Interactive Safety and the --yes Flag

Protecting Users From Themselves

If your tool performs a destructive or irreversible action — deleting a database, terminating instances, wiping a volume — you should prompt the user for confirmation when running interactively:

Warning: This will permanently destroy the production database 'orders-db'.
This action cannot be undone. Are you sure? [y/N]:

The [y/N] convention means N (No) is the default if the user just presses Enter. This is a safety net against accidental keystrokes.

The Automation Problem:

If you put this tool into a CI/CD pipeline or a shell script, it will hang forever waiting for a human to type "y". The build will time out, the pipeline will fail, and the on-call engineer will be paged for what turns out to be a tool that asked a question nobody could answer.

The Solution — The --yes Flag:

Always provide a --yes or --force flag that skips the confirmation prompt. Your code pattern should be:

def confirm_destructive_action(message, skip_confirm=False):
    if skip_confirm:
        return True
    response = input(f"{message} [y/N]: ").strip().lower()
    return response == "y"

# Usage
if not confirm_destructive_action(
    "This will destroy the production database.",
    skip_confirm=args.yes
):
    print("Aborted.", file=sys.stderr)
    sys.exit(0)

The --dry-run Companion:

For complex operations, pair --yes with a --dry-run flag. --dry-run shows exactly what the tool would do without actually doing it. This lets users verify the plan before committing with --yes. The pattern mytool destroy --dry-run followed by mytool destroy --yes is a safe, auditable workflow for destructive operations.