested fix - Add an explicit confirmation prompt by default, with an explicit `--yes`/`-y` flag for automation. - Optionally add a `--if-match <grant-id-prefix>` check to reduce accidental revocation.

bsakaguchi

2026-10-15 18:21:26 +00:00