feat: confirm mutations and speed up describe (#22)

* feat: confirm mutations and speed up describe

- `deployment create`, `deployment refresh`, `project refresh` now emit a
  success line after the render, matching the convention used by every
  other mutating command.
- `describe_deployment` filters `/tasks` server-side by `deployment_name`
  and `status=completed` instead of pulling every project task and
  filtering client-side.

Refs RijksICTGilde/RIG-Cluster#51 for the structural fix (no GET
endpoint for deployment state) that would retire the task-fusion
pattern entirely.

* test: cover describe_deployment server-side task filter

Adds two respx tests:
- verifies the /tasks request carries `deployment_name` and
  `status=completed` query params
- verifies that tasks whose `result.deployment.name` doesn't match the
  requested deployment are dropped, as defense in depth against upstream
  contract drift (prefix matches, case folding, etc.)

Restores the `dep_info.get("name") != deployment` guard that was removed
in the previous commit; the server filter is the primary gate, the
client check is the safety net.

Author: anneschuth

src/zad_cli/api/client.py

@@ -504,14 +504,18 @@ def describe_deployment(self, project: str, deployment: str) -> dict:
                 }
             )
 
-        # Get URLs and image info from ALL completed tasks for this deployment
+        # Upstream has no `GET /projects/{p}/deployments/{d}` endpoint, so URLs
+        # and image refs are reconstructed from completed task history. Filter
+        # server-side to avoid paging all project tasks.
         urls = {}
         images: dict[str, str] = {}
-        task_response = self._request("GET", "/tasks", params={"project_name": project})
+        task_response = self._request(
+            "GET",
+            "/tasks",
+            params={"project_name": project, "deployment_name": deployment, "status": "completed"},
+        )
         tasks = task_response.json().get("tasks", [])
         for task in tasks:
-            if task.get("status") != "completed":
-                continue
             result = task.get("result") or {}
             if not isinstance(result, dict):
                 continue

src/zad_cli/commands/deployment.py

@@ -173,6 +173,7 @@ def create(
 
     result = client.upsert_deployment(project, request.to_api_payload())
     formatter.render(result)
+    formatter.render_success(f"Deployment '{deployment_name}' created/updated in project '{project}'.")
 
 
 @app.command("update-image")
@@ -236,6 +237,7 @@ def refresh(
 
     result = client.refresh_deployment(project, deployment, force_clone=force_clone)
     formatter.render(result)
+    formatter.render_success(f"Deployment '{deployment}' refreshed.")
 
 
 @app.command()

src/zad_cli/commands/project.py

@@ -101,6 +101,7 @@ def refresh(
 
     result = client.refresh_project(project, force_clone=force_clone)
     formatter.render(result)
+    formatter.render_success(f"Project '{project}' refreshed.")
 
 
 @app.command()

tests/test_client.py

@@ -144,3 +144,87 @@ def test_api_key_header(client):
     )
     client.health()
     assert route.calls[0].request.headers["X-API-Key"] == "test-key"
+
+
+@respx.mock
+def test_describe_deployment_filters_tasks_server_side(client):
+    """describe_deployment must narrow the /tasks query to the target deployment."""
+    respx.get("https://api.example.com/logs/my-project").mock(
+        return_value=httpx.Response(
+            200,
+            json={
+                "results": [
+                    {"component": "web", "deployment": "staging", "namespace": "ns-staging", "k8s_deployment": "web"},
+                ]
+            },
+        )
+    )
+    tasks_route = respx.get("https://api.example.com/tasks").mock(
+        return_value=httpx.Response(
+            200,
+            json={
+                "tasks": [
+                    {
+                        "status": "completed",
+                        "result": {
+                            "deployment": {
+                                "name": "staging",
+                                "components": [{"reference": "web", "image": "ghcr.io/org/web:v1"}],
+                            },
+                            "urls": {"staging": {"urls": {"web": "https://staging.example.com"}}},
+                        },
+                    },
+                ]
+            },
+        )
+    )
+
+    result = client.describe_deployment("my-project", "staging")
+
+    assert tasks_route.called
+    params = tasks_route.calls[0].request.url.params
+    assert params["project_name"] == "my-project"
+    assert params["deployment_name"] == "staging"
+    assert params["status"] == "completed"
+
+    assert result["urls"] == {"web": "https://staging.example.com"}
+    assert result["components"][0]["image"] == "ghcr.io/org/web:v1"
+
+
+@respx.mock
+def test_describe_deployment_ignores_tasks_with_mismatched_name(client):
+    """If the server filter ever leaks a mismatched task, the client guard must drop it."""
+    respx.get("https://api.example.com/logs/my-project").mock(
+        return_value=httpx.Response(
+            200,
+            json={
+                "results": [
+                    {"component": "web", "deployment": "staging", "namespace": "ns-staging", "k8s_deployment": "web"},
+                ]
+            },
+        )
+    )
+    respx.get("https://api.example.com/tasks").mock(
+        return_value=httpx.Response(
+            200,
+            json={
+                "tasks": [
+                    {
+                        "status": "completed",
+                        "result": {
+                            "deployment": {
+                                "name": "staging-prefix-leak",
+                                "components": [{"reference": "web", "image": "ghcr.io/org/web:wrong"}],
+                            },
+                            "urls": {"staging-prefix-leak": {"urls": {"web": "https://wrong.example.com"}}},
+                        },
+                    },
+                ]
+            },
+        )
+    )
+
+    result = client.describe_deployment("my-project", "staging")
+
+    assert result["urls"] == {}
+    assert result["components"][0]["image"] == ""