SP-1173: add CUI marking for files the CLI writes to disk by dwoditsch · Pull Request #405 · celonis/content-cli

Dennis Woditsch (dwoditsch) · 2026-08-07T13:30:09Z

Description

Every user-facing file content-cli writes to disk has to carry the team's CUI (Controlled Unclassified Information) marking. This PR adds the mechanism and wires up list spaces --json and list packages --json. The remaining writers follow in later PRs.

What a user gets depends on the team's CUI settings:

Team setting	Artifact
marking does not apply	original filename, unchanged
marking applies, no categories	`Unclassified - <name>`
marking applies, with categories	`CUI - <name>.zip`, holding the payload plus `CUI_Cover_Sheet.pdf`
marking cannot be resolved	nothing written, the command fails

This ships inert in production: the cover endpoint is allowlisted for staging only, so production keeps taking the unmarked path until the matching rule lands. Commands that only print to the console never probe the endpoint.

Scope: how the write is triggered

Trigger	Commands	CUI marking
`--json` listings and reports	`list spaces`, `list packages`	This PR, together with the marking mechanism
`--json` listings and reports	`list assets/assignments/data-pools`, `config `, `t2tc package list/diff`, `deployment `, `asset-registry *`	To follow in #407
`-o, --outputToJsonFile` reports	`analyze/import action-flows`, `export data-pool`, `import data-pools`, `t2tc package import` report	To follow in #410
artifact is already an archive	`config package export --zip`, `config branch export --zip`, `t2tc package export`, `export action-flows`, `pull package`	To follow in #411
single non-archive export	`pull asset/skill/data-pool/view-bookmarks/bookmarks`, `export bookmarks`	To follow in #412
output is a directory	`config package export`, `config branch export`, `t2tc package export --unzip`	To follow in #413: cover sheet into the directory, prefix the directory name
`--gitBranch` variants	`config package export`, `config branch export`, `t2tc package export`	Out of scope, nothing reaches local disk
no output flag	console-only listings, profile/git-profile/log files	Out of scope

Two things were left to settle here and both are answered further up the stack: an artifact that is already a zip gets the cover sheet merged in rather than nested (#411), and directory output keeps the cover sheet inside the directory with the directory name prefixed.

Relevant links

Jira: SP-1173
Backend endpoint: celonis/cloud-team#5659 (VEX-3192)
Gateway allowlist (staging): celonis/policy-guard#127

Checklist

I have self-reviewed this PR
I have tested the change and proved that it works in different scenarios
I have updated docs if needed

Note

Medium Risk
Changes what files users receive on export when CUI is enabled and fails closed on cover API errors; production stays on the unmarked path until the endpoint is allowlisted (403).

Overview
Adds CUI (Controlled Unclassified Information) marking for disk writes from Studio list commands. Before writing, the CLI calls GET /api/team/cui-settings/cui-pdf-cover and adjusts the output based on the response: no change when marking does not apply (403 feature flag or 204 team disabled), Unclassified - <name> when marking applies but there are no categories, or a CUI - <name>.zip containing the JSON plus CUI_Cover_Sheet.pdf when classified.

list spaces --json and list packages --json now route exports through CuiFileService instead of writing directly. Console-only listings skip the CUI probe.

Supporting changes: HttpClient.getStatusAndData returns status and body without treating 4xx as fatal (needed for 403/204 semantics), BaseManager.findAll awaits async onFindAll, and HTTP test mocks default the cover endpoint to 204 so existing tests stay unmarked unless they opt in.

^{Reviewed by Cursor Bugbot for commit 66a75f8. Bugbot is set up for automated code reviews on this repo. Configure here.}

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 45d2e1f. Configure here.}

Route the JSON output of `list spaces` and `list packages` through a new CuiFileService, which asks the team's CUI settings how the content is classified and names the output accordingly: a `CUI - <name>.zip` holding the listing plus the decoded cover sheet when categories apply, an `Unclassified - <name>` rename when none do, and the original filename when no marking applies at all. CuiService owns the API contract and derives enablement from the response status, so the CLI translates the backend's answer rather than deciding entitlement itself. HttpClient.getStatusAndData exposes the status code because get() throws on 4xx and would otherwise hide the 204/403 signal. BaseManager.findAll now awaits onFindAll so an async listing callback completes before the command resolves. Includes-AI-Code: true Co-authored-by: Cursor <cursoragent@cursor.com>

Once findAll moved to async/await, return Promise.reject() was equivalent to throwing undefined: Sonar flags it, and the command handler logged "undefined" instead of the real cause. Rethrow the original error. Includes-AI-Code: true Co-authored-by: Cursor <cursoragent@cursor.com>

Drop the 403 branch from CuiService. Any status other than 200 or 204 now raises a FatalError, so no file is written when the marking cannot be resolved. Also flatten the nested template literal in the error path, which Sonar flags. Includes-AI-Code: true Co-authored-by: Cursor <cursoragent@cursor.com>

403 means the feature flag is disabled, 204 means the team has CUI disabled. Both keep the original filename, as separate branches so the debug log says which one applied. Any other non-200 status still fails closed. Includes-AI-Code: true Co-authored-by: Cursor <cursoragent@cursor.com>

CuiPdfCoverResponse is the only type consumed outside the module, so the three helper interfaces are inlined into it. Categories are counted, never read, so their element type carries no weight. Includes-AI-Code: true Co-authored-by: Cursor <cursoragent@cursor.com>

sonarqubecloud · 2026-08-10T12:15:41Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
96.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Kastriot Salihu (ksalihu)

Approach looks sound and the staged rollout across #407-#413 makes sense to me. None of my comments block merge - fine to pick them up in the follow-up PRs.

The one I would put for consideration is only the 200-with-an-unrecognised-body case in cui-api.ts. It is the only path where the feature silently produces an unverified Unclassified marking instead of failing closed, and it gets more surface area with every command that starts routing through CuiFileService. Also fine to address in followup PRs if this adds conflicts or smth

Dennis Woditsch (dwoditsch) changed the title ~~SP-1173: mark CUI content when writing Studio listings to disk~~ SP-1173: add CUI marking for files the CLI writes to disk Aug 7, 2026

Dennis Woditsch (dwoditsch) marked this pull request as ready for review August 10, 2026 07:49

Dennis Woditsch (dwoditsch) requested review from a team as code owners August 10, 2026 07:50

cursor Bot reviewed Aug 10, 2026

View reviewed changes

Comment thread src/core/utils/cui-service.ts Outdated

Dennis Woditsch (dwoditsch) mentioned this pull request Aug 10, 2026

SP-1173: extend CUI marking to every --json command #407

Open

3 tasks

Nikolai Fischer (nikolai-celonis) previously approved these changes Aug 10, 2026

View reviewed changes

Comment thread src/core/utils/cui-file-service.ts

Dennis Woditsch (dwoditsch) dismissed Nikolai Fischer (nikolai-celonis)’s stale review via ddaf42d August 10, 2026 09:25

Dennis Woditsch (dwoditsch) force-pushed the feat/SP-1173-cui-marking-data branch from ddaf42d to f730ba9 Compare August 10, 2026 09:28

Nikolai Fischer (nikolai-celonis) approved these changes Aug 10, 2026

View reviewed changes

This was referenced Aug 10, 2026

SP-1173: extend CUI marking to --outputToJsonFile commands #410

Open

SP-1173: extend CUI marking to exported archives #411

Open

Dennis Woditsch (dwoditsch) and others added 7 commits August 10, 2026 14:14

SP-1173: sonar

5745783

SP-1173: comment and bugbot

66a75f8

Dennis Woditsch (dwoditsch) force-pushed the feat/SP-1173-cui-marking-data branch from f730ba9 to 66a75f8 Compare August 10, 2026 12:14

This was referenced Aug 10, 2026

SP-1173: extend CUI marking to single-file exports #412

Open

SP-1173: extend CUI marking to directory exports #413

Open

Alexander Probst (alex-probst) approved these changes Aug 11, 2026

View reviewed changes

Kastriot Salihu (ksalihu) reviewed Aug 12, 2026

View reviewed changes

Comment thread src/core/utils/cui-api.ts

Comment thread src/core/utils/cui-api.ts

Comment thread src/core/utils/cui-api.ts

Comment thread tests/core/utils/cui-file-service.spec.ts

Comment thread src/core/utils/cui-file-service.ts

Kastriot Salihu (ksalihu) approved these changes Aug 12, 2026

View reviewed changes

Zgjim Haziri (ZgjimHaziri) approved these changes Aug 12, 2026

View reviewed changes

Dennis Woditsch (dwoditsch) mentioned this pull request Aug 13, 2026

SP-1173: say what to do when CUI marking cannot be resolved #416

Open

3 tasks

Navigation Menu

Uh oh!

SP-1173: add CUI marking for files the CLI writes to disk - #405

SP-1173: add CUI marking for files the CLI writes to disk#405
Dennis Woditsch (dwoditsch) wants to merge 7 commits into
mainfrom
feat/SP-1173-cui-marking-data

Dennis Woditsch (dwoditsch) commented Aug 7, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud Bot commented Aug 10, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Kastriot Salihu (ksalihu) left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

Dennis Woditsch (dwoditsch) commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Scope: how the write is triggered

Relevant links

Checklist

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud Bot commented Aug 10, 2026

Quality Gate passed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Kastriot Salihu (ksalihu) left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Dennis Woditsch (dwoditsch) commented Aug 7, 2026 •

edited

Loading