Confirm interactive RSC permission updates

packages/cli/src/commands/app/rsc/index.ts

@@ -1,10 +1,11 @@
 import { Command } from 'commander';
-import { select, checkbox, Separator } from '@inquirer/prompts';
+import { select, checkbox, confirm, Separator } from '@inquirer/prompts';
 import pc from 'picocolors';
 import { createSilentSpinner } from '../../../utils/spinner.js';
 import { logger } from '../../../utils/logger.js';
 import { CliError, wrapAction } from '../../../utils/errors.js';
 import { outputJson } from '../../../utils/json-output.js';
+import { isAutoConfirm } from '../../../utils/interactive.js';
 import { getAccount, getTokenSilent, teamsDevPortalScopes } from '../../../auth/index.js';
 import {
   inferScope,
@@ -87,6 +88,17 @@ function printPermissionsTable(permissions: RscPermissionEntry[]): void {
   }
 }
 
+async function confirmPermissionUpdate(addedCount: number, removedCount: number): Promise<boolean> {
+  const parts: string[] = [];
+  if (addedCount > 0) parts.push(`add ${addedCount}`);
+  if (removedCount > 0) parts.push(`remove ${removedCount}`);
+
+  logger.info(pc.bold(`RSC permission changes: ${parts.join(', ')}`));
+
+  if (isAutoConfirm()) return true;
+  return confirm({ message: 'Apply RSC permission changes?', default: true });
+}
+
 /**
  * Show all permissions for a scope as a single checkbox list.
  * Already-enabled permissions are pre-checked.
@@ -171,6 +183,12 @@ async function editScopePermissions(
     return;
   }
 
+  const approved = await confirmPermissionUpdate(toAdd.length, toRemoveKeys.size);
+  if (!approved) {
+    logger.info(pc.dim('No changes made.'));
+    return;
+  }
+
   // Atomic update: keep non-scope perms + selected scope perms
   const otherScopePerms = current.filter((p) => !p.name.endsWith(scopeSuffix));
   const finalPerms = [...otherScopePerms, ...selected];