Merge Protections

Your pull request matches the following merge protections and will not be merged until they are valid.

🟢 require-ready-label-and-ci

Greptile Summary

This PR promotes API-wide string scope parameters (e.g. workspaceId, TenantFilter) to env-backed global scope, allowing generated CLIs to satisfy required scope flags via canonical env vars while preserving explicit flag precedence. It also injects the same env defaults into sync's syncUserParams so that sync commands respect the same env-var convention.

• classifyGlobalParams (parser.go): The counting pass now uses isPathSubstitutionParam instead of isGlobalFilterCandidate, so originally-required string params with scope-like names can reach the 50% threshold and be promoted; the filtering pass promotes them first, then falls through to isGlobalFilterCandidate only for the drop path.
• command_endpoint.go.tmpl: Scope param flags are registered with globalScopeParamDefault(envName, fallback) as their default, and the required-flag guard adds && flagValue == \"\" so the env var silently satisfies the check without an explicit CLI flag.
• helpers.go.tmpl / sync.go.tmpl: setGlobalDefault writes into flatGlobal (not trueGlobal), preserving the flat/dependent split — env-backed scope defaults apply to flat-list requests but are intentionally not injected into dependent path-scoped requests, preventing the Asana-style "duplicate scope param" rejection. The inline TestSyncGlobalScopeEnvDefaultsUseFlatGlobal test embedded in the integration test explicitly verifies this boundary.

Confidence Score: 5/5

Safe to merge. The flatGlobal/trueGlobal boundary is preserved correctly and is now explicitly tested by an embedded helper test.

The key concern from the prior review thread — that env-backed scope defaults might land in trueGlobal and silently break dependent-request calls on Asana-style APIs — is demonstrably addressed: setGlobalDefault writes into flatGlobal, and the new TestSyncGlobalScopeEnvDefaultsUseFlatGlobal helper test verifies that dependent requests do not receive the scope param from env defaults. The parser change widening the counting phase to include required params is intentional and covered by the updated tests. No credential-path reads are introduced.

No files require special attention.

Important Files Changed

sequenceDiagram
    participant Env as OS Env
    participant Cmd as Generated CLI cmd
    participant Sync as sync RunE
    participant SP as syncUserParams
    participant API as HTTP API

    Note over Cmd: cobra flag registration (startup)
    Env-->>Cmd: os.Getenv(SCOPE_VAR)
    Cmd->>Cmd: globalScopeParamDefault sets flag default

    Note over Cmd: RunE (list command)
    Cmd->>Cmd: check !Changed and flagValue empty
    Cmd->>API: "GET /users?ScopeParam=tenant-a (flat)"

    Note over Sync: RunE (sync command)
    Sync->>SP: parseSyncUserParams
    Sync->>SP: applySyncGlobalScopeEnvDefaults
    SP->>Env: globalScopeParamDefault(SCOPE_VAR)
    Env-->>SP: tenant-a
    SP->>SP: setGlobalDefault into flatGlobal

    Sync->>API: "GET /resource?ScopeParam=tenant-a (isDependent=false)"
    Note over Sync,API: flatGlobal applies

    Sync->>API: "GET /parent/{id}/children (isDependent=true)"
    Note over Sync,API: flatGlobal skipped - no duplicate scope param
    Note over Sync,API: trueGlobal via --global-param still applies

_{Reviews (2): Last reviewed commit: "fix(cli): scope env sync defaults to fla..." | Re-trigger Greptile}

Merge Queue Status

• ✅ Entered queue — 2026-06-07 23:18 UTC · Rule: default
• ✅ Checks passed · on draft merge queue: embarking main (e4bc665), #2826, #2819 and #2827 together #2852
• ✅ Merged — 2026-06-07 23:40 UTC · at 40e0c72a33a7d1c2bcb8945012427205ef2e8755 · squash

This pull request spent 22 minutes 12 seconds in the queue, including 21 minutes 54 seconds running CI.