Skip to content

feat(cli): guide recovery from command typos - #6503

Merged
lidge-jun merged 4 commits into
devfrom
codex/cli-ux-recovery
Oct 3, 2026
Merged

lidge-jun merged 4 commits into
devfrom
codex/cli-ux-recovery

Conversation

@lidge-jun

@lidge-jun lidge-jun commented Oct 3, 2026 •

Copy link
Copy Markdown
Owner

Summary

  • Unknown commands now produce concise stderr guidance instead of printing the whole root banner. ocx modles suggests ocx help models; nested suggestions stay within the known family. Suggestions are never executed.
  • Reject unknown roots before shim preflight. Preserve registered commands, aliases, hidden/internal operations, appended-help fallback, provider diagnostics, and capability JSON. Bound matching/output and avoid echoing control characters or trailing operands.
  • Stack: depends on feat(cli): organize help around common tasks #6500, which depends on feat(cli): add explicit help paths and complete reference #6498. This PR targets codex/cli-ux-navigation; review only the recovery layer. No client support or runtime provider changes.

Manual stack (bottom to top)

Order PR Layer
1 #6506 Restart deadline prerequisite
2 #6498 Explicit help paths and full reference
3 #6500 Compact root and family navigation
4 #6503 Contextual recovery

Integration proceeds bottom-up under the owner's explicit merge request. Local full-suite limitations remain disclosed below.

Verification

  • Six meaningful RED tests preceded 146 passing focused tests across ten files.
  • bun run test:changed: 1,113 passed, 1 skipped, 0 failed across 48 files.
  • Typecheck, structure, generated skill surface, privacy, 18 layout tests and docs build passed (561 pages; 77,932 links).
  • Twenty-four real isolated-home CLI scenarios checked output streams, exits, typo recovery, long/control input and no writes; resources cleaned up.
  • Fresh independent review: all 14 changed files reviewed; 2,483 edit-distance oracle comparisons, 75 hostile-input cases, 15 isolated CLI probes and 73 preflight admissions passed. No internal operations were executed by those probes.
  • Draft: inherited full-local-suite failures remain documented in 011_verification.md; three reproduce on untouched baseline, and the snapshot EISDIR failure remains unresolved. This is not a full macOS validation or merge-readiness claim. Each PR's current-head CI is checked independently.

Final publication verification: head 5ffef49be2d42befb7404eb5309b8f7f97e039df; Cross-platform CI run 37116552538 (pull_request, attempt 1) completed successfully with all four Linux test shards and ci. The checkout tested by shard 1 was d5eb8d29c149a873f61b1017e370cc183c353c4d. Policy-skipped platform jobs are not claimed as passing platform validation.

Checklist

  • Scope stays focused and avoids unrelated cleanup.
  • Docs or release notes were updated when needed.
  • Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Integration status

The owner explicitly requested merging the complete manual stack. This PR will be retargeted to dev after its predecessor lands; any refreshed head must pass hosted CI before integration. The prior local full-suite failures remain disclosed and are not claimed as a pass.

Local-suite failure attribution

All four previously recorded local-suite failures now reproduce on untouched baseline 4b98328dca. The three restart-lease failures were already baseline-confirmed. The remaining EISDIR is in tests/codex-integration/injection-model-suggest-routes.test.ts:100, before the tested request: setup calls the bundled Codex catalog probe, whose codex debug models --bundled subprocess creates CODEX_HOME/tmp; the shallow snapshot attempts to read that directory as a file. The unchanged baseline test reproduced the identical failure in an isolated home. A controlled inherited-home / redirected-home / inherited-home experiment produced tmp only in the selected subprocess home. The baseline fixture matches Git blob ef0dafba8dfe2cff3b7519453502d95a46b64925; the fixture and direct catalog producer are unchanged by this stack.

This closes the previously unexplained attribution gap; it does not turn the failed full local run into a pass. No test skip, quarantine or retry-as-fix was added. Merge still requires successful current-head hosted CI and resolution of actionable reviews.

Maintainer integration

The owner explicitly requested completion through merge. Integrating into dev under MAINTAINERS.md as authenticated current maintainer lidge-jun with live admin permission; this is not a self-approval. Earlier draft-only status records the original publication state and is superseded by this integration decision. All four local full-suite failures are baseline-reproduced as documented above; no local full-suite pass is claimed. The provider usage correction is included through parent #6500.

Final head 53d64d3f03515bb861d1474f126c5d1f60a67075 passed Cross-platform CI 37126906980 (pull_request, attempt 1), including all four Linux test shards, docs/structure gates, package smokes and aggregate ci. Tested checkout 2eaee34b3723df5fc81618d34f4d9910218530fa has tree b3d021ccab21c29c6e3bdc656fcda4cba43fce51, identical to the conflict-free prospective merge with dev cb2d1736a858a69b3d95944d531f48b93c2f56a5 after #6500. Superseded canceled runs and policy-skipped platform jobs are not represented as passing validation.

Summary by CodeRabbit

  • New Features
    • Unknown commands and unavailable help topics now show concise error messages in standard error, with relevant suggestions when available.
    • Unknown root commands exit before CLI preflight; recognized aliases, hidden commands, and the internal runner remain supported.
  • Documentation
    • Updated CLI help documentation to explain recovery guidance, output behavior, and command handling.
  • Verification
    • Added coverage for help recovery and updated existing CLI help expectations. Local full-suite validation still has four failures; changes remain in draft and are not merged or released.

@coderabbitai

coderabbitai Bot commented Oct 3, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: cc96b52b-9c5f-4d22-adba-0e4b335e40b0
📥 Commits

Reviewing files that changed from the base of the PR and between cb2d173 and 53d64d3.

📒 Files selected for processing (25)
  • devlog/_fin/261003_cli_help_ux/000_plan.md
  • devlog/_fin/261003_cli_help_ux/001_evidence.md
  • devlog/_fin/261003_cli_help_ux/002_terminal_design.md
  • devlog/_fin/261003_cli_help_ux/010_help_foundation.md
  • devlog/_fin/261003_cli_help_ux/011_verification.md
  • devlog/_fin/261003_cli_help_ux/020_help_navigation.md
  • devlog/_fin/261003_cli_help_ux/021_verification.md
  • devlog/_fin/261003_cli_help_ux/030_help_recovery.md
  • devlog/_fin/261003_cli_help_ux/031_verification.md
  • devlog/_fin/261003_cli_help_ux/040_publication.md
  • devlog/_fin/261003_cli_help_ux/041_deadline_prerequisite.md
  • devlog/_fin/261003_cli_help_ux/090_outcome.md
  • devlog/_plan/261003_cli_help_ux/040_publication.md
  • docs-site/src/content/docs/reference/cli.md
  • scripts/test-layout/layout.json
  • src/cli/dispatch.ts
  • src/cli/help-catalog.ts
  • src/cli/help-recovery.ts
  • src/cli/help.ts
  • src/cli/root.ts
  • structure/runtime.md
  • tests/cli/cli-help-paths.test.ts
  • tests/cli/cli-help-recovery.test.ts
  • tests/cli/cli-help.test.ts
  • tests/fixtures/test-layout-expected.json
💤 Files with no reviewable changes (1)
  • devlog/_plan/261003_cli_help_ux/040_publication.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.


📝 Walkthrough

Walkthrough

The CLI now provides bounded suggestions for unknown commands and unavailable help paths. Unknown roots are rejected before shim preflight. The changes also update CLI documentation, tests, and work-unit records.

Changes

CLI help recovery

Layer / File(s) Summary
Recovery candidates and matching
src/cli/help-catalog.ts, src/cli/help-recovery.ts, devlog/_fin/261003_cli_help_ux/030_help_recovery.md
The catalog provides visible root commands and documented nested paths as candidates. Recovery validates tokens, applies bounded edit-distance matching, and returns at most three suggestions.
CLI recovery and validation
src/cli/root.ts, src/cli/help.ts, src/cli/dispatch.ts, tests/cli/*, docs-site/src/content/docs/reference/cli.md, structure/runtime.md, scripts/test-layout/layout.json, tests/fixtures/test-layout-expected.json
Unknown roots are rejected before shim preflight. Unknown commands and unavailable help use concise stderr diagnostics and exit with status 1. Tests and documentation cover recovery behavior and preserved help paths.
Verification and publication records
devlog/_fin/261003_cli_help_ux/*, devlog/_plan/261003_cli_help_ux/040_publication.md
Work-unit notes record validation results, a remaining full-suite limitation, publication steps, prerequisite work, and a published-draft outcome. The earlier publication plan is removed.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant runCli
  participant findCommand
  participant printUnknownCommand
  participant formatHelpRecovery
  participant suggestHelpPaths
  participant helpRecoveryCandidates
  participant stderr
  runCli->>findCommand: Check root command
  runCli->>printUnknownCommand: Report unrecognized root
  printUnknownCommand->>formatHelpRecovery: Format command path
  formatHelpRecovery->>suggestHelpPaths: Find recovery suggestions
  suggestHelpPaths->>helpRecoveryCandidates: Get documented candidates
  printUnknownCommand->>stderr: Write diagnostic
Loading

Merge Risk: ⚪ Minimal · up to 53d64

The CLI recovery change has no identified merge-blocking issue. The incomplete local full-suite result remains a validation limitation, not a demonstrated regression from this change.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 53d64

The inspected recovery flow provides bounded guidance without executing suggestions, exposing hidden commands through suggestions, or entering shim preflight for unknown roots. No introduced security issue was established. The exact target-branch comparison and broader validation coverage remain incomplete, leaving limited residual uncertainty.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — The assessed attacker-controlled surface is CLI token input reaching diagnostic stderr. Catalog suggestions introduce no handler invocation or authority transfer. Unknown roots are prevented from reaching the shim preflight through the inspected CLI admission path.

Trust Boundaries and Controls

  • observed — Raw tokens are echoed only when their length and ASCII syntax pass validation and the shared redactor leaves them unchanged. This suppresses control-character output and secrets recognized by the redactor; it is pattern-based protection, not a guarantee that every possible secret is detected. Suggested and parent paths come from catalog-owned destinations or recognized documented prefixes.

Resilience and Maintainability Implications

  • inferred — The inspected recovery branch creates no persistent transition requiring rollback: rejected roots terminate before shim preflight, unavailable explicit help terminates after diagnostics, and candidate generation only creates local values. Repetition or interruption of this diagnostic branch therefore does not leave a partially applied shim change attributable to recovery.
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 28.57% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 8 files. (10 skipped:… Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly describes the main change: CLI guidance for command typos and recovery.
Full details: Docstring Coverage

Explanation

Docstring coverage is 28.57% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 8 files. (10 skipped: 10 unsupported.)

  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Oct 3, 2026

Copy link
Copy Markdown
Contributor

✅ Deterministic PR hygiene checks passed.

@github-actions github-actions Bot added the enhancement New feature or request label Oct 3, 2026
@lidge-jun
lidge-jun force-pushed the codex/cli-ux-recovery branch from 43b31b6 to d642e2f Compare October 3, 2026 10:25
@lidge-jun
lidge-jun force-pushed the codex/cli-ux-navigation branch from aaf3672 to 13c0e82 Compare October 3, 2026 10:25
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 3, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-03T13:34:41.958400Z 5ffef49 Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

Base automatically changed from codex/cli-ux-navigation to dev October 3, 2026 13:59
@lidge-jun
lidge-jun merged commit 9f89b72 into dev Oct 3, 2026
47 of 50 checks passed
@lidge-jun
lidge-jun deleted the codex/cli-ux-recovery branch October 3, 2026 14:08
@lidge-jun lidge-jun mentioned this pull request Oct 4, 2026
3 tasks done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant