fix(cloudsec): broken --project flag + wrong help examples - #328
Merged
Conversation
The docs accuracy audit cross-checked the CLI against the server and found the cloudsec group's own help contradicting reality in four ways, plus one broken flag: - --project on 'query run' / 'export query' split its value into a JSON array, but the server's 'project' body field is a string that only accepts "graph" — so the flag was silently ignored no matter what was passed. It is now a Choice(["graph"]) passed through verbatim, and the help says what it actually does (adds the induced subgraph next to the rows). The SDK signature follows (project: str | None). - Help examples used '--named public-buckets', which is not a query-pack name (the real one is public_data_stores) — anyone copying the example got an error. - Help examples showed natural-language --text queries; --text is the Cypher-lite MATCH...RETURN grammar and those examples cannot parse. Replaced with a valid query. - 'limacharlie hive list cloudsec_query' (positional) is invalid syntax; hive list requires --hive-name. - The --expires-at example used epoch 1767225600 (2026-01-01), now in the past — an acceptance created from it would be expired on arrival. Replaced with a relative form. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013wAL18rVrkErdz8kBTkkRi
lcbill
approved these changes
Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found while auditing the Cloud Security docs against the product (companion to refractionPOINT/documentation#322): the
cloudsecCLI group's own--help/--ai-helpcontradicted the server in four places, and one flag was silently broken.Fixes
--projectwas silently ignored. The CLI split its value into a list and the SDK sent a JSON array, but the server'sprojectbody field is a string that only accepts"graph"— so no value ever had any effect. It is nowChoice(["graph"]), passed through verbatim, with help text describing what it actually does (adds the induced subgraph next to the rows). SDK signature updated toproject: str | None, docstring corrected.--named public-bucketsin help examples — not a real query-pack name; copying the example errors. Nowpublic_data_stores.--textexamples —--textis the Cypher-liteMATCH … RETURNgrammar;"public bucket with sensitive data"cannot parse. Replaced with a valid query (the same one the docs use).limacharlie hive list cloudsec_query(positional) — invalid syntax;hive listrequires--hive-name. Fixed in all four help texts.--expires-at 1767225600example — that epoch (2026-01-01) is in the past, so an acceptance created from it is expired on arrival. Now uses"$(date -d '+90 days' +%s)".Testing
Unit tests updated for the
--projectsemantics and pack name; full unit suite passes (3,676 passed, 6 pre-existing skips).Note:
--projectpreviously accepted arbitrary comma-separated values and did nothing; it now rejects anything butgraph. That's a behavior change only for invocations that were already broken.🤖 Generated with Claude Code
https://claude.ai/code/session_013wAL18rVrkErdz8kBTkkRi