feat(smartgroup): pro smart-group templates — 23 curated smart groups across 5 categories

[ktn-jamf]

Summary

Adds a new pro smart-group namespace (alias pro sg) with 4 subcommands and a curated library of 23 smart-group templates across 5 operational categories: encryption, software updates, MDM health, compliance basics, and lifecycle hygiene.

Admins go from "I need a smart group for [common operational case]" to a working smart group in one command. Templates encode operational knowledge sourced and verified byte-for-byte against the JSS server source for criterion-name strings.

New commands

Command	Purpose
pro sg templates [--category X]	List the 23 templates (table or JSON)
pro sg preview --template <slug> [params]	Show the JSON body that would POST — no API call
pro sg apply --template <slug> --name <NAME> [params] [--recalculate] [--dry-run] [--yes]	Idempotent create-or-update by name with post-apply membership check
pro sg verify-templates [--category X] [--no-cleanup]	Smoke-test every template against the live tenant; report OK / zero-match / error per template

Template library (23 templates, 5 categories)

encryption (6): not-encrypted, invalid-recovery-key, escrow-missing, irk-only-deprecated, encryption-stalled, fv-ineligible.

updates (4): os-version-below, major-version-behind, rsr-not-applied, beta-os.

mdm (5): bootstrap-token-missing, user-approved-mdm-no, stale-checkin, mdm-cert-expiring, declarative-management-disabled.

compliance (4): gatekeeper-disabled, sip-disabled, firewall-disabled, non-compliant-baseline.

lifecycle (4): unsupervised, ade-enrolled, jamf-binary-outdated, fv-ineligible-hardware.

Architecture

• New internal/smartgroup/ package — Template + ParamSpec types, criterion-name constants (JSS-cited), library registry with Register/Lookup/All/ByCategory/FuzzyMatch, membership-count helper, verify-runner. Tests in isolation: ~42 tests covering type validation, criterion uniqueness, registry behavior, per-template golden JSON, library integration (23 subtests).
• New internal/commands/pro_smartgroup.go — cobra namespace + 4 subcommands. Tests cover all flags + happy/error paths with mocked HTTP.
• Wire-up: pro.go (+1 line), groups.go (+1 entry under Computer Management), aliases.go (+1 entry pro sg).
• No generator changes. No spec changes. Reuses existing cliCtx.Client.Do HTTP path and existing /v2/computer-groups/smart-groups endpoints.

Design docs

• docs/solutions/design-patterns/pro-smart-group-templates-spec-2026-05-12.md — full design with criterion-name registry citations
• docs/solutions/design-patterns/pro-smart-group-templates-plan-2026-05-12.md — 17-task TDD implementation plan

Live test results (ktn tenant)

Round 1 caught 4 string bugs. Round 2 caught 2 more. All 6 fixed (separate fix commits with JSS source citations in commit messages):

• encryption/not-encrypted value: "Not Encrypted" → "No Partitions Encrypted" (per ComputerFileVault2Status enum)
• CriterionJamfBinaryVersion: "Jamf Binary Version" → "JAMF Binary Version" (per JamfBinaryVersionMatcher.java @Component annotation)
• compliance/gatekeeper-disabled value: "Disabled" → "Off" (per ComputerGatekeeperStatus)
• mdm/mdm-cert-expiring searchType: "less than x days from now" → "in less than x days" (per SearchCriteriaOperator.IN_LESS_THAN_DAYS)
• lifecycle/jamf-binary-outdated: parameterized "less than" operator was invalid → zero-param using "not current" operator (operationally better — no version-threshold maintenance burden)
• lifecycle/ade-enrolled: wrong criterion (PreStage profile name) → correct Boolean criterion "Enrolled via Automated Device Enrollment"

Final live-test result on ktn: 0 errors, 18 OK, 5 zero-match warnings — and the 5 remaining warnings are characteristic of a healthy fleet (Gatekeeper enabled, SIP enabled, no legacy IRK, no MDM certs expiring soon, no beta OS).

Test plan

• Unit tests: ~42 pass in internal/smartgroup/ (types, criteria, library, 23 template goldens, library integration, membership, verify)
• Unit tests: pass in internal/commands/ (templates / preview / apply / verify-templates with mocked HTTP)
• go test ./... — all 29 packages green
• make lint — 0 issues
• make build — clean
• Live test: bin/jamf-cli pro sg verify-templates against ktn tenant — 0 errors, 18 OK
• Reviewer: spot-check criterion-name citations against a recent JSS sync
• Reviewer: try a no-op apply --dry-run of a few templates
• Reviewer: run pro sg verify-templates --category encryption against their own tenant

🤖 Generated with Claude Code

[neilmartin83]

Review — pro smart-group templates

Tested live against pro-nmartin and platform-nmartin. Core library, criterion-name registry, and API integration are solid. Three issues need fixing before merge; one more worth fixing.

---

Must Fix

1. --dry-run flag collision breaks global -n shorthand

newSmartGroupApplyCmd defines cmd.Flags().BoolVar(&dryRun, "dry-run", ...) locally. Root already defines cmd.PersistentFlags().BoolVarP(&dryRun, "dry-run", "n", ...) as a persistent flag. Two definitions of --dry-run in the same cobra flag set cause the global -n shorthand to fail:

$ bin/jamf-cli -p pro-nmartin -n pro smart-group apply --template encryption/not-encrypted --name x
unknown shorthand flag: 'n' in -n

Local --dry-run works fine; global -n doesn't. Fix: remove the local --dry-run from apply and route through the global flag (read cmd.Root().PersistentFlags().GetBool("dry-run") or pass via cliCtx), or rename the local flag to --preview to avoid the clash.

2. verify-templates --json is inconsistent with the rest of the CLI

Every other command uses -o json / --output. verify-templates has its own --json bool flag. Change to -o/--output string with table|json, matching the templates subcommand.

3. Invalid --category silently exits 0

$ bin/jamf-cli pro smart-group verify-templates --category bogus
Verifying 0 templates...
Summary: 0 OK, 0 zero-match warnings, 0 errors.

Exit 0. Same for templates --category bogus. Both commands should validate against smartgroup.Categories() and return an error on unknown input.

---

Also Fix Before Merge

VerifyResult JSON output has no struct tags — serialises ugly

{ "Slug": "...", "Outcome": 0, "MemberCount": 2, "Error": "" }

• Fields are PascalCase (should be camelCase with json: tags)
• Outcome serialises as int 0/1/2 rather than "OK"/"ZERO_MATCH"/"ERROR" — add MarshalText on VerifyOutcome or convert to string before encode

---

Minor / Nits

Leftover lint-suppression vars in pro_smartgroup_test.go:85–89 — context and http are already used directly in the tests now; delete the block.

TestTemplates_JSONOutput hardcodes 23 — will fail when a template is added without updating the test. Use len(smartgroup.All()) instead.

defaultVerifyOpts in verify.go hardcodes major-below: 15 — add a comment pointing to where to bump when macOS 16 ships.

encryption/escrow-missing uses Value: "" — empty string for is searchType is unusual. Confirmed it matched 4 devices live, but add a comment explaining JSS interprets empty string as "no recovery key type set."

---

Live Test Results

Profile	Category	Result
pro-nmartin	encryption	4 OK, 2 zero-match (irk-only-deprecated, not-encrypted — expected on healthy fleet)
pro-nmartin	mdm	5/5 OK
platform-nmartin	mdm	5/5 OK (Pro API routed through gateway)
platform-nmartin	updates	3 OK, 1 zero-match (beta-os — expected)
Create + update + delete cycle	—	All working
Idempotency guard (missing --yes)	—	Correct error returned

Criterion strings are clean. The two zero-match encryption results match the author's own test report for a healthy fleet.

---

Verdict: Fix the four items above (three must-fix + JSON tags), then this is good to merge.