Harden CLI safety and release checks

[cnluzhang]

Summary

• require confirmation for retained-version deletion and reject its unsupported --dry-run flag
• open token-store credentials once with no-follow/nonblocking semantics, validate the same descriptor and POSIX ownership/permissions, then read from that descriptor
• keep config explain and doctor useful when an attempted token-store read is malformed, unreadable, or unsafe
• reject Control URLs with embedded credentials, query strings, or fragments without echoing potentially sensitive input
• tighten local HTTP classification, Tail event-size limits, Workflow pagination, and the Wrangler v4 compatibility gate
• pin official GitHub Actions and gate stable releases on non-empty matching changelog notes before publish
• synchronize the full guides, topic docs, agent guidance, tests, and release notes

Why

The audit found several places where an accepted option was silently ignored, a trusted local credential source was not revalidated safely on read, or diagnostics and release automation did not enforce their documented contracts. This change closes those gaps without moving Control-plane business policy into the CLI.

The final token-store read path rejects symlink and non-regular credential files, avoids FIFO blocking, validates the opened file descriptor, and keeps secure user-managed config-directory symlinks working.

Validation

• npm run format:check
• npm run lint
• npm run typecheck
• npm test (601 tests)
• credential/config tests under umask 002
• npm audit --audit-level=moderate
• npm pack --dry-run
• actionlint .github/workflows/ci.yml .github/workflows/release.yml
• git diff main --check

Hosted live integration was not rerun after the final filesystem/URL hardening; its retained-version cleanup invocation now passes the required --yes flag.

DCO: the commits are signed off.

[Copilot]

Pull request overview

Hardens CLI credential handling, destructive operations, input validation, Wrangler compatibility, and release automation.

Changes:

• Adds confirmation and validation safeguards across delete, Tail, Workflow, URL, and token-store paths.
• Enforces Wrangler v4 and improves Windows npx resolution.
• Pins GitHub Actions and validates stable changelog notes before publishing.

Reviewed changes

Copilot reviewed 43 out of 45 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tsconfig.json	Type-checks release scripts.
eslint.config.js	Lints release scripts.
bin/wdl.js	Fails closed on required namespace resolution.
lib/common.js	Adds shared page-limit normalization.
lib/config-state.js	Adds diagnostic token-store fallback.
lib/credentials.js	Tightens URL and credential resolution.
lib/token-store.js	Validates store paths and permissions.
lib/wrangler/command.js	Enforces Wrangler v4 and Windows npx support.
commands/config.js	Reports token-store diagnostic errors.
commands/delete.js	Confirms version deletion and rejects dry-run.
commands/deploy.js	Preserves local Worker URL origins.
commands/doctor.js	Aligns diagnostics with new safety checks.
commands/r2.js	Uses shared limit validation.
commands/tail.js	Caps cumulative SSE event data.
commands/workflows.js	Validates pagination limits.
scripts/changelog-section.js	Extracts and validates release notes.
.github/workflows/ci.yml	Pins official actions.
.github/workflows/release.yml	Pins actions and gates release notes.
tests/unit/helpers.js	Shares invalid pagination fixtures.
tests/unit/cli-common.test.js	Updates confirmed deletion coverage.
tests/unit/cli-config-doctor.test.js	Covers diagnostic and Wrangler behavior.
tests/unit/cli-credentials.test.js	Covers URL and unsafe-store handling.
tests/unit/cli-delete.test.js	Covers version confirmation safeguards.
tests/unit/cli-deploy.test.js	Covers .local Worker URL behavior.
tests/unit/cli-r2.test.js	Expands limit normalization coverage.
tests/unit/cli-release.test.js	Tests changelog extraction.
tests/unit/cli-tail.test.js	Tests SSE event-size limits.
tests/unit/cli-token-store.test.js	Tests store permission and type checks.
tests/unit/cli-workflows.test.js	Tests Workflow pagination validation.
tests/unit/cli-wrangler-command.test.js	Tests v4 and Windows npx handling.
tests/integration/cli-live.test.js	Confirms retained-version deletion.
GUIDE.md	Documents hardened behavior.
GUIDE-zh.md	Synchronizes Chinese guidance.
docs/deploy.md	Updates deployment safety guidance.
docs/deploy-zh.md	Synchronizes Chinese deployment guidance.
docs/r2.md	Documents output overwrite semantics.
docs/r2-zh.md	Synchronizes Chinese R2 guidance.
docs/token.md	Documents store trust requirements.
docs/token-zh.md	Synchronizes Chinese token guidance.
docs/workflows.md	Documents pagination limits.
docs/workflows-zh.md	Synchronizes Chinese Workflow guidance.
CONTRIBUTING.md	Updates module ownership documentation.
CHANGELOG.md	Records safety and release changes.
AGENTS.md	Updates credential-store security guidance.
.claude/skills/wdl-deploy/SKILL.md	Updates agent-facing CLI guidance.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 43 out of 45 changed files in this pull request and generated no new comments.

Suppressed comments (1)

commands/delete.js:71

• The new interactive prompt writes the namespace, worker, and version directly to the terminal. confirmAction escapes only the non-TTY action; readTtyLine emits prompt verbatim, so a positional populated from an untrusted shell variable can inject terminal control sequences before confirmation. Escape the interpolated values as is done for other CLI diagnostics.

      prompt: `Are you sure you want to delete version "${ns}/${worker}@${version}"? [y/N] `,