Harden portable Redmine CLI runtime and cache writes

bin/rcontacts-live

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Portable contacts live entry point. No shell evaluation of credentials.
+set -euo pipefail
+ROOT="$(dirname "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")")"
+exec python3 "$ROOT/redmine_cli_runtime.py" contacts live "$@"

bin/redmine-runtime-completion.bash

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Source this file; no network calls and no config/secret loading.
+_redmine_completion_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source "$_redmine_completion_root/redmine_contacts_completion.sh"
+_redmine_runtime_complete() {
+  local cur="${COMP_WORDS[COMP_CWORD]}" prev="${COMP_WORDS[COMP_CWORD-1]}"
+  local common="--help --show-config --doctor --doctor-nmi --env-file --base-cache --base-url --project --mode --api-key-file"
+  COMPREPLY=()
+  case "$prev" in
+    --env-file|--cache|--cache-dir|--base-cache|--api-key-file|--config|--body-file)
+      while IFS= read -r entry; do COMPREPLY+=("$entry"); done < <(compgen -f -- "$cur")
+      return ;;
+    --mode) COMPREPLY=( $(compgen -W 'production dev' -- "$cur") ); return ;;
+    --source) COMPREPLY=( $(compgen -W 'cache api auto' -- "$cur") ); return ;;
+  esac
+  if [[ "${COMP_WORDS[0]}" == *rcontacts-live ]]; then
+    _redmine_contacts_completion
+    COMPREPLY+=( $(compgen -W "$common" -- "$cur") )
+  else
+    local commands="sync search view walk materialize-queues note customer-email set-fields meta-refresh contacts-sync contacts-search contact-show contact-set ticket-contact attachments entities browse tui textual-tui triage ocr-rename categories control-tag draft spam-check close-if-spam tag-maybe-customer decompose"
+    local flags="--cache-dir --config --allow-prod-writes --where --open-only --max-tickets --issue-id --contact-id --json --jsonl --ids-only --fetch --apply --private --body --body-file --remote-updated-since --remote-updated-before --remote-status-id --dry-run --quiet --run-log"
+    COMPREPLY=( $(compgen -W "$commands $common $flags" -- "$cur") )
+  fi
+}
+complete -F _redmine_runtime_complete rtl rtd rtickets-live rcontacts-live ./bin/rtl ./bin/rtd ./bin/rtickets-live ./bin/rcontacts-live
+unset _redmine_completion_root

bin/rtd

@@ -1,6 +1,5 @@
 #!/usr/bin/env bash
-# Muscle-memory wrapper: LAN/dev customer-service cache + base URL.
-# Usage: rtd note --issue-id 39305 --body 'test' --apply
+# Portable tickets dev entry point. No shell evaluation of credentials.
 set -euo pipefail
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-exec "$ROOT/redmine_tickets.py" --config "$ROOT/configs/dev.json" "$@"
+ROOT="$(dirname "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")")"
+exec python3 "$ROOT/redmine_cli_runtime.py" tickets dev "$@"

bin/rtickets-live

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Portable tickets live entry point. No shell evaluation of credentials.
+set -euo pipefail
+ROOT="$(dirname "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")")"
+exec python3 "$ROOT/redmine_cli_runtime.py" tickets live "$@"

bin/rtl

@@ -1,9 +1,5 @@
 #!/usr/bin/env bash
-# Muscle-memory wrapper: prod customer-service cache + base URL.
-# Usage: rtl search --where 'assigned_to IS NULL' --max-tickets 10
+# Portable tickets live entry point. No shell evaluation of credentials.
 set -euo pipefail
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-# rtl is the production Redmine wrapper. Keep an explicitly supplied mode, but
-# never silently default its NMI briefs to the dev profile.
-export NMI_MODE="${NMI_MODE:-production}"
-exec "$ROOT/redmine_tickets.py" --config "$ROOT/configs/live.json" "$@"
+ROOT="$(dirname "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")")"
+exec python3 "$ROOT/redmine_cli_runtime.py" tickets live "$@"