[ant-release-bot]

Updates cf to openapi@2d3b9ab6825d7087ebe00a4b03c2ff219f08e4b4.

• pins OpenAPI revision 2d3b9ab6825d7087ebe00a4b03c2ff219f08e4b4
• regenerates the committed command surface with the pinned Forge package

This PR is maintained automatically by the Update OpenAPI workflow.

[pkg-pr-new]

npm i https://pkg.pr.new/cf@389

commit: c11c16c

[ask-bonk]

LGTM

github run

[clanky-the-clanker]

💬 Approved with comments — Automated OpenAPI pin bump and regeneration of the generated command tree. No blocking or warning-level issues; two informational notes about generated command labels and newly generated internal test routes.

Findings: 2 info

_{The decision is advisory: this comment never approves, blocks or requests changes on the pull request.}

🔧 Fix with your agent

Paste the following into your coding agent to investigate and fix these issues.

Fix the following code review issues found in pull request #389.

Before making changes, review each issue and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g., the fix would require disproportionate changes
  for minimal ROI, or the finding is factually incorrect), explain why
- If you need to clarify something before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order

## INFO (2)

### [Security] Operations described as internal test routes (`internal submit create`, `signed-url get`, `live get`, `ready get`) are now generated as unscoped, hidden top-level commands. Confirm upstream that they belong in the CLI audience.
- **File:** packages/cli/src/commands/_generated/internal/submit/create.ts

### [Code Quality] `cf email-domains verify` shows "Creating"/"Created" for a verify (re-check) action. The label comes from the generator, so fix it in the generator or the spec metadata, not in `_generated/`.
- **File:** packages/cli/src/commands/_generated/email-domains/verify.ts

---

🔒 Security: 💬 1 info

This pull request adds no secrets, injection risks or auth changes. One note: routes described as internal or for testing are now generated as unscoped commands.

Recommendation: 💬 Optional Nits

• [INFO] Operations described as internal test routes (internal submit create, signed-url get, live get, ready get) are now generated as unscoped, hidden top-level commands. Confirm upstream that they belong in the CLI audience. (packages/cli/src/commands/_generated/internal/submit/create.ts)

View full review

• packages/cli/src/commands/_generated/internal/submit/create.ts, signed-url/get.ts, live/get.ts, ready/get.ts: the spec describes these operations as "Internal route for testing …". They are now generated as top-level commands against /client/v4/<path> with no account scoping. Before this change, submit create was account-scoped under brand-protection. The roots are hidden from help and requests still carry the user's token, so no authentication is removed. Still, the upstream spec should confirm that these routes are meant to be in the CLI audience. If they are not, they should be excluded upstream.
• The pin change in packages/cli/generate.ts only swaps the SHA in the pinned release URL. It adds no new trust boundary.
• No hardcoded secrets, path or command injection, or weakened confirmation prompts appear in the generated files that were checked.

---

📋 Code Quality: 💬 1 info

This pull request regenerates the command tree for the new OpenAPI pin. Nothing blocks it; one note covers a misleading spinner label.

Recommendation: 💬 Optional Nits

• [INFO] cf email-domains verify shows "Creating"/"Created" for a verify (re-check) action. The label comes from the generator, so fix it in the generator or the spec metadata, not in _generated/. (packages/cli/src/commands/_generated/email-domains/verify.ts)

View full review

• packages/cli/src/commands/_generated/email-domains/verify.ts: the handler uses withProgress("Creating", ...) and successLabel: "Created". The operation is a POST that schedules a re-check and returns 202, so nothing is created. The label comes from the generator choosing a verb from the HTTP method. The fix belongs in the generator plugin or the upstream spec metadata, not in a hand edit of _generated/.

Checked and fine:

• Removed roots: logos, queries, matches, logo-matches, submit and url-info no longer exist as top-level roots. No hand-written code or tests outside _generated/ import them. The e2e brand-protection fixtures use the separate cf brand-protection tree.
• New roots: email-domains, internal, live, ready and signed-url are registered with hideCommand: true.
• flagship apps flags patch: compactBody keeps an empty --metadata '{}' object, so you can still clear metadata with it.
• Pin and changeset: FORGE_OPENAPI_VERSION in packages/cli/generate.ts matches the SHA in the description. The minor changeset follows the repository's update-workflow convention.

---

✅ All other checks passed

🚀 Release: ✅ LGTM

Risk: Low. The changeset is present with a minor bump. That fits the repository's convention for OpenAPI update PRs and the pre-1.0 command-surface changes, including the added and removed roots.

---

📖 AGENTS.md: ✅ LGTM

This OpenAPI pin bump and regeneration need no update to the AGENTS.md guidance.

---

⚡ Performance: ✅ LGTM

The changes are to the generated command tree only and do not affect performance. New roots are still registered through the lazy top-level registry.

---

📝 Documentation: ✅ LGTM

No documentation changes are needed for this regeneration.

---

_{Reviewed commit: c11c16c7}

[github-actions]

cf --help startup

	mean	stddev	min	max
PR	277.9 ms	4.2 ms	267.9 ms	285.8 ms
base	281.4 ms	6.4 ms	272.8 ms	293.6 ms

Δ (PR vs base): ↓ -3.5 ms (-1.2%)

Measured with hyperfine on ubuntu-latest (3 warmup runs, 20 timed runs). CI numbers carry ±a few ms of runner jitter; treat small deltas as noise.

[ask-bonk]

LGTM

github run

[ask-bonk]

LGTM!

github run

[ask-bonk]

LGTM

github run

[ask-bonk]

The changeset needs to name the breaking command removals and strict flag rename.

Update the generated command surface for Forge OpenAPI release `e3ada35b5554e5a0847b1daf3511d99ee0e859d8`.

Breaking: remove the legacy hidden `cf logos`, `cf logo-matches`, `cf matches`, `cf queries`, `cf submit`, and `cf url-info` roots. Use the corresponding `cf brand-protection` commands instead. Rename `cf intel indicator-feeds providers create --account-id` to `--account-id-body`.

[ask-bonk]

🤖 I've done a thorough review of your PR.

Regenerates the CLI surface for OpenAPI e3ada35b5554.

1. Warning: The changeset omits breaking command removals and a renamed strict flag. Posted a suggested replacement comment.

github run

[ask-bonk]

Review: 1 finding.

Posted 1 inline finding.

github run

[ask-bonk]

🤖 I've done a thorough review of your PR.

Regenerates the CLI surface for OpenAPI 2d3b9ab6825d.

1. Warning: --metadata null is advertised but rejected by the JSON-map parser. Posted an inline suggestion.
2. Warning: The changeset omits removed command roots and the strict --account-id rename. Updated the existing ask-bonk suggestion.

github run