{"record":{"id":"7f46f018ad0c12a6","repo":"paperclipai/paperclip","slug":"deletion-requires-yes-7f46f0","errorCode":null,"errorMessage":"Deletion requires --yes.","messagePattern":"Deletion requires --yes\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"cli/src/commands/client/secrets.ts","lineNumber":543,"sourceCode":"        try {\n          const ctx = resolveCommandContext(opts);\n          printOutput(await ctx.api.get(apiPath`/api/secrets/${secretId}/access-events`), { json: ctx.json });\n        } catch (err) {\n          handleCommandError(err);\n        }\n      }),\n  );\n\n  addCommonClientOptions(\n    secrets\n      .command(\"delete\")\n      .description(\"Delete a secret\")\n      .argument(\"<secretId>\", \"Secret ID\")\n      .option(\"--yes\", \"Required safety flag to confirm destructive action\", false)\n      .option(\"--confirm <secretId>\", \"Repeat the secret ID to confirm deletion\")\n      .action(async (secretId: string, opts: SecretDeleteOptions) => {\n        try {\n          if (!opts.yes) throw new Error(\"Deletion requires --yes.\");\n          if (opts.confirm !== secretId) {\n            throw new Error(\"Deletion requires --confirm <secretId> matching the secret ID.\");\n          }\n          const ctx = resolveCommandContext(opts);\n          printOutput(await ctx.api.delete(apiPath`/api/secrets/${secretId}`), { json: ctx.json });\n        } catch (err) {\n          handleCommandError(err);\n        }\n      }),\n  );\n\n  addCommonClientOptions(\n    secrets\n      .command(\"doctor\")\n      .description(\"Run secret provider health checks through the Paperclip API\")\n      .requiredOption(\"-C, --company-id <id>\", \"Company ID\")\n      .action(async (opts: SecretDoctorOptions) => {\n        try {","sourceCodeStart":525,"sourceCodeEnd":561,"githubUrl":"https://github.com/paperclipai/paperclip/blob/67001ec6eb96ae601aa27bc91d9b2415d665334a/cli/src/commands/client/secrets.ts#L525-L561","documentation":"The `secrets delete` command requires the `--yes` safety flag (default false) before it will call the delete API. The guard is identical in shape to the project delete guard: the flag is optional so Commander does not enforce it, and the action throws on a missing flag. This is the first of two confirmations for secret deletion.","triggerScenarios":"Running `paperclipai secrets delete <secretId>` without `--yes`.","commonSituations":"Automation/aliases that drop the flag; expecting an interactive prompt (none exists); copy-paste from a docs example that omitted the flag.","solutions":["Add `--yes` to the command: `paperclipai secrets delete <secretId> --yes`","Also pass `--confirm <secretId>` (see error 97), which is the second required confirmation","In scripts, set both flags explicitly rather than relying on a prompt"],"exampleFix":"# before\npaperclipai secrets delete sec_01H...\n# after\npaperclipai secrets delete sec_01H... --yes --confirm sec_01H...","handlingStrategy":"validation","validationCode":"function assertSecretDeleteConfirmed(opts: { yes?: boolean; confirm?: string }, secretId: string): void {\n  if (!opts.yes) throw new Error(\"Deletion requires --yes.\");\n  if (opts.confirm !== secretId) throw new Error(\"Deletion requires --confirm <secretId> matching the secret ID.\");\n}\nassertSecretDeleteConfirmed(opts, secretId);","typeGuard":"function isSecretDeleteReady(opts: unknown, secretId: string): opts is { yes: true; confirm: string } {\n  return typeof opts === \"object\" && opts !== null && (opts as any).yes === true && (opts as any).confirm === secretId;\n}","tryCatchPattern":null,"preventionTips":["Always pass both --yes and --confirm <id> in delete scripts","Use a single variable for the id, the argument, and --confirm","Never expect an interactive confirmation prompt"],"tags":["cli","secrets","destructive","validation","commander"],"backgroundTag":null,"analyzedSha":"67001ec6eb96ae601aa27bc91d9b2415d665334a","analyzedAt":"2026-08-12T12:05:45.408Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}