@bussolabs/closeyourit-cli 0.21.0 → 0.23.1

package/README.md

@@ -79,6 +79,15 @@ CLOSEYOURIT_TOKEN=cyi_u_… CLOSEYOURIT_API_URL=https://www.closeyour.it \
 | `errors list --project <id\|key> [--status] [--page]` | List error groups. |
 | `errors show <id> --project <id\|key>` | Show one error group. |
 | `errors resolve\|reopen\|mute\|unmute <id> --project <id\|key>` | Triage an error group. |
+| `errors bulk-triage --project <id\|key> --action resolve\|ignore\|reopen --group <id>…` | Triage several error groups in one call. Repeated ids are sent once. If the server does not return every group asked for — an id belonging to another project is dropped without a word — the command names the ones left out and exits non-zero: the rest were changed. |
+| `errors assign <id> --project <id\|key> (--assignee <id\|email> \| --unassign)` | Put an error group in someone's hands, or take it out. An account outside the organization is refused by the server in silence: the command checks the answer and exits non-zero instead of reporting an error handed to nobody. |
+| `errors merge <primary-id> --project <id\|key> --group <id>… --confirm` | Merge error groups into the primary: occurrences move, counters add up, the absorbed groups disappear. Irreversible. The ids travel raw, so one id the server cannot find in the project aborts the whole merge and nothing is half-done. |
+| `errors split <id> --project <id\|key> --event <event-id>…` | Pull some occurrences out into a new group. All-or-nothing too: an occurrence that is not in this group stops the split. Splitting every occurrence is refused — that would be a deletion. |
+| `errors delete <id> --project <id\|key> --confirm` | Delete an error group and every occurrence it holds (requires errors.destroy). Irreversible. |
+| `errors grouping-rules list --project <id\|key> [--page]` | The project's custom grouping rules, in the order they are applied. |
+| `errors grouping-rules create --project <id\|key> --field exception_type\|message\|culprit\|transaction --operator contains\|equals\|starts_with --value <text> --fingerprint-key <key> [--position] [--active\|--no-active]` | Add a rule: at ingest the first active rule that matches rewrites the fingerprint, and everything sharing a `--fingerprint-key` lands in one group. Matching is case-insensitive and never a regular expression. |
+| `errors grouping-rules update <id> --project <id\|key> [--field] [--operator] [--value] [--fingerprint-key] [--position] [--active\|--no-active]` | Change a rule, or turn it off without deleting it. At least one field is required. |
+| `errors grouping-rules delete <id> --project <id\|key> --confirm` | Delete a rule; the groups it already made stay where they are. |
 | `vulnerabilities list [--project <id\|key>] [--severity] [--status] [--package] [--page]` | List known dependency vulnerabilities across every visible project, worst first. |
 | `vulnerabilities show <id>` | Show one: advisory, package, manifest, fixing version. |
 | `vulnerabilities ignore <id> [--note]` / `reopen <id>` | Accept living with the risk, or change your mind (requires vulnerabilities.triage). |
@@ -92,6 +101,7 @@ CLOSEYOURIT_TOKEN=cyi_u_… CLOSEYOURIT_API_URL=https://www.closeyour.it \
 | `seo promote <id>` | Open a ticket from it, evidence included. |
 | `seo rescan --site <id>` | Check a site now, without waiting for the scheduled run (requires seo.manage). |
 | `seo-sites list [--project <id\|key>] [--page]` | The sites under SEO check, with cadence and open findings. |
+| `seo-sites show <id>` | One site in full: setup, open findings, last run and vitals. |
 | `seo-sites create --project <id\|key> --url <url> --environment <id> [--frequency] [--max-pages] [--no-sitemap]` | Declare a site to watch; the first check starts right away. |
 | `seo-sites update <id> [--url] [--frequency] [--max-pages] [--sitemap\|--no-sitemap] [--enable\|--disable]` | Change how a site is checked. |
 | `seo-sites delete <id>` | Stop watching a site and remove its pages and findings. |
@@ -107,11 +117,18 @@ CLOSEYOURIT_TOKEN=cyi_u_… CLOSEYOURIT_API_URL=https://www.closeyour.it \
 | `secrets assets download <id> --project <id\|key> --output <path> [--version] [--force]` | Decrypt to an explicit `0600` file; refuses overwrite by default. |
 | `secrets assets versions\|rollback\|archive\|purge …` | Manage immutable versions, restore, archive or owner-only permanent purge. |
 | `secrets assets shared-list\|shared-upload\|delegate\|undelegate …` | Manage one organization-level ciphertext and delegate it to authorized projects. |
+| `shared list` | List the organization shared secret variables (name, description, last update); automatically fetches all pages. Never prints values. |
+| `shared set --environment <code\|id> NAME=VALUE [--description]` | Create or update a shared variable on one environment (`NAME --value <v>` also works). Projects delegated on that environment read the new value. Requires `shared_secrets.manage`. |
+| `shared delete <name\|id> --confirm` | Delete a shared variable from **every** environment at once (there is no per-environment deletion). Irreversible. |
+| `vault requests list` | List the secret changes waiting for a second approval, across every visible project (org-level, no `--project`). Shows the name and the intent, never the proposed value. |
+| `vault requests approve <id>` | Apply a pending secret change. Four-eyes: whoever asked for it cannot approve it, and a service account never decides — only a person. |
+| `vault requests reject <id> --reason <why>` | Freeze a pending secret change as rejected; nothing changes in the vault and the reason reaches whoever asked. `--reason` is required and cannot be blank. |
 | `tickets list --project <id\|key> [--page]` | List tickets. |
 | `tickets show <id> --project <id\|key>` | Show one ticket. |
 | `tickets create --project <id\|key> --title <t> [--kind bug\|story\|task\|epic] [--parent-id] [--step-*] [--description] [--status <code\|label\|id>] [--priority <code\|label\|id>]` | Create a ticket. `--status` defaults to `open` and `--priority` to `medium`, and both take a code or a label (`in_progress`, `"In Progress"`), so no id lookup is needed. Length caps: title 255, description 4000, technical analysis 1500 characters — every field over the cap is listed at once, before the call. |
 | `tickets statuses` | List the org ticket statuses (id, code, label) — any of the three works as `--status`. |
 | `tickets priorities` | List the org ticket priorities (id, code, label) — any of the three works as `--priority`. |
+| `tickets ask <question…> [--timeout <seconds>]` | Ask a natural-language question across every ticket you can see (no `--project`: it spans them all); the AI answers and cites the tickets it used. Waits for the answer, then gives up saying so. |
 | `tickets report <id\|code> --project <id\|key> (--body <text> \| --body-file <path>)` | Write the work report — the long text a comment cannot hold (max 20000 characters). Each write adds a version, it never overwrites the previous one. |
 | `tickets report-show <id\|code> --project <id\|key> [--version <n>]` | Show the current work report, or a past version. |
 | `tickets report-versions <id\|code> --project <id\|key> [--page]` | List the versions of the work report (newest first). |
@@ -127,29 +144,40 @@ CLOSEYOURIT_TOKEN=cyi_u_… CLOSEYOURIT_API_URL=https://www.closeyour.it \
 | `tickets lease claim <id\|code> --project <id\|key> [--ttl <seconds>] [--run-id <id>]` | Claim the working lease on a ticket (server default TTL: 8h). Exits non-zero on a 409, naming the current holder and its expiry. |
 | `tickets lease renew <id\|code> --project <id\|key> [--ttl <seconds>] [--run-id <id>]` | Extend your own lease before it expires. |
 | `tickets lease release <id\|code> --project <id\|key> [--run-id <id>]` | Release your own lease so someone else can claim the ticket. |
+| `tickets work-context <id\|code> --project <id\|key> [--full]` | Show the work context frozen at claim time: the references and procedures actually delivered, never the project's current guidance. `--full` also prints their frozen text. The snapshot is taken only when an automation host claims the ticket from the queue, so a ticket claimed by hand has none: that case exits non-zero with `R404-TICKET-004`, spelling out why. Reading it needs `tickets.audit.view`. |
 | `ideas delete <id> --project <id\|key> --confirm` | Delete an idea (author always allowed; others need ideas.delete). |
 | `ideas archive\|unarchive <id> --project <id\|key>` | Archive an idea (open → archived) / reopen it. |
 | `ideas case-update <idea-id> <case-id> --project <id\|key> [--title] [--description]` | Update a case (example) of an idea. |
 | `ideas case-delete <idea-id> <case-id> --project <id\|key> --confirm` | Delete a case from an open idea. |
 | `metrics list --project <id\|key> [--kind] [--page]` | List metric groups. |
 | `metrics show <id> --project <id\|key>` | Show one metric group. |
+| `metrics bulk-triage --project <id\|key> --action resolve\|ignore\|reopen --group <id>…` | Triage several metric groups in one call — same rules as `errors bulk-triage`, including the refusal to call a partial selection a success. |
 | `logs list [--project <id\|key>] [--level] [--trace-id] [--environment] [--page]` | List structured log entries. Cross-app: omit `--project` for the full visible stream. |
 | `logs show <id>` | Show a single log entry (attributes, trace id, correlation). |
 | `logs link <id> --to <Errors::Group:uuid\|Ticketing::Ticket:uuid>` | Manually link a log entry to an error group or ticket. |
 | `logs unlink <id> <link-id> --confirm` | Remove a manual log link. |
 | `kb list [--project <id\|key>] [--kind] [--status] [--awaiting-consolidation] [--per] [--page]` | List knowledge pages. Cross-project: omit `--project` for every visible project. Published only unless `--status` says otherwise. |
 | `kb search <query…> [--project <id\|key>] [--kind] [--per] [--page] [--with-related]` | Search knowledge pages (semantic when available, title ILIKE fallback). |
-| `kb show <id> [--related] [--question <q>]` | Show one knowledge page: metadata header, raw markdown body, then the technical section. |
+| `kb show <id> [--related] [--question <q>]` | Show one knowledge page: metadata header (every project it belongs to, its groups and tags), raw markdown body, then the technical section. |
 | `kb related <id> [--question <q>] [--links-only]` | Pages to read next: linked with `[[wiki links]]` plus close matches by meaning. |
-| `kb create --project <id\|key> --title <t> [--kind note\|decision\|guide] (--body <md> \| --body-file <path>) [--tech-spec <md> \| --tech-spec-file <path>] [--in-review] [--review-note <line>]` | Create a knowledge page (optional technical section, kept separate from the body). Length caps: title 255, body 4000, technical section 1500, review note 240 characters — every field over the cap is listed at once, before the call. With `--in-review` the page waits for a human and stays out of search, answers and related panels. |
+| `kb create [--project <id\|key>…] [--group <id\|name>…] [--tag <tag>…] --title <t> [--kind note\|decision\|guide] (--body <md> \| --body-file <path>) [--tech-spec <md> \| --tech-spec-file <path>] [--in-review] [--review-note <line>] [--author-origin <name>]` | Create a knowledge page (optional technical section, kept separate from the body). `--project`, `--group` and `--tag` are repeatable — a page can belong to several projects and groups at once, and to groups alone; at least one project or group is required. Length caps: title 255, body 4000, technical section 1500, review note 240 characters — every field over the cap is listed at once, before the call. With `--in-review` the page waits for a human and stays out of search, answers and related panels. `--author-origin` declares the assistant or skill that wrote the text, which is not the owner of the token. |
 | `kb publish --project <id\|key> --publication-key <key> --title <t> [--kind note\|decision\|guide] (--body <md> \| --body-file <path>)` | Create or update a knowledge page in one atomic call, keyed by a stable `--publication-key` (1-255 URL-safe characters). Safe to repeat: the same key always lands on the same page, and the output says whether it was `created` or `updated`. Exactly one body source is required. Omitting `--kind` keeps the kind the page already has (a new page is a `note`). Same title/body caps as `kb create`. |
 | `kb consolidate <id> --path <doc-path>` | Mark an accepted page as written to the versioned docs, recording where the document lives. |
-| `kb update <id> [--title] [--kind] [--body \| --body-file] [--tech-spec \| --tech-spec-file]` | Update a page (unpassed fields keep their current value). Same length caps as `kb create`; text already over the cap is refused only if it grows. |
+| `kb update <id> [--title] [--kind] [--body \| --body-file] [--tech-spec \| --tech-spec-file] [--project <id\|key>…] [--group <id\|name>…] [--tag <tag>…] [--author-origin <name>]` | Update a page (unpassed fields keep their current value — including projects, groups, tags and attachments). Passing `--project`, `--group` or `--tag` **replaces** that list with what you name; `--tag ""` clears the tags. Changing only scope or tags never rewrites the text, so a concurrent edit is not overwritten. Same length caps as `kb create`; text already over the cap is refused only if it grows. |
 | `kb delete <id> --confirm` | Delete a knowledge page (irreversible). |
+| `kb attachments <id>` | List every file attached to a knowledge page — all pages, never truncated (`SCRIPT` says whether the server considers it executable). |
+| `kb attach <id> --file <path>…` | Attach one or more local files to a page. All-or-nothing: an unreadable path or a file the server refuses leaves the page untouched. |
+| `kb attachment-download <id> <attachment-id> [--out <dir>] [--filename <name>]` | Download an attachment to disk. The server always sends it as an inert file, never something a viewer would render. |
+| `kb detach <id> --attachment <attachment-id> --confirm` | Remove an attachment from a page (irreversible). |
 | `kb ask <question…>` | Ask a question; the AI answers from the knowledge base and cites the pages it used. |
 | `kb book list [--project <id\|key>] [--q <text>] [--per] [--page]` | List knowledge books (ordered collections of pages). Cross-project: omit `--project` for every visible project. |
 | `kb book show <id>` | Show a book: metadata, then the summary of the pages it collects (`#` is the 0-based position). |
 | `kb book add-page <id> --page <page-id> [--position <n>]` | Add a page to a book's summary. `--page` takes a page **id** (alias: `--page-id`), not a page number; `--position` is 0-based (`0` = top, omitted = last), like the position the summary shows back. Idempotent: repeating it never lists the page twice. |
+| `assistant ask <question…> [--conversation <id>] [--timeout <seconds>]` | Ask the assistant a question about your own data; it reads what you are allowed to see, answers, and lists the tools it used. Prints the conversation id so the next question can keep the context (`--conversation <id>`). |
+| `assistant conversations list [--per] [--page]` | List your conversations with the assistant, most recently active first. |
+| `assistant conversations create [--title]` | Open an empty conversation; without `--title` the server names it after its first question. |
+| `assistant conversations show <id>` | Read one conversation: every question and answer, the tools each answer used, and why a reply failed. |
+| `assistant conversations delete <id> --confirm` | Delete a conversation and all its messages (irreversible). |
 | `servers list [--status] [--page]` | List the monitored servers (fleet snapshot: status, cpu/mem/disk, last seen). |
 | `servers show <id>` | Show a monitored server (latest snapshot + machine details). |
 | `servers rename <id> --name <name>` | Rename a server (display name only). |
@@ -164,8 +192,11 @@ CLOSEYOURIT_TOKEN=cyi_u_… CLOSEYOURIT_API_URL=https://www.closeyour.it \
 | `agents tokens create <name>` | Create an org automator token (secret shown only once). |
 | `agents tokens revoke <id> --confirm` | Revoke an org automator token. |
 | `service-accounts list [--page]` | List the service accounts (AI members, CLI-only) in your org. |
+| `service-accounts show <id>` | Show one service account: identity, active token count, and the environments it may read secrets in. |
 | `service-accounts create --name [--handle] [--project <id\|key>…] [--group <id\|name>…] [--role <id\|name>…] [--grant-secrets] [--secret-environment <code>…]` | Create a service account (optionally granting read+write secrets, limited to environment codes). |
+| `service-accounts update <id> --secret-environment <code>… \| --all-environments` | Replace the environments the account may read secrets in. An empty list means *every* environment, so it must be asked for with `--all-environments`; an unknown code is refused before the write, and the boundary actually applied is verified after it. |
 | `service-accounts delete <id> --confirm` | Delete a service account (revokes tokens + removes access; secrets audit kept). |
+| `service-accounts tokens list <account-id> [--page]` | List a service account's CLI tokens: prefix, active/revoked, last use. Never the secret. |
 | `service-accounts tokens create <account-id> <name>` | Mint a CLI token (cyi_u_) for a service account (secret shown only once). |
 | `service-accounts tokens revoke <account-id> <token-id> --confirm` | Revoke a service account token. |
 | `monitors create --project <id\|key> --url <url> [--environment] [--http-method] [--interval-seconds] [--expected-status] [--timeout-seconds] [--expected-body-keyword] [--ssl-expiry-warn-days] [--group-id]` | Create an uptime monitor (one per environment). |
@@ -232,6 +263,13 @@ CLOSEYOURIT_TOKEN=cyi_u_… CLOSEYOURIT_API_URL=https://www.closeyour.it \
 | `todos items add <list-id> --title <title> [--ticket] [--position]` | Add an item to a todo list. |
 | `todos items update <list-id> <item-id> [--title] [--ticket] [--position]` | Update a todo item. |
 | `todos items delete <list-id> <item-id> --confirm` | Delete a todo item. |
+| `workload list [--page]` | List the workload actions (non-dev activities) of the teams you belong to. |
+| `workload show <action-id>` | Show one workload action with its participants. |
+| `workload create --team <id\|name> --title <title> [--description] [--status] [--scheduled-at] [--due-at] [--ticket <code\|id>]` | Create a workload action on one of your teams. |
+| `workload update <action-id> [--title] [--description] [--status] [--scheduled-at] [--due-at] [--ticket]` | Update a workload action (`--ticket ""` unlinks the ticket; the team never changes). |
+| `workload delete <action-id> --confirm` | Delete a workload action (a linked ticket survives, it only loses the link). |
+| `workload participant add\|remove <action-id> <email\|id>` | Add/remove one participant (they must belong to the action team). |
+| `workload promote <action-id> --project <id\|key> [--title] [--description] [--kind] [--status] [--priority]` | Generate a ticket from the action and link it back. |
 
 Every command accepts `--json` for machine-readable output and `--help` for usage details.
 `--project` accepts either a project UUID or its key (matched case-insensitively).
@@ -253,6 +291,10 @@ never a silent success:
 missing `--confirm`) and `message` says what; `C500-SYS-001` is reserved for unexpected failures.
 Codes starting with `R`/`G` come straight from the backend.
 
+`C408-ASK-001` is not a failure: the AI answer did not arrive within `--timeout` and is still being
+worked on — `assistant ask` says which conversation to read it from once it lands. `C502-ASK-002`
+means the answer will not come, and the server gave no code of its own to explain why.
+
 ## Configuration
 
 The CLI stores its state in:

package/dist/base.d.ts

@@ -45,6 +45,16 @@ export declare abstract class BaseCommand extends Command {
     protected resolveTeamId(value: string): Promise<string>;
     /** Resolve a member reference (UUID account id passes through; otherwise matched by email). */
     protected resolveMemberId(value: string): Promise<string>;
+    /**
+     * Resolve a ticket reference: a UUID passes through, a human code ("DRFL-3", case-insensitive) is
+     * looked up inside its own project — the same identifier `tickets show` prints, so linking a
+     * ticket to a workload action never costs a UUID hunt first (CYCL-42).
+     *
+     * A reference that is neither is refused here instead of being sent: the workload endpoint drops
+     * a ticket id it cannot see (anti-BOLA) and stores "no ticket" without a word, so an unusable
+     * reference must fail loudly on this side.
+     */
+    protected resolveTicketId(value: string): Promise<string>;
     /**
      * Resolve a ticket status/priority reference: a UUID passes through, anything else is matched
      * against the organization lookup by code first, then by label (case-insensitive).
@@ -59,6 +69,19 @@ export declare abstract class BaseCommand extends Command {
     protected resolveAll(values: string[], resolve: (value: string) => Promise<string>): Promise<string[]>;
     /** Resolve an `{id, name}` reference by name (UUID passes through). */
     private resolveByName;
+    /**
+     * Every row of an organization lookup (teams, roles, groups, members) — all its pages.
+     *
+     * The server serves ten per page: stopping at the first made the eleventh team or the eleventh
+     * person invisible, and a perfectly good name or email came back as "not found" (CYCL-42, the
+     * lesson `resolveProjectId` already learned on project keys in CYCL-1).
+     *
+     * A 403 here is not about the command being run: listing teams needs `permissions.manage` and
+     * listing members `members.view`, permissions that a team workload board never asks for. Left
+     * alone it would read as "Permesso negato" on an operation the caller is entitled to, so the
+     * refusal carries the way out instead — name the id, skip the lookup.
+     */
+    private fetchLookupRows;
     /**
      * Surface API errors, then exit non-zero. In `--json` mode `logToStderr` is a no-op, so emit the
      * structured `{ error: { code, message } }` envelope on stdout instead — otherwise the failure is

package/dist/base.js

@@ -82,13 +82,39 @@ class BaseCommand extends core_1.Command {
     async resolveMemberId(value) {
         if (exports.UUID_RE.test(value))
             return value;
-        const res = await this.api.get('/cli/v1/members');
-        const match = (res.data ?? []).find((m) => (m.email ?? '').toLowerCase() === value.toLowerCase());
+        const rows = await this.fetchLookupRows('/cli/v1/members', 'Listing the organization members needs the members.view permission — pass the account id instead of the email.');
+        const match = rows.find((m) => (m.email ?? '').toLowerCase() === value.toLowerCase());
         if (!match) {
             throw new api_1.ApiRequestError(404, error_codes_1.ErrorCodes.Member.notFound, `Member not found: ${value}`);
         }
         return match.account_id;
     }
+    /**
+     * Resolve a ticket reference: a UUID passes through, a human code ("DRFL-3", case-insensitive) is
+     * looked up inside its own project — the same identifier `tickets show` prints, so linking a
+     * ticket to a workload action never costs a UUID hunt first (CYCL-42).
+     *
+     * A reference that is neither is refused here instead of being sent: the workload endpoint drops
+     * a ticket id it cannot see (anti-BOLA) and stores "no ticket" without a word, so an unusable
+     * reference must fail loudly on this side.
+     */
+    async resolveTicketId(value) {
+        const ref = value.trim();
+        if (exports.UUID_RE.test(ref))
+            return ref;
+        // Stessa forma che il server accetta come code: chiave progetto (max 4) + numero.
+        const match = /^([a-z\d]{1,4})-\d+$/i.exec(ref);
+        if (!match) {
+            throw new api_1.ApiRequestError(404, error_codes_1.ErrorCodes.Ticket.notFound, `Ticket not found: ${value}. Pass a ticket id or its code (e.g. DRFL-3).`);
+        }
+        const projectId = await this.resolveProjectId(match[1]);
+        const res = await this.api.get(`/cli/v1/projects/${encodeURIComponent(projectId)}/tickets/${encodeURIComponent(ref)}`);
+        const id = res.data?.id;
+        if (typeof id !== 'string' || id === '') {
+            throw new api_1.ApiRequestError(404, error_codes_1.ErrorCodes.Ticket.notFound, `Ticket not found: ${value}`);
+        }
+        return id;
+    }
     /**
      * Resolve a ticket status/priority reference: a UUID passes through, anything else is matched
      * against the organization lookup by code first, then by label (case-insensitive).
@@ -116,13 +142,47 @@ class BaseCommand extends core_1.Command {
     async resolveByName(path, value, code, label) {
         if (exports.UUID_RE.test(value))
             return value;
-        const res = await this.api.get(path);
-        const match = (res.data ?? []).find((row) => (row.name ?? '').toLowerCase() === value.toLowerCase());
+        const noun = label.toLowerCase();
+        const rows = await this.fetchLookupRows(path, `Listing the ${noun}s needs the permissions.manage permission — pass the ${noun} id instead of its name.`);
+        const match = rows.find((row) => (row.name ?? '').toLowerCase() === value.toLowerCase());
         if (!match) {
             throw new api_1.ApiRequestError(404, code, `${label} not found: ${value}`);
         }
         return match.id;
     }
+    /**
+     * Every row of an organization lookup (teams, roles, groups, members) — all its pages.
+     *
+     * The server serves ten per page: stopping at the first made the eleventh team or the eleventh
+     * person invisible, and a perfectly good name or email came back as "not found" (CYCL-42, the
+     * lesson `resolveProjectId` already learned on project keys in CYCL-1).
+     *
+     * A 403 here is not about the command being run: listing teams needs `permissions.manage` and
+     * listing members `members.view`, permissions that a team workload board never asks for. Left
+     * alone it would read as "Permesso negato" on an operation the caller is entitled to, so the
+     * refusal carries the way out instead — name the id, skip the lookup.
+     */
+    async fetchLookupRows(path, hint) {
+        const rows = [];
+        let page = 1;
+        let totalPages = 1;
+        try {
+            do {
+                // eslint-disable-next-line no-await-in-loop
+                const res = await this.api.get(`${path}?page=${page}&per=100`);
+                rows.push(...(res.data ?? []));
+                totalPages = Number(res.meta?.total_pages ?? 1);
+                page += 1;
+            } while (page <= totalPages);
+        }
+        catch (error) {
+            if (error instanceof api_1.ApiRequestError && error.status === 403) {
+                throw new api_1.ApiRequestError(error.status, error.code, `${error.message}. ${hint}`);
+            }
+            throw error;
+        }
+        return rows;
+    }
     /**
      * Surface API errors, then exit non-zero. In `--json` mode `logToStderr` is a no-op, so emit the
      * structured `{ error: { code, message } }` envelope on stdout instead — otherwise the failure is

package/dist/commands/assistant/ask.d.ts

@@ -0,0 +1,24 @@
+import { BaseCommand } from '../../base';
+export default class AssistantAsk extends BaseCommand {
+    static strict: boolean;
+    static description: string;
+    static examples: string[];
+    static args: {
+        question: import("@oclif/core/lib/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        conversation: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        timeout: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+    /**
+     * Send the question, and if this very command opened the conversation for it, do not leave an
+     * empty one behind when the send is refused (AI switched off, question too long): the backend
+     * lists conversations without messages too, so the reader would find a shell with no questions
+     * in it until the retention job passes. Deleting it is best-effort — the refusal is the news,
+     * and a failed cleanup must never replace it.
+     */
+    private sendQuestion;
+    /** Open the conversation this question will live in, and return its id. */
+    private openConversation;
+}

package/dist/commands/assistant/ask.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+const error_codes_1 = require("../../errors/error-codes");
+const api_1 = require("../../lib/api");
+const assistant_1 = require("../../lib/assistant");
+const output_1 = require("../../lib/output");
+const poll_1 = require("../../lib/poll");
+class AssistantAsk extends base_1.BaseCommand {
+    // Variadic question: every positional word is joined into a single natural-language question.
+    static strict = false;
+    static description = 'Ask the assistant a question about your own data; it reads what you are allowed to see and answers (may take a while)';
+    static examples = [
+        '<%= config.bin %> assistant ask how many open tickets does acme-api have',
+        '<%= config.bin %> assistant ask "what changed in the last release?" --conversation <id>',
+        '<%= config.bin %> assistant ask "who is working on CYCL-43?" --timeout 60 --json',
+    ];
+    // Non-required: with strict = false the arg validation is off, so we guard the empty case ourselves.
+    static args = {
+        question: core_1.Args.string({ description: 'The question (all positional words are joined)' }),
+    };
+    static flags = {
+        conversation: core_1.Flags.string({
+            char: 'c',
+            description: 'Ask inside an existing conversation (keeps the context of the previous questions)',
+        }),
+        timeout: core_1.Flags.integer({
+            description: 'Seconds to wait for the answer before giving up',
+            default: poll_1.DEFAULT_TIMEOUT_SECONDS,
+        }),
+    };
+    async run() {
+        const { argv, flags } = await this.parse(AssistantAsk);
+        const question = argv.join(' ').trim();
+        if (question === '') {
+            this.error('Provide a question (e.g. "assistant ask how many open tickets do I have").', { exit: 2 });
+        }
+        const invalidTimeout = (0, poll_1.timeoutError)(flags.timeout);
+        if (invalidTimeout)
+            this.error(invalidTimeout, { exit: 2 });
+        if (!this.jsonEnabled())
+            this.log('Asking the assistant, this may take a while…');
+        // A brand-new conversation is opened empty and titled by the server after this first question.
+        const opened = flags.conversation === undefined;
+        const conversationId = flags.conversation ?? (await this.openConversation());
+        const sent = await this.sendQuestion(conversationId, question, opened);
+        const reply = sent.data ?? {};
+        const messageId = reply.id;
+        if (typeof messageId !== 'string' || messageId === '') {
+            throw new api_1.ApiRequestError(502, error_codes_1.ErrorCodes.Ask.failed, 'The server accepted the question without an id for its answer: there is nothing to follow.');
+        }
+        const answered = await (0, poll_1.pollUntil)(async () => (await this.api.get(`/cli/v1/assistant/messages/${encodeURIComponent(messageId)}`)).data ?? {}, (message) => message.status !== 'streaming', {
+            initial: reply,
+            timeoutMs: flags.timeout * 1000,
+            timeoutMessage: `The assistant did not answer within ${flags.timeout}s and may still be working. ` +
+                `Read the answer later with "${this.config.bin} assistant conversations show ${conversationId}".`,
+        });
+        // A failed reply carries no text: exit non-zero saying which of the three failures it is, so a
+        // script never mistakes "no answer" for an empty answer.
+        if (answered.status === 'failed') {
+            const failure = (0, assistant_1.assistantFailure)(answered.error_code);
+            throw new api_1.ApiRequestError(502, failure.code, failure.message);
+        }
+        // Anything that is not `streaming` ended the wait, but only `complete` means there is an answer:
+        // a missing or unknown status would otherwise be printed as a successful empty reply, which is
+        // the one outcome a caller cannot tell apart from "the assistant had nothing to say".
+        if (answered.status !== 'complete') {
+            throw new api_1.ApiRequestError(502, error_codes_1.ErrorCodes.Ask.failed, `The assistant reported an answer state this CLI does not know ("${answered.status ?? 'none'}"): treat the reply as missing.`);
+        }
+        if (!this.jsonEnabled()) {
+            const content = String(answered.content ?? '').trim();
+            if (content !== '')
+                this.log((0, output_1.sanitizeMultiline)(answered.content));
+            const tools = (0, assistant_1.renderToolsUsed)(answered.tools_used, '\n');
+            if (tools !== '')
+                this.log(tools);
+            this.log(`\nConversation: ${conversationId} — keep asking with --conversation ${conversationId}`);
+        }
+        return { data: { ...answered, conversation_id: conversationId } };
+    }
+    /**
+     * Send the question, and if this very command opened the conversation for it, do not leave an
+     * empty one behind when the send is refused (AI switched off, question too long): the backend
+     * lists conversations without messages too, so the reader would find a shell with no questions
+     * in it until the retention job passes. Deleting it is best-effort — the refusal is the news,
+     * and a failed cleanup must never replace it.
+     */
+    async sendQuestion(conversationId, text, opened) {
+        try {
+            return await this.api.post(`/cli/v1/assistant/conversations/${encodeURIComponent(conversationId)}/messages`, { text });
+        }
+        catch (error) {
+            if (opened) {
+                await this.api
+                    .delete(`/cli/v1/assistant/conversations/${encodeURIComponent(conversationId)}`)
+                    .catch(() => undefined);
+            }
+            throw error;
+        }
+    }
+    /** Open the conversation this question will live in, and return its id. */
+    async openConversation() {
+        const res = await this.api.post('/cli/v1/assistant/conversations', { title: undefined });
+        const id = res.data?.id;
+        if (typeof id !== 'string' || id === '') {
+            throw new api_1.ApiRequestError(502, error_codes_1.ErrorCodes.Ask.failed, 'The server opened a conversation without an id: there is nowhere to ask.');
+        }
+        return id;
+    }
+}
+exports.default = AssistantAsk;

package/dist/commands/assistant/conversations/create.d.ts

@@ -0,0 +1,9 @@
+import { BaseCommand } from '../../../base';
+export default class AssistantConversationsCreate extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        title: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/assistant/conversations/create.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+const output_1 = require("../../../lib/output");
+class AssistantConversationsCreate extends base_1.BaseCommand {
+    static description = 'Open an empty conversation with the assistant (ask questions into it with `assistant ask --conversation`)';
+    static examples = [
+        '<%= config.bin %> assistant conversations create',
+        '<%= config.bin %> assistant conversations create --title "Stato dei rilasci"',
+    ];
+    static flags = {
+        // Optional: without it the server titles the conversation after its first question, which is
+        // what makes a list of past conversations searchable at all.
+        title: core_1.Flags.string({ description: 'Conversation title (defaults to the first question asked)' }),
+    };
+    async run() {
+        const { flags } = await this.parse(AssistantConversationsCreate);
+        const res = await this.api.post('/cli/v1/assistant/conversations', { title: flags.title });
+        if (!this.jsonEnabled())
+            this.log((0, output_1.renderRecord)(res.data ?? {}));
+        return res;
+    }
+}
+exports.default = AssistantConversationsCreate;

package/dist/commands/assistant/conversations/delete.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../../base';
+export default class AssistantConversationsDelete extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        confirm: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/assistant/conversations/delete.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+class AssistantConversationsDelete extends base_1.BaseCommand {
+    static description = 'Delete a conversation with the assistant, questions and answers included (irreversible)';
+    static examples = ['<%= config.bin %> assistant conversations delete <conversation-id> --confirm'];
+    static args = {
+        id: core_1.Args.string({ description: 'Conversation id', required: true }),
+    };
+    static flags = {
+        confirm: core_1.Flags.boolean({ description: 'Required: confirm the irreversible deletion' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(AssistantConversationsDelete);
+        if (!flags.confirm) {
+            this.error('Refusing to delete without --confirm (the action is irreversible).', { exit: 2 });
+        }
+        await this.api.delete(`/cli/v1/assistant/conversations/${encodeURIComponent(args.id)}`);
+        if (!this.jsonEnabled())
+            this.log(`Deleted conversation ${args.id}`);
+        return { deleted: args.id };
+    }
+}
+exports.default = AssistantConversationsDelete;

package/dist/commands/assistant/conversations/list.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../../base';
+export default class AssistantConversationsList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        page: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        per: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/assistant/conversations/list.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+const assistant_1 = require("../../../lib/assistant");
+class AssistantConversationsList extends base_1.BaseCommand {
+    static description = 'List your conversations with the assistant (most recently active first)';
+    static examples = [
+        '<%= config.bin %> assistant conversations list',
+        '<%= config.bin %> assistant conversations list --per 50 --json',
+    ];
+    static flags = {
+        per: core_1.Flags.integer({ description: 'Page size' }),
+        ...base_1.pageFlag,
+    };
+    async run() {
+        const { flags } = await this.parse(AssistantConversationsList);
+        const invalid = (0, base_1.paginationError)(flags);
+        if (invalid)
+            this.error(invalid, { exit: 2 });
+        const query = new URLSearchParams({ page: String(flags.page) });
+        if (flags.per !== undefined)
+            query.set('per', String(flags.per));
+        const res = await this.api.get(`/cli/v1/assistant/conversations?${query.toString()}`);
+        if (!this.jsonEnabled())
+            this.log((0, assistant_1.renderConversationsTable)(res.data ?? []));
+        return res;
+    }
+}
+exports.default = AssistantConversationsList;

package/dist/commands/assistant/conversations/show.d.ts

@@ -0,0 +1,9 @@
+import { BaseCommand } from '../../../base';
+export default class AssistantConversationsShow extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/assistant/conversations/show.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+const assistant_1 = require("../../../lib/assistant");
+const output_1 = require("../../../lib/output");
+class AssistantConversationsShow extends base_1.BaseCommand {
+    static description = 'Read one conversation with the assistant: its questions, its answers and what they were based on';
+    static examples = ['<%= config.bin %> assistant conversations show <conversation-id>'];
+    static args = {
+        id: core_1.Args.string({ description: 'Conversation id', required: true }),
+    };
+    async run() {
+        const { args } = await this.parse(AssistantConversationsShow);
+        const res = await this.api.get(`/cli/v1/assistant/conversations/${encodeURIComponent(args.id)}`);
+        const data = res.data ?? {};
+        if (!this.jsonEnabled()) {
+            this.log((0, output_1.renderRecord)(data));
+            this.log((0, output_1.section)('Messages', '💬'));
+            this.log((0, assistant_1.renderMessages)(data.messages));
+        }
+        return res;
+    }
+}
+exports.default = AssistantConversationsShow;

package/dist/commands/errors/assign.d.ts

@@ -0,0 +1,14 @@
+import { BaseCommand } from '../../base';
+export default class ErrorsAssign extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        assignee: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        unassign: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}