fix(cli): compact incident audit outputs

Author: ysyneu

internal/cli/alert_event.go

@@ -21,15 +21,19 @@ func newAlertEventCmd() *cobra.Command {
 }
 
 func newAlertEventListCmd() *cobra.Command {
-	var severity, channel, integrationType, since, until string
+	var severity, channel, integrationType, since, until, fields string
 	var limit, page int
 
 	cmd := &cobra.Command{
 		Use:   "list",
 		Short: "List alert events globally",
-		Long:  curatedLong("List alert events across all alerts within a time window, optionally filtered by severity, channel, or integration type.", "Alerts", "EventReadList"),
+		Long:  curatedLong("List alert events across all alerts within a time window, optionally filtered by severity, channel, or integration type. In json/toon mode, output defaults to compact event fields; use --fields to choose a different projection.", "Alerts", "EventReadList"),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			return runCommand(cmd, args, func(ctx *RunContext) error {
+				if ctx.Structured() && cmd.Flags().Changed("fields") && len(parseStringSlice(fields)) == 0 {
+					return fmt.Errorf("--fields must name at least one field")
+				}
+
 				startTime, err := timeutil.Parse(since)
 				if err != nil {
 					return fmt.Errorf("invalid --since: %w", err)
@@ -77,6 +81,18 @@ func newAlertEventListCmd() *cobra.Command {
 					{Header: "TITLE", MaxWidth: 50, Field: func(v any) string { return v.(flashduty.AlertEventItem).Title }},
 				}
 
+				if ctx.Structured() {
+					fieldNames := []string{"event_id", "alert_id", "event_severity", "event_status", "event_time", "title"}
+					if fields != "" {
+						fieldNames = parseStringSlice(fields)
+					}
+					proj, err := projectFields(result.Items, fieldNames)
+					if err != nil {
+						return err
+					}
+					return ctx.PrintList(proj, nil, len(result.Items), page, int(result.Total))
+				}
+
 				return ctx.PrintList(result.Items, cols, len(result.Items), page, int(result.Total))
 			})
 		},
@@ -90,6 +106,7 @@ func newAlertEventListCmd() *cobra.Command {
 	cmd.Flags().StringVar(&until, "until", "now", "End time")
 	cmd.Flags().IntVar(&limit, "limit", 20, "Max results")
 	cmd.Flags().IntVar(&page, "page", 1, "Page number")
+	cmd.Flags().StringVar(&fields, "fields", "", "Comma-separated fields to project in json/toon output (e.g. event_id,alert_id,event_severity,event_status,event_time,title); ignored in table mode. Defaults to these compact event fields.")
 
 	return cmd
 }

internal/cli/fieldproject_test.go

@@ -1,9 +1,12 @@
 package cli
 
 import (
+	"bytes"
 	"encoding/json"
 	"strings"
 	"testing"
+
+	"github.com/spf13/cobra"
 )
 
 // incidentRow / alertRow are multi-field stub payloads with the nested blobs
@@ -235,3 +238,155 @@ func TestFieldsUnknownFieldErrors(t *testing.T) {
 		})
 	}
 }
+
+func TestIncidentSimilarStructuredProjection(t *testing.T) {
+	saveAndResetGlobals(t)
+	stub := newGFStub(t)
+	items := make([]any, 20)
+	for i := range items {
+		row := incidentRow()
+		row["incident_id"] = "similar-" + string(rune('a'+i))
+		row["close_time"] = 1712000060
+		row["ack_time"] = 1712000030
+		row["alert_cnt"] = 3
+		row["root_cause"] = "disk exhaustion"
+		row["score"] = 0.9
+		row["description"] = strings.Repeat("large description ", 100)
+		row["images"] = []map[string]any{{"src": strings.Repeat("https://example.test/image/", 100)}}
+		items[i] = row
+	}
+	stub.data = map[string]any{"items": items, "total": len(items)}
+
+	out, err := execCommand("incident", "similar", "inc-1", "--limit", "20", "--output-format", "json")
+	if err != nil {
+		t.Fatalf("execCommand: %v", err)
+	}
+	if len(out) >= 16*1024 {
+		t.Fatalf("compact similar output is %d bytes, want <16 KiB", len(out))
+	}
+
+	var rows []map[string]json.RawMessage
+	if err := json.Unmarshal([]byte(strings.TrimSpace(out)), &rows); err != nil {
+		t.Fatalf("parse compact similar json: %v\n%s", err, out)
+	}
+	want := []string{"incident_id", "title", "incident_severity", "progress", "start_time", "close_time", "ack_time", "alert_cnt", "root_cause", "score"}
+	if len(rows) != len(items) {
+		t.Fatalf("got %d rows, want %d", len(rows), len(items))
+	}
+	for _, row := range rows {
+		if len(row) != len(want) {
+			t.Fatalf("got keys %v, want exactly %v", row, want)
+		}
+		for _, field := range want {
+			if _, ok := row[field]; !ok {
+				t.Errorf("projected row missing %q", field)
+			}
+		}
+		if _, ok := row["description"]; ok {
+			t.Errorf("projected row includes description: %v", row)
+		}
+	}
+
+}
+
+func TestIncidentDetailFieldsProjection(t *testing.T) {
+	saveAndResetGlobals(t)
+	stub := newGFStub(t)
+	row := incidentRow()
+	row["description"] = strings.Repeat("large description ", 500)
+	row["images"] = []map[string]any{{"src": strings.Repeat("https://example.test/image/", 100)}}
+	stub.data = row
+
+	out, err := execCommand("incident", "detail", "inc-1", "--fields", "incident_id,title,root_cause", "--output-format", "json")
+	if err != nil {
+		t.Fatalf("execCommand: %v", err)
+	}
+	if len(out) >= 8*1024 {
+		t.Fatalf("projected detail output is %d bytes, want <8 KiB", len(out))
+	}
+	var detail map[string]json.RawMessage
+	if err := json.Unmarshal([]byte(strings.TrimSpace(out)), &detail); err != nil {
+		t.Fatalf("parse projected detail json: %v\n%s", err, out)
+	}
+	if len(detail) != 3 || detail["incident_id"] == nil || detail["title"] == nil || detail["root_cause"] == nil {
+		t.Fatalf("projected detail = %v, want exactly incident_id,title,root_cause", detail)
+	}
+	if _, ok := detail["description"]; ok {
+		t.Errorf("projected detail includes description: %v", detail)
+	}
+
+}
+
+func TestAlertEventListStructuredProjection(t *testing.T) {
+	saveAndResetGlobals(t)
+	stub := newGFStub(t)
+	items := make([]any, 30)
+	for i := range items {
+		items[i] = map[string]any{
+			"event_id":       "event-" + string(rune('a'+i)),
+			"alert_id":       "alert-1",
+			"event_severity": "Warning",
+			"event_status":   "Triggered",
+			"event_time":     1712000000,
+			"title":          "CPU high",
+			"description":    strings.Repeat("large description ", 100),
+			"labels":         map[string]any{"host": "web-01"},
+			"images":         []map[string]any{{"src": strings.Repeat("https://example.test/image/", 100)}},
+		}
+	}
+	stub.data = map[string]any{"items": items, "total": len(items)}
+
+	out, err := execCommand("alert-event", "list", "--limit", "30", "--output-format", "json")
+	if err != nil {
+		t.Fatalf("execCommand: %v", err)
+	}
+	if len(out) >= 16*1024 {
+		t.Fatalf("compact alert-event output is %d bytes, want <16 KiB", len(out))
+	}
+	var rows []map[string]json.RawMessage
+	if err := json.Unmarshal([]byte(strings.TrimSpace(out)), &rows); err != nil {
+		t.Fatalf("parse compact alert-event json: %v\n%s", err, out)
+	}
+	want := []string{"event_id", "alert_id", "event_severity", "event_status", "event_time", "title"}
+	if len(rows) != len(items) {
+		t.Fatalf("got %d rows, want %d", len(rows), len(items))
+	}
+	for _, row := range rows {
+		if len(row) != len(want) {
+			t.Fatalf("got keys %v, want exactly %v", row, want)
+		}
+		for _, field := range want {
+			if _, ok := row[field]; !ok {
+				t.Errorf("projected row missing %q", field)
+			}
+		}
+	}
+
+}
+
+func TestStructuredFieldsEmptyErrors(t *testing.T) {
+	cases := []struct {
+		name string
+		cmd  func() *cobra.Command
+		args []string
+	}{
+		{"incident similar", newIncidentSimilarCmd, []string{"inc-1", "--fields", ""}},
+		{"incident detail", newIncidentDetailCmd, []string{"inc-1", "--fields", ""}},
+		{"alert-event list", newAlertEventListCmd, []string{"--fields", ""}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			saveAndResetGlobals(t)
+			newGFStub(t)
+			flagOutputFormat = "json"
+			cmd := tc.cmd()
+			cmd.SetOut(new(bytes.Buffer))
+			cmd.SetErr(cmd.OutOrStderr())
+			cmd.SetArgs(tc.args)
+			err := cmd.Execute()
+			if err == nil || !strings.Contains(err.Error(), "--fields") {
+				t.Fatalf("empty --fields error = %v, want --fields validation", err)
+			}
+		})
+	}
+}

internal/cli/incident.go

@@ -564,6 +564,7 @@ func newIncidentAlertsCmd() *cobra.Command {
 }
 
 func newIncidentSimilarCmd() *cobra.Command {
+	var fields string
 	var limit int
 
 	cmd := &cobra.Command{
@@ -573,6 +574,10 @@ func newIncidentSimilarCmd() *cobra.Command {
 		Args:  requireArgs("incident_id"),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			return runCommand(cmd, args, func(ctx *RunContext) error {
+				if ctx.Structured() && cmd.Flags().Changed("fields") && len(parseStringSlice(fields)) == 0 {
+					return errors.New("--fields must name at least one field")
+				}
+
 				result, _, err := ctx.Client.Incidents.PastList(cmdContext(ctx.Cmd), &flashduty.ListPastIncidentsRequest{
 					IncidentID: ctx.Args[0],
 					Limit:      flashduty.Int64(int64(limit)),
@@ -586,12 +591,25 @@ func newIncidentSimilarCmd() *cobra.Command {
 					return nil
 				}
 
+				if ctx.Structured() {
+					fieldNames := []string{"incident_id", "title", "incident_severity", "progress", "start_time", "close_time", "ack_time", "alert_cnt", "root_cause", "score"}
+					if fields != "" {
+						fieldNames = parseStringSlice(fields)
+					}
+					proj, err := projectFields(result.Items, fieldNames)
+					if err != nil {
+						return err
+					}
+					return ctx.Printer.Print(proj, nil)
+				}
+
 				return ctx.Printer.Print(result.Items, pastIncidentColumns())
 			})
 		},
 	}
 
 	cmd.Flags().IntVar(&limit, "limit", 5, "Max results")
+	cmd.Flags().StringVar(&fields, "fields", "", "Comma-separated fields to project in json/toon output (e.g. incident_id,title,incident_severity,progress,start_time); ignored in table mode. Defaults to a compact incident summary.")
 	return cmd
 }
 
@@ -1301,13 +1319,19 @@ func resolveFeedOperators(rc *RunContext, items []flashduty.IncidentFeedItem) ma
 }
 
 func newIncidentDetailCmd() *cobra.Command {
-	return &cobra.Command{
+	var fields string
+
+	cmd := &cobra.Command{
 		Use:   "detail <id>",
 		Short: "View full incident detail with AI summary",
 		Long:  curatedLong("View full incident detail, including the AI summary, root cause, and resolution.", "Incidents", "Info"),
 		Args:  requireArgs("incident_id"),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			return runCommand(cmd, args, func(ctx *RunContext) error {
+				if ctx.Structured() && cmd.Flags().Changed("fields") && len(parseStringSlice(fields)) == 0 {
+					return errors.New("--fields must name at least one field")
+				}
+
 				fullID, candidates, err := resolveIncidentArg(ctx, ctx.Args[0])
 				if err != nil {
 					return err
@@ -1324,6 +1348,13 @@ func newIncidentDetailCmd() *cobra.Command {
 				}
 
 				if ctx.Structured() {
+					if fields != "" {
+						proj, err := projectFields([]flashduty.IncidentInfo{*result}, parseStringSlice(fields))
+						if err != nil {
+							return err
+						}
+						return ctx.Printer.Print(proj[0], nil)
+					}
 					return ctx.Printer.Print(result, nil)
 				}
 
@@ -1332,6 +1363,8 @@ func newIncidentDetailCmd() *cobra.Command {
 			})
 		},
 	}
+	cmd.Flags().StringVar(&fields, "fields", "", "Comma-separated fields to project in json/toon output (e.g. incident_id,title,incident_severity,progress,root_cause); ignored in table mode. Omit for full detail.")
+	return cmd
 }
 
 func printIncidentFullDetail(w io.Writer, inc *flashduty.IncidentInfo) {

internal/cli/incident_summary_script_test.go

@@ -0,0 +1,45 @@
+package cli
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func TestIncidentSummaryScriptCompactOutput(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("Bash fixture is unavailable on Windows")
+	}
+
+	root, err := filepath.Abs("../..")
+	if err != nil {
+		t.Fatalf("resolve repository root: %v", err)
+	}
+	script := filepath.Join(root, "skills", "flashduty", "scripts", "incident-summary.sh")
+	log := filepath.Join(t.TempDir(), "fduty.log")
+	bin := filepath.Join(t.TempDir(), "fduty")
+	if err := os.WriteFile(bin, []byte("#!/usr/bin/env bash\nprintf '%s\\n' \"$*\" >> \"$FDUTY_LOG\"\nprintf 'compact result\\n'\n"), 0o755); err != nil {
+		t.Fatalf("write fake fduty: %v", err)
+	}
+	t.Setenv("FDUTY_LOG", log)
+	t.Setenv("PATH", filepath.Dir(bin)+string(os.PathListSeparator)+os.Getenv("PATH"))
+
+	output, err := exec.Command("bash", script, "inc-1").CombinedOutput()
+	if err != nil {
+		t.Fatalf("run incident summary: %v\n%s", err, output)
+	}
+	invocations, err := os.ReadFile(log)
+	if err != nil {
+		t.Fatalf("read fake fduty log: %v", err)
+	}
+	lines := strings.FieldsFunc(strings.TrimSpace(string(invocations)), func(r rune) bool { return r == '\n' })
+	if len(lines) != 6 {
+		t.Fatalf("fduty calls = %d, want 6:\n%s", len(lines), invocations)
+	}
+	if strings.Contains(string(invocations), "--output-format toon") {
+		t.Fatalf("summary forces toon instead of each command's compact default:\n%s", invocations)
+	}
+}

internal/skilldoc/incident_projection_guidance_test.go

@@ -0,0 +1,39 @@
+package skilldoc
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestIncidentCardAvoidsUnboundedStructuredHotFlows(t *testing.T) {
+	card, err := os.ReadFile(filepath.Join("..", "..", "skills", "flashduty", "reference", "incident.md"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	body := string(card)
+	for description, command := range map[string]string{
+		"triage list":    "incident list --severity Critical --progress Triggered --since 4h --fields incident_id,title,incident_severity,progress,start_time,channel_id --output-format toon",
+		"triage detail":  "incident detail <incident-id> --fields incident_id,title,incident_severity,progress,ai_summary,root_cause,resolution,alert_cnt,start_time --output-format toon",
+		"summary detail": `incident detail   "$ID" --fields incident_id,title,incident_severity,progress,ai_summary,root_cause,resolution,alert_cnt,start_time --output-format toon`,
+	} {
+		if !strings.Contains(body, command) {
+			t.Errorf("incident %s must project structured output to the fields needed by the workflow", description)
+		}
+	}
+
+	for _, command := range []string{
+		"incident alerts <incident-id> --output-format toon",
+		`incident alerts   "$ID" --output-format toon`,
+		`incident timeline "$ID" --output-format toon`,
+		"incident post-mortem-list --channel-ids <channel-id> --output-format toon",
+		"change list --since 24h --output-format toon",
+		"incident timeline <primary-incident-id> --output-format toon",
+	} {
+		if strings.Contains(body, command) {
+			t.Errorf("incident hot flow must use the compact default instead of %q", command)
+		}
+	}
+}