feat: --confirm flag to prompt before executing every shell line

[seanseannery]

Problem This Solves

Issue #21 proposes a ? per-line prefix to mark individual shell lines as requiring confirmation. However, there are situations where an operator wants to step through every command in a block interactively — for example, when running an unfamiliar Opsfile for the first time, auditing what a command actually does in a given environment, or exercising extra caution during a sensitive production incident.

A global --confirm / -c flag provides this safety net without requiring every line in the Opsfile to be prefixed with ?.

Proposal

Add a -c / --confirm CLI flag that forces interactive confirmation before executing every shell line, regardless of whether the line carries a ? prefix.

Usage:

ops --confirm prod rollback
ops -c prod restart-pods

Runtime behaviour:

When --confirm is active, ops treats every shell line as if it had a ? prefix:

1. Prints the fully resolved command (variables substituted) to stdout
2. Prompts: Execute? [y/N]:
3. y or Y → executes the line normally
4. Anything else (including empty Enter) → prints Skipped. and moves to the next line
5. Execution continues through all remaining lines (each prompted individually)

Interaction with other flags and prefixes:

• ?-prefixed lines (Issue feat: confirm-before-execute prefix syntax for destructive Opsfile commands #21): --confirm is additive — lines already marked ? behave identically; unmarkded lines gain the same behaviour
• --dry-run: takes precedence — no prompts shown, resolved commands printed with a [confirm] annotation
• --silent: does not suppress confirmation prompts (same as ? prefix behaviour)
• - (ignore-error prefix) and @ (suppress-echo prefix): unaffected by --confirm

Example session:

$ ops --confirm prod deploy
aws s3 sync ./dist s3://my-bucket/
Execute? [y/N]: y
... (aws output) ...
aws cloudfront create-invalidation --distribution-id ABCDEF
Execute? [y/N]:
Skipped.

Acceptance Criteria

Flag parsing:

• -c and --confirm are accepted as equivalent flags
• --confirm is reflected in OpsFlags as Confirm bool
• Unknown or conflicting flag combinations produce a clear error (none expected, but document interaction with --dry-run)

Executor:

• When --confirm is set and stdin is a TTY: every shell line is printed and prompted with Execute? [y/N]: before execution
• y or Y executes the line; any other input skips it and prints Skipped.
• When stdin is not a TTY (piped/scripted): --confirm is ignored and all lines execute without prompting (non-interactive mode must not hang)
• --dry-run takes precedence over --confirm: no prompts shown; resolved lines printed with [confirm] annotation
• Lines with a ? prefix (Issue feat: confirm-before-execute prefix syntax for destructive Opsfile commands #21) and --confirm active behave identically to lines without ? and --confirm active — no double-prompting
• Exit code behaviour is unchanged: a confirmed line that exits non-zero still stops execution (unless - prefix is also set)

Tests:

• Flag parser test: -c and --confirm both set OpsFlags.Confirm
• Executor test: --confirm prompts for every line; y executes, non-y skips
• Executor test: non-TTY stdin with --confirm executes all lines without prompting
• Executor test: --dry-run --confirm prints annotation, no prompt
• Executor test: ?-prefixed line with --confirm does not double-prompt