[mbevc1]

Follows the web app changes in kosli-dev/server#8051 and kosli-dev/server#8039. The API is unchanged; this aligns the behaviour and help text of kosli list product-updates with the app.

• Unread only by default. The command now lists only unread updates. --all lists the read ones too.
• 10 at most. The app shows at most 10 updates, so the CLI lists the first 10. --limit N changes that and --limit 0 means no limit.
• --dismiss. Marks the unread updates listed as seen, in one step. Listing does not do that by default: the command also runs in scripts and pipes, where it would use up a user's unread updates unseen.

--all and --limit apply to the table and to --output json. The table footer says when more updates exist than are shown.

The help text also said a first listing marks every update as seen. Since kosli-dev/server#8039 the server does that only for users who signed up less than 7 days before, so that sentence is corrected.

kosli dismiss product-updates --all is unchanged and still dismisses every unread update.

This changes the default output of a beta command merged in #1374.

Checklist

• Docs are autogenerated from CLI help — make sure the help text reflects your changes
• Helm chart (charts/k8s-reporter/) updated, if needed. Note: these changes live in a separate PR (not needed)
• Terraform provider and related changes (terraform-provider-kosli, terraform-aws-evidence-reporter, terraform-aws-kosli-reporter) updated, if needed (not needed)

[claude]

Claude finished @mbevc1's task in 1m 26s —— View job

---

Follow-up review summary

• Fetch previous review comments
• Diff BEFORE..AFTER and map findings to status
• Check for new bugs/regressions in changed lines only
• Verify resolved threads
• Post summary comment

Both previous findings are resolved (both review threads are confirmed marked resolved on GitHub):

1. JSON re-marshal drops unknown top-level fields / escapes HTML characters — resolved. selectProductUpdates (cmd/kosli/listProductUpdates.go:169-214) now decodes the top level into map[string]json.RawMessage, replaces only product_updates, and encodes via the new marshalKeepingHTMLCharacters helper (cmd/kosli/listProductUpdates.go:218-226), which uses encoder.SetEscapeHTML(false). TestJSONKeepsUnknownFieldsAndHTMLCharacters (listProductUpdates_test.go:157) pins down both an unknown field (feed_url) and &/</> in a summary.
2. No explicit guard against negative --limit — resolved. validate() rejects o.limit < 0 with "--limit must be 0 or more" (cmd/kosli/listProductUpdates.go:110-115), wired into PreRunE independent of root's generic flag guard. TestListProductUpdatesRefusesANegativeLimitItself (listProductUpdates_test.go:319) pins this down directly; TestItRefusesANegativeLimit is kept with a comment explaining the two rules are independent.

Also reviewed the markProductUpdatesSeen extraction in cmd/kosli/dismissProductUpdates.go:106-140 (shared between list --dismiss and dismiss product-updates) — it's a faithful, behavior-preserving extraction of the existing chunked-POST logic, nothing new introduced there.

No new bugs or regressions found in the changed lines — 0 new inline comments.

(Note: I don't have the ability to run go build/go vet/make test_integration in this environment — review is based on static reading of the diff and existing tests.)

[claude]

Follow-up review summary

Both previous findings are resolved in the latest commit (both review threads were already marked resolved):

1. JSON re-marshal drops unknown top-level fields / escapes HTML characters — resolved. selectProductUpdates now decodes the top level into map[string]json.RawMessage, only replaces product_updates, and encodes with encoder.SetEscapeHTML(false) via the new marshalKeepingHTMLCharacters helper (cmd/kosli/listProductUpdates.go:169-226). A dedicated test, TestJSONKeepsUnknownFieldsAndHTMLCharacters, pins down both an unknown top-level field (feed_url) and an &/</> in a summary.
2. No explicit guard against negative --limit — resolved. validate() now rejects o.limit < 0 with a clear message (cmd/kosli/listProductUpdates.go:110-115), wired into PreRunE, independent of the root flag guard. TestListProductUpdatesRefusesANegativeLimitItself pins this down directly, and the existing TestItRefusesANegativeLimit (via root's guard) is kept with a comment explaining why both exist.

No new bugs or regressions found in the changed lines — 0 new inline comments.

View job run