Skip to content

Add org entitlements command - #232

Merged
IlyaasK merged 7 commits into
mainfrom
ilyaas/kernel-1713-org-entitlements
Aug 19, 2026
Merged

Add org entitlements command#232
IlyaasK merged 7 commits into
mainfrom
ilyaas/kernel-1713-org-entitlements

Conversation

@IlyaasK

@IlyaasK IlyaasK commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Why

The organization entitlements API and Go SDK v0.92.0 are released. The CLI should expose the effective organization policy calculated by the API without maintaining a second plan-to-entitlement table.

What

  • upgrade kernel-go-sdk from v0.91.0 to v0.92.0
  • add the read-only kernel org entitlements command
  • show effective plan, feature access, feature constraints, and organization limits in human-readable output
  • support --output json using the generated SDK model unchanged
  • render nullable caps as unlimited in human output while preserving JSON null

kernel org limits remains the command for reading and changing configurable organization concurrency limits.

How

The command calls the generated Organization.Entitlements.Get SDK operation directly. All entitlement resolution remains in the API; the CLI only projects the returned model.

Verification

Before: kernel-go-sdk v0.91.0 and the CLI did not expose organization entitlements.

After:

  • make test passes (go vet ./... and go test ./...)
  • make build passes
  • focused organization command tests pass
  • command registration and help output verified locally
  • read-only production smoke passes for both human and JSON output
  • production JSON was structurally asserted for plan, trial, managed-auth, extension-cap, and browser-limit fields without printing organization data

KERNEL-1713


Note

Low Risk
Read-only CLI surface over a new SDK GET; no auth, persistence, or limit-mutation behavior changes.

Overview
Adds a read-only kernel org entitlements command that surfaces the API’s effective organization policy (plan, trial, features, and limits) without duplicating entitlement logic in the CLI.

The command calls Organization.Entitlements.Get from kernel-go-sdk v0.92.0 (upgraded from v0.91.0). Human output is a table projection of the SDK model; --output json prints the generated model as-is. Nullable caps render as unlimited / none / unknown in the table while JSON keeps null where applicable.

README documents the new subcommand. kernel org limits is unchanged for reading and updating configurable concurrency settings.

Reviewed by Cursor Bugbot for commit 4961b76. Bugbot is set up for automated code reviews on this repo. Configure here.

@socket-security

socket-security Bot commented Aug 17, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedgolang/​github.com/​kernel/​kernel-go-sdk@​v0.91.0 ⏵ v0.92.072 +1100100100100

View full report

@IlyaasK
IlyaasK requested a review from masnwilliams August 17, 2026 21:39

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 60c8fd3. Configure here.

Comment thread cmd/org.go
Expose the API-resolved entitlement snapshot through kernel org entitlements without duplicating plan policy in the CLI. Upgrade the Go SDK to v0.92.0 and preserve null-as-unlimited values in both human and JSON output.
Use the CLI's shared human-readable timestamp formatter for organization entitlement trial dates and cover the behavior with a focused regression test.
@IlyaasK
IlyaasK force-pushed the ilyaas/kernel-1713-org-entitlements branch from 60c8fd3 to c820e44 Compare August 17, 2026 21:46

@masnwilliams masnwilliams left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

requesting changes on two boundary/testability issues. the direct SDK-backed command and flattened table are otherwise the right shape; this does not need a larger architectural rewrite.

Comment thread cmd/org.go Outdated
Comment thread cmd/org_test.go Outdated
@IlyaasK
IlyaasK requested a review from masnwilliams August 18, 2026 19:21

@masnwilliams masnwilliams left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

both requested changes are addressed: nullable response states are distinguished correctly, and the full entitlement projection now has structured coverage with boolean provenance checks. local vet, test, build, and diff checks pass on 4961b76.

@IlyaasK
IlyaasK merged commit 99e42f3 into main Aug 19, 2026
7 checks passed
@IlyaasK
IlyaasK deleted the ilyaas/kernel-1713-org-entitlements branch August 19, 2026 17:08
kernel-internal Bot added a commit that referenced this pull request Aug 19, 2026
Bumps kernel-go-sdk to 796d4245c87a39acbb0d408b05f0de830c500772.

That SDK release adds `interaction_id` to managed auth state and to the
submit request. The API requires it for canonical submissions
(field_values / selected_choice_id) and rejects it when paired with a
legacy submit mode, so before this change every canonical `auth
connections submit` failed with "interaction_id is required for
canonical submissions".

`auth connections submit` gains --interaction-id. Left off, the CLI reads
the connection's current interaction ID, since the ID changes on every
actionable pause and the freshly read one is the only sane default;
passing it pins the submission so the API can reject it as stale. Legacy
submit modes never send one, and --interaction-id with a legacy mode is
rejected locally with the same rule the API enforces. `auth connections
get` and `follow` now show the interaction ID next to the canonical
fields and choices it scopes.

Also resolves the stale merge of main into this branch, which had left
two competing org entitlements implementations in cmd/org.go (the branch
built `org entitlements get`; main shipped `org entitlements` in #232) so
the package no longer compiled. Main's reviewed version wins.

A full enumeration of api.md against the CLI found no other gaps: all
136 non-x-cli-skip SDK methods have commands, and the only new params
field in this release is SubmitFieldsRequest.interaction_id.

Tested against the live API: created a managed auth connection, started
a login flow, and confirmed `get` (table + JSON) and `follow` render the
interaction ID at AWAITING_INPUT; canonical submit with and without
--interaction-id now clears the API's interaction validation (it stops
at this org's submit-v2 feature gate, while the same request sent
without interaction_id still returns "interaction_id is required");
legacy `--field` submit still accepted; `--interaction-id` with `--field`
rejected locally; org entitlements, browsers create/get/delete pass.
go build ./..., go vet ./... and go test ./... pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants