feat: hidden kosli list rego-policies and kosli get rego-policy, read published Rego policies

[jumboduck]

Implements the CLI side of kosli-dev/server#7080 with the read endpoints the server already has (kosli-dev/server#7311). Follows kosli publish rego-policy (#1256).

kosli list rego-policies [--page N] [-n N] [--search TEXT] [--sort updated_at|identifier] [--sort-direction asc|desc]
kosli get rego-policy IDENTIFIER [--policy-version N]

What it does

kosli list rego-policies: GET /api/v2/rego-policies/{org}.

• Table: IDENTIFIER, NAME, DESCRIPTION, CREATED BY, LAST UPDATED, then "Showing page X of Y, total Z rego policies". No policies: "No rego policies were found." (with the page number after page 1).
• --page / -n/--page-limit (from addListFlags), --search, --sort (sent as sort_by), --sort-direction. As in list environments and list controls, the sort values are checked by the server, not the CLI.

kosli get rego-policy IDENTIFIER: GET /api/v2/rego-policies/{org}/{identifier}.

• Shows the policy, its newest version with its status, and its current version (the highest-numbered valid one, which an evaluation runs) with its digest, input schema and params schema. With no valid version yet: "Current version: none, as no version is valid yet".

--policy-version N: GET .../versions/{n}.

• Shows status, the error kind and message for a rejected or failed version, digest, input schema, comment, who published it and when, when it was validated, OPA version, entrypoint and params schema.
• Exits 0 whatever the status: get only reads. (publish rego-policy exits 1 on a version that is not valid, because there it is the outcome of the command.)

Both commands: --output json prints the server answer as it is; a 404 or 403 is shown in the server's words.

Decisions worth a reviewer's attention

• Nouns rego-policies / rego-policy, not list policies --type rego / get policy as the #7080 draft says. get policy and list policies already exist for environment policies, and #7079 made rego policies a separate entity; this matches publish rego-policy.
• --policy-version, not --version. The CLI reads every flag from KOSLI_<FLAG>, and KOSLI_VERSION is often set to the CLI version to install (our Dockerfile.alpine, the docs, capture-managed). With --version, an exported KOSLI_VERSION=2.38.0 failed the command, and KOSLI_VERSION=2 silently showed version 2.
• Hidden and beta, no docs page, like publish rego-policy, while the endpoints are behind is-server-side-evaluation-enabled.
• The endpoint URLs are exported from internal/regopolicies (ListURL, PolicyURL, VersionURL), so publish, get and list escape the identifier as one path segment and refuse "", . and .. the same way. A refactor commit on its own.

Not in this PR

Each needs server work first:

• The current version and input schema in the list items. The policy document already holds current, but _list_item() does not return it. kosli-dev/server#7379
• Download of a version's files. Each version stores its bundle, but no route returns it. kosli-dev/server#7380
• A list of the versions of a policy (a separate command, or a flag on get rego-policy). The data layer can list versions; there is no route. kosli-dev/server#7381

Testing

• New: cmd/kosli/listRegoPolicies_test.go (11), a shared read fake, cmd/kosli/getRegoPolicy_test.go (16), internal/regopolicies/urls_test.go (4), all against stubbed servers.
• Empty-flag audit: entries in spec.json and the regenerated coverage.json.
• make test_integration passes (3585 tests, 53 skipped). make lint: 0 issues.
• Not yet done: a manual run against staging with an org that has is-server-side-evaluation-enabled.

🤖 Generated with Claude Code

[claude]

Claude finished @jumboduck's task in 1m 38s —— View job

---

Follow-up review of commit 2036f0b

• Fetched previous review comments and current resolution state
• Diffed 042e192e..2036f0be (the only new commit) and checked each touched hunk
• Checked for new bugs/regressions in the changed lines
• Posted summary

Previous findings — all three threads are resolved (author replies + isResolved: true on all three review threads):

1. Reuse regopolicies.Version (getRegoPolicy.go:169) — ✅ Resolved. printRegoPolicyVersionAsTable now unmarshals into the typed regopolicies.Version struct; the ok && != nil map-probing is gone and a new test (TestItPrintsAVersionWithANullFieldWithoutFormatNoise) checks a null field no longer prints %!s(<nil>).
2. Nil-field formatting nit (listRegoPolicies.go:158) — ✅ Resolved by explanation, not by code change. Author's reply argues identifier, name, created_by, digest, input_schema, version are required/non-null in the server's response models (deleted users are named "Unknown"), so the %!s(<nil>) scenario can't occur for those fields; the optional ones were already nil-checked. The get --policy-version path additionally benefits from the typed Version fix in (1). I didn't find anything in the diff that contradicts this.
3. Readability of the endpoint/err overwrite (getRegoPolicy.go) — ✅ Resolved. run() now builds endpoint/printTable with a single if/else, matching the suggested diff exactly.

New issues in the changed lines: none found. The --version → --policy-version rename is applied consistently across the command, help text, flag-audit spec.json/coverage fixture, and tests, and a new test (TestKosliVersionInTheEnvironmentDoesNotPickAVersion) confirms KOSLI_VERSION in the environment no longer collides with the flag.

No inline comments needed this round.