[Harshi-Shah-CS]

What

Jira: CL-7174

• A bare Enter skips the variables checklist. On a terminal with no variable source, projects:create and env:create ask "Add environment variables". That checkbox used to refuse an empty answer, so you had to tick "Skip adding environment variables" first. Now Enter with nothing ticked skips it and prints the same Skipped adding environment variables. line. The Skip choice stays, and combining it with a source is still a usage error. variables:set already accepted an empty answer and is unchanged.
• --no-vars is removed from projects:create and env:create, along with the noVarsAlone rule and the noVars request field. Variables are never required: a create without a terminal and with no source already sends an empty list and asks nothing, and on a terminal one Enter now skips. Passing --no-vars is now oclif's unknown-flag error, exit 2.
• AGENTS.md and the README are updated. The .talismanrc checksums are refreshed for the two test files Talisman flags on file name and wording (no secret).

One thing to know: whether create prompts depends on stdin being a terminal, not stdout. So a fully flagged create typed as … > deploy.log stops at the checklist, which is drawn into the file. A --var or </dev/null avoids that. Any missing value already behaves this way.

Stacked on #281. This branch includes that PR's deps commit, so its own commits pass the Snyk pre-commit hook. Review only the two fix(variables) commits. It will be rebased onto v2-dev once #281 merges.

Tests

• Unit: an empty pick passes the checkbox's validation and skips with the message. The --no-vars unit and rule tests are removed.
• Integration: env:create and projects:create on a terminal, with every other value given as a flag, ask only "Add environment variables", and a bare Enter creates with no variables. --no-vars is refused with exit 2 before any request.
• npm test: 193 suites, 3813 tests pass. Lint and typecheck are clean, and the changed files have 100% branch coverage.
• Harness follow-up: CL-7174 in contentstack/contentfly-dev-workspace (PR to follow).

#claude_code#
🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

[dhruv-parekh-cs]

Reviewed this PR's own changes on top of #281 (fcf225e..5dcf9bb): no high or medium issues. --no-vars never shipped in a release (absent from main, development and v1.11.x), so removing it breaks no released scripts. variables:set still calls chooseSources with skippable: false and requireOne: false, so it behaves as before.

Cross-repo (CL-7174): merge order is #281 → #282 → contentfly-dev-workspace#180. #180's 50-lifecycle GitHub create answers "Add environment variables" with a bare Enter, which a CLI built before #282 refuses (the checklist still requires a selection), so run the harness only against a CLI that includes #282.

— 🤖 launch-pr-review-agent (Claude)

---

Generated by Claude Code

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	2	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 0
• Medium without fixes: 2
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed

The merge-base changed after approval.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	2	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 0
• Medium without fixes: 2
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed

[dhruv-parekh-cs]

Reviewed the whole PR at f1d2215 (rebased onto v2-dev after #281 merged, so the earlier review's commit is no longer an ancestor): no high or medium issues.

Removing --no-vars breaks no released user: the flag only ever existed on v2-dev (not on main or development, and in no tag). The chooser keeps rejecting Skip combined with other sources, and variables:set (not skippable) behaves as before on an empty pick.

— 🤖 launch-pr-review-agent (Claude)

---

Generated by Claude Code