fix: Validate boolean CLI options instead of coercing them

Greptile caught that `--auto-update=treu` became `autoUpdate: false` rather
than an error, which either turns auto-update off on an update or fails the
mutation outright on a dynamic collection.

Constrain these options with click.Choice so a bad value fails at parse time.
`--cascade` on `repository remove` had the same flaw -- and worse, silently
skipped the cascade -- so it gets the same treatment rather than being left
inconsistent with the option this branch adds. The parser and choice type are
now shared in utils.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: howbazaar

NEWS.md

@@ -31,6 +31,10 @@
 
 ### Fixes
 
+- `repository remove --cascade` now rejects a value that isn't `true` or `false`.
+  Previously anything unrecognised was taken as `false`, so a typo silently skipped
+  the cascade instead of reporting the mistake.
+
 ---
 
 ## August 10, 2026

stacklet/client/platform/graphql/snippets/policy_collection.py

@@ -1,6 +1,7 @@
 # Copyright Stacklet, Inc.
 # SPDX-License-Identifier: Apache-2.0
 
+from ...utils import BOOL_CHOICE, to_bool
 from ..snippet import GraphQLSnippet
 
 # Shared selection for a policy collection node. `repositoryConfig`/`repositoryView`
@@ -82,19 +83,12 @@
     "policy_directory": "[String!]",
 }
 
-
-def to_bool(value: str | None) -> bool | None:
-    """
-    Parse an optional boolean option.
-
-    None has to survive as None: variables are transformed before the query is built,
-    and the builder drops an option's line only when its value is None. Coercing an
-    unset flag to False would send it, and `autoUpdate: false` is an error on a
-    dynamic collection rather than a no-op.
-    """
-    if value is None:
-        return None
-    return value.lower() in ("true", "t", "yes", "y")
+AUTO_UPDATE_OPTION = {
+    "auto_update": {
+        "help": "Bump policies to their latest version as they are scanned",
+        "type": BOOL_CHOICE,
+    },
+}
 
 
 class ListPolicyCollections(GraphQLSnippet):
@@ -172,7 +166,7 @@ class AddPolicyCollection(GraphQLSnippet):
 
     optional = {
         "description": "Policy Collection Description",
-        "auto_update": "Bump policies to their latest version as they are scanned (true|false)",
+        **AUTO_UPDATE_OPTION,
         "repository_uuid": (
             "Repository config UUID. Setting it makes this a dynamic collection, whose "
             "policies always match the latest scan of that repository"
@@ -216,7 +210,7 @@ class UpdatePolicyCollection(GraphQLSnippet):
         "name": "Policy Collection Name in Stacklet",
         "provider": "Cloud Provider",
         "description": "Policy Collection Description",
-        "auto_update": "Bump policies to their latest version as they are scanned (true|false)",
+        **AUTO_UPDATE_OPTION,
         **VIEW_OPTIONS,
     }
     parameter_types = dict(VIEW_TYPES)

stacklet/client/platform/graphql/snippets/repository.py

@@ -1,6 +1,7 @@
 # Copyright Stacklet, Inc.
 # SPDX-License-Identifier: Apache-2.0
 
+from ...utils import BOOL_CHOICE, to_bool
 from ..snippet import GraphQLSnippet
 
 
@@ -141,15 +142,12 @@ class RemoveRepository(GraphQLSnippet):
     }
     optional = {
         "cascade": {
-            "help": (
-                "Also remove bindings and policy collections tied to this repository (true|false)"
-            ),
+            "help": "Also remove bindings and policy collections tied to this repository",
             "default": "false",
+            "type": BOOL_CHOICE,
         },
     }
-    variable_transformers = {
-        "cascade": lambda x: x is not None and x.lower() in ("true", "t", "yes", "y")
-    }
+    variable_transformers = {"cascade": to_bool}
     result_expr = "data.removeRepositoryConfig"
 
 

stacklet/client/platform/utils.py

@@ -10,6 +10,26 @@
 
 USER_AGENT = f"stacklet.client.platform/{__version__}"
 
+# Type for an optional boolean option. Constraining the values matters: these are sent
+# on to the API, where a wrong one is a rejected mutation or a silently different
+# setting rather than something the user gets told about.
+BOOL_CHOICE = click.Choice(["true", "false"], case_sensitive=False)
+
+
+def to_bool(value: str | None) -> bool | None:
+    """
+    Parse an optional boolean option, as constrained by BOOL_CHOICE.
+
+    None has to survive as None: variables are transformed before the query is built,
+    and the builder drops an option's line only when its value is None. Coercing an
+    unset option to False would send it, and `autoUpdate: false` is an error on a
+    dynamic policy collection rather than a no-op.
+    """
+    if value is None:
+        return None
+    return value.lower() == "true"
+
+
 PAGINATION_OPTIONS = {
     "first": {
         "help": "For use with pagination. Return the first n results.",

tests/test_policy_collection.py

@@ -111,12 +111,32 @@ def test_add_auto_update_given(self, run_query):
         pc_uuid = str(uuid.uuid4())
         res, body = run_query(
             "policy-collection",
-            ["add", "--name=c", "--provider=AWS", "--auto-update=true"],
+            ["add", "--name=c", "--provider=AWS", "--auto-update=TRUE"],
             collection_response("addPolicyCollection", pc_uuid),
         )
         assert body["variables"]["auto_update"] is True
         assert_query_contains(body, "$auto_update: Boolean!")
 
+    def test_add_auto_update_false(self, run_query):
+        pc_uuid = str(uuid.uuid4())
+        res, body = run_query(
+            "policy-collection",
+            ["add", "--name=c", "--provider=AWS", "--auto-update=false"],
+            collection_response("addPolicyCollection", pc_uuid),
+        )
+        assert body["variables"]["auto_update"] is False
+
+    def test_add_auto_update_rejects_nonsense(self, run_queries):
+        "A misspelling has to fail, not quietly turn into false."
+        res, bodies = run_queries(
+            "policy-collection",
+            ["add", "--name=c", "--provider=AWS", "--auto-update=treu"],
+            [],
+        )
+        assert res.exit_code != 0
+        assert "'treu' is not one of 'true', 'false'" in res.output
+        assert bodies == []
+
     def test_add_view_option_without_repository(self, run_queries):
         "View options are meaningless without a repository, so say so up front."
         res, bodies = run_queries(

tests/test_repository.py

@@ -250,6 +250,25 @@ def test_add_repository_with_auth(self, run_query):
             "auth_token": "sometoken",
         }
 
+    def test_remove_repository_cascade(self, run_query):
+        res, body = run_query(
+            "repository",
+            ["remove", f"--uuid={REPO_UUID}", "--cascade=true"],
+            response={"data": {"removeRepositoryConfig": {"removed": [], "problems": []}}},
+        )
+        assert body["variables"] == {"uuid": REPO_UUID, "cascade": True}
+
+    def test_remove_repository_cascade_rejects_nonsense(self, run_queries):
+        "A misspelling has to fail, not quietly leave the cascade off."
+        res, bodies = run_queries(
+            "repository",
+            ["remove", f"--uuid={REPO_UUID}", "--cascade=treu"],
+            [],
+        )
+        assert res.exit_code != 0
+        assert "'treu' is not one of 'true', 'false'" in res.output
+        assert bodies == []
+
     def test_process_repository(self, run_query):
         res, body = run_query(
             "repository",