UAT: `agents validation attach` does not enforce mutual exclusion of `--project` and `--plan` scope flags #4500

New issue

Open

opened 2026-04-08 13:53:05 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-08 13:53:05 +00:00

Owner

Bug Report

Feature Area: Validation CLI — agents validation attach scope enforcement

Expected Behavior (from spec)

The spec (CLI Commands > agents validation attach) explicitly states:

"At most one scope flag may be provided per invocation."

And the command synopsis shows --project and --plan as mutually exclusive:

agents validation attach [--project <PROJECT>|--plan <PLAN_ID>]
                         <RESOURCE> <VALIDATION> [<ARGS>...]

The | separator indicates these are mutually exclusive options.

Actual Behavior

The implementation in src/cleveragents/cli/commands/validation.py (attach() function) accepts both --project and --plan simultaneously without any validation:

def attach(
    ctx: typer.Context,
    resource: ...,
    validation_name: ...,
    project: Annotated[str | None, typer.Option("--project", "-p", ...)] = None,
    plan_id: Annotated[str | None, typer.Option("--plan", ...)] = None,
    ...
) -> None:
    ...
    service.attach_validation(
        validation_name=validation_name,
        resource_id=resource,
        project_name=project,
        plan_id=plan_id,
        args=extra_args,
    )

There is no check that project and plan_id are mutually exclusive. A user can pass both --project my-project --plan my-plan-id and the command will silently pass both to the service layer, which may create an attachment with ambiguous scope.

Code Location

src/cleveragents/cli/commands/validation.py — attach() function, before calling service.attach_validation().

Impact

Users can accidentally create attachments with both project and plan scope specified, which violates the spec's "at most one scope flag" constraint. The resulting attachment has undefined behavior since the spec only defines three scopes: direct (no flag), project-scoped, and plan-scoped.

Steps to Reproduce

Register a validation: agents validation add --config ./my-validation.yaml
Run: agents validation attach --project local/my-project --plan 01HXYZ123 local/my-resource local/my-validation
Observe the command succeeds without error, violating the spec's mutual exclusion requirement

Fix

Add a mutual exclusion check before calling the service:

if project is not None and plan_id is not None:
    console.print(
        "[red]Error:[/red] --project and --plan are mutually exclusive. "
        "At most one scope flag may be provided per invocation."
    )
    raise typer.Abort()

Metadata

Branch: fix/validation-attach-mutual-exclusion
Commit Message: fix(cli): enforce mutual exclusion of --project and --plan in validation attach
Milestone: Backlog
Parent Epic: #4182

Subtasks

Add mutual exclusion guard in attach() function in src/cleveragents/cli/commands/validation.py
Add unit tests verifying that passing both --project and --plan raises an error
Add unit tests verifying that passing only --project or only --plan succeeds
Update CLI help text to clarify mutual exclusion if not already present

Definition of Done

attach() raises a clear error when both --project and --plan are provided simultaneously
Error message references the spec constraint ("at most one scope flag per invocation")
Existing tests for attach() with single scope flags continue to pass
New tests cover the mutual exclusion error path
All nox stages pass
Coverage >= 97%

Backlog note: This issue was discovered during autonomous operation
on milestone v3.2.0 (M3). It does not block milestone completion and has been
placed in the backlog for human review and future milestone assignment.

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: new-issue-creator

## Bug Report **Feature Area:** Validation CLI — `agents validation attach` scope enforcement ### Expected Behavior (from spec) The spec (CLI Commands > agents validation attach) explicitly states: > "At most one scope flag may be provided per invocation." And the command synopsis shows `--project` and `--plan` as mutually exclusive: ``` agents validation attach [--project <PROJECT>|--plan <PLAN_ID>] <RESOURCE> <VALIDATION> [<ARGS>...] ``` The `|` separator indicates these are mutually exclusive options. ### Actual Behavior The implementation in `src/cleveragents/cli/commands/validation.py` (`attach()` function) accepts both `--project` and `--plan` simultaneously without any validation: ```python def attach( ctx: typer.Context, resource: ..., validation_name: ..., project: Annotated[str | None, typer.Option("--project", "-p", ...)] = None, plan_id: Annotated[str | None, typer.Option("--plan", ...)] = None, ... ) -> None: ... service.attach_validation( validation_name=validation_name, resource_id=resource, project_name=project, plan_id=plan_id, args=extra_args, ) ``` There is no check that `project` and `plan_id` are mutually exclusive. A user can pass both `--project my-project --plan my-plan-id` and the command will silently pass both to the service layer, which may create an attachment with ambiguous scope. ### Code Location `src/cleveragents/cli/commands/validation.py` — `attach()` function, before calling `service.attach_validation()`. ### Impact Users can accidentally create attachments with both project and plan scope specified, which violates the spec's "at most one scope flag" constraint. The resulting attachment has undefined behavior since the spec only defines three scopes: direct (no flag), project-scoped, and plan-scoped. ### Steps to Reproduce 1. Register a validation: `agents validation add --config ./my-validation.yaml` 2. Run: `agents validation attach --project local/my-project --plan 01HXYZ123 local/my-resource local/my-validation` 3. Observe the command succeeds without error, violating the spec's mutual exclusion requirement ### Fix Add a mutual exclusion check before calling the service: ```python if project is not None and plan_id is not None: console.print( "[red]Error:[/red] --project and --plan are mutually exclusive. " "At most one scope flag may be provided per invocation." ) raise typer.Abort() ``` ## Metadata - **Branch**: `fix/validation-attach-mutual-exclusion` - **Commit Message**: `fix(cli): enforce mutual exclusion of --project and --plan in validation attach` - **Milestone**: Backlog - **Parent Epic**: #4182 ## Subtasks - [ ] Add mutual exclusion guard in `attach()` function in `src/cleveragents/cli/commands/validation.py` - [ ] Add unit tests verifying that passing both `--project` and `--plan` raises an error - [ ] Add unit tests verifying that passing only `--project` or only `--plan` succeeds - [ ] Update CLI help text to clarify mutual exclusion if not already present ## Definition of Done - [ ] `attach()` raises a clear error when both `--project` and `--plan` are provided simultaneously - [ ] Error message references the spec constraint ("at most one scope flag per invocation") - [ ] Existing tests for `attach()` with single scope flags continue to pass - [ ] New tests cover the mutual exclusion error path - [ ] All nox stages pass - [ ] Coverage >= 97% > **Backlog note:** This issue was discovered during autonomous operation > on milestone v3.2.0 (M3). It does not block milestone completion and has been > placed in the backlog for human review and future milestone assignment. --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: new-issue-creator

HAL9000 added a new dependency

2026-04-08 13:54:22 +00:00

#4182 Epic: Legacy CLI command removal and full verification of CLI interface and workflows

HAL9000 added this to the v3.5.0 milestone

2026-04-08 17:42:07 +00:00

HAL9000 added the