fix: disable generic root requests

[chaim0m]

Summary

• disable restish's generic HTTP request handler on the dci root command
• reject positional operands that reach the root instead of a registered DCI command
• remove generic hostname completion from the root command
• retain local help behavior when the root is invoked without a child command

This is the focused follow-up to the root-cause gap Alfredo identified in his review of #36. It addresses note 2 only and is independently based on main; it does not contain or depend on the dci version point fix.

Root cause

Restish installs a generic root Run handler that treats args[0] as a hostname. DCI removes the visible generic commands, but previously left that root handler and its positional-argument contract intact. An argument that bypassed command normalization—such as dci ""—could therefore initiate a generic request, with the active customerContext already attached.

The root command now accepts no operands and can only render local help. Generated DCI API subcommands and local commands continue to execute through their own handlers.

Test methods

go test ./...
go vet ./...
go build -o /tmp/dci-root-lock .
DCI_NO_UPDATE_CHECK=1 /tmp/dci-root-lock ""

The smoke test exits locally with unknown command ""; it emits no URL, DNS lookup, or network error. A regression test verifies that the generic request handler and hostname completion are removed and that an empty root operand is rejected.

Could this break things?

Risk: low-medium, intentionally restrictive. Anyone relying on the DCI binary as restish's undocumented generic HTTP client will no longer be able to make arbitrary-host requests through the root command. That behavior conflicts with DCI's locked command surface. Registered DCI API commands, local commands, help, and completion remain supported.

Jira

CMP-48648

[Copilot]

Pull request overview

This PR tightens the dci CLI’s “locked-down” command surface by removing restish’s generic root request behavior, ensuring that the root command can’t be used as an ad-hoc HTTP client and instead only renders local help.

Changes:

• Disable generic root execution by forcing cli.Root to accept no positional operands and to render help via a safe handler.
• Remove any root-level “hostname” completion hook by clearing cli.Root.ValidArgsFunction.
• Add a regression test to ensure the generic root request handler and hostname completion are not left installed.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
main.go	Hardens the root command (cli.Root) by disabling generic request execution and positional operands, and clearing root arg completion.
main_test.go	Adds a regression test asserting the generic root handler and hostname completion are removed and that root operands are rejected.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[josuesilva-doit]

LGTM