@brunyee-studio/onus-cli 2.29.0 → 2.30.1

package/dist/bin.js

@@ -3,7 +3,7 @@ import {
   cliVersion,
   createApiClient,
   loginWithOAuth
-} from "./chunk-HJQGUY5T.js";
+} from "./chunk-NQJIFUZV.js";
 import {
   clearConfig,
   getConfigDirectory,
@@ -2250,7 +2250,7 @@ function registerWatchCommand(program2) {
     const opts = this.opts();
     let teamId = opts.team;
     if (teamId) {
-      const { createApiClient: createApiClient2 } = await import("./client-QNEDGCP7.js");
+      const { createApiClient: createApiClient2 } = await import("./client-CBLKSKYG.js");
       const client = createApiClient2({ token, apiUrl });
       teamId = await resolveTeamId(client, teamId);
     }

package/dist/{chunk-HJQGUY5T.js → chunk-NQJIFUZV.js}

@@ -3585,8 +3585,11 @@ function createApiClient(options = {}) {
     const baseFetch = options.fetchApi || fetch;
     const response = await baseFetch(url, init);
     if (response.status === 401 && !url.toString().includes("/oauth/token")) {
+      const hasExplicitToken = Boolean(
+        options.token || process.env.ONUS_TOKEN || process.env.ONUS_API_KEY
+      );
       const activeConfig = loadConfig();
-      if (activeConfig.refreshToken) {
+      if (activeConfig.refreshToken && !hasExplicitToken) {
         try {
           const baseUrl = getOAuthBaseUrl(basePath);
           const refreshed = await refreshAccessToken({

package/dist/{client-QNEDGCP7.js → client-CBLKSKYG.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   createApiClient
-} from "./chunk-HJQGUY5T.js";
+} from "./chunk-NQJIFUZV.js";
 import "./chunk-HE2HTZ3Y.js";
 export {
   createApiClient

package/dist/index.js

@@ -7450,8 +7450,11 @@ function createApiClient(options = {}) {
     const baseFetch = options.fetchApi || fetch;
     const response = await baseFetch(url, init);
     if (response.status === 401 && !url.toString().includes("/oauth/token")) {
+      const hasExplicitToken = Boolean(
+        options.token || process.env.ONUS_TOKEN || process.env.ONUS_API_KEY
+      );
       const activeConfig = loadConfig();
-      if (activeConfig.refreshToken) {
+      if (activeConfig.refreshToken && !hasExplicitToken) {
         try {
           const baseUrl = getOAuthBaseUrl(basePath);
           const refreshed = await refreshAccessToken({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brunyee-studio/onus-cli",
-  "version": "2.29.0",
+  "version": "2.30.1",
   "description": "Official CLI and TypeScript SDK for Onus issue tracking platform",
   "keywords": [
     "agent",

package/skills/onus-cli/SKILL.md

@@ -16,8 +16,14 @@ onus auth status       # check current auth state
 ONUS_TOKEN=<token> onus me --json   # or auth via env var (ONUS_TOKEN / ONUS_API_KEY)
 onus --token <token> me --json      # or per-invocation override
 onus --api-url <url> …              # custom API base URL
+onus auth logout       # clear stored credentials
 ```
 
+Explicit token overrides (`--token` or `ONUS_TOKEN` / `ONUS_API_KEY`) take
+precedence over stored credentials and **fail hard with exit 3** when the API
+rejects them — they are never silently rescued by the stored session.
+Transparent refresh on 401 applies only to the stored config-file session.
+
 ## Golden rules
 
 - **Starting work on an issue: transition it to `in_progress` immediately.** As soon as you pick up an issue to implement it — before writing any code — run `onus issue update <ref> --status in_progress --json`. No update needed if `onus issue get <ref> --json` already shows the status is `in_progress` or `done`.
@@ -82,6 +88,38 @@ onus issue update ENG-42 --remove-label <labelId> --assignee <userId> --json
 onus issue delete ENG-42 --yes            # skip confirmation
 ```
 
+## Templates
+
+Per-team reusable issue templates; `--default` marks a team's default:
+
+```bash
+onus template list --team ONUS --json
+onus template create --team ONUS --name "Bug report" --priority high --default --json
+onus template get <id> --json
+onus template update <id> --title "New title" --add-label <labelId> --json   # alias: template edit
+onus template delete <id> --yes
+```
+
+`onus issue create --template <nameOrId>` fills omitted fields from the template.
+
+## Bulk operations
+
+`issue bulk-update` / `issue bulk-comment` apply to many issues with per-item partial success:
+
+```bash
+onus issue bulk-update ENG-42 ENG-43 --status done --json
+onus issue bulk-comment ENG-42 ENG-43 --body "Deployed in v2.31" --idempotency-key run-17 --json
+onus issue bulk-update --file ./items.json --json   # per-item payloads; see --help for the format
+```
+
+## Create projects
+
+```bash
+onus project create --name "Mobile app" --team ONUS --lead <userId> \
+  --description-file ./brief.md --agent-context-file AGENTS.md --json
+onus project attachment list <projectId> --json
+```
+
 ## Long text via file input
 
 Multi-line values (issue and project descriptions, comment bodies, project
@@ -125,14 +163,28 @@ onus analytics events --team ONUS --limit 25 --json
 onus analytics query --team ONUS --query '{"type":"trends","series":[{"event":"signup"}]}' --json
 ```
 
+## Watch (live events)
+
+```bash
+onus watch --team ONUS --type issue.status_changed,error_group.regressed --json
+```
+
+Streams live issue/comment/error events over SSE with automatic resume.
+
 ## Relations, attachments, subscriptions
 
 ```bash
 onus issue relation add ENG-42 --with ENG-43 --type blocks --json   # types: blocks|duplicate|related|similar
 onus issue attachment upload ENG-42 --file ./notes.md --json
+onus issue relation remove ENG-42 --relation <relationId> --json
+onus issue attachment upload ENG-42 --file ./notes.md --json
 onus issue attachment list ENG-42 --json
+onus issue attachment download ENG-42 --attachment <attachmentId> --output ./notes.md --json
+onus issue attachment delete ENG-42 --attachment <attachmentId> --json
 onus issue subscribe ENG-42 --json
+onus issue unsubscribe ENG-42 --json
 onus issue link-pr ENG-42 --repo owner/repo --pr 42 --json    # link a GitHub pull request
+onus issue unlink-pr ENG-42 --pr-link <linkId> --json         # remove a linked pull request
 ```
 
 ## Errors and ingest keys (DSN)
@@ -140,30 +192,59 @@ onus issue link-pr ENG-42 --repo owner/repo --pr 42 --json    # link a GitHub pu
 ```bash
 onus dsn list --team ONUS --json          # masked ingest keys for a team
 onus dsn create --team ONUS --label ci    # prints the full secret exactly once
+onus dsn rotate <keyId> --grace-seconds 86400 --json   # old secret stays valid during the grace window
+onus dsn disable <keyId> --json           # reversible
+onus dsn enable <keyId> --json            # re-enable a disabled key
+onus dsn revoke <keyId> --json            # terminal
 ```
 
 ## Pull requests and issues
 
 Linking a PR to an issue means **the issue is auto-closed when the PR merges** —
-there is no "related" link type. How links are created:
-
-- **Auto-linking is GitHub-style.** The integration scans the PR title, body,
-  and branch name for `KEY-123` refs introduced by a closing keyword —
-  `Fixes` / `Closes` / `Resolves` (case-insensitive, optional colon, comma/
-  `and` lists). A plain prose mention of an issue ID does NOT link and never
-  auto-closes, so avoid writing bare issue IDs in PR text: use the issue's
-  name or its Onus URL instead.
-- **Manual linking is deliberate.** `onus issue link-pr` creates a bot link
-  that survives body edits and closes on merge — use it when the PR fully
-  resolves an issue but its text has no closing keyword.
-- **Only link PRs that actually fix/close the issue.** If a PR merely touches
-  related code, discusses the issue, or implements part of it without completing
-  it, do NOT link it (no keyword in the PR text, no `link-pr`). Use a relation
-  (`onus issue relation add … --type related`) or a comment mention instead.
-- Never guess or assume: before linking, verify the PR's changes fully resolve
-  the issue (e.g. you implemented the fix in that PR, or the PR description
-  says "Fixes ONUS-42").
+there is no "related" link type.
+
+**Always link manually with `onus issue link-pr`. Never rely on the fix
+keyword.** The integration also scans the PR title, body, and branch name for
+`KEY-123` refs introduced by a closing keyword (`Fixes` / `Closes` /
+`Resolves` — case-insensitive, optional colon, comma/`and` lists), but agents
+must never depend on that scan and must never write a closing keyword before
+an Onus issue ref in PR text or a branch name. Reference issues in PR text by
+name or their Onus URL, never as bare issue IDs.
+
+Required PR flow, in order:
+
+1. **Create the PR** (push the branch, open the PR with `gh`).
+2. **Determine whether the PR closes the issue.** It closes the issue only if
+   the PR fully resolves it — you implemented the whole fix in that PR. A PR
+   that merely touches related code, discusses the issue, or implements part
+   of it without completing it does not close it.
+3. **Link it.** If (and only if) step 2 says yes, run:
+
+   ```bash
+   onus issue link-pr <ref> --repo owner/repo --pr <number> --json
+   ```
+
+   The bot link survives PR-body edits and closes the issue on merge. If the
+   PR does not close the issue, leave it unlinked — use a relation
+   (`onus issue relation add … --type related`) or a comment mention instead.
+
+- Never guess or assume: link only issues you know the PR fully resolves.
 - Link at most once per PR per issue; don't spam links across partially-related
   issues.
 
+## Skill management
+
+The CLI bundles this skill and can install/update it for detected AI agents:
+
+```bash
+onus skill install --agent claude-code codex   # or --global / --copy; see --help
+onus skill update                              # refresh installed copies to the bundled version
+onus skill remove --global                     # alias: skill rm
+```
+
+## Command aliases
+
+`issue get` = `issue view`, `issue update` = `issue edit`, `template update` = `template edit`,
+`skill remove` = `skill rm`.
+
 Run any command with `--help` for its exact flags — e.g. `onus issue relation add --help`.