fix: tighten ledger skip CLI auditing

Co-authored-by: genichin <4282227+genichin@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-08-24 13:42:47 +00:00
committed by GitHub
co-authored by genichin
parent 48dfc3e76f
commit 169f222042
3 changed files with 84 additions and 9 deletions
+7 -3
View File
@@ -401,6 +401,7 @@ def _ledger_backfill_audit_path(args, execution_id: str) -> Path:
def _write_ledger_backfill_audit(args, report: dict) -> str:
path = _ledger_backfill_audit_path(args, report["request"]["execution_id"])
report["audit_path"] = str(path)
path.parent.mkdir(parents=True, exist_ok=True)
path.write_text(_json.dumps(report, ensure_ascii=False, indent=2, default=str) + "\n",
encoding="utf-8")
@@ -419,6 +420,7 @@ def _ledger_skip_resolve_audit_path(args, skip_key: str) -> Path:
def _write_ledger_skip_resolve_audit(args, report: dict) -> str:
path = _ledger_skip_resolve_audit_path(args, report["request"]["skip_key"])
report["audit_path"] = str(path)
path.parent.mkdir(parents=True, exist_ok=True)
path.write_text(_json.dumps(report, ensure_ascii=False, indent=2, default=str) + "\n",
encoding="utf-8")
@@ -1101,10 +1103,10 @@ def _cmd_ledger_skips_resolve(args, cfg, confirm) -> int:
"record": None,
"audit_path": None,
}
if is_live and not getattr(args, "live", False):
report["result"] = {"status": "rejected", "reason": "live account requires --live (with --yes)"}
if is_live and (not getattr(args, "yes", False) or not getattr(args, "live", False)):
report["result"] = {"status": "rejected", "reason": "live account requires --yes --live"}
report["audit_path"] = _write_ledger_skip_resolve_audit(args, report)
_fail("live account requires --live (with --yes)", args.json)
_fail("live account requires --yes --live", args.json)
if args.json:
_emit(report, as_json=True)
else:
@@ -1139,6 +1141,8 @@ def _cmd_ledger_skips_resolve(args, cfg, confirm) -> int:
_fail(f"unresolved ledger skip not found: {args.skip_key}", args.json)
if args.json:
_emit(report, as_json=True)
else:
_emit_pretty_json(report)
return 1
emitter, transport = _default_alarm_emitter(cfg)
try: