fix(audit): honour skipConfirm in workflow and extension removal

Import runs audit fix with skipConfirm in --external-config instead of
passing --yes. Every other audit confirmation honours skipConfirm and
copy-dir, but the per-item removal prompts for workflows and extensions
only checked --yes, so `cm:stacks:import --yes` still stopped once for
each workflow or extension whose content types were all missing.

Accept copy-dir, skipConfirm or yes there, matching the file-write
confirmation in the same modules.

Also upgrade adm-zip to 0.6.1 in apps-cli and moment to 2.31.0 in
content-type to clear high-severity Snyk findings, and bump
@contentstack/cli-launch and the uuid, brace-expansion, js-yaml,
fast-uri and ws overrides.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: cs-raj

.talismanrc

@@ -1,5 +1,7 @@
 fileignoreconfig:
 
 - filename: pnpm-lock.yaml
-  checksum: 90ca97ef1a06fb5b7d8071f1317e079de6a34fce91559f70f80d9d958b5a834e
+  checksum: 8ab0fa4a3ef73e44c440757223202629b999f011c617888c4e7d4f3c90f546d8
   version: '1.0'
+- filename: packages/contentstack-audit/test/unit/modules/extensions.test.ts
+  checksum: 548b6e10241eb38df4b92f2dec90987b555ed6b7c582846d539828854eb1dadc

packages/contentstack-apps-cli/package.json

@@ -23,9 +23,9 @@
   "dependencies": {
     "@apollo/client": "^3.14.1",
     "@contentstack/cli-command": "~1.8.7",
-    "@contentstack/cli-launch": "^1.11.1",
+    "@contentstack/cli-launch": "^1.11.3",
     "@contentstack/cli-utilities": "~1.19.2",
-    "adm-zip": "^0.6.0",
+    "adm-zip": "^0.6.1",
     "chalk": "^4.1.2",
     "lodash": "^4.18.1",
     "shelljs": "^0.10.0",

packages/contentstack-audit/src/modules/extensions.ts

@@ -167,7 +167,11 @@ export default class Extensions {
       } else {
         log.debug(`Extension ${title} has no valid content types or scope not found`, this.config.auditContext);
         cliux.print($t(commonMsg.EXTENSION_FIX_WARN, { title: title, uid }), { color: 'yellow' });
-        const shouldDelete = this.config.flags.yes || (await cliux.confirm(commonMsg.EXTENSION_FIX_CONFIRMATION));
+        const shouldDelete =
+          this.config.flags['copy-dir'] ||
+          this.config.flags['external-config']?.skipConfirm ||
+          this.config.flags.yes ||
+          (await cliux.confirm(commonMsg.EXTENSION_FIX_CONFIRMATION));
         if (shouldDelete) {
           log.debug(`Deleting extension: ${title} (${uid})`, this.config.auditContext);
           delete newExtensionSchema[uid];

packages/contentstack-audit/src/modules/workflows.ts

@@ -223,7 +223,12 @@ export default class Workflows {
 
           cliux.print(warningMessage, { color: 'yellow' });
 
-          if (this.config.flags.yes || (await cliux.confirm(commonMsg.WORKFLOW_FIX_CONFIRMATION))) {
+          if (
+            this.config.flags['copy-dir'] ||
+            this.config.flags['external-config']?.skipConfirm ||
+            this.config.flags.yes ||
+            (await cliux.confirm(commonMsg.WORKFLOW_FIX_CONFIRMATION))
+          ) {
             log.debug(`Deleting workflow ${name} (${uid})`, this.config.auditContext);
             delete newWorkflowSchema[workflow.uid];
           } else {

packages/contentstack-audit/test/unit/modules/extensions.test.ts

@@ -6,7 +6,7 @@ import { ux, cliux } from '@contentstack/cli-utilities';
 
 import config from '../../../src/config';
 import { Extensions } from '../../../src/modules';
-import { $t, auditMsg } from '../../../src/messages';
+import { $t, auditMsg, commonMsg } from '../../../src/messages';
 import sinon from 'sinon';
 import { Extension } from '../../../src/types';
 import { mockLogger } from '../mock-logger';
@@ -387,4 +387,67 @@ describe('Extensions scope containing content_types uids', () => {
         },
       );
   });
+
+  describe('fixExtensionsScope confirmation before removing an extension', () => {
+    class ExtensionsWithCapturedFix extends Extensions {
+      public fixedExtensions: Record<string, Extension> = {};
+
+      async writeFixContent(fixedExtensions: Record<string, Extension>) {
+        this.fixedExtensions = fixedExtensions;
+      }
+    }
+
+    // ext1 and ext2 are scoped only to missing content types, so the fix removes them.
+    const createExtensions = (flags: Record<string, unknown>) =>
+      new ExtensionsWithCapturedFix({
+        moduleName: 'extensions',
+        ctSchema: cloneDeep(require('./../mock/contents/extensions/ctSchema.json')),
+        config: Object.assign(cloneDeep(config), {
+          basePath: resolve(`./test/unit/mock/contents/extensions/invalidExtensions/`),
+          flags,
+        }),
+        fix: true,
+      });
+
+    it('should remove the extensions without prompting when external-config skipConfirm is set', async () => {
+      const confirm = sinon.stub(cliux, 'confirm').resolves(false);
+      const ext = createExtensions({ 'external-config': { skipConfirm: true } });
+
+      await ext.run();
+
+      expect(confirm.notCalled).to.be.true;
+      expect(ext.fixedExtensions).to.not.have.any.keys('ext1', 'ext2');
+    });
+
+    it('should remove the extensions without prompting when copy-dir is set', async () => {
+      const confirm = sinon.stub(cliux, 'confirm').resolves(false);
+      const ext = createExtensions({ 'copy-dir': true });
+
+      await ext.run();
+
+      expect(confirm.notCalled).to.be.true;
+      expect(ext.fixedExtensions).to.not.have.any.keys('ext1', 'ext2');
+    });
+
+    it('should remove the extensions without prompting when yes is set', async () => {
+      const confirm = sinon.stub(cliux, 'confirm').resolves(false);
+      const ext = createExtensions({ yes: true });
+
+      await ext.run();
+
+      expect(confirm.notCalled).to.be.true;
+      expect(ext.fixedExtensions).to.not.have.any.keys('ext1', 'ext2');
+    });
+
+    it('should ask once per extension to remove and keep them when the user declines', async () => {
+      const confirm = sinon.stub(cliux, 'confirm').resolves(false);
+      const ext = createExtensions({});
+
+      await ext.run();
+
+      expect(confirm.callCount).to.equal(2);
+      expect(confirm.alwaysCalledWithExactly(commonMsg.EXTENSION_FIX_CONFIRMATION)).to.be.true;
+      expect(ext.fixedExtensions).to.include.all.keys('ext1', 'ext2');
+    });
+  });
 });

packages/contentstack-audit/test/unit/modules/workflow.test.ts

@@ -3,12 +3,13 @@ import { resolve } from 'path';
 import { fancy } from 'fancy-test';
 import { expect } from 'chai';
 import cloneDeep from 'lodash/cloneDeep';
-import { ux } from '@contentstack/cli-utilities';
+import { ux, cliux } from '@contentstack/cli-utilities';
 import sinon from 'sinon';
 
 import config from '../../../src/config';
 import { Workflows } from '../../../src/modules';
-import { $t, auditMsg } from '../../../src/messages';
+import { $t, auditMsg, commonMsg } from '../../../src/messages';
+import { Workflow } from '../../../src/types';
 import { values } from 'lodash';
 import { mockLogger } from '../mock-logger';
 
@@ -147,4 +148,69 @@ describe('Workflows', () => {
         ]);
       });
   });
+
+  describe('fixWorkflowSchema confirmation before removing a workflow', () => {
+    class WorkflowsWithCapturedFix extends Workflows {
+      public fixedWorkflows: Record<string, Workflow> = {};
+
+      async writeFixContent(newWorkflowSchema: Record<string, Workflow>) {
+        this.fixedWorkflows = newWorkflowSchema;
+      }
+    }
+
+    const createWorkflows = (flags: Record<string, unknown>) =>
+      new WorkflowsWithCapturedFix({
+        moduleName: 'workflows',
+        // Without ct2, every content type on wf3 is missing, so the fix removes wf3.
+        ctSchema: cloneDeep(require('./../mock/contents/workflows/ctSchema.json')).filter(
+          (ct: { uid: string }) => ct.uid !== 'ct2',
+        ),
+        config: Object.assign(cloneDeep(config), {
+          basePath: resolve(`./test/unit/mock/contents/`),
+          branch: undefined,
+          flags,
+        }),
+        fix: true,
+      });
+
+    it('should remove the workflow without prompting when external-config skipConfirm is set', async () => {
+      const confirm = sinon.stub(cliux, 'confirm').resolves(false);
+      const wf = createWorkflows({ 'external-config': { skipConfirm: true } });
+
+      await wf.run();
+
+      expect(confirm.notCalled).to.be.true;
+      expect(wf.fixedWorkflows).to.not.have.property('wf3');
+    });
+
+    it('should remove the workflow without prompting when copy-dir is set', async () => {
+      const confirm = sinon.stub(cliux, 'confirm').resolves(false);
+      const wf = createWorkflows({ 'copy-dir': true });
+
+      await wf.run();
+
+      expect(confirm.notCalled).to.be.true;
+      expect(wf.fixedWorkflows).to.not.have.property('wf3');
+    });
+
+    it('should remove the workflow without prompting when yes is set', async () => {
+      const confirm = sinon.stub(cliux, 'confirm').resolves(false);
+      const wf = createWorkflows({ yes: true });
+
+      await wf.run();
+
+      expect(confirm.notCalled).to.be.true;
+      expect(wf.fixedWorkflows).to.not.have.property('wf3');
+    });
+
+    it('should ask once per workflow to remove and keep it when the user declines', async () => {
+      const confirm = sinon.stub(cliux, 'confirm').resolves(false);
+      const wf = createWorkflows({});
+
+      await wf.run();
+
+      expect(confirm.calledOnceWithExactly(commonMsg.WORKFLOW_FIX_CONFIRMATION)).to.be.true;
+      expect(wf.fixedWorkflows).to.have.property('wf3');
+    });
+  });
 });

packages/contentstack-content-type/package.json

@@ -11,7 +11,7 @@
     "cli-ux": "^6.0.9",
     "diff": "^9.0.0",
     "diff2html": "^3.4.56",
-    "moment": "^2.30.1",
+    "moment": "^2.31.0",
     "node-graphviz": "^0.1.1",
     "table": "^6.9.0",
     "tmp": "^0.2.7",