feat(risk): make the risk taxonomy typed and fail closed on a bad one

cmd/api/api.go

@@ -118,7 +118,7 @@ Examples:
 	cmdutil.RegisterFlagCompletion(cmd, "format", func(_ *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
 		return []string{"json", "ndjson", "table", "csv"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	cmdutil.SetRisk(cmd, "write")
+	cmdutil.SetRisk(cmd, cmdutil.RiskWrite)
 
 	return cmd
 }

cmd/auth/check.go

@@ -48,7 +48,7 @@ func newCmdAuthCheck(
 	cmd.Flags().StringVar(&opts.Scope, "scope", "", "scopes to check (space-separated)")
 	cmd.Flags().BoolVar(&opts.JSON, "json", false, "structured JSON output")
 	cmd.MarkFlagRequired("scope")
-	cmdutil.SetRisk(cmd, "read")
+	cmdutil.SetRisk(cmd, cmdutil.RiskRead)
 
 	return cmd
 }

cmd/auth/list.go

@@ -46,7 +46,7 @@ func newCmdAuthList(
 		},
 	}
 	cmd.Flags().BoolVar(&opts.JSON, "json", false, "structured JSON output")
-	cmdutil.SetRisk(cmd, "read")
+	cmdutil.SetRisk(cmd, cmdutil.RiskRead)
 
 	return cmd
 }

cmd/auth/login.go

@@ -69,7 +69,7 @@ to generate QR codes (supports ASCII and PNG formats).`,
 		},
 	}
 	cmdutil.SetSupportedIdentities(cmd, []string{"user"})
-	cmdutil.SetRisk(cmd, "write")
+	cmdutil.SetRisk(cmd, cmdutil.RiskWrite)
 
 	cmd.Flags().StringVar(&opts.Scope, "scope", "", "scopes to request (space- or comma-separated). Combines additively with --domain/--recommend")
 	cmd.Flags().BoolVar(&opts.Recommend, "recommend", false, "request only recommended (auto-approve) scopes")

cmd/auth/logout.go

@@ -36,7 +36,7 @@ func NewCmdAuthLogout(f *cmdutil.Factory, runF func(*LogoutOptions) error) *cobr
 		},
 	}
 	cmd.Flags().BoolVar(&opts.JSON, "json", false, "structured JSON output")
-	cmdutil.SetRisk(cmd, "write")
+	cmdutil.SetRisk(cmd, cmdutil.RiskWrite)
 
 	return cmd
 }

cmd/auth/scopes.go

@@ -43,7 +43,7 @@ func NewCmdAuthScopes(f *cmdutil.Factory, runF func(*ScopesOptions) error) *cobr
 
 	cmd.Flags().StringVar(&opts.Format, "format", "json", "output format: json (default) | pretty")
 	cmd.Flags().BoolVar(&opts.JSON, "json", false, "structured JSON output")
-	cmdutil.SetRisk(cmd, "read")
+	cmdutil.SetRisk(cmd, cmdutil.RiskRead)
 
 	return cmd
 }

cmd/auth/status.go

@@ -46,7 +46,7 @@ func newCmdAuthStatus(
 
 	cmd.Flags().BoolVar(&opts.Verify, "verify", false, "verify token against server (requires network)")
 	cmd.Flags().BoolVar(&opts.JSON, "json", false, "structured JSON output")
-	cmdutil.SetRisk(cmd, "read")
+	cmdutil.SetRisk(cmd, cmdutil.RiskRead)
 
 	return cmd
 }

cmd/completion/completion.go

@@ -38,6 +38,6 @@ func NewCmdCompletion(f *cmdutil.Factory) *cobra.Command {
 		},
 	}
 	cmdutil.DisableAuthCheck(cmd)
-	cmdutil.SetRisk(cmd, "read")
+	cmdutil.SetRisk(cmd, cmdutil.RiskRead)
 	return cmd
 }

cmd/config/bind.go

@@ -116,7 +116,7 @@ Interactive terminal use: run with no flags to enter the TUI form.`,
 	cmd.Flags().StringVar(&opts.Identity, "identity", "", "identity preset (bot-only|user-default); defaults to bot-only in flag mode (safer: no impersonation)")
 	cmd.Flags().BoolVar(&opts.Force, "force", false, "confirm a risky transition (currently: bot-only → user-default identity change in flag mode)")
 	cmd.Flags().StringVar(&opts.Lang, "lang", "", "language preference (e.g. zh or zh_cn)")
-	cmdutil.SetRisk(cmd, "write")
+	cmdutil.SetRisk(cmd, cmdutil.RiskWrite)
 
 	return cmd
 }

cmd/config/default_as.go

@@ -52,6 +52,6 @@ func NewCmdConfigDefaultAs(f *cmdutil.Factory) *cobra.Command {
 			return nil
 		},
 	}
-	cmdutil.SetRisk(cmd, "write")
+	cmdutil.SetRisk(cmd, cmdutil.RiskWrite)
 	return cmd
 }

cmd/config/init.go

@@ -110,7 +110,7 @@ func NewCmdConfigInit(f *cmdutil.Factory, runF func(*ConfigInitOptions) error) *
 	cmd.Flags().StringVar(&opts.Lang, "lang", "", "language preference (e.g. zh or zh_cn)")
 	cmd.Flags().StringVar(&opts.ProfileName, "name", "", "create or update a named profile (append instead of replace)")
 	cmd.Flags().BoolVar(&opts.ForceInit, "force-init", false, forceInitUsageWithBind)
-	cmdutil.SetRisk(cmd, "write")
+	cmdutil.SetRisk(cmd, cmdutil.RiskWrite)
 
 	return cmd
 }

cmd/config/keychain_downgrade.go

@@ -44,7 +44,7 @@ reports "already downgraded" and exits 0.`,
 			return configKeychainDowngradeRun(f)
 		},
 	}
-	cmdutil.SetRisk(cmd, "write")
+	cmdutil.SetRisk(cmd, cmdutil.RiskWrite)
 	return cmd
 }
 

cmd/config/plugins.go

@@ -56,7 +56,7 @@ the plugin name as the prefix at registration time, so an entry
 			return runConfigPluginsShow(f)
 		},
 	}
-	cmdutil.SetRisk(cmd, "read")
+	cmdutil.SetRisk(cmd, cmdutil.RiskRead)
 	return cmd
 }
 

cmd/config/policy.go

@@ -36,7 +36,7 @@ func newCmdConfigPolicyShow(f *cmdutil.Factory) *cobra.Command {
 			return runConfigPolicyShow(f)
 		},
 	}
-	cmdutil.SetRisk(cmd, "read")
+	cmdutil.SetRisk(cmd, cmdutil.RiskRead)
 	return cmd
 }
 

cmd/config/remove.go

@@ -33,7 +33,7 @@ func NewCmdConfigRemove(f *cmdutil.Factory, runF func(*ConfigRemoveOptions) erro
 			return configRemoveRun(opts)
 		},
 	}
-	cmdutil.SetRisk(cmd, "write")
+	cmdutil.SetRisk(cmd, cmdutil.RiskWrite)
 
 	return cmd
 }

cmd/config/show.go

@@ -35,7 +35,7 @@ func NewCmdConfigShow(f *cmdutil.Factory, runF func(*ConfigShowOptions) error) *
 			return configShowRun(opts)
 		},
 	}
-	cmdutil.SetRisk(cmd, "read")
+	cmdutil.SetRisk(cmd, cmdutil.RiskRead)
 
 	return cmd
 }

cmd/config/strict_mode.go

@@ -68,7 +68,7 @@ explicit user confirmation — never run on your own initiative.`,
 
 	cmd.Flags().BoolVar(&global, "global", false, "set at global level (applies to all profiles)")
 	cmd.Flags().BoolVar(&reset, "reset", false, "reset profile setting to inherit global")
-	cmdutil.SetRisk(cmd, "write")
+	cmdutil.SetRisk(cmd, cmdutil.RiskWrite)
 
 	return cmd
 }

cmd/doctor/doctor.go

@@ -58,7 +58,7 @@ func newCmdDoctor(f *cmdutil.Factory, projector *recovery.Projector) *cobra.Comm
 	}
 	cmdutil.DisableAuthCheck(cmd)
 	cmd.Flags().BoolVar(&opts.Offline, "offline", false, "skip network checks (only verify local state)")
-	cmdutil.SetRisk(cmd, "read")
+	cmdutil.SetRisk(cmd, cmdutil.RiskRead)
 
 	return cmd
 }

cmd/event/bus.go

@@ -81,7 +81,7 @@ func NewCmdBus(f *cmdutil.Factory, snap *catalog.Snapshot) *cobra.Command {
 
 	cmd.Flags().StringVar(&domain, "domain", "", "API domain")
 	_ = cmd.Flags().MarkHidden("domain")
-	cmdutil.SetRisk(cmd, "write")
+	cmdutil.SetRisk(cmd, cmdutil.RiskWrite)
 
 	return cmd
 }

cmd/event/consume.go

@@ -76,7 +76,7 @@ Use 'event schema <EventKey>' for parameter details.`,
 	_ = cmd.RegisterFlagCompletionFunc("as", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"user", "bot", "auto"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	cmdutil.SetRisk(cmd, "read")
+	cmdutil.SetRisk(cmd, cmdutil.RiskRead)
 
 	return cmd
 }

cmd/event/list.go

@@ -33,7 +33,7 @@ func NewCmdList(f *cmdutil.Factory, snap *catalog.Snapshot) *cobra.Command {
 		"Only list EventKeys of this domain. Valid domains: %s",
 		strings.Join(snap.Domains(), ", "),
 	))
-	cmdutil.SetRisk(cmd, "read")
+	cmdutil.SetRisk(cmd, cmdutil.RiskRead)
 	return cmd
 }
 

cmd/event/schema.go

@@ -29,7 +29,7 @@
 		},
 	}
 	cmd.Flags().BoolVar(&asJSON, "json", false, "Emit the EventKey definition + resolved schema as JSON (for AI / scripts)")
-	cmdutil.SetRisk(cmd, "read")
+	cmdutil.SetRisk(cmd, cmdutil.RiskRead)
 	return cmd
 }
 

cmd/event/status.go

@@ -38,7 +38,7 @@ func NewCmdStatus(f *cmdutil.Factory) *cobra.Command {
 	cmd.Flags().BoolVar(&asJSON, "json", false, "Emit status as JSON (for AI / scripts)")
 	cmd.Flags().BoolVar(&current, "current", false, "Only show status for the current profile's app")
 	cmd.Flags().BoolVar(&failOnOrphan, "fail-on-orphan", false, "Exit 2 when any orphan bus is detected (default: always exit 0)")
-	cmdutil.SetRisk(cmd, "read")
+	cmdutil.SetRisk(cmd, cmdutil.RiskRead)
 	return cmd
 }
 

cmd/event/stop.go

@@ -70,7 +70,7 @@ Exit code: 2 if any target was refused or errored, 0 otherwise.
 	cmd.Flags().BoolVar(&o.all, "all", false, "Stop all running bus daemons")
 	cmd.Flags().BoolVar(&o.force, "force", false, "Stop even with active consumers; on shutdown-timeout also SIGKILL the bus")
 	cmd.Flags().BoolVar(&o.asJSON, "json", false, "Emit results as JSON (for AI / scripts)")
-	cmdutil.SetRisk(cmd, "write")
+	cmdutil.SetRisk(cmd, cmdutil.RiskWrite)
 
 	return cmd
 }

cmd/platform_bootstrap_test.go

@@ -74,7 +74,7 @@ func fakeTree(t *testing.T) *cobra.Command {
 	return root
 }
 
-func addLeaf(parent *cobra.Command, use, risk string) {
+func addLeaf(parent *cobra.Command, use string, risk cmdutil.Risk) {
 	leaf := &cobra.Command{
 		Use:  use,
 		RunE: func(*cobra.Command, []string) error { return nil },

cmd/plugin_integration_test.go

@@ -93,7 +93,7 @@ func syntheticTree() (*cobra.Command, *cobra.Command) {
 		Use:  "+write",
 		RunE: func(*cobra.Command, []string) error { return nil },
 	}
-	cmdutil.SetRisk(leaf, "write")
+	cmdutil.SetRisk(leaf, cmdutil.RiskWrite)
 	group.AddCommand(leaf)
 	return root, leaf
 }

cmd/profile/add.go

@@ -47,7 +47,7 @@
 
 	_ = cmd.MarkFlagRequired("name")
 	_ = cmd.MarkFlagRequired("app-id")
-	cmdutil.SetRisk(cmd, "write")
+	cmdutil.SetRisk(cmd, cmdutil.RiskWrite)
 
 	return cmd
 }

cmd/profile/list.go

@@ -42,7 +42,7 @@
 			return profileListRun(f)
 		},
 	}
-	cmdutil.SetRisk(cmd, "read")
+	cmdutil.SetRisk(cmd, cmdutil.RiskRead)
 	return cmd
 }
 

cmd/profile/remove.go

@@ -30,7 +30,7 @@
 	cmdutil.SetTips(cmd, []string{
 		"AI agents: Do NOT remove profiles unless the user explicitly asks. This is destructive and clears all associated credentials.",
 	})
-	cmdutil.SetRisk(cmd, "write")
+	cmdutil.SetRisk(cmd, cmdutil.RiskWrite)
 	return cmd
 }
 

cmd/profile/rename.go

@@ -25,7 +25,7 @@
 			return profileRenameRun(f, args[0], args[1])
 		},
 	}
-	cmdutil.SetRisk(cmd, "write")
+	cmdutil.SetRisk(cmd, cmdutil.RiskWrite)
 	return cmd
 }
 

cmd/profile/use.go

@@ -29,7 +29,7 @@
 	cmdutil.SetTips(cmd, []string{
 		"AI agents: Do NOT switch profiles unless the user explicitly asks.",
 	})
-	cmdutil.SetRisk(cmd, "write")
+	cmdutil.SetRisk(cmd, cmdutil.RiskWrite)
 	return cmd
 }
 

cmd/prune_test.go

@@ -355,7 +355,7 @@ func TestStrictModeStub_PreservesOriginalMetadata(t *testing.T) {
 		RunE:  func(*cobra.Command, []string) error { return nil },
 	}
 	cmdutil.SetSupportedIdentities(userOnly, []string{"user"})
-	cmdutil.SetRisk(userOnly, "read")
+	cmdutil.SetRisk(userOnly, cmdutil.RiskRead)
 	svc.AddCommand(userOnly)
 
 	pruneForStrictMode(root, core.StrictModeBot)

cmd/root_risk_help_test.go

@@ -32,7 +32,7 @@ func TestHelpFunc_RendersRiskLineWhenAnnotated(t *testing.T) {
 	installTipsHelpFunc(root, nilSkills, nil, nil)
 
 	child := &cobra.Command{Use: "delete", Short: "delete a file"}
-	cmdutil.SetRisk(child, "high-risk-write")
+	cmdutil.SetRisk(child, cmdutil.RiskHighRiskWrite)
 	root.AddCommand(child)
 
 	out := rendersHelp(t, child)
@@ -59,7 +59,7 @@ func TestHelpFunc_RiskLinePrecedesTips(t *testing.T) {
 	installTipsHelpFunc(root, nilSkills, nil, nil)
 
 	child := &cobra.Command{Use: "delete", Short: "delete a file"}
-	cmdutil.SetRisk(child, "high-risk-write")
+	cmdutil.SetRisk(child, cmdutil.RiskHighRiskWrite)
 	cmdutil.SetTips(child, []string{"use --yes to confirm"})
 	root.AddCommand(child)
 

cmd/service/affordance_test.go

@@ -197,7 +197,7 @@ func TestPrepareShortcutHelp(t *testing.T) {
 	sc := &cobra.Command{Use: "+create", Short: "Create an event"}
 	cmdmeta.SetSource(sc, cmdmeta.SourceShortcut, false)
 	cmdmeta.SetAffordanceRef(sc, "calendar", "+create")
-	cmdutil.SetRisk(sc, "write")
+	cmdutil.SetRisk(sc, cmdutil.RiskWrite)
 	cmdutil.SetTips(sc, []string{"start/end 收 ISO 8601"})
 
 	if !PrepareShortcutHelp(sc, nil) {

cmd/service/service.go

@@ -190,7 +190,7 @@
 	method      meta.Method
 	schemaPath  string       // "service.resource.method", for the --help hint
 	servicePath string       // service HTTP base path
-	risk        string       // RiskRead | RiskWrite | RiskHighRiskWrite
+	risk        cmdutil.Risk // RiskRead | RiskWrite | RiskHighRiskWrite; see newMethodCommandSpec for the string boundary
 	restricts   bool         // method declares accessTokens (identity-restricted)
 	identities  []string     // permitted --as values; empty when unrestricted
 	params      []meta.Field // path/query params -> typed flags
@@ -206,6 +206,22 @@
 	serviceName  string // owning service name (e.g. "approval"), for the lazy affordance lookup
 }
 
+// methodRisk converts the generated catalog's risk string into the typed
+// taxonomy. The catalog is generated data, so this is a string boundary and
+// goes through core.ParseRisk rather than a bare conversion.
+//
+// A value outside the taxonomy is kept as-is instead of being normalised
+// away: the command then carries an invalid declaration, which the runtime
+// gate (cmdutil.EnforceRiskDeclaration) refuses. Substituting a default here
+// would silently repair a catalog bug at the worst possible place — the one
+// that decides whether a destructive call needs confirmation.
+func methodRisk(m meta.Method) cmdutil.Risk {
+	if risk, err := core.ParseRisk(m.Risk); err == nil {
+		return risk
+	}
+	return cmdutil.Risk(m.Risk)
+}
+
 // methodPaginates reports whether a method takes a page_token param, the signal
 // that makes the --page-all/--page-limit/--page-delay flags meaningful.
 func methodPaginates(m meta.Method) bool {
@@ -224,7 +240,7 @@
 		schemaPath:   ref.SchemaPath(),
 		servicePath:  ref.Service.ServicePath,
 		serviceName:  ref.Service.Name,
-		risk:         m.Risk,
+		risk:         methodRisk(m),
 		restricts:    m.RestrictsIdentity(),
 		identities:   m.Identities(),
 		params:       m.Params(),
@@ -304,7 +320,7 @@
 	cmd.Flags().Bool("json", false, "shorthand for --format json")
 	cmd.Flags().StringVarP(&opts.JqExpr, "jq", "q", "", "jq expression to filter JSON output")
 	cmd.Flags().BoolVar(&opts.DryRun, "dry-run", false, "print request without executing")
-	if spec.risk == cmdutil.RiskHighRiskWrite {
+	if cmdutil.RequiresConfirmation(spec.risk) {
 		cmd.Flags().Bool("yes", false, "confirm high-risk operation")
 	}
 	// --file only for body methods that actually declare file-type fields.
@@ -409,7 +425,11 @@
 		return serviceDryRun(f, request, config, opts)
 	}
 
-	if opts.Method.Risk == cmdutil.RiskHighRiskWrite {
+	risk := methodRisk(opts.Method)
+	if err := cmdutil.EnforceRiskDeclaration(opts.SchemaPath, risk); err != nil {
+		return err
+	}
+	if cmdutil.RequiresConfirmation(risk) {
 		if yes, _ := opts.Cmd.Flags().GetBool("yes"); !yes {
 			return cmdutil.RequireConfirmation(opts.SchemaPath)
 		}

cmd/skill/skill.go

@@ -94,7 +94,7 @@ func newListCmd(f *cmdutil.Factory) *cobra.Command {
 	}
 	// --json is a no-op (list is always JSON), accepted only to stay symmetric with read.
 	cmd.Flags().Bool("json", false, "no-op (list output is always JSON)")
-	cmdutil.SetRisk(cmd, "read")
+	cmdutil.SetRisk(cmd, cmdutil.RiskRead)
 	cmdutil.DisableAuthCheck(cmd)
 	return cmd
 }
@@ -151,7 +151,7 @@ func newReadCmd(f *cmdutil.Factory) *cobra.Command {
 		},
 	}
 	cmd.Flags().BoolVar(&asJSON, "json", false, "output as a JSON envelope instead of raw markdown")
-	cmdutil.SetRisk(cmd, "read")
+	cmdutil.SetRisk(cmd, cmdutil.RiskRead)
 	cmdutil.DisableAuthCheck(cmd)
 	return cmd
 }