feat(cli): Add confirmation prompt for DELETE API operations by tknickman · Pull Request #14769 · vercel/vercel

tknickman · 2026-01-28T16:19:49Z

Summary

Adds user confirmation prompts for DELETE API operations in the CLI
Adds --dangerously-skip-permissions flag to the api command to bypass confirmation prompts
When running under an AI agent (detected via @vercel/detect-agent), displays a warning to stderr when DELETE confirmation is bypassed
In non-TTY mode, DELETE operations fail with an error unless --dangerously-skip-permissions is used

Changes

New Flag for `vercel api` Command

--dangerously-skip-permissions - Skips confirmation prompts for DELETE operations (use with caution)

Behavior

DELETE operations now require interactive confirmation before proceeding
Agent mode warning: When an AI agent bypasses DELETE confirmation using --dangerously-skip-permissions, a prominent warning is displayed to stderr
Non-TTY mode: DELETE operations fail with a helpful error message unless --dangerously-skip-permissions is specified

Example Usage

# Will prompt for confirmation
vercel api /v13/deployments/dpl_abc123 -X DELETE

# Skips confirmation (shows warning when run by AI agent)
vercel api /v13/deployments/dpl_abc123 -X DELETE --dangerously-skip-permissions

Files Changed

packages/cli/src/util/client.ts - Added confirmMutatingOperation() method and agent/permission flags
packages/cli/src/index.ts - Pass agent detection to Client
packages/cli/src/commands/api/command.ts - Added --dangerously-skip-permissions option
packages/cli/src/commands/api/index.ts - Parse flag and set client property
packages/cli/src/util/telemetry/commands/api/index.ts - Added telemetry tracking for new flag
packages/cli/test/unit/util/client-confirmation.test.ts - Added 15 unit tests
packages/cli/test/mocks/client.ts - Added reset for new flags

Test plan

Build passes
Type checking passes
15 unit tests covering all scenarios pass
Manual testing of DELETE confirmation prompt
Manual testing with --dangerously-skip-permissions flag

🤖 Generated with Claude Code

changeset-bot · 2026-01-28T16:19:54Z

🦋 Changeset detected

Latest commit: 84b3049

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
vercel	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

github-actions · 2026-01-28T16:20:43Z

📦 CLI Tarball Ready

The Vercel CLI tarball for this PR is now available!

Quick Test

You can test this PR's CLI directly by running:

npx https://vercel-ivvza83gq.vercel.sh/tarballs/vercel.tgz --help

Use in vercel.json

To use this CLI version in your project builds, add to your vercel.json:

{
  "build": {
    "env": {
      "VERCEL_CLI_VERSION": "vercel@https://vercel-ivvza83gq.vercel.sh/tarballs/vercel.tgz"
    }
  }
}

github-actions · 2026-01-28T16:21:02Z

🧪 Unit Test Strategy

Comparing: 9e388af → 84b3049 (view diff)

Strategy: Affected packages only

✅ Only testing packages that have been modified or depend on modified packages.

Affected packages - 1 (2%)

vercel

Unaffected packages - 40 (98%)

@vercel-internals/get-package-json
@vercel/backends
@vercel/build-utils
@vercel/cervel
@vercel/cli-auth
@vercel/client
@vercel/config
@vercel/detect-agent
@vercel/edge
@vercel/elysia
@vercel/error-utils
@vercel/express
@vercel/fastify
@vercel/firewall
@vercel/frameworks
@vercel/fs-detectors
@vercel/functions
@vercel/gatsby-plugin-vercel-builder
@vercel/go
@vercel/h3
@vercel/hono
@vercel/hydrogen
@vercel/introspection
@vercel/koa
@vercel/nestjs
@vercel/next
@vercel/node
@vercel/oidc
@vercel/oidc-aws-credentials-provider
@vercel/python
@vercel/python-analysis
@vercel/redwood
@vercel/related-projects
@vercel/remix-builder
@vercel/routing-utils
@vercel/ruby
@vercel/rust
@vercel/static-build
@vercel/static-config
examples

Results

Unit tests: Only affected packages will run unit tests
E2E tests: Handled separately (Version Packages PRs or run-e2e-tests label)
Type checks: Only affected packages will run type checks

This comment is automatically generated based on the affected testing strategy

Move the --dangerously-skip-permissions flag from global options to be specific to the api command only. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Set dangerouslySkipPermissions=true by default in MockClient to prevent DELETE confirmation prompts from hanging tests. Tests that specifically test confirmation behavior now explicitly set it to false. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## vercel@50.9.0 ### Minor Changes - Add confirmation prompt for DELETE API operations and agent mode warning ([#14769](#14769)) - DELETE operations now require user confirmation before proceeding - When running under an AI agent with `--dangerously-skip-permissions`, a warning is displayed to stderr - In non-TTY mode, DELETE operations fail unless `--dangerously-skip-permissions` is used ### Patch Changes - Add auto-provision flow for integration resources (behind feature flag) ([#14734](#14734)) - Revert "[cli] Use promote flow when targeting production alias" ([#14771](#14771)) - Improved curl generation with auth header placeholder ([#14752](#14752)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## Problem PR vercel#14769 introduced a DELETE confirmation prompt for AI agent safety, but incorrectly placed the `confirmMutatingOperation()` call inside `client.fetch()`. This caused ALL commands using DELETE API calls (e.g., `vercel env rm`, `vercel remove`) to fail in non-TTY environments (CI/CD pipelines) because: 1. `confirmMutatingOperation()` was called on every `client.fetch()` with DELETE method 2. In non-TTY mode, it requires `--dangerously-skip-permissions` flag to proceed 3. But this flag was only added to the `vercel api` command 4. Other commands like `env rm` have their own `--yes` flag for confirmation, which became ineffective ## Solution Move the DELETE confirmation logic to only apply to `vercel api` command: 1. Remove `confirmMutatingOperation()` call from `client.fetch()` 2. Change `confirmMutatingOperation()` from private to public method 3. Call `confirmMutatingOperation()` directly in `vercel api`'s `executeSingleRequest()` 4. Update tests to call `confirmMutatingOperation()` directly instead of through `fetch()` ## Changes - `packages/cli/src/util/client.ts`: - Remove confirmation call from `fetch()` method (6 lines removed) - Change `confirmMutatingOperation` visibility from `private` to `public` - `packages/cli/src/commands/api/index.ts`: - Add `confirmMutatingOperation()` call at the start of `executeSingleRequest()` - Place it inside try-catch block for proper error handling - `packages/cli/test/unit/util/client-confirmation.test.ts`: - Update all tests to call `client.confirmMutatingOperation()` directly - Remove mock endpoint setup (no longer needed) - Update assertions from response objects to boolean values ## Testing - All 15 unit tests pass - `vercel env rm` now works with `--yes` flag in CI/CD environments - `vercel api -X DELETE` still prompts for confirmation as intended Fixes commands failing in CI with error: "DELETE operations require confirmation. Use --dangerously-skip-permissions to skip confirmation in non-interactive mode."

Huinno-ParkJinHyun · 2026-01-29T11:42:53Z

Found that this change breaks vercel env rm in CI environments. Opened a fix in #14784

Xiphe · 2026-01-29T15:36:43Z

Hey vercel team. On our end we swich out some aliases from within our CLI

# This had worked in CI before
bun x vercel --token ${{ secrets.VERCEL_TOKEN }} alias rm $OLD_ALIAS --yes

And this now breaks everywhere without an obvious migration path

tknickman · 2026-01-29T15:37:20Z

@Xiphe / @Huinno-ParkJinHyun fixing - thanks for the report!

…ly (#14787) ## Summary Fixes a regression from #14769 where the DELETE confirmation prompt was incorrectly applied to **all** DELETE operations instead of only the `vercel api` command. This was breaking CI/CD pipelines that use commands like: - `vercel env rm <name> --yes` - `vercel alias rm <alias> --yes` - `vercel remove <deployment> --yes` These commands have their own `--yes` flags for confirmation and should not be affected by the new `--dangerously-skip-permissions` flag which was designed specifically for the `vercel api` command. ## Changes - **`packages/cli/src/util/client.ts`**: Made `confirmMutatingOperation()` public and removed the call from `fetch()` method - **`packages/cli/src/commands/api/index.ts`**: Added `confirmMutatingOperation()` calls in `executeSingleRequest()` and `executePaginatedRequest()` - scoping confirmation to only the `vercel api` command - **`packages/cli/test/mocks/client.ts`**: Removed workaround that set `dangerouslySkipPermissions = true` by default - **`packages/cli/test/unit/util/client-confirmation.test.ts`**: Updated tests to call `confirmMutatingOperation()` directly ## Test plan - [x] All 15 unit tests pass - [x] TypeScript compiles without errors - [x] `vercel env rm --yes` works in non-TTY mode (no longer blocked) - [x] `vercel api -X DELETE` still prompts for confirmation as intended ## Related - Fixes regression introduced in #14769 - Supersedes #14784 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## vercel@50.9.2 ### Patch Changes - fix(cli): Scope DELETE confirmation prompt to `vercel api` command only ([#14787](#14787)) This fixes a regression from #14769 where the DELETE confirmation prompt was incorrectly applied to all DELETE operations (e.g., `vercel env rm`, `vercel alias rm`) instead of only the `vercel api` command. Commands like `env rm` and `alias rm` have their own `--yes` flags for confirmation and should not be affected. - experimental rust runtime framework preset ([#14765](#14765)) - Add redirects command to top level help message. ([#14772](#14772)) - Updated dependencies \[]: - @vercel/static-build@2.8.28 ## @vercel/frameworks@3.16.1 ### Patch Changes - Generic node framework preset ([#14779](#14779)) - experimental rust runtime framework preset ([#14765](#14765)) ## @vercel/fs-detectors@5.7.19 ### Patch Changes - experimental rust runtime framework preset ([#14765](#14765)) - Updated dependencies \[[`9d1e38e9ff6f0431dce8e421497e1ec4fc823291`](9d1e38e), [`e800617a334377e11953df22ef40d03716daf692`](e800617)]: - @vercel/frameworks@3.16.1 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

tknickman · 2026-01-29T17:04:53Z

@Xiphe / @Huinno-ParkJinHyun should be fixed in vercel@50.9.2

## Summary - Adds user confirmation prompts for DELETE API operations in the CLI - Adds `--dangerously-skip-permissions` flag to the `api` command to bypass confirmation prompts - When running under an AI agent (detected via `@vercel/detect-agent`), displays a warning to stderr when DELETE confirmation is bypassed - In non-TTY mode, DELETE operations fail with an error unless `--dangerously-skip-permissions` is used ## Changes ### New Flag for `vercel api` Command - `--dangerously-skip-permissions` - Skips confirmation prompts for DELETE operations (use with caution) ### Behavior 1. **DELETE operations** now require interactive confirmation before proceeding 2. **Agent mode warning**: When an AI agent bypasses DELETE confirmation using `--dangerously-skip-permissions`, a prominent warning is displayed to stderr 3. **Non-TTY mode**: DELETE operations fail with a helpful error message unless `--dangerously-skip-permissions` is specified ### Example Usage ```bash # Will prompt for confirmation vercel api /v13/deployments/dpl_abc123 -X DELETE # Skips confirmation (shows warning when run by AI agent) vercel api /v13/deployments/dpl_abc123 -X DELETE --dangerously-skip-permissions ``` ### Files Changed - `packages/cli/src/util/client.ts` - Added `confirmMutatingOperation()` method and agent/permission flags - `packages/cli/src/index.ts` - Pass agent detection to Client - `packages/cli/src/commands/api/command.ts` - Added `--dangerously-skip-permissions` option - `packages/cli/src/commands/api/index.ts` - Parse flag and set client property - `packages/cli/src/util/telemetry/commands/api/index.ts` - Added telemetry tracking for new flag - `packages/cli/test/unit/util/client-confirmation.test.ts` - Added 15 unit tests - `packages/cli/test/mocks/client.ts` - Added reset for new flags ## Test plan - [x] Build passes - [x] Type checking passes - [x] 15 unit tests covering all scenarios pass - [ ] Manual testing of DELETE confirmation prompt - [ ] Manual testing with `--dangerously-skip-permissions` flag 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## vercel@50.9.0 ### Minor Changes - Add confirmation prompt for DELETE API operations and agent mode warning ([#14769](#14769)) - DELETE operations now require user confirmation before proceeding - When running under an AI agent with `--dangerously-skip-permissions`, a warning is displayed to stderr - In non-TTY mode, DELETE operations fail unless `--dangerously-skip-permissions` is used ### Patch Changes - Add auto-provision flow for integration resources (behind feature flag) ([#14734](#14734)) - Revert "[cli] Use promote flow when targeting production alias" ([#14771](#14771)) - Improved curl generation with auth header placeholder ([#14752](#14752)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…ly (#14787) ## Summary Fixes a regression from #14769 where the DELETE confirmation prompt was incorrectly applied to **all** DELETE operations instead of only the `vercel api` command. This was breaking CI/CD pipelines that use commands like: - `vercel env rm <name> --yes` - `vercel alias rm <alias> --yes` - `vercel remove <deployment> --yes` These commands have their own `--yes` flags for confirmation and should not be affected by the new `--dangerously-skip-permissions` flag which was designed specifically for the `vercel api` command. ## Changes - **`packages/cli/src/util/client.ts`**: Made `confirmMutatingOperation()` public and removed the call from `fetch()` method - **`packages/cli/src/commands/api/index.ts`**: Added `confirmMutatingOperation()` calls in `executeSingleRequest()` and `executePaginatedRequest()` - scoping confirmation to only the `vercel api` command - **`packages/cli/test/mocks/client.ts`**: Removed workaround that set `dangerouslySkipPermissions = true` by default - **`packages/cli/test/unit/util/client-confirmation.test.ts`**: Updated tests to call `confirmMutatingOperation()` directly ## Test plan - [x] All 15 unit tests pass - [x] TypeScript compiles without errors - [x] `vercel env rm --yes` works in non-TTY mode (no longer blocked) - [x] `vercel api -X DELETE` still prompts for confirmation as intended ## Related - Fixes regression introduced in #14769 - Supersedes #14784 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## vercel@50.9.2 ### Patch Changes - fix(cli): Scope DELETE confirmation prompt to `vercel api` command only ([#14787](#14787)) This fixes a regression from #14769 where the DELETE confirmation prompt was incorrectly applied to all DELETE operations (e.g., `vercel env rm`, `vercel alias rm`) instead of only the `vercel api` command. Commands like `env rm` and `alias rm` have their own `--yes` flags for confirmation and should not be affected. - experimental rust runtime framework preset ([#14765](#14765)) - Add redirects command to top level help message. ([#14772](#14772)) - Updated dependencies \[]: - @vercel/static-build@2.8.28 ## @vercel/frameworks@3.16.1 ### Patch Changes - Generic node framework preset ([#14779](#14779)) - experimental rust runtime framework preset ([#14765](#14765)) ## @vercel/fs-detectors@5.7.19 ### Patch Changes - experimental rust runtime framework preset ([#14765](#14765)) - Updated dependencies \[[`9d1e38e9ff6f0431dce8e421497e1ec4fc823291`](9d1e38e), [`e800617a334377e11953df22ef40d03716daf692`](e800617)]: - @vercel/frameworks@3.16.1 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

feat(cli): require confirmation for DELETE

fa4b3d4

tknickman requested a review from a team as a code owner January 28, 2026 16:19

vercel bot deployed to Preview January 28, 2026 16:20 View deployment

tknickman requested review from brookemosby, mehulkar and onsclom January 28, 2026 16:20

mehulkar approved these changes Jan 28, 2026

View reviewed changes

refactor(cli): make --dangerously-skip-permissions api-command-specific

8f23c0f

Move the --dangerously-skip-permissions flag from global options to be specific to the api command only. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

vercel bot deployed to Preview January 28, 2026 16:40 View deployment

vercel bot deployed to Preview January 28, 2026 19:50 View deployment

tknickman merged commit 615a57c into main Jan 28, 2026
120 checks passed

tknickman deleted the tknickman/cli-agent-confirm branch January 28, 2026 20:15

vercel-release-bot mentioned this pull request Jan 28, 2026

Version Packages #14768

Merged

developerjhp mentioned this pull request Jan 29, 2026

fix(cli): Move DELETE confirmation prompt to vercel api command only #14784

Closed

3 tasks

tknickman mentioned this pull request Jan 29, 2026

fix(cli): Scope DELETE confirmation prompt to vercel api command only #14787

Merged

4 tasks

vercel-release-bot mentioned this pull request Jan 29, 2026

Version Packages #14778

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(cli): Add confirmation prompt for DELETE API operations#14769

feat(cli): Add confirmation prompt for DELETE API operations#14769
tknickman merged 3 commits intomainfrom
tknickman/cli-agent-confirm

tknickman commented Jan 28, 2026 •

edited

Loading

Uh oh!

changeset-bot bot commented Jan 28, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 28, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 28, 2026 •

edited

Loading

Uh oh!

Uh oh!

Huinno-ParkJinHyun commented Jan 29, 2026

Uh oh!

Xiphe commented Jan 29, 2026 •

edited

Loading

Uh oh!

tknickman commented Jan 29, 2026

Uh oh!

tknickman commented Jan 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

tknickman commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

New Flag for vercel api Command

Behavior

Example Usage

Files Changed

Test plan

Uh oh!

changeset-bot bot commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

github-actions bot commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 CLI Tarball Ready

Quick Test

Use in vercel.json

Uh oh!

github-actions bot commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🧪 Unit Test Strategy

Results

Uh oh!

Uh oh!

Huinno-ParkJinHyun commented Jan 29, 2026

Uh oh!

Xiphe commented Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tknickman commented Jan 29, 2026

Uh oh!

tknickman commented Jan 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

tknickman commented Jan 28, 2026 •

edited

Loading

New Flag for `vercel api` Command

changeset-bot bot commented Jan 28, 2026 •

edited

Loading

github-actions bot commented Jan 28, 2026 •

edited

Loading

github-actions bot commented Jan 28, 2026 •

edited

Loading

Xiphe commented Jan 29, 2026 •

edited

Loading