Add non-interactive CLI support and pre-commit hooks

Makefile

@@ -43,3 +43,13 @@ examples: build
 	cargo run -p turnkey_examples --bin sub_organization
 	cargo run -p turnkey_examples --bin wallet
 	cargo run -p turnkey_examples --bin proofs
+
+.PHONY: check
+check: lint test
+	@echo "All checks passed."
+
+.PHONY: install-hooks
+install-hooks:
+	@cp scripts/pre-commit .git/hooks/pre-commit
+	@chmod +x .git/hooks/pre-commit
+	@echo "Pre-commit hook installed."

scripts/pre-commit

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Pre-commit hook for rust-sdk
+# Runs formatting, clippy, and tests for staged Rust changes.
+# Install with: make install-hooks
+
+set -euo pipefail
+
+# Check if any Rust files are staged
+STAGED_RS=$(git diff --cached --name-only --diff-filter=ACM | grep '\.rs$' || true)
+STAGED_TOML=$(git diff --cached --name-only --diff-filter=ACM | grep 'Cargo\.toml$' || true)
+
+if [ -z "$STAGED_RS" ] && [ -z "$STAGED_TOML" ]; then
+    exit 0
+fi
+
+echo "Running pre-commit checks..."
+
+# Check formatting
+echo "  Checking formatting..."
+if ! cargo fmt -- --check; then
+    echo ""
+    echo "Formatting check failed. Run 'cargo fmt' to fix."
+    exit 1
+fi
+
+# Run clippy
+echo "  Running clippy..."
+if ! cargo clippy --all-targets --all-features -- -D warnings; then
+    echo ""
+    echo "Clippy check failed. Fix the warnings above."
+    exit 1
+fi
+
+# Run tests
+echo "  Running tests..."
+if ! cargo test; then
+    echo ""
+    echo "Tests failed. Fix the failing tests above."
+    exit 1
+fi
+
+echo "Pre-commit checks passed."

tvc/src/cli.rs

@@ -1,12 +1,28 @@
 //! CLI parsing and dispatch.
 
 use crate::commands;
-use clap::{Parser, Subcommand};
+use clap::{Args as ClapArgs, Parser, Subcommand};
+
+/// Global options available to all commands.
+#[derive(Debug, Clone, ClapArgs)]
+pub struct GlobalOpts {
+    /// Disable all interactive prompts. Fails if input is required.
+    /// Set TVC_NO_INPUT=true in CI/CD environments.
+    #[arg(long, global = true, env = "TVC_NO_INPUT")]
+    pub no_input: bool,
+
+    /// Suppress non-essential output.
+    #[arg(long, short, global = true)]
+    pub quiet: bool,
+}
 
 /// CLI command parsing and dispatch.
 #[derive(Debug, Parser)]
 #[command(about = "CLI for building with Turnkey Verifiable Cloud", long_about = None)]
 pub struct Cli {
+    #[command(flatten)]
+    global: GlobalOpts,
+
     #[command(subcommand)]
     command: Commands,
 }
@@ -15,20 +31,24 @@ impl Cli {
     /// Run the CLI.
     pub async fn run() -> anyhow::Result<()> {
         let args = Cli::parse();
+        let no_input = args.global.no_input;
+        let quiet = args.global.quiet;
 
         match args.command {
             Commands::Deploy { command } => match command {
-                DeployCommands::Approve(args) => commands::deploy::approve::run(args).await,
-                DeployCommands::Status(args) => commands::deploy::status::run(args).await,
-                DeployCommands::Create(args) => commands::deploy::create::run(args).await,
-                DeployCommands::Init(args) => commands::deploy::init::run(args).await,
+                DeployCommands::Approve(cmd_args) => {
+                    commands::deploy::approve::run(cmd_args, no_input).await
+                }
+                DeployCommands::Status(cmd_args) => commands::deploy::status::run(cmd_args).await,
+                DeployCommands::Create(cmd_args) => commands::deploy::create::run(cmd_args).await,
+                DeployCommands::Init(cmd_args) => commands::deploy::init::run(cmd_args).await,
             },
             Commands::App { command } => match command {
-                AppCommands::List(args) => commands::app::list::run(args).await,
-                AppCommands::Create(args) => commands::app::create::run(args).await,
-                AppCommands::Init(args) => commands::app::init::run(args).await,
+                AppCommands::List(cmd_args) => commands::app::list::run(cmd_args).await,
+                AppCommands::Create(cmd_args) => commands::app::create::run(cmd_args).await,
+                AppCommands::Init(cmd_args) => commands::app::init::run(cmd_args).await,
             },
-            Commands::Login(args) => commands::login::run(args).await,
+            Commands::Login(cmd_args) => commands::login::run(cmd_args, no_input, quiet).await,
         }
     }
 }

tvc/src/commands/deploy/approve.rs

@@ -61,9 +61,9 @@ pub struct Args {
     #[arg(long)]
     pub dry_run: bool,
 
-    /// DANGEROUS: skip interactive prompts for approving each aspect of manifest.
-    #[arg(long)]
-    pub dangerous_skip_interactive: bool,
+    /// Skip interactive prompts for approving each aspect of the manifest.
+    #[arg(short = 'y', long = "yes", alias = "dangerous-skip-interactive")]
+    pub yes: bool,
 
     /// Write approval to file instead of stdout.
     #[arg(short, long, value_name = "PATH")]
@@ -75,7 +75,7 @@ pub struct Args {
 }
 
 /// Run the approve deploy command.
-pub async fn run(args: Args) -> anyhow::Result<()> {
+pub async fn run(args: Args, no_input: bool) -> anyhow::Result<()> {
     // Fetch manifest - track manifest_id if fetched from API
     let (manifest, fetched_manifest_id) = match (&args.manifest, &args.deploy_id) {
         (Some(path), _) => (read_manifest_from_path(path).await?, None),
@@ -86,7 +86,12 @@ pub async fn run(args: Args) -> anyhow::Result<()> {
         (None, None) => bail!("a manifest source is required"),
     };
 
-    if !args.dangerous_skip_interactive {
+    if no_input && !args.yes {
+        bail!("Approval input is required in non-interactive mode. Re-run with --yes to explicitly approve the manifest.");
+    }
+
+    // Skip interactive approval only when --yes/-y is passed
+    if !args.yes {
         interactive_approve(&manifest)?;
     }
 
@@ -238,27 +243,28 @@ async fn generate_approval(
 }
 
 /// Walk the user through each section of the manifest for approval.
+/// All interactive output goes to stderr to keep stdout clean for data.
 fn interactive_approve(manifest: &Manifest) -> anyhow::Result<()> {
-    println!("\n========================================");
-    println!("         MANIFEST APPROVAL");
-    println!("========================================\n");
+    eprintln!("\n========================================");
+    eprintln!("         MANIFEST APPROVAL");
+    eprintln!("========================================\n");
 
     review_namespace(&manifest.namespace)?;
     review_enclave(&manifest.enclave)?;
     review_pivot(&manifest.pivot)?;
     review_manifest_set(&manifest.manifest_set)?;
     review_share_set(&manifest.share_set)?;
 
-    println!("\n========================================");
-    println!("    ALL SECTIONS APPROVED");
-    println!("========================================\n");
+    eprintln!("\n========================================");
+    eprintln!("    ALL SECTIONS APPROVED");
+    eprintln!("========================================\n");
 
     Ok(())
 }
 
 fn confirm(prompt: &str) -> anyhow::Result<()> {
-    print!("{prompt} [y/N]: ");
-    std::io::stdout().flush()?;
+    eprint!("{prompt} [y/N]: ");
+    std::io::stderr().flush()?;
 
     let mut input = String::new();
     std::io::stdin().lock().read_line(&mut input)?;
@@ -272,56 +278,56 @@ fn confirm(prompt: &str) -> anyhow::Result<()> {
 }
 
 fn review_namespace(namespace: &Namespace) -> anyhow::Result<()> {
-    println!("NAMESPACE");
-    println!("─────────────────────────────────────");
-    println!("  Name:       {}", namespace.name);
-    println!("  Nonce:      {}", namespace.nonce);
-    println!("  Quorum Key: {}", hex::encode(&namespace.quorum_key));
-    println!();
+    eprintln!("NAMESPACE");
+    eprintln!("─────────────────────────────────────");
+    eprintln!("  Name:       {}", namespace.name);
+    eprintln!("  Nonce:      {}", namespace.nonce);
+    eprintln!("  Quorum Key: {}", hex::encode(&namespace.quorum_key));
+    eprintln!();
 
     confirm("Approve namespace?")
 }
 
 fn review_enclave(enclave: &NitroConfig) -> anyhow::Result<()> {
-    println!("ENCLAVE (AWS Nitro)");
-    println!("─────────────────────────────────────");
-    println!("  PCR0 (image):     {}", hex::encode(&enclave.pcr0));
-    println!("  PCR1 (kernel):    {}", hex::encode(&enclave.pcr1));
-    println!("  PCR2 (app):       {}", hex::encode(&enclave.pcr2));
-    println!("  PCR3 (IAM role):  {}", hex::encode(&enclave.pcr3));
+    eprintln!("ENCLAVE (AWS Nitro)");
+    eprintln!("─────────────────────────────────────");
+    eprintln!("  PCR0 (image):     {}", hex::encode(&enclave.pcr0));
+    eprintln!("  PCR1 (kernel):    {}", hex::encode(&enclave.pcr1));
+    eprintln!("  PCR2 (app):       {}", hex::encode(&enclave.pcr2));
+    eprintln!("  PCR3 (IAM role):  {}", hex::encode(&enclave.pcr3));
     // Skip the QOS commit since its not cryptographically linked
-    println!();
+    eprintln!();
 
     confirm("Approve enclave configuration?")
 }
 
 fn review_pivot(pivot: &PivotConfig) -> anyhow::Result<()> {
-    println!("PIVOT BINARY");
-    println!("─────────────────────────────────────");
-    println!("  Pivot Binary Hash: {}", hex::encode(pivot.hash));
+    eprintln!("PIVOT BINARY");
+    eprintln!("─────────────────────────────────────");
+    eprintln!("  Pivot Binary Hash: {}", hex::encode(pivot.hash));
     if pivot.args.is_empty() {
-        println!("  CLI Args: (none)");
+        eprintln!("  CLI Args: (none)");
     } else {
-        println!("  CLI Args:\n   {}", pivot.args.join("\n   "));
+        eprintln!("  CLI Args:\n   {}", pivot.args.join("\n   "));
     }
-    println!();
+    eprintln!();
 
     confirm("Approve pivot binary?")
 }
 
 fn print_quorum_members(members: &[QuorumMember]) {
     for member in members.iter() {
-        println!("    {} ({})", member.alias, hex::encode(&member.pub_key));
+        eprintln!("    {} ({})", member.alias, hex::encode(&member.pub_key));
     }
 }
 
 fn review_manifest_set(set: &ManifestSet) -> anyhow::Result<()> {
-    println!("MANIFEST SET");
-    println!("─────────────────────────────────────");
-    println!("  Threshold: {} of {}", set.threshold, set.members.len());
-    println!("  Members:");
+    eprintln!("MANIFEST SET");
+    eprintln!("─────────────────────────────────────");
+    eprintln!("  Threshold: {} of {}", set.threshold, set.members.len());
+    eprintln!("  Members:");
     print_quorum_members(&set.members);
-    println!();
+    eprintln!();
 
     confirm("Approve manifest set?")
 }
@@ -352,10 +358,10 @@ fn review_share_set(set: &ShareSet) -> anyhow::Result<()> {
         bail!("Share set threshold must be 2, found: {}", set.threshold);
     }
 
-    println!("SHARE SET");
-    println!("─────────────────────────────────────");
-    println!("  ✓ Keys and threshold match dev known share set operators");
-    println!();
+    eprintln!("SHARE SET");
+    eprintln!("─────────────────────────────────────");
+    eprintln!("  Keys and threshold match dev known share set operators");
+    eprintln!();
 
     Ok(())
 }