@brunyee-studio/onus-cli 2.30.0 → 2.30.1

package/dist/bin.js

@@ -3,7 +3,7 @@ import {
   cliVersion,
   createApiClient,
   loginWithOAuth
-} from "./chunk-HJQGUY5T.js";
+} from "./chunk-NQJIFUZV.js";
 import {
   clearConfig,
   getConfigDirectory,
@@ -2250,7 +2250,7 @@ function registerWatchCommand(program2) {
     const opts = this.opts();
     let teamId = opts.team;
     if (teamId) {
-      const { createApiClient: createApiClient2 } = await import("./client-QNEDGCP7.js");
+      const { createApiClient: createApiClient2 } = await import("./client-CBLKSKYG.js");
       const client = createApiClient2({ token, apiUrl });
       teamId = await resolveTeamId(client, teamId);
     }

package/dist/{chunk-HJQGUY5T.js → chunk-NQJIFUZV.js}

@@ -3585,8 +3585,11 @@ function createApiClient(options = {}) {
     const baseFetch = options.fetchApi || fetch;
     const response = await baseFetch(url, init);
     if (response.status === 401 && !url.toString().includes("/oauth/token")) {
+      const hasExplicitToken = Boolean(
+        options.token || process.env.ONUS_TOKEN || process.env.ONUS_API_KEY
+      );
       const activeConfig = loadConfig();
-      if (activeConfig.refreshToken) {
+      if (activeConfig.refreshToken && !hasExplicitToken) {
         try {
           const baseUrl = getOAuthBaseUrl(basePath);
           const refreshed = await refreshAccessToken({

package/dist/{client-QNEDGCP7.js → client-CBLKSKYG.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   createApiClient
-} from "./chunk-HJQGUY5T.js";
+} from "./chunk-NQJIFUZV.js";
 import "./chunk-HE2HTZ3Y.js";
 export {
   createApiClient

package/dist/index.js

@@ -7450,8 +7450,11 @@ function createApiClient(options = {}) {
     const baseFetch = options.fetchApi || fetch;
     const response = await baseFetch(url, init);
     if (response.status === 401 && !url.toString().includes("/oauth/token")) {
+      const hasExplicitToken = Boolean(
+        options.token || process.env.ONUS_TOKEN || process.env.ONUS_API_KEY
+      );
       const activeConfig = loadConfig();
-      if (activeConfig.refreshToken) {
+      if (activeConfig.refreshToken && !hasExplicitToken) {
         try {
           const baseUrl = getOAuthBaseUrl(basePath);
           const refreshed = await refreshAccessToken({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brunyee-studio/onus-cli",
-  "version": "2.30.0",
+  "version": "2.30.1",
   "description": "Official CLI and TypeScript SDK for Onus issue tracking platform",
   "keywords": [
     "agent",

package/skills/onus-cli/SKILL.md

@@ -16,8 +16,14 @@ onus auth status       # check current auth state
 ONUS_TOKEN=<token> onus me --json   # or auth via env var (ONUS_TOKEN / ONUS_API_KEY)
 onus --token <token> me --json      # or per-invocation override
 onus --api-url <url> …              # custom API base URL
+onus auth logout       # clear stored credentials
 ```
 
+Explicit token overrides (`--token` or `ONUS_TOKEN` / `ONUS_API_KEY`) take
+precedence over stored credentials and **fail hard with exit 3** when the API
+rejects them — they are never silently rescued by the stored session.
+Transparent refresh on 401 applies only to the stored config-file session.
+
 ## Golden rules
 
 - **Starting work on an issue: transition it to `in_progress` immediately.** As soon as you pick up an issue to implement it — before writing any code — run `onus issue update <ref> --status in_progress --json`. No update needed if `onus issue get <ref> --json` already shows the status is `in_progress` or `done`.
@@ -82,6 +88,38 @@ onus issue update ENG-42 --remove-label <labelId> --assignee <userId> --json
 onus issue delete ENG-42 --yes            # skip confirmation
 ```
 
+## Templates
+
+Per-team reusable issue templates; `--default` marks a team's default:
+
+```bash
+onus template list --team ONUS --json
+onus template create --team ONUS --name "Bug report" --priority high --default --json
+onus template get <id> --json
+onus template update <id> --title "New title" --add-label <labelId> --json   # alias: template edit
+onus template delete <id> --yes
+```
+
+`onus issue create --template <nameOrId>` fills omitted fields from the template.
+
+## Bulk operations
+
+`issue bulk-update` / `issue bulk-comment` apply to many issues with per-item partial success:
+
+```bash
+onus issue bulk-update ENG-42 ENG-43 --status done --json
+onus issue bulk-comment ENG-42 ENG-43 --body "Deployed in v2.31" --idempotency-key run-17 --json
+onus issue bulk-update --file ./items.json --json   # per-item payloads; see --help for the format
+```
+
+## Create projects
+
+```bash
+onus project create --name "Mobile app" --team ONUS --lead <userId> \
+  --description-file ./brief.md --agent-context-file AGENTS.md --json
+onus project attachment list <projectId> --json
+```
+
 ## Long text via file input
 
 Multi-line values (issue and project descriptions, comment bodies, project
@@ -125,14 +163,28 @@ onus analytics events --team ONUS --limit 25 --json
 onus analytics query --team ONUS --query '{"type":"trends","series":[{"event":"signup"}]}' --json
 ```
 
+## Watch (live events)
+
+```bash
+onus watch --team ONUS --type issue.status_changed,error_group.regressed --json
+```
+
+Streams live issue/comment/error events over SSE with automatic resume.
+
 ## Relations, attachments, subscriptions
 
 ```bash
 onus issue relation add ENG-42 --with ENG-43 --type blocks --json   # types: blocks|duplicate|related|similar
 onus issue attachment upload ENG-42 --file ./notes.md --json
+onus issue relation remove ENG-42 --relation <relationId> --json
+onus issue attachment upload ENG-42 --file ./notes.md --json
 onus issue attachment list ENG-42 --json
+onus issue attachment download ENG-42 --attachment <attachmentId> --output ./notes.md --json
+onus issue attachment delete ENG-42 --attachment <attachmentId> --json
 onus issue subscribe ENG-42 --json
+onus issue unsubscribe ENG-42 --json
 onus issue link-pr ENG-42 --repo owner/repo --pr 42 --json    # link a GitHub pull request
+onus issue unlink-pr ENG-42 --pr-link <linkId> --json         # remove a linked pull request
 ```
 
 ## Errors and ingest keys (DSN)
@@ -140,6 +192,10 @@ onus issue link-pr ENG-42 --repo owner/repo --pr 42 --json    # link a GitHub pu
 ```bash
 onus dsn list --team ONUS --json          # masked ingest keys for a team
 onus dsn create --team ONUS --label ci    # prints the full secret exactly once
+onus dsn rotate <keyId> --grace-seconds 86400 --json   # old secret stays valid during the grace window
+onus dsn disable <keyId> --json           # reversible
+onus dsn enable <keyId> --json            # re-enable a disabled key
+onus dsn revoke <keyId> --json            # terminal
 ```
 
 ## Pull requests and issues
@@ -176,4 +232,19 @@ Required PR flow, in order:
 - Link at most once per PR per issue; don't spam links across partially-related
   issues.
 
+## Skill management
+
+The CLI bundles this skill and can install/update it for detected AI agents:
+
+```bash
+onus skill install --agent claude-code codex   # or --global / --copy; see --help
+onus skill update                              # refresh installed copies to the bundled version
+onus skill remove --global                     # alias: skill rm
+```
+
+## Command aliases
+
+`issue get` = `issue view`, `issue update` = `issue edit`, `template update` = `template edit`,
+`skill remove` = `skill rm`.
+
 Run any command with `--help` for its exact flags — e.g. `onus issue relation add --help`.