[cscheid]

Problem

Without a terminal (--no-prompt, --json, CI, an agent shell), you could not dry-run q2 add or q2 use brand against a remote source. Each error told you to do what the other forbade:

• without --trust: "Refusing to download … Re-run with --trust"
• with --trust: "--trust cannot be combined with --dry-run"

The guard's rationale ("--dry-run writes nothing, so there is nothing for --trust to authorize") is right for --force but wrong for --trust. A dry run of a remote source still downloads it to build the [Install]/[Update]/[No Change] table (add) or the file plan (use brand), and the trust gate governs that download.

Strand: bd-cjqhcaz6, discovered while installing posit-dev/product-doc-theme (bd-0i6fii0k).

Changes

• Guards (add/mod.rs, use_cmd/mod.rs): only --force is rejected with --dry-run. The comments now say why --trust is different.
• Mode-aware refusal hint (both confirm_trust functions): a refused dry run is told to re-run with --dry-run --trust, a refused real run with --trust. Both functions already read req.dry_run, so no new parameter was needed.
• Consent stays required in every mode. A dry run without --trust and with no terminal is still refused before any request. An interactive dry run still asks the trust question before downloading.
• Shared test fixture: the localhost archive server and tar_gz moved from add.rs into tests/integration/archive_server.rs so use_brand.rs can use them too.
• Docs: extensions.qmd and brand.qmd explain that a dry run of a remote source needs trust, why a preview can prompt, and that --trust works with --dry-run while --force does not.
• Plan: claude-notes/plans/2026-10-27-trust-with-dry-run.md records the investigation and the design decisions.

Tests

New or rewritten. All failed before the fix and pass after it:

• add::a_trusted_remote_dry_run_shows_the_table_and_writes_nothing: prints the [Install] table, leaves _extensions/ absent, makes exactly one request.
• add::a_remote_dry_run_without_trust_is_refused_before_any_request: zero requests, and the hint names --dry-run --trust.
• use_brand::trust_with_dry_run_previews_a_remote_source_and_writes_nothing: replaces trust_with_dry_run_is_rejected.
• use_brand::a_remote_dry_run_without_trust_is_refused_before_any_request
• Unit tests the_trust_refusal_hint_matches_the_mode in add/resolve.rs and use_cmd/brand.rs.
• The existing add refusal test now also checks that the real-run hint does not mention --dry-run. --force --dry-run stays rejected in both commands (existing tests).

cargo xtask verify (full, including the hub build) passes locally on macOS.

Windows: cargo clippy -p quarto --all-targets --target x86_64-pc-windows-msvc cannot cross-check from macOS: the ring and aws-lc-sys build scripts fail to compile C for MSVC. The change adds no platform-specific code. The moved test server uses std::net::TcpListener on loopback, unchanged from before.

🤖 Generated with Claude Code

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.