Automation

Automate the stable parts.

Practical shell and integration patterns, plus the places where dove intentionally does not claim a machine-stable CLI contract yet.

Choose CLI or core by output contract

The CLI is good for human-in-the-loop scripts whose useful result is a printed link or a file on disk. Its progress and status output are human-readable and may change. For a program that needs typed IDs, sizes, expiration timestamps, or errors, call dove-core directly.

No JSON mode exists today. Do not depend on ANSI formatting, progress labels, or column spacing. A future machine-output flag would need an explicit compatibility contract.

Make the target account explicit

aws sso login --profile production
dove provision full --profile production --region us-west-2

The CLI still displays the resolved AWS account and asks for confirmation. That is deliberate protection around a rare privileged action. Ordinary share, ls, and revoke operations use the scoped key created during provisioning.

Share a generated artifact

set -euo pipefail

artifact="dist/nightly-report.pdf"
test -f "$artifact"
dove share "$artifact" --expires 24h --downloads 3

Capture CLI output only if you accept that it is a human-facing format. If another program must consume the link reliably, wrap Transfer::share and serialize only the fields your system owns.

Receive to a known path

dove get "$DOVE_SHARE_URL" --out ./incoming/report.pdf

A share URL contains decryption material after #. Treat the entire value as a secret: quote it, avoid shell tracing, redact it from job logs, and do not put it in command transcripts or telemetry. The current --pin value is also a command-line argument and may be visible to local process inspection; use it only within your threat model.

Isolate local state

export XDG_CONFIG_HOME="$PWD/.dove-runtime"
dove status

XDG_CONFIG_HOME relocates both config.toml and secrets.toml. DOVE_CONFIG overrides only the registry file, so it is useful for tests but does not fully isolate credentials. Ensure the chosen directory is excluded from version control and protected with appropriate filesystem permissions.

Operational checks

dove status
dove gate status
dove ls

status reports configured resources; it is not a comprehensive end-to-end health probe. ls reads storage and may use a local ledger to recover full-mode filenames. Build alerts against AWS metrics and the gate directly when you operate a high-consequence deployment.

Automation gaps

No stable JSON output.
No unattended provision confirmation flag.
No stdin upload contract.
No batch-share command.
No automatic infrastructure teardown.
No released external-backend subprocess protocol.

These are limitations, not invitations to guess hidden interfaces.