cli/api: add --jurisdiction and document the command#1631
Merged
Conversation
`entire api --to cell` only reached the caller's home entire-api cell.
Add `--jurisdiction <slug>` (e.g. us, eu) to target a specific
jurisdiction's cell instead, reusing the existing cell machinery: it
passes `auth.CellTarget{Jurisdiction: slug}` into NewEntireAPICellClient,
which mints the jurisdictional identity token and resolves that
jurisdiction's cell URL. No new exchange/URL/security logic.
`--jurisdiction` targets a cell, so it implies `--to cell`; combining it
with an explicit `--to core` is a contradiction and errors clearly. The
slug is normalized to a bare lowercase DNS label (US/" us " -> us).
Surface it to agents: the command was already visible in `entire help`
and `entire agent-help`, and agent-help renders live from the Cobra tree,
so the updated Long/Example/flag-usage explain `--jurisdiction`
automatically on drill-down. Also document `entire api` in CLAUDE.md,
which was missing it entirely.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Entire-Checkpoint: 2e2d0343f4a1
Contributor
There was a problem hiding this comment.
Pull request overview
Adds first-class support for calling a specific jurisdiction’s entire-api cell from entire api, and documents the command surface so it’s discoverable via help/agent-help and CLAUDE.md.
Changes:
- Add
--jurisdiction <slug>toentire api, with slug normalization and a--to core+--jurisdictioncontradiction error. - Thread the resolved jurisdiction into cell client construction via
auth.CellTarget{Jurisdiction: ...}. - Document
apiinCLAUDE.mdalongside the other top-level commands.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| cmd/entire/cli/api_cmd.go | Adds --jurisdiction, resolves --to/--jurisdiction interplay, and passes jurisdiction into cell client creation. |
| cmd/entire/cli/api_cmd_test.go | Updates client tests for new signature and adds coverage for target resolution behavior. |
| CLAUDE.md | Documents the api command and the new --jurisdiction behavior for users/agents. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 7e82009. Configure here.
`-j` is free on the command (used: -X, -f, -F, -H, -i). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Entire-Checkpoint: 6d4dbe371e4a
Two fixes from PR review: - Cursor Bugbot (correctness): when `--jurisdiction` was set, the CellTarget carried only Jurisdiction (no BaseURL). If the configured data origin was already a direct entire-api cell (a ".api." host) rather than an apex/BFF, auth kept that origin as the dial target while minting an identity token for the *pinned* jurisdiction — so `--jurisdiction eu` could mint an EU token but still dial the configured (e.g. US) cell. Fix in auth.resolveTargetCellBaseURL: an explicitly pinned jurisdiction on a non-loopback origin now resolves that jurisdiction's own cell from the cluster catalog (reusing resolveCellAPIBaseURL) instead of dialing the origin verbatim. Loopback dev hosts still stay verbatim (single cell, no catalog). Only the new Jurisdiction-pinned-without-BaseURL path is affected; nil-target (home) and BaseURL-set (repo-scoped experts) paths are unchanged. - Copilot (nit): TestResolveAPITarget now uses the apiTargetCore/ apiTargetCell constants instead of hard-coded "core"/"cell" literals. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Entire-Checkpoint: 51810afcea3c
nodo
approved these changes
Jul 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
--jurisdiction <slug>(short-j) toentire api(e.g.us,eu) to target a specific jurisdiction's entire-api cell instead of the caller's home cell.entire apiin CLAUDE.md, which was missing it entirely.Why
entire api --to cellonly ever reached the caller's home entire-api cell. There was no way to call a different jurisdiction's cell from the CLI, even though the underlying cell client (auth.NewEntireAPICellClient+auth.CellTarget) already supports pinning a jurisdiction. This is the sibling of PR #1619, which added--jurisdictiontoentire auth token.Details
--jurisdictionpassesauth.CellTarget{Jurisdiction: slug}intoNewEntireAPICellClient, which mints the jurisdictional identity token (RFC 8693,scope=openid,aud=<jurisdiction host>) and resolves that jurisdiction's cell URL from the cluster catalog — the same audited path used elsewhere.--jurisdictionimplies--to cell. Combining it with an explicit--to coreis a contradiction and errors clearly (--jurisdiction targets a cell; use --to cell (not --to core)). The slug is normalized to a bare lowercase DNS label (US/" us "→us);NewEntireAPICellClientvalidates it as a label.-jshorthand. Added alongside the existing-X/-f/-F/-H/-ishorthands (-jwas free).entire apiwas already visible inentire helpandentire agent-help, and agent-help renders live from the Cobra tree — so the updatedLong,Example, and flag usage explain--jurisdictionautomatically onentire agent-help apidrill-down. No annotation changes needed.Testing
TestResolveAPITargetcovers pass-through, implied-cell + slug normalization, explicit cell, and the--to corecontradiction.mise run fmt+mise run lintclean.go test ./cmd/entire/cli/ ./cmd/entire/cli/auth/passes.entire api --help/entire agent-help apishow the flag (-j, --jurisdiction) + examples, andentire api --to core --jurisdiction euemits the contradiction error.🤖 Generated with Claude Code