feat(cli): ask for the organization and project on trace init

[migmartri]

Closes #3426. Closes PFM-7114.

https://www.tella.tv/video/vid_cmtul6y87001j0agmbli4hat5/view

chainloop trace init failed on --project is required. That was a new user's first experience of tracing: an error naming a flag, with no way to learn what a project is, which ones they could use, or which organization any of it would land in. Finding out meant chainloop project list, which only ships in the enterprise CLI, or guessing a name and learning the rules from a rejected API call.

Everything needed to avoid that is already known once the user is logged in. Now init asks.

What it does

Run chainloop trace init on a terminal and it walks through the setup:

• Organization — picked from the ones you belong to, created for you if you belong to none.
• Project — picked from the ones you can actually add a workflow to, or named freely and normalized to the label Chainloop stores.
• Harnesses — which AI tools to trace.

Each answer defaults to what .chainloop.yml already holds, so pressing Enter on a configured repository keeps it. Flags still win: --org, --project and --claude/--cursor/--opencode skip their question. CI and redirected output ask nothing, where --project stays required.

The rule throughout is that nothing is offered unless it will work. A project you can only view is not in the list, and neither is one that .chainloop.yml names but the organization does not have; "create a project" appears only if your role allows it; an organization you can only view is shown marked, and says who to ask. Every question is answered before anything is created or written, so an abandoned or failed run leaves the repository as it was.

A successful run ends with what was set up, the files to commit, and what to do next.

Server side

The picker needs a project listing the control plane did not have, so this adds ProjectService.List: organization-scoped, RBAC-filtered, paginated. No schema change, no migration.

It also reports two permissions, because seeing a project is not the same as being able to use it, and neither is derivable client-side:

• can_create_workflow, per project — a viewer can read a project but not add a workflow, and a caller can hold several roles on one project.
• can_create_project, per response — it describes the organization role, not any project: a contributor can administer every project it sees and still create none.

Both come from the same checks the write calls enforce, so the picker only offers what will succeed.

Notes

The prompts live in a new app/cli/pkg/prompt package: select, multi-select and input over charm.land/huh/v2, with an accessible plain-text mode for screen readers and terminals that cannot draw the UI. It knows nothing about tracing, so other commands can ask questions through it. The trace init logic talks to it through a small interface and is tested against a scripted fake, without a terminal. huh is a new dependency and adds about 2.3 MB to the binary.

A service-level RBAC test for the new RPC is tracked in #3419.

The guide says committing .chainloop.yml and the agent config onboards the rest of the team automatically. It does not: the git hooks live in .git/hooks, which git does not carry between clones, so a teammate still runs trace init. The CLI says what the code does; the docs page may want the same correction.

---

AI disclosure: this change was produced with the assistance of Claude Code. Every commit carries an Assisted-by: Claude Code trailer.

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri

[chainloop-platform]

AI Session Checks — 🟡 79% · ⚠️ 1 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟡 79%	1	⚠️ 1	100% AI / 0% Human	22	+2158 / -54	3h53m8s

🟡 79% — 100% AI — ⚠️ 1 policies failing

Sep 8, 2026 13:55 UTC · 3h53m8s · $87.70 · 5.5k in / 658.6k out · claude-code 2.1.263 (claude-opus-5)

View session details ↗

Change Summary

• Adds interactive trace init organization and project selection with .chainloop.yml defaults and CHAINLOOP_NO_PROMPT.
• Adds slugification, validation, huh-based prompting, and client-side project paging helpers plus tests.
• Adds control-plane ProjectService.List with org-scoped RBAC filtering, name filtering, and offset pagination.
• Opens PR feat(cli): ask for the organization and project on trace init #3418 and then prepares follow-up fixes for reviewer-found resolver bugs and module tidy drift.

AI Session Overall Score

🟡 79% — Strongly planned feature work, but review-found bugs and incomplete final verification keep it yellow.

AI Session Analysis Breakdown

🟢 92% · context-and-planning

🟢 A detailed spec and review cycle existed before coding started. · High Impact

🟢 88% · alignment

No notes.

🟢 86% · scope-discipline

No notes.

🟢 80% · user-trust-signal

🟢 The user kept delegating implementation, PR work, and review follow-up without pushback. · Medium Impact

🟡 No human acknowledgment appears after the bot-review fixes, so confidence comes only from AI reruns. · Low Severity

🟡 74% · solution-quality

🟠 Reviewer comments found real resolver bugs in the first PR, so inspect the follow-up commit closely. · Medium Severity

💡 Before opening the PR, rerun edge-case tests around flag-skipping, pinning, and prompt-abort paths.

🟡 68% · verification

🟢 The AI used test-first iterations and broad local Go test coverage. · High Impact

🟠 The first pushed PR failed all Test jobs because the module tidy step was skipped. · Medium Severity

💡 Treat dependency additions as incomplete until the tidy-sensitive CI path passes.

🟠 Post-review fixes were re-tested locally, but no final push or passing remote check appears. · Medium Severity

💡 After review-driven fixes, show the push and one passing remote check or explicit user confirmation.

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
created	ai	app/cli/cmd/trace_init_identity_test.go	+475 / -0
created	ai	app/cli/cmd/trace_init_identity.go	+236 / -0
modified	ai	app/cli/cmd/trace_init_resolve.go	+177 / -22
created	ai	app/controlplane/pkg/biz/project_list_integration_test.go	+190 / -0
created	ai	app/cli/cmd/trace_init_steps_test.go	+167 / -0
modified	ai	app/cli/internal/trace/config/slug_test.go	+120 / -6
created	ai	app/cli/pkg/action/trace_identity_test.go	+120 / -0
created	ai	app/cli/cmd/trace_init_prompt.go	+119 / -0
created	ai	app/cli/pkg/action/trace_identity.go	+98 / -0
created	ai	app/cli/internal/trace/config/slug.go	+79 / -0
created	ai	app/cli/cmd/trace_init_prompt_test.go	+76 / -0
modified	ai	app/controlplane/internal/service/project.go	+58 / -0
modified	ai	app/controlplane/pkg/data/project.go	+49 / -5
modified	ai	go.sum	+52 / -0
modified	ai	app/cli/cmd/trace_init.go	+25 / -17
modified	ai	app/controlplane/pkg/biz/project.go	+34 / -0
modified	ai	app/controlplane/api/controlplane/v1/project.proto	+32 / -0
modified	ai	go.mod	+21 / -1
modified	ai	app/cli/cmd/trace_init_test.go	+8 / -3
modified	ai	app/cli/documentation/cli-reference.mdx	+9 / -0
modified	ai	app/controlplane/pkg/authz/authz.go	+7 / -0
modified	ai	app/cli/cmd/root.go	+6 / -0

---

Policies (4, 1 failing)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-184822	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-184822	-
⚠️ Failed	ai-config-no-secrets	ai-coding-session-184822	Secret (posthog-project-api-key) was redacted from session content [turn=1670, source=tool_result, line=42] Secret (posthog-project-api-key) was redacted from session content [turn=35, source=tool_result, line=444]
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-184822	-

---

Security Checks — ✅ 8 passing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-

✅ iac-scan

Status	Policy	Messages
✅ Passed	iac-misconfiguration	-

PR info

Status	Policy	Messages
✅ Passed	pr-description-required	-
✅ Passed	pr-user-story-linked	-

⏭️ 2 scans not applied

Scan	Reason
vulnerability-scan	ran, but its output is not attested yet
github-actions-scan	no workflow files changed

View attestation ↗

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

All reported issues were addressed across 30 files

<sub>Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic</sub>

[migmartri]

Thanks — three of the five were real. Fixed in 986b8d8.

Explicit flags still opened the picker (P2). Confirmed, and worse than the report suggests. resolveIdentityInteractively now skips a question whose value came from a flag and leaves its save flag alone; covered by table tests.

Stale pinned organization failed auth before the picker (P2). Confirmed. The first connection now authenticates unpinned, which is all that listing memberships needs, and repins once the organization is settled. The org resolver already had a test for the "no longer a member" case; the auth check was reaching it first.

huh recorded as indirect (P3). Correct, and the cause of the four failing Test jobs — they all run the module tidy check. go mod tidy run.

Two I did not act on:

Root pre-run writing the current organization. Real, but pre-existing and not specific to this command: PersistentPreRunE writes the resolved organization to the CLI config for every command when local config has none. This PR's guarantee is that nothing is written to the repository before the workflow exists, which still holds. Deferring that write for one command is a change to shared startup behavior and belongs in its own PR.

errAborted exiting 1. Intentional. A dismissed prompt is a cancellation, not a success, and the spec called for a non-zero exit. The ERROR aborted prefix is noisier than it needs to be — happy to quiet that if reviewers prefer, but the exit code should stay non-zero.

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri

[cubic-dev-ai]

1 issue found across 4 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="app/cli/cmd/trace_init_steps_test.go">

<violation number="1" location="app/cli/cmd/trace_init_steps_test.go:144">
P3: The new assertion `assert.Contains(t, f.prompt.selects[1].options, projectAPI)` cannot detect the regression the comment claims ('the project step must use the repinned connection'), because `pinTo` returns the same `f.projects` fake for every org and `fakeProjectLister.ListProjects` returns that same list unconditionally. So the project picker shows `projectAPI` whether it lists against the repinned org or a stale one. To actually verify the org-scoped listing, have `pinTo` return a lister whose projects differ per org (e.g., keyed by the org it was pinned to) and assert the offered options match the chosen org.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[migmartri]

Good catch, and correct — fixed in c61326c.

The assertion was checking the project picker's options against a fixture that returned one lister for every organization, and that lister answered with the same projects regardless of which one it was pinned to. It would have held whether the project step used the repinned connection or a stale one.

The fixture now gives each organization its own projects and returns a fresh lister per pin, so the offered options identify the connection that produced them. I verified it has teeth by mutating pinTo(cfg.organization) to pinTo("") — the test fails, and passes again when reverted.

Worth noting this was a regression I introduced while fixing the previous version of the same assertion, which checked a flag the fixture set on itself. Same class of mistake twice: asserting on something the test controls rather than on something the code under test decides.

The three findings from the earlier review are addressed in 986b8d8, and the two I did not act on are explained in the comment above.

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri

[cubic-dev-ai]

All reported issues were addressed across 10 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 11 files (changes from recent commits).

_{Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.}

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[jiparis]

Thanks, do you have a screenshot for this?

[migmartri]

Thanks, do you have a screenshot for this?

Yes, a video will come

[cubic-dev-ai]

All reported issues were addressed across 3 files (changes from recent commits).

_{Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.}

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 3 files (changes from recent commits).

_{Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.}

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 3 files (changes from recent commits).

_{Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.}

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 3 files (changes from recent commits).

_{Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.}

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

_{Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.}

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 12 files (changes from recent commits).

_{Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.}

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 6 files (changes from recent commits).

_{Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.}

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 7 files (changes from recent commits).

_{Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.}

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

_{Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.}

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

_{Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.}

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[jiparis]

I like it!