To your first comment, I work in tools and infra at $bigco, and at this point I essentially require that any newish tool expose an internal API that the tool is

To your first comment, I work in tools and infra at $bigco, and at this point I essentially require that any newish tool expose an internal API that the tool is an unprivileged consumer of. CLI? Your Python or Java binary should be a flag parser that calls all logic out to a library. Web api? It consumes an internal library and the server just parses and passes arguments. (Obviously this doesn't always work for rich interactive apps, but often things aren't). Then adding a new interface is easy (and can sometimes be done automatically). It took a new hire on my team like 2 days to add a new interface to a tool that followed this pattern, when I've asked other teams for similar, estimates in weeks :/ It also has a side effect of improved testability and maintainability.