Consume positional source/target left-to-right across commands

[Soph]

Problem

sync/replicate/plan, bootstrap, and probe consumed positional args by fixed index (args[0]→source, args[1]→target):

if req.Source.URL == "" && len(args) > 0 { req.Source.URL = args[0] }
if req.Target.URL == "" && len(args) > 1 { req.Target.URL = args[1] }

So --source-url URL <target> left the lone positional in args[0] and the target slot empty:

• sync/bootstrap/plan errored with "requires source and target".
• probe failed silently — the target was dropped and only the source probed.

convert-sha256 already did the correct left-to-right consumption (resolveConvertSHA256Args); the rule was just never applied to the others.

Fix

Extract that left-to-right consumption into a shared resolvePositionalEndpoints(source, target *string, args []string) error helper and route all four commands through it. When a positional is left over after both slots are filled — e.g. a flag-supplied source plus two positionals (sync --source-url X a b) — it returns an error rather than silently ignoring one (the old fixed-index code dropped a positional here too). This complements cobra.MaximumNArgs(2), which only bounds the count.

fetch is intentionally left alone — it takes a single source-only positional, has no mixed-form ambiguity, and doesn't fit the two-endpoint helper.

Tests

args_test.go covers both-positional, source-flag+positional-target, target-flag+positional-source, both-flags, source-only, and the two over-specified cases that must now error. Existing resolveConvertSHA256Args table test still passes against the shared helper.

🤖 Generated with Claude Code

---

Note

Low Risk
CLI-only argument parsing; behavior change is more correct invocation and stricter rejection of ambiguous extra positionals, with no auth or sync-engine logic touched.

Overview
Fixes mixed flag/positional usage so forms like --source-url URL <target> correctly fill the target slot instead of treating the lone positional as source and failing (or, for probe, silently dropping the target).

Adds shared resolvePositionalEndpoints in flags.go and wires bootstrap, probe, sync / replicate / plan, and convert-sha256 through it, replacing fixed args[0]/args[1] indexing. Extra positionals after both endpoints are set now return an explicit error instead of being ignored.

args_test.go exercises mixed flag/positional cases and the over-specified error paths.

^{Reviewed by Cursor Bugbot for commit 653abf2. Configure here.}