feat!: remove allowArbitraryFlags parse override

package.json

@@ -17,9 +17,7 @@
     "execa": "^9.6.1",
     "inquirer": "^12.11.1",
     "open": "^11.0.0",
-    "tsheredoc": "^1.0.1",
-    "yargs-parser": "^22.0.0",
-    "yargs-unparser": "^2.0.0"
+    "tsheredoc": "^1.0.1"
   },
   "devDependencies": {
     "@heroku-cli/schema": "^1.0.25",
@@ -33,8 +31,6 @@
     "@types/proxyquire": "^1.3.31",
     "@types/sinon": "^21.0.0",
     "@types/supports-color": "^5.3.0",
-    "@types/yargs-parser": "^21.0.3",
-    "@types/yargs-unparser": "^2.0.3",
     "c8": "^12.0.0",
     "chai": "^6.2.2",
     "chai-as-promised": "^8.0.1",

scripts/verify-packed-consumer.mjs

@@ -73,6 +73,9 @@ const intentionalAdditions = new Set([
   'lib/login-state-coordinator.js',
 ])
 const intentionalPackageAdditions = new Set(['@heroku/heroku-credential-manager'])
+// Dependencies intentionally dropped versus the authoritative baseline. yargs-parser
+// and yargs-unparser were only used by the removed allowArbitraryFlags parse override.
+const intentionalPackageRemovals = new Set(['yargs-parser', 'yargs-unparser'])
 const sensitivePathPattern = /(^|\/)(?:\.npmrc|npmrc|npm-cache|\.npm|cache|logs?|_logs?)(?:\/|$)|(?:^|\/)(?:[^/]*(?:token|userconfig)[^/]*)$|heroku-credential-manager[^/]*\.tgz$/i
 const safeEnvironmentNames = new Set([
   'ALL_PROXY',
@@ -560,7 +563,7 @@ async function verifyPackManifest(packMetadata, baseline) {
   const removedDependencies = Object.keys(baselineDependencies).filter(name => !(name in currentDependencies))
   const changedDependencies = Object.keys(currentDependencies).filter(name => name in baselineDependencies && currentDependencies[name] !== baselineDependencies[name])
   check(addedDependencies.every(name => intentionalPackageAdditions.has(name)), `unexpected dependencies added versus baseline: ${addedDependencies.join(', ')}`)
-  check(removedDependencies.length === 0, `dependencies removed versus baseline: ${removedDependencies.join(', ')}`)
+  check(removedDependencies.every(name => intentionalPackageRemovals.has(name)), `unexpected dependencies removed versus baseline: ${removedDependencies.filter(name => !intentionalPackageRemovals.has(name)).join(', ')}`)
   check(changedDependencies.every(name => intentionalDependencyChanges.has(name)), `unexpected dependency ranges changed versus baseline: ${changedDependencies.join(', ')}`)
   check(currentDependencies['@heroku/http-call'] === expectedDependencies.get('@heroku/http-call').version, '@heroku/http-call baseline range did not change to the required exact version')
   return {added, paths}

src/command.ts

@@ -1,5 +1,4 @@
 import {Command as Base} from '@oclif/core/command'
-import {type CLIError} from '@oclif/core/errors'
 import * as Flags from '@oclif/core/flags'
 
 import {APIClient, type IOptions} from './api-client.js'
@@ -9,7 +8,7 @@
    * Base flags that includes the prompt flag by default
    * Subclasses can override this to customize base flags
    */
   static baseFlags: Record<string, any> = {
     prompt: Flags.boolean({
       description: 'interactively prompt for command arguments and flags',
       helpGroup: 'GLOBAL',
@@ -21,7 +20,6 @@
    */
   static promptFlagActive = true
   _heroku!: APIClient
-  allowArbitraryFlags = false
 
   /**
    * Helper function to get baseFlags without the prompt flag
@@ -33,7 +31,7 @@
    *   static flags = { ... }
    * }
    */
   static baseFlagsWithoutPrompt(): Record<string, any> {
     // Destructure to remove the prompt flag
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     const {prompt, ...rest} = this.baseFlags
@@ -87,55 +85,4 @@
     const Ctor = this.constructor as typeof Command
     return Ctor.promptFlagActive && ('prompt' in Ctor.baseFlags)
   }
-
-  protected async parse(options?: any, argv?: string[]): Promise<any> {
-    if (this.allowArbitraryFlags) {
-      try {
-        return await super.parse(options, argv)
-      } catch (error) {
-        const parser = (await import('yargs-parser')).default
-        const unparser = (await import('yargs-unparser')).default
-        const {flags: nonExistentFlags} = error as CLIError & {flags: string[]}
-        const parsed = parser(this.argv)
-        const nonExistentFlagsWithValues = {...parsed}
-
-        if (nonExistentFlags && nonExistentFlags.length > 0) {
-          this.warn(`You're using a deprecated syntax with the [${nonExistentFlags.join(',')}] flag.\nAdd a '--' (end of options) separator before the flags you're passing through.`)
-          for (const flag of nonExistentFlags) {
-            const key = flag.replace('--', '')
-            Reflect.deleteProperty(parsed, key)
-          }
-        }
-
-        for (const key in parsed) {
-          if (Reflect.has(parsed, key)) {
-            Reflect.deleteProperty(nonExistentFlagsWithValues, key)
-          }
-        }
-
-        this.argv = unparser(parsed as any)
-        const result = await super.parse(options, argv)
-        result.nonExistentFlags = unparser(nonExistentFlagsWithValues as any)
-
-        for (let index = 0; index < result.nonExistentFlags.length; index++) {
-          const positionalValue = result.nonExistentFlags[index]
-          const positionalValueIsFlag = positionalValue.startsWith('--')
-          if (positionalValueIsFlag) {
-            const nextElement = result.nonExistentFlags[index + 1] ?? ''
-            const nextElementIsFlag = nextElement.startsWith('--')
-            // eslint-disable-next-line max-depth
-            if (nextElement && !nextElementIsFlag) {
-              result.argv.push(`${positionalValue}=${nextElement}`)
-            } else if (!nextElement || nextElementIsFlag) {
-              result.argv.push(`${positionalValue}=true`)
-            }
-          }
-        }
-
-        return result
-      }
-    }
-
-    return super.parse(options, argv)
-  }
 }