6. Writes: dry-run and confirm

Back to the spec index

• A write command never acts without -confirm. -confirm is always a bare parameter, never given a value. Without it, the command exits 4 and prints this on stdout. {"result": {"status": "confirmation_required", "command": ..., "changes": [...], "confirmCommand": ...}}
• -dry-run returns the same structured changes list.
• No interactive prompts in any mode, with or without -no-input, on a TTY or not.
• The confirm step is defence in depth, not authorization.