feat: --visibility anyone|private|hidden (then --comments)

[scott]

Summary

Paired CLI for team-gated commenting, thread visibility, and private docs.

gander share [--watch] [--foreground] [--comments=anyone|team] [--comment-visibility=public|team] [--private] [--no-comments] file.md

Same flags on gander watch (runShareWithCtx already prepends --watch).

Plan: gandermd plans/2026-09-01-per-share-comment-access-control.md (PR 5).

Ship after the post-dashboard gandermd is on :latest. readJSON + DisallowUnknownFields 400s these fields against today’s server. This inverts the usual CLI-first pairing rule.

This supersedes #93 (--no-comments / comments_enabled). Server issue #61 was closed; there is no comments_enabled column. --no-comments is an alias for --comments team (hides threads from the public; the team can still comment).

Contract

Omit each JSON key unless that flag is set (flag.Visit). Server omitted = no-touch on upsert; insert defaults anyone + public threads + public doc.

• --comments team with visibility omitted → POST "comment_access":"team" only; server stores comment_visibility=team.
• --no-comments → same body as --comments team. Together with --comments anyone → CLI 400.
• --private → "doc_visibility":"private" only unless other flags set; server stores access + comment visibility team. Together with --comments anyone → CLI 400.
• --comment-visibility public|team → that key only.
• Watch PUT stays {content} only.

shareResp grows the three fields (CLI decoder does not DisallowUnknownFields). gander list: COMMENTS (anyone / team), thread-visibility column, PRIVATE (yes / blank).

No invite subcommand in v1. Token-only authors change policy by re-sharing with flags.

If the server response omits comment_access after we sent a flag, error (gandermd does not support --comments; upgrade the server) instead of printing a URL.

Files

share.go, api.go (CreateShare map; unexported patchShare optional), list.go, tests, completions/gander.bash, completions/_gander, man/man1/gander.1, README usage.

Tests

• Flags omitted → body has none of the three keys.
• --comments team sends "team" and no visibility / doc keys.
• --no-comments same body as --comments team.
• --private sends "private" and no access / comment-visibility keys.
• PUT watch has none of the fields.
• Invalid combos are usage errors before HTTP.

Pairing

Blocked on the gandermd dashboard/viewer PR being deployed (:latest). Open paired PRs and reference them. Smoke with make dev / make dev-cli.

[scott]

Depends on: gandermd#69 deployed to :latest (enforcement is #67; do not ship this CLI against an old server).

Supersedes #93.

[scott]

Smoke-test follow-up on the server stack: Commenting and Comment Visibility are each Anyone / Team / No one. --no-comments should send comment_access=none (not an alias for --comments team). --comment-visibility=anyone|team|none (wire value anyone, not public).

Server issue: https://github.com/gandermd/gandermd/issues/76
Plan: plans/2026-09-01-per-share-comment-access-control.md PR 7.

[scott]

Superseded by #98.

gandermd wave 1 + wave 2 are on main (PRs 79–86): Visibility = Anyone / Private / Hidden, Commenting = Anyone / Private / Disabled. This issue’s body still describes --comments team, --comment-visibility, and --no-comments ≡ --comments team. PR #97 stays closed.

Do not implement from feat/96-share-comment-access. #98 is the pairing issue; start that PR from main.