@bussolabs/closeyourit-cli 0.22.0 → 0.23.1

package/opencli.json

@@ -3,7 +3,7 @@
   "opencli": "0.1",
   "info": {
     "title": "closeyourit",
-    "version": "0.22.0",
+    "version": "0.23.1",
     "description": "CLI for CloseYourIt — manage org, errors, tokens and tickets with your user token",
     "license": {
       "name": "MIT",
@@ -1007,6 +1007,142 @@
           }
         ]
       },
+      {
+        "name": "assistant",
+        "description": "AI assistant that reads the data you can see and answers questions about it",
+        "commands": [
+          {
+            "name": "ask",
+            "description": "Ask the assistant a question about your own data; it reads what you are allowed to see and answers (may take a while)",
+            "options": [
+              {
+                "name": "--conversation",
+                "aliases": [
+                  "-c"
+                ],
+                "description": "Ask inside an existing conversation (keeps the context of the previous questions)",
+                "arguments": [
+                  {
+                    "name": "CONVERSATION",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--timeout",
+                "description": "Seconds to wait for the answer before giving up",
+                "arguments": [
+                  {
+                    "name": "TIMEOUT",
+                    "required": true
+                  }
+                ]
+              }
+            ],
+            "arguments": [
+              {
+                "name": "QUESTION",
+                "description": "The question (all positional words are joined)"
+              }
+            ],
+            "examples": [
+              "closeyourit assistant ask how many open tickets does acme-api have",
+              "closeyourit assistant ask \"what changed in the last release?\" --conversation <id>",
+              "closeyourit assistant ask \"who is working on CYCL-43?\" --timeout 60 --json"
+            ]
+          },
+          {
+            "name": "conversations",
+            "description": "Conversations with the assistant (list, open, read, delete)",
+            "commands": [
+              {
+                "name": "create",
+                "description": "Open an empty conversation with the assistant (ask questions into it with `assistant ask --conversation`)",
+                "options": [
+                  {
+                    "name": "--title",
+                    "description": "Conversation title (defaults to the first question asked)",
+                    "arguments": [
+                      {
+                        "name": "TITLE",
+                        "required": true
+                      }
+                    ]
+                  }
+                ],
+                "examples": [
+                  "closeyourit assistant conversations create",
+                  "closeyourit assistant conversations create --title \"Stato dei rilasci\""
+                ]
+              },
+              {
+                "name": "delete",
+                "description": "Delete a conversation with the assistant, questions and answers included (irreversible)",
+                "options": [
+                  {
+                    "name": "--confirm",
+                    "description": "Required: confirm the irreversible deletion"
+                  }
+                ],
+                "arguments": [
+                  {
+                    "name": "ID",
+                    "required": true,
+                    "description": "Conversation id"
+                  }
+                ],
+                "examples": [
+                  "closeyourit assistant conversations delete <conversation-id> --confirm"
+                ]
+              },
+              {
+                "name": "list",
+                "description": "List your conversations with the assistant (most recently active first)",
+                "options": [
+                  {
+                    "name": "--per",
+                    "description": "Page size",
+                    "arguments": [
+                      {
+                        "name": "PER",
+                        "required": true
+                      }
+                    ]
+                  },
+                  {
+                    "name": "--page",
+                    "description": "Page number",
+                    "arguments": [
+                      {
+                        "name": "PAGE",
+                        "required": true
+                      }
+                    ]
+                  }
+                ],
+                "examples": [
+                  "closeyourit assistant conversations list",
+                  "closeyourit assistant conversations list --per 50 --json"
+                ]
+              },
+              {
+                "name": "show",
+                "description": "Read one conversation with the assistant: its questions, its answers and what they were based on",
+                "arguments": [
+                  {
+                    "name": "ID",
+                    "required": true,
+                    "description": "Conversation id"
+                  }
+                ],
+                "examples": [
+                  "closeyourit assistant conversations show <conversation-id>"
+                ]
+              }
+            ]
+          }
+        ]
+      },
       {
         "name": "cron-monitors",
         "description": "Cron/heartbeat monitors (read-only)",
@@ -1263,11 +1399,11 @@
       },
       {
         "name": "errors",
-        "description": "Error monitoring: list, show, triage",
+        "description": "Error monitoring: list, show, triage, assign, merge/split, delete",
         "commands": [
           {
-            "name": "list",
-            "description": "List error groups for a project",
+            "name": "assign",
+            "description": "Put an error group in someone's hands, or take it out (--unassign)",
             "options": [
               {
                 "name": "--project",
@@ -1284,48 +1420,18 @@
                 ]
               },
               {
-                "name": "--page",
-                "description": "Page number",
+                "name": "--assignee",
+                "description": "Account id (UUID) or member email",
                 "arguments": [
                   {
-                    "name": "PAGE",
+                    "name": "ASSIGNEE",
                     "required": true
                   }
                 ]
               },
               {
-                "name": "--status",
-                "description": "Filter by status (e.g. unresolved, resolved, muted)",
-                "arguments": [
-                  {
-                    "name": "STATUS",
-                    "required": true
-                  }
-                ]
-              }
-            ],
-            "examples": [
-              "closeyourit errors list --project acme-api",
-              "closeyourit errors list -p acme-api --status unresolved --json"
-            ]
-          },
-          {
-            "name": "mute",
-            "description": "Mute an error group",
-            "options": [
-              {
-                "name": "--project",
-                "aliases": [
-                  "-p"
-                ],
-                "description": "Project id (UUID) or key",
-                "required": true,
-                "arguments": [
-                  {
-                    "name": "PROJECT",
-                    "required": true
-                  }
-                ]
+                "name": "--unassign",
+                "description": "Leave the group to nobody"
               }
             ],
             "arguments": [
@@ -1336,12 +1442,13 @@
               }
             ],
             "examples": [
-              "closeyourit errors mute <group-id> --project acme-api"
+              "closeyourit errors assign <group-id> --project acme-api --assignee alice@acme.test",
+              "closeyourit errors assign <group-id> --project acme-api --unassign"
             ]
           },
           {
-            "name": "promote",
-            "description": "Promote an error group to a ticket",
+            "name": "bulk-triage",
+            "description": "Resolve, ignore or reopen several error groups in one call",
             "options": [
               {
                 "name": "--project",
@@ -1356,82 +1463,43 @@
                     "required": true
                   }
                 ]
-              }
-            ],
-            "arguments": [
-              {
-                "name": "ID",
-                "required": true,
-                "description": "Error group id"
-              }
-            ],
-            "examples": [
-              "closeyourit errors promote <group-id> --project acme-api"
-            ]
-          },
-          {
-            "name": "reopen",
-            "description": "Reopen a resolved error group",
-            "options": [
+              },
               {
-                "name": "--project",
-                "aliases": [
-                  "-p"
-                ],
-                "description": "Project id (UUID) or key",
+                "name": "--action",
+                "description": "What to do with them",
                 "required": true,
                 "arguments": [
                   {
-                    "name": "PROJECT",
-                    "required": true
+                    "name": "ACTION",
+                    "required": true,
+                    "acceptedValues": [
+                      "resolve",
+                      "ignore",
+                      "reopen"
+                    ]
                   }
                 ]
-              }
-            ],
-            "arguments": [
-              {
-                "name": "ID",
-                "required": true,
-                "description": "Error group id"
-              }
-            ],
-            "examples": [
-              "closeyourit errors reopen <group-id> --project acme-api"
-            ]
-          },
-          {
-            "name": "resolve",
-            "description": "Mark an error group as resolved",
-            "options": [
+              },
               {
-                "name": "--project",
-                "aliases": [
-                  "-p"
-                ],
-                "description": "Project id (UUID) or key",
+                "name": "--group",
+                "description": "Error group id (repeatable)",
                 "required": true,
                 "arguments": [
                   {
-                    "name": "PROJECT",
+                    "name": "GROUP",
                     "required": true
                   }
                 ]
               }
             ],
-            "arguments": [
-              {
-                "name": "ID",
-                "required": true,
-                "description": "Error group id"
-              }
-            ],
             "examples": [
-              "closeyourit errors resolve <group-id> --project acme-api"
+              "closeyourit errors bulk-triage -p acme-api --action resolve --group <id-a> --group <id-b>",
+              "closeyourit errors bulk-triage -p acme-api --action ignore --group <id-a> --json"
             ]
           },
           {
-            "name": "show",
-            "description": "Show a single error group",
+            "name": "delete",
+            "description": "Delete an error group and every occurrence it holds (irreversible)",
             "options": [
               {
                 "name": "--project",
@@ -1446,6 +1514,10 @@
                     "required": true
                   }
                 ]
+              },
+              {
+                "name": "--confirm",
+                "description": "Required: confirm the irreversible deletion"
               }
             ],
             "arguments": [
@@ -1456,45 +1528,588 @@
               }
             ],
             "examples": [
-              "closeyourit errors show <group-id> --project acme-api"
+              "closeyourit errors delete <group-id> --project acme-api --confirm"
             ]
           },
           {
-            "name": "unmute",
-            "description": "Unmute an error group",
-            "options": [
+            "name": "grouping-rules",
+            "description": "Custom grouping rules: how a project bends the automatic error grouping",
+            "commands": [
               {
-                "name": "--project",
-                "aliases": [
-                  "-p"
-                ],
-                "description": "Project id (UUID) or key",
-                "required": true,
-                "arguments": [
+                "name": "create",
+                "description": "Add a grouping rule: occurrences that match it are grouped under one key",
+                "options": [
                   {
-                    "name": "PROJECT",
-                    "required": true
-                  }
-                ]
-              }
-            ],
-            "arguments": [
-              {
-                "name": "ID",
-                "required": true,
-                "description": "Error group id"
-              }
-            ],
-            "examples": [
-              "closeyourit errors unmute <group-id> --project acme-api"
-            ]
-          }
-        ]
-      },
-      {
-        "name": "groups",
-        "commands": [
-          {
+                    "name": "--project",
+                    "aliases": [
+                      "-p"
+                    ],
+                    "description": "Project id (UUID) or key",
+                    "required": true,
+                    "arguments": [
+                      {
+                        "name": "PROJECT",
+                        "required": true
+                      }
+                    ]
+                  },
+                  {
+                    "name": "--field",
+                    "description": "Occurrence field the rule looks at",
+                    "required": true,
+                    "arguments": [
+                      {
+                        "name": "FIELD",
+                        "required": true,
+                        "acceptedValues": [
+                          "exception_type",
+                          "message",
+                          "culprit",
+                          "transaction"
+                        ]
+                      }
+                    ]
+                  },
+                  {
+                    "name": "--operator",
+                    "description": "How the field is compared (always case-insensitive)",
+                    "required": true,
+                    "arguments": [
+                      {
+                        "name": "OPERATOR",
+                        "required": true,
+                        "acceptedValues": [
+                          "contains",
+                          "equals",
+                          "starts_with"
+                        ]
+                      }
+                    ]
+                  },
+                  {
+                    "name": "--value",
+                    "description": "Text to compare the field against",
+                    "required": true,
+                    "arguments": [
+                      {
+                        "name": "VALUE",
+                        "required": true
+                      }
+                    ]
+                  },
+                  {
+                    "name": "--fingerprint-key",
+                    "description": "Grouping key: rules sharing it send their occurrences to the same group",
+                    "required": true,
+                    "arguments": [
+                      {
+                        "name": "FINGERPRINT-KEY",
+                        "required": true
+                      }
+                    ]
+                  },
+                  {
+                    "name": "--position",
+                    "description": "Order of application (lower runs first)",
+                    "arguments": [
+                      {
+                        "name": "POSITION",
+                        "required": true
+                      }
+                    ]
+                  },
+                  {
+                    "name": "--active",
+                    "description": "Whether the rule applies at ingest"
+                  }
+                ],
+                "examples": [
+                  "closeyourit errors grouping-rules create -p acme-api --field message --operator contains --value \"timeout\" --fingerprint-key net-timeout",
+                  "closeyourit errors grouping-rules create -p acme-api --field culprit --operator starts_with --value \"app/jobs/\" --fingerprint-key jobs --position 2"
+                ]
+              },
+              {
+                "name": "delete",
+                "description": "Delete a grouping rule (the groups it already made stay where they are)",
+                "options": [
+                  {
+                    "name": "--project",
+                    "aliases": [
+                      "-p"
+                    ],
+                    "description": "Project id (UUID) or key",
+                    "required": true,
+                    "arguments": [
+                      {
+                        "name": "PROJECT",
+                        "required": true
+                      }
+                    ]
+                  },
+                  {
+                    "name": "--confirm",
+                    "description": "Required: confirm the deletion"
+                  }
+                ],
+                "arguments": [
+                  {
+                    "name": "ID",
+                    "required": true,
+                    "description": "Grouping rule id"
+                  }
+                ],
+                "examples": [
+                  "closeyourit errors grouping-rules delete <rule-id> --project acme-api --confirm"
+                ]
+              },
+              {
+                "name": "list",
+                "description": "List the custom grouping rules of a project, in the order they are applied",
+                "options": [
+                  {
+                    "name": "--project",
+                    "aliases": [
+                      "-p"
+                    ],
+                    "description": "Project id (UUID) or key",
+                    "required": true,
+                    "arguments": [
+                      {
+                        "name": "PROJECT",
+                        "required": true
+                      }
+                    ]
+                  },
+                  {
+                    "name": "--page",
+                    "description": "Page number",
+                    "arguments": [
+                      {
+                        "name": "PAGE",
+                        "required": true
+                      }
+                    ]
+                  }
+                ],
+                "examples": [
+                  "closeyourit errors grouping-rules list --project acme-api"
+                ]
+              },
+              {
+                "name": "update",
+                "description": "Change a grouping rule: what it matches, where it sends, when it runs, or turn it off",
+                "options": [
+                  {
+                    "name": "--project",
+                    "aliases": [
+                      "-p"
+                    ],
+                    "description": "Project id (UUID) or key",
+                    "required": true,
+                    "arguments": [
+                      {
+                        "name": "PROJECT",
+                        "required": true
+                      }
+                    ]
+                  },
+                  {
+                    "name": "--field",
+                    "description": "Occurrence field the rule looks at",
+                    "arguments": [
+                      {
+                        "name": "FIELD",
+                        "required": true,
+                        "acceptedValues": [
+                          "exception_type",
+                          "message",
+                          "culprit",
+                          "transaction"
+                        ]
+                      }
+                    ]
+                  },
+                  {
+                    "name": "--operator",
+                    "description": "How the field is compared",
+                    "arguments": [
+                      {
+                        "name": "OPERATOR",
+                        "required": true,
+                        "acceptedValues": [
+                          "contains",
+                          "equals",
+                          "starts_with"
+                        ]
+                      }
+                    ]
+                  },
+                  {
+                    "name": "--value",
+                    "description": "Text to compare the field against",
+                    "arguments": [
+                      {
+                        "name": "VALUE",
+                        "required": true
+                      }
+                    ]
+                  },
+                  {
+                    "name": "--fingerprint-key",
+                    "description": "Grouping key the matching occurrences land on",
+                    "arguments": [
+                      {
+                        "name": "FINGERPRINT-KEY",
+                        "required": true
+                      }
+                    ]
+                  },
+                  {
+                    "name": "--position",
+                    "description": "Order of application (lower runs first)",
+                    "arguments": [
+                      {
+                        "name": "POSITION",
+                        "required": true
+                      }
+                    ]
+                  },
+                  {
+                    "name": "--active",
+                    "description": "Whether the rule applies at ingest"
+                  }
+                ],
+                "arguments": [
+                  {
+                    "name": "ID",
+                    "required": true,
+                    "description": "Grouping rule id"
+                  }
+                ],
+                "examples": [
+                  "closeyourit errors grouping-rules update <rule-id> -p acme-api --value \"connection reset\"",
+                  "closeyourit errors grouping-rules update <rule-id> -p acme-api --position 0",
+                  "closeyourit errors grouping-rules update <rule-id> -p acme-api --no-active"
+                ]
+              }
+            ]
+          },
+          {
+            "name": "list",
+            "description": "List error groups for a project",
+            "options": [
+              {
+                "name": "--project",
+                "aliases": [
+                  "-p"
+                ],
+                "description": "Project id (UUID) or key",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "PROJECT",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--page",
+                "description": "Page number",
+                "arguments": [
+                  {
+                    "name": "PAGE",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--status",
+                "description": "Filter by status (e.g. unresolved, resolved, muted)",
+                "arguments": [
+                  {
+                    "name": "STATUS",
+                    "required": true
+                  }
+                ]
+              }
+            ],
+            "examples": [
+              "closeyourit errors list --project acme-api",
+              "closeyourit errors list -p acme-api --status unresolved --json"
+            ]
+          },
+          {
+            "name": "merge",
+            "description": "Merge error groups into one: the occurrences move, the absorbed groups disappear (irreversible)",
+            "options": [
+              {
+                "name": "--project",
+                "aliases": [
+                  "-p"
+                ],
+                "description": "Project id (UUID) or key",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "PROJECT",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--group",
+                "description": "Error group to absorb (repeatable)",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "GROUP",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--confirm",
+                "description": "Required: confirm the irreversible merge"
+              }
+            ],
+            "arguments": [
+              {
+                "name": "ID",
+                "required": true,
+                "description": "Error group that keeps everything (the primary)"
+              }
+            ],
+            "examples": [
+              "closeyourit errors merge <primary-id> --project acme-api --group <duplicate-a> --group <duplicate-b> --confirm"
+            ]
+          },
+          {
+            "name": "mute",
+            "description": "Mute an error group",
+            "options": [
+              {
+                "name": "--project",
+                "aliases": [
+                  "-p"
+                ],
+                "description": "Project id (UUID) or key",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "PROJECT",
+                    "required": true
+                  }
+                ]
+              }
+            ],
+            "arguments": [
+              {
+                "name": "ID",
+                "required": true,
+                "description": "Error group id"
+              }
+            ],
+            "examples": [
+              "closeyourit errors mute <group-id> --project acme-api"
+            ]
+          },
+          {
+            "name": "promote",
+            "description": "Promote an error group to a ticket",
+            "options": [
+              {
+                "name": "--project",
+                "aliases": [
+                  "-p"
+                ],
+                "description": "Project id (UUID) or key",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "PROJECT",
+                    "required": true
+                  }
+                ]
+              }
+            ],
+            "arguments": [
+              {
+                "name": "ID",
+                "required": true,
+                "description": "Error group id"
+              }
+            ],
+            "examples": [
+              "closeyourit errors promote <group-id> --project acme-api"
+            ]
+          },
+          {
+            "name": "reopen",
+            "description": "Reopen a resolved error group",
+            "options": [
+              {
+                "name": "--project",
+                "aliases": [
+                  "-p"
+                ],
+                "description": "Project id (UUID) or key",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "PROJECT",
+                    "required": true
+                  }
+                ]
+              }
+            ],
+            "arguments": [
+              {
+                "name": "ID",
+                "required": true,
+                "description": "Error group id"
+              }
+            ],
+            "examples": [
+              "closeyourit errors reopen <group-id> --project acme-api"
+            ]
+          },
+          {
+            "name": "resolve",
+            "description": "Mark an error group as resolved",
+            "options": [
+              {
+                "name": "--project",
+                "aliases": [
+                  "-p"
+                ],
+                "description": "Project id (UUID) or key",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "PROJECT",
+                    "required": true
+                  }
+                ]
+              }
+            ],
+            "arguments": [
+              {
+                "name": "ID",
+                "required": true,
+                "description": "Error group id"
+              }
+            ],
+            "examples": [
+              "closeyourit errors resolve <group-id> --project acme-api"
+            ]
+          },
+          {
+            "name": "show",
+            "description": "Show a single error group",
+            "options": [
+              {
+                "name": "--project",
+                "aliases": [
+                  "-p"
+                ],
+                "description": "Project id (UUID) or key",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "PROJECT",
+                    "required": true
+                  }
+                ]
+              }
+            ],
+            "arguments": [
+              {
+                "name": "ID",
+                "required": true,
+                "description": "Error group id"
+              }
+            ],
+            "examples": [
+              "closeyourit errors show <group-id> --project acme-api"
+            ]
+          },
+          {
+            "name": "split",
+            "description": "Split an error group: pull some occurrences out into a new one",
+            "options": [
+              {
+                "name": "--project",
+                "aliases": [
+                  "-p"
+                ],
+                "description": "Project id (UUID) or key",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "PROJECT",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--event",
+                "description": "Occurrence id to pull out (repeatable)",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "EVENT",
+                    "required": true
+                  }
+                ]
+              }
+            ],
+            "arguments": [
+              {
+                "name": "ID",
+                "required": true,
+                "description": "Error group to split"
+              }
+            ],
+            "examples": [
+              "closeyourit errors split <group-id> --project acme-api --event <event-a> --event <event-b>"
+            ]
+          },
+          {
+            "name": "unmute",
+            "description": "Unmute an error group",
+            "options": [
+              {
+                "name": "--project",
+                "aliases": [
+                  "-p"
+                ],
+                "description": "Project id (UUID) or key",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "PROJECT",
+                    "required": true
+                  }
+                ]
+              }
+            ],
+            "arguments": [
+              {
+                "name": "ID",
+                "required": true,
+                "description": "Error group id"
+              }
+            ],
+            "examples": [
+              "closeyourit errors unmute <group-id> --project acme-api"
+            ]
+          }
+        ]
+      },
+      {
+        "name": "groups",
+        "commands": [
+          {
             "name": "create",
             "description": "Create a group (a container of related projects, e.g. \"DriverOne\")",
             "options": [
@@ -2365,7 +2980,7 @@
         "commands": [
           {
             "name": "create",
-            "description": "Invite a person to the organization. Prints the acceptance link (shown only once).",
+            "description": "Invite a person to the organization. Prints the acceptance link.",
             "options": [
               {
                 "name": "--role",
@@ -2417,7 +3032,7 @@
           },
           {
             "name": "resend",
-            "description": "Resend a pending invitation. Prints the acceptance link (shown only once).",
+            "description": "Resend a pending invitation. Prints the acceptance link.",
             "arguments": [
               {
                 "name": "ID",
@@ -2463,6 +3078,91 @@
               "closeyourit kb ask \"what is our retry/backoff policy?\" --json"
             ]
           },
+          {
+            "name": "attach",
+            "description": "Attach one or more local files to a knowledge page",
+            "options": [
+              {
+                "name": "--file",
+                "description": "Path to a local file to upload (repeatable)",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "FILE",
+                    "required": true
+                  }
+                ]
+              }
+            ],
+            "arguments": [
+              {
+                "name": "ID",
+                "required": true,
+                "description": "Knowledge page id"
+              }
+            ],
+            "examples": [
+              "closeyourit kb attach <page-id> --file ./rollback.sh",
+              "closeyourit kb attach <page-id> --file ./diagram.png --file ./checklist.pdf"
+            ]
+          },
+          {
+            "name": "attachment-download",
+            "description": "Download a knowledge page's attachment to disk",
+            "options": [
+              {
+                "name": "--out",
+                "description": "Output directory",
+                "arguments": [
+                  {
+                    "name": "OUT",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--filename",
+                "description": "Override the output filename",
+                "arguments": [
+                  {
+                    "name": "FILENAME",
+                    "required": true
+                  }
+                ]
+              }
+            ],
+            "arguments": [
+              {
+                "name": "ID",
+                "required": true,
+                "description": "Knowledge page id"
+              },
+              {
+                "name": "ATTACHMENT",
+                "required": true,
+                "description": "Attachment id"
+              }
+            ],
+            "examples": [
+              "closeyourit kb attachment-download <page-id> <attachment-id>",
+              "closeyourit kb attachment-download <page-id> <attachment-id> --out ./downloads"
+            ]
+          },
+          {
+            "name": "attachments",
+            "description": "List a knowledge page's attachments",
+            "arguments": [
+              {
+                "name": "ID",
+                "required": true,
+                "description": "Knowledge page id"
+              }
+            ],
+            "examples": [
+              "closeyourit kb attachments <page-id>",
+              "closeyourit kb attachments <page-id> --json"
+            ]
+          },
           {
             "name": "book",
             "description": "Knowledge books: ordered collections of pages (summary, add a page)",
@@ -2608,18 +3308,37 @@
           },
           {
             "name": "create",
-            "description": "Create a knowledge page in a project",
+            "description": "Create a knowledge page in one or more projects (and groups)",
             "options": [
               {
-                "name": "--project",
-                "aliases": [
-                  "-p"
-                ],
-                "description": "Project id (UUID) or key",
-                "required": true,
+                "name": "--project",
+                "aliases": [
+                  "-p"
+                ],
+                "description": "Project id (UUID) or key the page belongs to (repeatable)",
+                "arguments": [
+                  {
+                    "name": "PROJECT",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--group",
+                "description": "Group id (UUID) or name the page belongs to (repeatable)",
+                "arguments": [
+                  {
+                    "name": "GROUP",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--tag",
+                "description": "Tag for the page (repeatable; the server lowercases and dedupes them)",
                 "arguments": [
                   {
-                    "name": "PROJECT",
+                    "name": "TAG",
                     "required": true
                   }
                 ]
@@ -2698,13 +3417,24 @@
                     "required": true
                   }
                 ]
+              },
+              {
+                "name": "--author-origin",
+                "description": "Name of the assistant or skill that wrote the text (declares an automatic author)",
+                "arguments": [
+                  {
+                    "name": "AUTHOR-ORIGIN",
+                    "required": true
+                  }
+                ]
               }
             ],
             "examples": [
               "closeyourit kb create --project acme-api --title \"Kamal rollback\" --body \"Steps…\"",
               "closeyourit kb create -p acme-api --title \"ADR: queue backend\" --kind decision --body-file ./adr.md",
               "closeyourit kb create -p acme-api --title \"Deploy\" --body-file ./body.md --tech-spec-file ./tech.md",
-              "closeyourit kb create -p acme-api --title \"Worktree trap\" --body-file ./note.md --in-review --review-note \"Hit it today, not obvious from the code\""
+              "closeyourit kb create -p acme-api --title \"Worktree trap\" --body-file ./note.md --in-review --review-note \"Hit it today, not obvious from the code\"",
+              "closeyourit kb create -p acme-api -p billing --group Piattaforma --tag deploy --tag kamal --title \"Rollback\" --body-file ./note.md"
             ]
           },
           {
@@ -2727,6 +3457,37 @@
               "closeyourit kb delete <page-id> --confirm"
             ]
           },
+          {
+            "name": "detach",
+            "description": "Remove an attachment from a knowledge page (irreversible)",
+            "options": [
+              {
+                "name": "--attachment",
+                "description": "Attachment id to remove",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "ATTACHMENT",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--confirm",
+                "description": "Required: confirm the irreversible deletion"
+              }
+            ],
+            "arguments": [
+              {
+                "name": "ID",
+                "required": true,
+                "description": "Knowledge page id"
+              }
+            ],
+            "examples": [
+              "closeyourit kb detach <page-id> --attachment <attachment-id> --confirm"
+            ]
+          },
           {
             "name": "list",
             "description": "List knowledge pages across the projects you can see",
@@ -3022,6 +3783,49 @@
                   }
                 ]
               },
+              {
+                "name": "--project",
+                "aliases": [
+                  "-p"
+                ],
+                "description": "Replace the projects the page belongs to: id (UUID) or key (repeatable)",
+                "arguments": [
+                  {
+                    "name": "PROJECT",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--group",
+                "description": "Replace the groups the page belongs to: id (UUID) or name (repeatable)",
+                "arguments": [
+                  {
+                    "name": "GROUP",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--tag",
+                "description": "Replace the page tags (repeatable; `--tag \"\"` clears them)",
+                "arguments": [
+                  {
+                    "name": "TAG",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--author-origin",
+                "description": "Name of the assistant or skill that rewrote the text (only applies with a text change)",
+                "arguments": [
+                  {
+                    "name": "AUTHOR-ORIGIN",
+                    "required": true
+                  }
+                ]
+              },
               {
                 "name": "--kind",
                 "description": "New kind: note|decision|guide",
@@ -3083,7 +3887,9 @@
             "examples": [
               "closeyourit kb update <page-id> --title \"New title\"",
               "closeyourit kb update <page-id> --kind decision --body-file ./adr.md",
-              "closeyourit kb update <page-id> --tech-spec-file ./tech.md"
+              "closeyourit kb update <page-id> --tech-spec-file ./tech.md",
+              "closeyourit kb update <page-id> --project acme-api --project billing --group Piattaforma",
+              "closeyourit kb update <page-id> --tag deploy --tag kamal"
             ]
           }
         ]
@@ -3936,6 +4742,57 @@
         "name": "metrics",
         "description": "Performance metrics (slow queries/methods)",
         "commands": [
+          {
+            "name": "bulk-triage",
+            "description": "Resolve, ignore or reopen several metric groups in one call",
+            "options": [
+              {
+                "name": "--project",
+                "aliases": [
+                  "-p"
+                ],
+                "description": "Project id (UUID) or key",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "PROJECT",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--action",
+                "description": "What to do with them",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "ACTION",
+                    "required": true,
+                    "acceptedValues": [
+                      "resolve",
+                      "ignore",
+                      "reopen"
+                    ]
+                  }
+                ]
+              },
+              {
+                "name": "--group",
+                "description": "Metric group id (repeatable)",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "GROUP",
+                    "required": true
+                  }
+                ]
+              }
+            ],
+            "examples": [
+              "closeyourit metrics bulk-triage -p acme-api --action resolve --group <id-a> --group <id-b>",
+              "closeyourit metrics bulk-triage -p acme-api --action ignore --group <id-a> --json"
+            ]
+          },
           {
             "name": "list",
             "description": "List performance metric groups (slow queries/methods) for a project",
@@ -7926,113 +8783,271 @@
                     "required": true
                   }
                 ]
-              },
-              {
-                "name": "--grant-secrets",
-                "description": "Grant read+write secrets on the visible projects"
-              },
+              },
+              {
+                "name": "--grant-secrets",
+                "description": "Grant read+write secrets on the visible projects"
+              },
+              {
+                "name": "--secret-environment",
+                "description": "Restrict secret access to these environment codes (repeatable; empty = all environments)",
+                "arguments": [
+                  {
+                    "name": "SECRET-ENVIRONMENT",
+                    "required": true
+                  }
+                ]
+              }
+            ],
+            "examples": [
+              "closeyourit service-accounts create --name \"Deploy bot\" --project CYI --grant-secrets --secret-environment staging"
+            ]
+          },
+          {
+            "name": "delete",
+            "description": "Delete a service account (revokes its tokens + removes org access; the secrets audit trail is kept)",
+            "options": [
+              {
+                "name": "--confirm",
+                "description": "Required: confirm the deletion"
+              }
+            ],
+            "arguments": [
+              {
+                "name": "ID",
+                "required": true,
+                "description": "Service account id"
+              }
+            ],
+            "examples": [
+              "closeyourit service-accounts delete <id> --confirm"
+            ]
+          },
+          {
+            "name": "list",
+            "description": "List the service accounts (AI members, CLI-only) in your organization",
+            "options": [
+              {
+                "name": "--page",
+                "description": "Page number",
+                "arguments": [
+                  {
+                    "name": "PAGE",
+                    "required": true
+                  }
+                ]
+              }
+            ],
+            "examples": [
+              "closeyourit service-accounts list",
+              "closeyourit service-accounts list --json"
+            ]
+          },
+          {
+            "name": "show",
+            "description": "Show a service account: identity, how many tokens are active, and the environments it can read secrets in",
+            "arguments": [
+              {
+                "name": "ID",
+                "required": true,
+                "description": "Service account id"
+              }
+            ],
+            "examples": [
+              "closeyourit service-accounts show <id>",
+              "closeyourit service-accounts show <id> --json"
+            ]
+          },
+          {
+            "name": "tokens",
+            "commands": [
+              {
+                "name": "create",
+                "description": "Create a CLI token (cyi_u_) for a service account (the secret is shown only once)",
+                "arguments": [
+                  {
+                    "name": "ACCOUNT",
+                    "required": true,
+                    "description": "Service account id"
+                  },
+                  {
+                    "name": "NAME",
+                    "required": true,
+                    "description": "Token name (e.g. ci-deploy)"
+                  }
+                ],
+                "examples": [
+                  "closeyourit service-accounts tokens create <account-id> ci-deploy"
+                ]
+              },
+              {
+                "name": "list",
+                "description": "List the CLI tokens of a service account — which ones still work and which are revoked. Never the secret.",
+                "options": [
+                  {
+                    "name": "--page",
+                    "description": "Page number",
+                    "arguments": [
+                      {
+                        "name": "PAGE",
+                        "required": true
+                      }
+                    ]
+                  }
+                ],
+                "arguments": [
+                  {
+                    "name": "ACCOUNT",
+                    "required": true,
+                    "description": "Service account id"
+                  }
+                ],
+                "examples": [
+                  "closeyourit service-accounts tokens list <account-id>",
+                  "closeyourit service-accounts tokens list <account-id> --json"
+                ]
+              },
+              {
+                "name": "revoke",
+                "description": "Revoke a service account CLI token (the agent using it loses access)",
+                "options": [
+                  {
+                    "name": "--confirm",
+                    "description": "Required: confirm the revocation"
+                  }
+                ],
+                "arguments": [
+                  {
+                    "name": "ACCOUNT",
+                    "required": true,
+                    "description": "Service account id"
+                  },
+                  {
+                    "name": "ID",
+                    "required": true,
+                    "description": "Token id"
+                  }
+                ],
+                "examples": [
+                  "closeyourit service-accounts tokens revoke <account-id> <token-id> --confirm"
+                ]
+              }
+            ]
+          },
+          {
+            "name": "update",
+            "description": "Update a service account's secret access: the environments it may read secrets in (full replace)",
+            "options": [
               {
                 "name": "--secret-environment",
-                "description": "Restrict secret access to these environment codes (repeatable; empty = all environments)",
+                "description": "Environment code the account may read secrets in (repeatable; replaces the whole list)",
                 "arguments": [
                   {
                     "name": "SECRET-ENVIRONMENT",
                     "required": true
                   }
                 ]
+              },
+              {
+                "name": "--all-environments",
+                "description": "Remove the restriction entirely: secrets readable in every environment"
+              }
+            ],
+            "arguments": [
+              {
+                "name": "ID",
+                "required": true,
+                "description": "Service account id"
               }
             ],
             "examples": [
-              "closeyourit service-accounts create --name \"Deploy bot\" --project CYI --grant-secrets --secret-environment staging"
+              "closeyourit service-accounts update <id> --secret-environment staging --secret-environment production",
+              "closeyourit service-accounts update <id> --all-environments"
             ]
-          },
+          }
+        ]
+      },
+      {
+        "name": "shared",
+        "description": "Organization-level shared secret variables, delegated to projects",
+        "commands": [
           {
             "name": "delete",
-            "description": "Delete a service account (revokes its tokens + removes org access; the secrets audit trail is kept)",
+            "description": "Delete an organization shared secret from EVERY environment at once (irreversible). There is no per-environment deletion.",
             "options": [
               {
                 "name": "--confirm",
-                "description": "Required: confirm the deletion"
+                "description": "Required: confirm the deletion across every environment"
               }
             ],
             "arguments": [
               {
-                "name": "ID",
+                "name": "NAME",
                 "required": true,
-                "description": "Service account id"
+                "description": "Shared secret name, or its id"
               }
             ],
             "examples": [
-              "closeyourit service-accounts delete <id> --confirm"
+              "closeyourit shared delete API_KEY --confirm"
             ]
           },
           {
             "name": "list",
-            "description": "List the service accounts (AI members, CLI-only) in your organization",
+            "description": "List the organization shared secret names (one row per variable, every page). Never prints values.",
+            "examples": [
+              "closeyourit shared list",
+              "closeyourit shared list --json"
+            ]
+          },
+          {
+            "name": "set",
+            "description": "Set (create or update) an organization shared secret for one environment. Projects delegated on that environment read the new value.",
             "options": [
               {
-                "name": "--page",
-                "description": "Page number",
+                "name": "--environment",
+                "aliases": [
+                  "-e"
+                ],
+                "description": "Environment code (e.g. production) or id",
+                "required": true,
                 "arguments": [
                   {
-                    "name": "PAGE",
+                    "name": "ENVIRONMENT",
                     "required": true
                   }
                 ]
-              }
-            ],
-            "examples": [
-              "closeyourit service-accounts list",
-              "closeyourit service-accounts list --json"
-            ]
-          },
-          {
-            "name": "tokens",
-            "commands": [
+              },
               {
-                "name": "create",
-                "description": "Create a CLI token (cyi_u_) for a service account (the secret is shown only once)",
+                "name": "--value",
+                "description": "Secret value (use when the arg is just NAME)",
                 "arguments": [
                   {
-                    "name": "ACCOUNT",
-                    "required": true,
-                    "description": "Service account id"
-                  },
-                  {
-                    "name": "NAME",
-                    "required": true,
-                    "description": "Token name (e.g. ci-deploy)"
+                    "name": "VALUE",
+                    "required": true
                   }
-                ],
-                "examples": [
-                  "closeyourit service-accounts tokens create <account-id> ci-deploy"
                 ]
               },
               {
-                "name": "revoke",
-                "description": "Revoke a service account CLI token (the agent using it loses access)",
-                "options": [
-                  {
-                    "name": "--confirm",
-                    "description": "Required: confirm the revocation"
-                  }
-                ],
+                "name": "--description",
+                "description": "Optional description",
                 "arguments": [
                   {
-                    "name": "ACCOUNT",
-                    "required": true,
-                    "description": "Service account id"
-                  },
-                  {
-                    "name": "ID",
-                    "required": true,
-                    "description": "Token id"
+                    "name": "DESCRIPTION",
+                    "required": true
                   }
-                ],
-                "examples": [
-                  "closeyourit service-accounts tokens revoke <account-id> <token-id> --confirm"
                 ]
               }
+            ],
+            "arguments": [
+              {
+                "name": "ASSIGNMENT",
+                "required": true,
+                "description": "NAME=VALUE, or just NAME with --value"
+              }
+            ],
+            "examples": [
+              "closeyourit shared set -e production SENTRY_DSN=https://key@sentry.io/42",
+              "closeyourit shared set -e staging API_KEY --value s3cr3t --description \"Stripe key\""
             ]
           }
         ]
@@ -8274,7 +9289,7 @@
       },
       {
         "name": "tickets",
-        "description": "Tickets: list, show, create",
+        "description": "Tickets: list, show, create, ask",
         "commands": [
           {
             "name": "approve",
@@ -8306,6 +9321,32 @@
               "closeyourit tickets approve <ticket-id> --project acme-api"
             ]
           },
+          {
+            "name": "ask",
+            "description": "Ask a natural-language question about the tickets you can see; the AI answers and cites the tickets it used (may take a few seconds)",
+            "options": [
+              {
+                "name": "--timeout",
+                "description": "Seconds to wait for the answer before giving up",
+                "arguments": [
+                  {
+                    "name": "TIMEOUT",
+                    "required": true
+                  }
+                ]
+              }
+            ],
+            "arguments": [
+              {
+                "name": "QUESTION",
+                "description": "The question (all positional words are joined)"
+              }
+            ],
+            "examples": [
+              "closeyourit tickets ask what is left before the next release",
+              "closeyourit tickets ask \"has anyone reported this crash before?\" --json"
+            ]
+          },
           {
             "name": "assign",
             "description": "Assign a ticket to an account, or unassign it (--unassign)",
@@ -8875,6 +9916,113 @@
               "closeyourit tickets delete <ticket-id> --project acme-api --confirm"
             ]
           },
+          {
+            "name": "dependencies",
+            "commands": [
+              {
+                "name": "add",
+                "description": "Add a prerequisite to a ticket: the blocker has to be finished before this ticket can start",
+                "options": [
+                  {
+                    "name": "--project",
+                    "aliases": [
+                      "-p"
+                    ],
+                    "description": "Project id (UUID) or key",
+                    "required": true,
+                    "arguments": [
+                      {
+                        "name": "PROJECT",
+                        "required": true
+                      }
+                    ]
+                  }
+                ],
+                "arguments": [
+                  {
+                    "name": "ID",
+                    "required": true,
+                    "description": "Ticket id or code (e.g. CYRA-132)"
+                  },
+                  {
+                    "name": "BLOCKER",
+                    "required": true,
+                    "description": "Prerequisite ticket id or code — may live in another project"
+                  }
+                ],
+                "examples": [
+                  "closeyourit tickets dependencies add CYRA-132 CYAU-83 --project closeyourit-rails",
+                  "while read -r a b; do closeyourit tickets dependencies add \"$a\" \"$b\" -p closeyourit-rails; done < ordine.txt"
+                ]
+              },
+              {
+                "name": "list",
+                "description": "List the prerequisites of a ticket: what has to be finished before this one can start",
+                "options": [
+                  {
+                    "name": "--project",
+                    "aliases": [
+                      "-p"
+                    ],
+                    "description": "Project id (UUID) or key",
+                    "required": true,
+                    "arguments": [
+                      {
+                        "name": "PROJECT",
+                        "required": true
+                      }
+                    ]
+                  }
+                ],
+                "arguments": [
+                  {
+                    "name": "ID",
+                    "required": true,
+                    "description": "Ticket id or code (e.g. CYRA-132)"
+                  }
+                ],
+                "examples": [
+                  "closeyourit tickets dependencies list CYRA-132 --project closeyourit-rails",
+                  "closeyourit tickets dependencies list CYRA-132 -p closeyourit-rails --json"
+                ]
+              },
+              {
+                "name": "remove",
+                "description": "Remove a prerequisite from a ticket",
+                "options": [
+                  {
+                    "name": "--project",
+                    "aliases": [
+                      "-p"
+                    ],
+                    "description": "Project id (UUID) or key",
+                    "required": true,
+                    "arguments": [
+                      {
+                        "name": "PROJECT",
+                        "required": true
+                      }
+                    ]
+                  }
+                ],
+                "arguments": [
+                  {
+                    "name": "ID",
+                    "required": true,
+                    "description": "Ticket id or code (e.g. CYRA-132)"
+                  },
+                  {
+                    "name": "BLOCKER",
+                    "required": true,
+                    "description": "Prerequisite to remove: its ticket code (e.g. CYAU-83) or the dependency id"
+                  }
+                ],
+                "examples": [
+                  "closeyourit tickets dependencies remove CYRA-132 CYAU-83 --project closeyourit-rails"
+                ]
+              }
+            ]
+          },
           {
             "name": "detach",
             "description": "Remove an attachment from a ticket (irreversible)",
@@ -9958,8 +11106,38 @@
             ]
           },
           {
-            "name": "vote",
-            "description": "Upvote a ticket (idempotent)",
+            "name": "vote",
+            "description": "Upvote a ticket (idempotent)",
+            "options": [
+              {
+                "name": "--project",
+                "aliases": [
+                  "-p"
+                ],
+                "description": "Project id (UUID) or key",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "PROJECT",
+                    "required": true
+                  }
+                ]
+              }
+            ],
+            "arguments": [
+              {
+                "name": "ID",
+                "required": true,
+                "description": "Ticket id"
+              }
+            ],
+            "examples": [
+              "closeyourit tickets vote <ticket-id> --project acme-api"
+            ]
+          },
+          {
+            "name": "watch",
+            "description": "Watch a ticket to receive its notifications (idempotent)",
             "options": [
               {
                 "name": "--project",
@@ -9980,16 +11158,16 @@
               {
                 "name": "ID",
                 "required": true,
-                "description": "Ticket id"
+                "description": "Ticket id or code (e.g. DRFL-3)"
               }
             ],
             "examples": [
-              "closeyourit tickets vote <ticket-id> --project acme-api"
+              "closeyourit tickets watch <ticket-id> --project acme-api"
             ]
           },
           {
-            "name": "watch",
-            "description": "Watch a ticket to receive its notifications (idempotent)",
+            "name": "work-context",
+            "description": "Show the work context frozen when an automation host claimed the ticket: the references and procedures actually delivered back then, never the project's current guidance",
             "options": [
               {
                 "name": "--project",
@@ -10004,6 +11182,10 @@
                     "required": true
                   }
                 ]
+              },
+              {
+                "name": "--full",
+                "description": "Also print the frozen text of every reference and procedure, not just the table"
               }
             ],
             "arguments": [
@@ -10014,7 +11196,10 @@
               }
             ],
             "examples": [
-              "closeyourit tickets watch <ticket-id> --project acme-api"
+              "closeyourit tickets work-context <ticket-id> --project acme-api",
+              "closeyourit tickets work-context DRFL-3 -p driverone-flutter",
+              "closeyourit tickets work-context DRFL-3 -p driverone-flutter --full",
+              "closeyourit tickets work-context DRFL-3 -p driverone-flutter --json"
             ]
           }
         ]
@@ -10433,16 +11618,254 @@
               "closeyourit todos update <list-id> --name \"Sprint prep\"",
               "closeyourit todos update <list-id> --color rose"
             ]
-          }
-        ]
-      },
-      {
-        "name": "tokens",
-        "description": "Project ingest tokens (CI/SDK credentials)",
-        "commands": [
+          }
+        ]
+      },
+      {
+        "name": "tokens",
+        "description": "Project ingest tokens (CI/SDK credentials)",
+        "commands": [
+          {
+            "name": "create",
+            "description": "Create an ingest token (the secret is shown only once)",
+            "options": [
+              {
+                "name": "--project",
+                "aliases": [
+                  "-p"
+                ],
+                "description": "Project id (UUID) or key",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "PROJECT",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--name",
+                "description": "Human-readable token name",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "NAME",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--environment-id",
+                "description": "Environment id the token is scoped to",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "ENVIRONMENT-ID",
+                    "required": true
+                  }
+                ]
+              }
+            ],
+            "examples": [
+              "closeyourit tokens create --project acme-api --name \"CI prod\" --environment-id <env-id>"
+            ]
+          },
+          {
+            "name": "list",
+            "description": "List ingest tokens for a project",
+            "options": [
+              {
+                "name": "--project",
+                "aliases": [
+                  "-p"
+                ],
+                "description": "Project id (UUID) or key",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "PROJECT",
+                    "required": true
+                  }
+                ]
+              }
+            ],
+            "examples": [
+              "closeyourit tokens list --project acme-api",
+              "closeyourit tokens list -p acme-api --json"
+            ]
+          },
+          {
+            "name": "provision",
+            "description": "Generate an ingest token and deliver it without revealing the secret",
+            "options": [
+              {
+                "name": "--project",
+                "aliases": [
+                  "-p"
+                ],
+                "description": "Project id (UUID) or key",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "PROJECT",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--name",
+                "description": "Human-readable token name",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "NAME",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--environment-id",
+                "description": "Source environment code or id",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "ENVIRONMENT-ID",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--scope",
+                "description": "Token scope (repeatable)",
+                "arguments": [
+                  {
+                    "name": "SCOPE",
+                    "required": true,
+                    "acceptedValues": [
+                      "ingest",
+                      "read"
+                    ]
+                  }
+                ]
+              },
+              {
+                "name": "--to-project",
+                "description": "Destination project id or key",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "TO-PROJECT",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--to-environment-id",
+                "description": "Destination environment code or id",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "TO-ENVIRONMENT-ID",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--secret-name",
+                "description": "Destination vault variable name",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "SECRET-NAME",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--idempotency-key",
+                "description": "Stable key for safe request retries",
+                "arguments": [
+                  {
+                    "name": "IDEMPOTENCY-KEY",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--sync-github",
+                "description": "Synchronize the destination vault to GitHub"
+              },
+              {
+                "name": "--confirm-production",
+                "description": "Required when source or destination is production"
+              }
+            ],
+            "examples": [
+              "closeyourit tokens provision -p CYRA --name \"Self monitoring\" --environment-id staging --to-project CYRA --to-environment-id staging --secret-name CLOSEYOURIT_TOKEN"
+            ]
+          },
+          {
+            "name": "provisions",
+            "commands": [
+              {
+                "name": "retry",
+                "description": "Retry GitHub synchronization without regenerating or revealing the token",
+                "options": [
+                  {
+                    "name": "--project",
+                    "aliases": [
+                      "-p"
+                    ],
+                    "description": "Project id (UUID) or key",
+                    "required": true,
+                    "arguments": [
+                      {
+                        "name": "PROJECT",
+                        "required": true
+                      }
+                    ]
+                  }
+                ],
+                "arguments": [
+                  {
+                    "name": "ID",
+                    "required": true,
+                    "description": "Provision id"
+                  }
+                ]
+              },
+              {
+                "name": "show",
+                "description": "Show secret-free token provision status",
+                "options": [
+                  {
+                    "name": "--project",
+                    "aliases": [
+                      "-p"
+                    ],
+                    "description": "Project id (UUID) or key",
+                    "required": true,
+                    "arguments": [
+                      {
+                        "name": "PROJECT",
+                        "required": true
+                      }
+                    ]
+                  }
+                ],
+                "arguments": [
+                  {
+                    "name": "ID",
+                    "required": true,
+                    "description": "Provision id"
+                  }
+                ]
+              }
+            ]
+          },
           {
-            "name": "create",
-            "description": "Create an ingest token (the secret is shown only once)",
+            "name": "revoke",
+            "description": "Revoke an ingest token",
             "options": [
               {
                 "name": "--project",
@@ -10457,37 +11880,22 @@
                     "required": true
                   }
                 ]
-              },
-              {
-                "name": "--name",
-                "description": "Human-readable token name",
-                "required": true,
-                "arguments": [
-                  {
-                    "name": "NAME",
-                    "required": true
-                  }
-                ]
-              },
+              }
+            ],
+            "arguments": [
               {
-                "name": "--environment-id",
-                "description": "Environment id the token is scoped to",
+                "name": "ID",
                 "required": true,
-                "arguments": [
-                  {
-                    "name": "ENVIRONMENT-ID",
-                    "required": true
-                  }
-                ]
+                "description": "Token id"
               }
             ],
             "examples": [
-              "closeyourit tokens create --project acme-api --name \"CI prod\" --environment-id <env-id>"
+              "closeyourit tokens revoke <token-id> --project acme-api"
             ]
           },
           {
-            "name": "list",
-            "description": "List ingest tokens for a project",
+            "name": "rotate",
+            "description": "Rotate an ingest token (the new secret is shown only once)",
             "options": [
               {
                 "name": "--project",
@@ -10504,165 +11912,259 @@
                 ]
               }
             ],
+            "arguments": [
+              {
+                "name": "ID",
+                "required": true,
+                "description": "Token id"
+              }
+            ],
             "examples": [
-              "closeyourit tokens list --project acme-api",
-              "closeyourit tokens list -p acme-api --json"
+              "closeyourit tokens rotate <token-id> --project acme-api"
             ]
-          },
+          }
+        ]
+      },
+      {
+        "name": "uptime-groups",
+        "description": "Uptime monitor groups (org-level) + public status page",
+        "commands": [
           {
-            "name": "provision",
-            "description": "Generate an ingest token and deliver it without revealing the secret",
+            "name": "create",
+            "description": "Create an uptime monitor group (org-level container)",
             "options": [
               {
-                "name": "--project",
-                "aliases": [
-                  "-p"
-                ],
-                "description": "Project id (UUID) or key",
+                "name": "--name",
+                "description": "Group name",
                 "required": true,
                 "arguments": [
                   {
-                    "name": "PROJECT",
+                    "name": "NAME",
                     "required": true
                   }
                 ]
               },
               {
-                "name": "--name",
-                "description": "Human-readable token name",
-                "required": true,
+                "name": "--color",
+                "description": "Accent color (Tailwind palette name)",
                 "arguments": [
                   {
-                    "name": "NAME",
+                    "name": "COLOR",
                     "required": true
                   }
                 ]
               },
               {
-                "name": "--environment-id",
-                "description": "Source environment code or id",
-                "required": true,
+                "name": "--icon",
+                "description": "Icon name",
                 "arguments": [
                   {
-                    "name": "ENVIRONMENT-ID",
+                    "name": "ICON",
                     "required": true
                   }
                 ]
               },
               {
-                "name": "--scope",
-                "description": "Token scope (repeatable)",
+                "name": "--description",
+                "description": "Group description",
                 "arguments": [
                   {
-                    "name": "SCOPE",
-                    "required": true,
-                    "acceptedValues": [
-                      "ingest",
-                      "read"
-                    ]
+                    "name": "DESCRIPTION",
+                    "required": true
                   }
                 ]
-              },
+              }
+            ],
+            "examples": [
+              "closeyourit uptime-groups create --name \"Core services\"",
+              "closeyourit uptime-groups create --name API --color sky --icon server --description \"Public API\""
+            ]
+          },
+          {
+            "name": "delete",
+            "description": "Delete an uptime monitor group (irreversible)",
+            "options": [
               {
-                "name": "--to-project",
-                "description": "Destination project id or key",
+                "name": "--confirm",
+                "description": "Required: confirm the irreversible deletion"
+              }
+            ],
+            "arguments": [
+              {
+                "name": "ID",
                 "required": true,
+                "description": "Uptime group id"
+              }
+            ],
+            "examples": [
+              "closeyourit uptime-groups delete <group-id> --confirm"
+            ]
+          },
+          {
+            "name": "list",
+            "description": "List the uptime monitor groups in your organization",
+            "options": [
+              {
+                "name": "--page",
+                "description": "Page number",
                 "arguments": [
                   {
-                    "name": "TO-PROJECT",
+                    "name": "PAGE",
                     "required": true
                   }
                 ]
-              },
+              }
+            ],
+            "examples": [
+              "closeyourit uptime-groups list",
+              "closeyourit uptime-groups list --page 2 --json"
+            ]
+          },
+          {
+            "name": "publish",
+            "description": "Publish the public status page for an uptime group",
+            "arguments": [
               {
-                "name": "--to-environment-id",
-                "description": "Destination environment code or id",
+                "name": "ID",
+                "required": true,
+                "description": "Uptime group id"
+              }
+            ],
+            "examples": [
+              "closeyourit uptime-groups publish <group-id>"
+            ]
+          },
+          {
+            "name": "show",
+            "description": "Show an uptime monitor group",
+            "arguments": [
+              {
+                "name": "ID",
+                "required": true,
+                "description": "Uptime group id"
+              }
+            ],
+            "examples": [
+              "closeyourit uptime-groups show <group-id>"
+            ]
+          },
+          {
+            "name": "unpublish",
+            "description": "Unpublish (retract) the public status page for an uptime group",
+            "arguments": [
+              {
+                "name": "ID",
                 "required": true,
+                "description": "Uptime group id"
+              }
+            ],
+            "examples": [
+              "closeyourit uptime-groups unpublish <group-id>"
+            ]
+          },
+          {
+            "name": "update",
+            "description": "Update an uptime monitor group (only the provided fields)",
+            "options": [
+              {
+                "name": "--name",
+                "description": "Group name",
                 "arguments": [
                   {
-                    "name": "TO-ENVIRONMENT-ID",
+                    "name": "NAME",
                     "required": true
                   }
                 ]
               },
               {
-                "name": "--secret-name",
-                "description": "Destination vault variable name",
-                "required": true,
+                "name": "--color",
+                "description": "Accent color (Tailwind palette name)",
                 "arguments": [
                   {
-                    "name": "SECRET-NAME",
+                    "name": "COLOR",
                     "required": true
                   }
                 ]
               },
               {
-                "name": "--idempotency-key",
-                "description": "Stable key for safe request retries",
+                "name": "--icon",
+                "description": "Icon name",
                 "arguments": [
                   {
-                    "name": "IDEMPOTENCY-KEY",
+                    "name": "ICON",
                     "required": true
                   }
                 ]
               },
               {
-                "name": "--sync-github",
-                "description": "Synchronize the destination vault to GitHub"
-              },
+                "name": "--description",
+                "description": "Group description",
+                "arguments": [
+                  {
+                    "name": "DESCRIPTION",
+                    "required": true
+                  }
+                ]
+              }
+            ],
+            "arguments": [
               {
-                "name": "--confirm-production",
-                "description": "Required when source or destination is production"
+                "name": "ID",
+                "required": true,
+                "description": "Uptime group id"
               }
             ],
             "examples": [
-              "closeyourit tokens provision -p CYRA --name \"Self monitoring\" --environment-id staging --to-project CYRA --to-environment-id staging --secret-name CLOSEYOURIT_TOKEN"
+              "closeyourit uptime-groups update <group-id> --name \"New name\" --color emerald"
             ]
-          },
-          {
-            "name": "provisions",
-            "commands": [
-              {
-                "name": "retry",
-                "description": "Retry GitHub synchronization without regenerating or revealing the token",
-                "options": [
-                  {
-                    "name": "--project",
-                    "aliases": [
-                      "-p"
-                    ],
-                    "description": "Project id (UUID) or key",
-                    "required": true,
-                    "arguments": [
-                      {
-                        "name": "PROJECT",
-                        "required": true
-                      }
-                    ]
-                  }
-                ],
+          }
+        ]
+      },
+      {
+        "name": "vault",
+        "description": "Vault review: the secret changes waiting for a second approval",
+        "commands": [
+          {
+            "name": "requests",
+            "description": "Secret change requests: list, approve, reject (four-eyes, decided by a person)",
+            "commands": [
+              {
+                "name": "approve",
+                "description": "Approve a pending secret change request: the change it carries is applied to the vault. Whoever asked for it cannot approve it (four-eyes), and a service account never can.",
                 "arguments": [
                   {
                     "name": "ID",
                     "required": true,
-                    "description": "Provision id"
+                    "description": "Change request id (from \"vault requests list\")"
                   }
+                ],
+                "examples": [
+                  "closeyourit vault requests approve <id>",
+                  "closeyourit vault requests approve <id> --json"
                 ]
               },
               {
-                "name": "show",
-                "description": "Show secret-free token provision status",
+                "name": "list",
+                "description": "List the secret changes waiting for a second approval, across every visible project. Shows the name and the intent, never the proposed value.",
+                "examples": [
+                  "closeyourit vault requests list",
+                  "closeyourit vault requests list --json"
+                ]
+              },
+              {
+                "name": "reject",
+                "description": "Reject a pending secret change request with a reason. Nothing changes in the vault: the request freezes as rejected and the reason reaches whoever asked.",
                 "options": [
                   {
-                    "name": "--project",
+                    "name": "--reason",
                     "aliases": [
-                      "-p"
+                      "-r"
                     ],
-                    "description": "Project id (UUID) or key",
+                    "description": "Why the change is refused — recorded for the audit and sent to whoever asked",
                     "required": true,
                     "arguments": [
                       {
-                        "name": "PROJECT",
+                        "name": "REASON",
                         "required": true
                       }
                     ]
@@ -10672,26 +12174,34 @@
                   {
                     "name": "ID",
                     "required": true,
-                    "description": "Provision id"
+                    "description": "Change request id (from \"vault requests list\")"
                   }
+                ],
+                "examples": [
+                  "closeyourit vault requests reject <id> --reason \"rotate it on staging first\"",
+                  "closeyourit vault requests reject <id> -r \"wrong key\" --json"
                 ]
               }
             ]
-          },
+          }
+        ]
+      },
+      {
+        "name": "vulnerabilities",
+        "commands": [
           {
-            "name": "revoke",
-            "description": "Revoke an ingest token",
+            "name": "ignore",
+            "description": "Ignore a vulnerability: you accept living with the risk",
+            "aliases": [
+              "vulns:ignore"
+            ],
             "options": [
               {
-                "name": "--project",
-                "aliases": [
-                  "-p"
-                ],
-                "description": "Project id (UUID) or key",
-                "required": true,
+                "name": "--note",
+                "description": "Why you are keeping it (shown alongside the ignored row)",
                 "arguments": [
                   {
-                    "name": "PROJECT",
+                    "name": "NOTE",
                     "required": true
                   }
                 ]
@@ -10701,286 +12211,393 @@
               {
                 "name": "ID",
                 "required": true,
-                "description": "Token id"
+                "description": "Vulnerability finding id"
               }
             ],
             "examples": [
-              "closeyourit tokens revoke <token-id> --project acme-api"
+              "closeyourit vulnerabilities ignore <finding-id>",
+              "closeyourit vulnerabilities ignore <finding-id> --note \"Not reachable from our code.\""
             ]
           },
           {
-            "name": "rotate",
-            "description": "Rotate an ingest token (the new secret is shown only once)",
+            "name": "list",
+            "description": "List known vulnerabilities of the project dependencies (cross-project)",
+            "aliases": [
+              "vulns:list"
+            ],
             "options": [
               {
                 "name": "--project",
                 "aliases": [
                   "-p"
                 ],
-                "description": "Project id (UUID) or key",
-                "required": true,
+                "description": "Filter by project id (UUID) or key",
                 "arguments": [
                   {
                     "name": "PROJECT",
                     "required": true
                   }
                 ]
-              }
-            ],
-            "arguments": [
-              {
-                "name": "ID",
-                "required": true,
-                "description": "Token id"
-              }
-            ],
-            "examples": [
-              "closeyourit tokens rotate <token-id> --project acme-api"
-            ]
-          }
-        ]
-      },
-      {
-        "name": "uptime-groups",
-        "description": "Uptime monitor groups (org-level) + public status page",
-        "commands": [
-          {
-            "name": "create",
-            "description": "Create an uptime monitor group (org-level container)",
-            "options": [
+              },
               {
-                "name": "--name",
-                "description": "Group name",
-                "required": true,
+                "name": "--severity",
+                "description": "Filter by severity (critical, high, moderate, low, unknown)",
                 "arguments": [
                   {
-                    "name": "NAME",
+                    "name": "SEVERITY",
                     "required": true
                   }
                 ]
               },
               {
-                "name": "--color",
-                "description": "Accent color (Tailwind palette name)",
+                "name": "--status",
+                "description": "Filter by status (open, resolved, ignored)",
                 "arguments": [
                   {
-                    "name": "COLOR",
+                    "name": "STATUS",
                     "required": true
                   }
                 ]
               },
               {
-                "name": "--icon",
-                "description": "Icon name",
+                "name": "--package",
+                "description": "Filter by package name (partial match)",
                 "arguments": [
                   {
-                    "name": "ICON",
+                    "name": "PACKAGE",
                     "required": true
                   }
                 ]
               },
               {
-                "name": "--description",
-                "description": "Group description",
+                "name": "--page",
+                "description": "Page number",
                 "arguments": [
                   {
-                    "name": "DESCRIPTION",
+                    "name": "PAGE",
                     "required": true
                   }
                 ]
               }
             ],
             "examples": [
-              "closeyourit uptime-groups create --name \"Core services\"",
-              "closeyourit uptime-groups create --name API --color sky --icon server --description \"Public API\""
+              "closeyourit vulnerabilities list",
+              "closeyourit vulnerabilities list --severity critical",
+              "closeyourit vulnerabilities list --project acme-api --status open",
+              "closeyourit vulnerabilities list --package nokogiri --json"
             ]
           },
           {
-            "name": "delete",
-            "description": "Delete an uptime monitor group (irreversible)",
-            "options": [
+            "name": "promote",
+            "description": "Open a ticket from a vulnerability (automatic promotion only fires on high/critical)",
+            "aliases": [
+              "vulns:promote"
+            ],
+            "arguments": [
               {
-                "name": "--confirm",
-                "description": "Required: confirm the irreversible deletion"
+                "name": "ID",
+                "required": true,
+                "description": "Vulnerability finding id"
               }
             ],
+            "examples": [
+              "closeyourit vulnerabilities promote <finding-id>"
+            ]
+          },
+          {
+            "name": "reopen",
+            "description": "Reopen an ignored vulnerability: you changed your mind",
+            "aliases": [
+              "vulns:reopen"
+            ],
             "arguments": [
               {
                 "name": "ID",
                 "required": true,
-                "description": "Uptime group id"
+                "description": "Vulnerability finding id"
               }
             ],
             "examples": [
-              "closeyourit uptime-groups delete <group-id> --confirm"
+              "closeyourit vulnerabilities reopen <finding-id>"
             ]
           },
           {
-            "name": "list",
-            "description": "List the uptime monitor groups in your organization",
+            "name": "rescan",
+            "description": "Rescan a project now, without waiting for the nightly run",
+            "aliases": [
+              "vulns:rescan"
+            ],
             "options": [
               {
-                "name": "--page",
-                "description": "Page number",
+                "name": "--project",
+                "aliases": [
+                  "-p"
+                ],
+                "description": "Project id (UUID) or key",
+                "required": true,
                 "arguments": [
                   {
-                    "name": "PAGE",
+                    "name": "PROJECT",
                     "required": true
                   }
                 ]
               }
             ],
             "examples": [
-              "closeyourit uptime-groups list",
-              "closeyourit uptime-groups list --page 2 --json"
+              "closeyourit vulnerabilities rescan --project acme-api"
             ]
           },
           {
-            "name": "publish",
-            "description": "Publish the public status page for an uptime group",
-            "arguments": [
+            "name": "runtimes",
+            "description": "List the support state of the declared runtimes (Ruby, Node, Flutter…)",
+            "aliases": [
+              "vulns:runtimes"
+            ],
+            "options": [
               {
-                "name": "ID",
-                "required": true,
-                "description": "Uptime group id"
+                "name": "--project",
+                "aliases": [
+                  "-p"
+                ],
+                "description": "Filter by project id (UUID) or key",
+                "arguments": [
+                  {
+                    "name": "PROJECT",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--page",
+                "description": "Page number",
+                "arguments": [
+                  {
+                    "name": "PAGE",
+                    "required": true
+                  }
+                ]
               }
             ],
             "examples": [
-              "closeyourit uptime-groups publish <group-id>"
+              "closeyourit vulnerabilities runtimes",
+              "closeyourit vulnerabilities runtimes --project acme-api --json"
             ]
           },
           {
             "name": "show",
-            "description": "Show an uptime monitor group",
-            "arguments": [
-              {
-                "name": "ID",
-                "required": true,
-                "description": "Uptime group id"
-              }
+            "description": "Show a single vulnerability: advisory, package, manifest and the fixing version",
+            "aliases": [
+              "vulns:show"
             ],
-            "examples": [
-              "closeyourit uptime-groups show <group-id>"
-            ]
-          },
-          {
-            "name": "unpublish",
-            "description": "Unpublish (retract) the public status page for an uptime group",
             "arguments": [
               {
                 "name": "ID",
                 "required": true,
-                "description": "Uptime group id"
+                "description": "Vulnerability finding id"
               }
             ],
             "examples": [
-              "closeyourit uptime-groups unpublish <group-id>"
+              "closeyourit vulnerabilities show <finding-id>"
             ]
-          },
+          }
+        ]
+      },
+      {
+        "name": "whoami",
+        "description": "Show the authenticated account, organization, token prefix and permissions",
+        "examples": [
+          "closeyourit whoami",
+          "closeyourit whoami --json"
+        ]
+      },
+      {
+        "name": "workload",
+        "description": "Team workload actions (non-dev activities): participants, link or generate a ticket",
+        "commands": [
           {
-            "name": "update",
-            "description": "Update an uptime monitor group (only the provided fields)",
+            "name": "create",
+            "description": "Create a workload action (non-dev activity: fair, meeting, call…) on one of your teams. Add the people with `workload participant add`.",
             "options": [
               {
-                "name": "--name",
-                "description": "Group name",
+                "name": "--team",
+                "description": "Team id (UUID) or name — the action belongs to it and cannot be moved later",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "TEAM",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--title",
+                "description": "What the activity is",
+                "required": true,
+                "arguments": [
+                  {
+                    "name": "TITLE",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--description",
+                "description": "What the activity is about (free text)",
                 "arguments": [
                   {
-                    "name": "NAME",
+                    "name": "DESCRIPTION",
                     "required": true
                   }
                 ]
               },
               {
-                "name": "--color",
-                "description": "Accent color (Tailwind palette name)",
+                "name": "--status",
+                "description": "Status (planned, in_progress, done, cancelled)",
                 "arguments": [
                   {
-                    "name": "COLOR",
+                    "name": "STATUS",
+                    "required": true,
+                    "acceptedValues": [
+                      "planned",
+                      "in_progress",
+                      "done",
+                      "cancelled"
+                    ]
+                  }
+                ]
+              },
+              {
+                "name": "--scheduled-at",
+                "description": "When it takes place (ISO 8601)",
+                "arguments": [
+                  {
+                    "name": "SCHEDULED-AT",
                     "required": true
                   }
                 ]
               },
               {
-                "name": "--icon",
-                "description": "Icon name",
+                "name": "--due-at",
+                "description": "Deadline (ISO 8601)",
                 "arguments": [
                   {
-                    "name": "ICON",
+                    "name": "DUE-AT",
                     "required": true
                   }
                 ]
               },
               {
-                "name": "--description",
-                "description": "Group description",
+                "name": "--ticket",
+                "description": "Link an existing ticket by code (e.g. DRFL-3) or id — pass an empty string to unlink",
                 "arguments": [
                   {
-                    "name": "DESCRIPTION",
+                    "name": "TICKET",
                     "required": true
                   }
                 ]
               }
             ],
+            "examples": [
+              "closeyourit workload create --team Marketing --title \"Fiera di Rimini\"",
+              "closeyourit workload create --team Marketing --title \"Riunione firma accordo\" --scheduled-at 2026-09-01T09:00:00Z --due-at 2026-09-10T18:00:00Z",
+              "closeyourit workload create --team Marketing --title \"Materiale stand\" --status in_progress --ticket DRFL-3"
+            ]
+          },
+          {
+            "name": "delete",
+            "description": "Delete a workload action (irreversible; a linked ticket survives and only loses the link)",
+            "options": [
+              {
+                "name": "--confirm",
+                "description": "Required: confirm the irreversible deletion"
+              }
+            ],
             "arguments": [
               {
                 "name": "ID",
                 "required": true,
-                "description": "Uptime group id"
+                "description": "Workload action id"
               }
             ],
             "examples": [
-              "closeyourit uptime-groups update <group-id> --name \"New name\" --color emerald"
+              "closeyourit workload delete <action-id> --confirm"
             ]
-          }
-        ]
-      },
-      {
-        "name": "vulnerabilities",
-        "commands": [
+          },
           {
-            "name": "ignore",
-            "description": "Ignore a vulnerability: you accept living with the risk",
-            "aliases": [
-              "vulns:ignore"
-            ],
+            "name": "list",
+            "description": "List the workload actions of the teams you belong to (newest first)",
             "options": [
               {
-                "name": "--note",
-                "description": "Why you are keeping it (shown alongside the ignored row)",
+                "name": "--page",
+                "description": "Page number",
                 "arguments": [
                   {
-                    "name": "NOTE",
+                    "name": "PAGE",
                     "required": true
                   }
                 ]
               }
             ],
-            "arguments": [
+            "examples": [
+              "closeyourit workload list",
+              "closeyourit workload list --page 2 --json"
+            ]
+          },
+          {
+            "name": "participant",
+            "description": "People taking part in a workload action (members of its team)",
+            "commands": [
               {
-                "name": "ID",
-                "required": true,
-                "description": "Vulnerability finding id"
+                "name": "add",
+                "description": "Add someone to a workload action (they must belong to the team that owns it)",
+                "arguments": [
+                  {
+                    "name": "ACTION",
+                    "required": true,
+                    "description": "Workload action id"
+                  },
+                  {
+                    "name": "MEMBER",
+                    "required": true,
+                    "description": "Participant account id or email (must be on the action team)"
+                  }
+                ],
+                "examples": [
+                  "closeyourit workload participant add <action-id> ada@acme.com"
+                ]
+              },
+              {
+                "name": "remove",
+                "description": "Remove someone from a workload action (idempotent: removing who is not there succeeds)",
+                "arguments": [
+                  {
+                    "name": "ACTION",
+                    "required": true,
+                    "description": "Workload action id"
+                  },
+                  {
+                    "name": "MEMBER",
+                    "required": true,
+                    "description": "Participant account id or email"
+                  }
+                ],
+                "examples": [
+                  "closeyourit workload participant remove <action-id> ada@acme.com"
+                ]
               }
-            ],
-            "examples": [
-              "closeyourit vulnerabilities ignore <finding-id>",
-              "closeyourit vulnerabilities ignore <finding-id> --note \"Not reachable from our code.\""
             ]
           },
           {
-            "name": "list",
-            "description": "List known vulnerabilities of the project dependencies (cross-project)",
-            "aliases": [
-              "vulns:list"
-            ],
+            "name": "promote",
+            "description": "Generate a ticket from a workload action and link it back (the action keeps existing; an already linked action is refused)",
             "options": [
               {
                 "name": "--project",
                 "aliases": [
                   "-p"
                 ],
-                "description": "Filter by project id (UUID) or key",
+                "description": "Project id (UUID) or key",
+                "required": true,
                 "arguments": [
                   {
                     "name": "PROJECT",
@@ -10989,175 +12606,173 @@
                 ]
               },
               {
-                "name": "--severity",
-                "description": "Filter by severity (critical, high, moderate, low, unknown)",
+                "name": "--title",
+                "description": "Ticket title (default: the action title, max 255 characters)",
                 "arguments": [
                   {
-                    "name": "SEVERITY",
+                    "name": "TITLE",
                     "required": true
                   }
                 ]
               },
               {
-                "name": "--status",
-                "description": "Filter by status (open, resolved, ignored)",
+                "name": "--description",
+                "description": "Ticket description (max 4000 characters)",
                 "arguments": [
                   {
-                    "name": "STATUS",
+                    "name": "DESCRIPTION",
                     "required": true
                   }
                 ]
               },
               {
-                "name": "--package",
-                "description": "Filter by package name (partial match)",
+                "name": "--kind",
+                "description": "Ticket kind (default: task)",
                 "arguments": [
                   {
-                    "name": "PACKAGE",
+                    "name": "KIND",
+                    "required": true,
+                    "acceptedValues": [
+                      "bug",
+                      "story",
+                      "task",
+                      "epic"
+                    ]
+                  }
+                ]
+              },
+              {
+                "name": "--status",
+                "description": "Status code, label or id (e.g. open, \"In Progress\") — default: open",
+                "arguments": [
+                  {
+                    "name": "STATUS",
                     "required": true
                   }
                 ]
               },
               {
-                "name": "--page",
-                "description": "Page number",
+                "name": "--priority",
+                "description": "Priority code, label or id (e.g. medium, High) — default: medium",
                 "arguments": [
                   {
-                    "name": "PAGE",
+                    "name": "PRIORITY",
                     "required": true
                   }
                 ]
               }
             ],
-            "examples": [
-              "closeyourit vulnerabilities list",
-              "closeyourit vulnerabilities list --severity critical",
-              "closeyourit vulnerabilities list --project acme-api --status open",
-              "closeyourit vulnerabilities list --package nokogiri --json"
-            ]
-          },
-          {
-            "name": "promote",
-            "description": "Open a ticket from a vulnerability (automatic promotion only fires on high/critical)",
-            "aliases": [
-              "vulns:promote"
-            ],
             "arguments": [
               {
-                "name": "ID",
+                "name": "ACTION",
                 "required": true,
-                "description": "Vulnerability finding id"
+                "description": "Workload action id"
               }
             ],
             "examples": [
-              "closeyourit vulnerabilities promote <finding-id>"
+              "closeyourit workload promote <action-id> --project acme-api",
+              "closeyourit workload promote <action-id> -p acme-api --title \"Implement the partner API\" --description \"Agreed in the meeting\" --kind story --priority High"
             ]
           },
           {
-            "name": "reopen",
-            "description": "Reopen an ignored vulnerability: you changed your mind",
-            "aliases": [
-              "vulns:reopen"
-            ],
+            "name": "show",
+            "description": "Show one workload action (an action of another team answers 404, never 403)",
             "arguments": [
               {
                 "name": "ID",
                 "required": true,
-                "description": "Vulnerability finding id"
+                "description": "Workload action id"
               }
             ],
             "examples": [
-              "closeyourit vulnerabilities reopen <finding-id>"
+              "closeyourit workload show <action-id>"
             ]
           },
           {
-            "name": "rescan",
-            "description": "Rescan a project now, without waiting for the nightly run",
-            "aliases": [
-              "vulns:rescan"
-            ],
+            "name": "update",
+            "description": "Update a workload action (only the passed fields change). The team never changes: moving an action would change who can see it.",
             "options": [
               {
-                "name": "--project",
-                "aliases": [
-                  "-p"
-                ],
-                "description": "Project id (UUID) or key",
-                "required": true,
+                "name": "--title",
+                "description": "New title",
                 "arguments": [
                   {
-                    "name": "PROJECT",
+                    "name": "TITLE",
                     "required": true
                   }
                 ]
-              }
-            ],
-            "examples": [
-              "closeyourit vulnerabilities rescan --project acme-api"
-            ]
-          },
-          {
-            "name": "runtimes",
-            "description": "List the support state of the declared runtimes (Ruby, Node, Flutter…)",
-            "aliases": [
-              "vulns:runtimes"
-            ],
-            "options": [
+              },
               {
-                "name": "--project",
-                "aliases": [
-                  "-p"
-                ],
-                "description": "Filter by project id (UUID) or key",
+                "name": "--description",
+                "description": "What the activity is about (free text)",
                 "arguments": [
                   {
-                    "name": "PROJECT",
+                    "name": "DESCRIPTION",
                     "required": true
                   }
                 ]
               },
               {
-                "name": "--page",
-                "description": "Page number",
+                "name": "--status",
+                "description": "Status (planned, in_progress, done, cancelled)",
                 "arguments": [
                   {
-                    "name": "PAGE",
+                    "name": "STATUS",
+                    "required": true,
+                    "acceptedValues": [
+                      "planned",
+                      "in_progress",
+                      "done",
+                      "cancelled"
+                    ]
+                  }
+                ]
+              },
+              {
+                "name": "--scheduled-at",
+                "description": "When it takes place (ISO 8601)",
+                "arguments": [
+                  {
+                    "name": "SCHEDULED-AT",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--due-at",
+                "description": "Deadline (ISO 8601)",
+                "arguments": [
+                  {
+                    "name": "DUE-AT",
+                    "required": true
+                  }
+                ]
+              },
+              {
+                "name": "--ticket",
+                "description": "Link an existing ticket by code (e.g. DRFL-3) or id — pass an empty string to unlink",
+                "arguments": [
+                  {
+                    "name": "TICKET",
                     "required": true
                   }
                 ]
               }
             ],
-            "examples": [
-              "closeyourit vulnerabilities runtimes",
-              "closeyourit vulnerabilities runtimes --project acme-api --json"
-            ]
-          },
-          {
-            "name": "show",
-            "description": "Show a single vulnerability: advisory, package, manifest and the fixing version",
-            "aliases": [
-              "vulns:show"
-            ],
             "arguments": [
               {
                 "name": "ID",
                 "required": true,
-                "description": "Vulnerability finding id"
+                "description": "Workload action id"
               }
             ],
             "examples": [
-              "closeyourit vulnerabilities show <finding-id>"
+              "closeyourit workload update <action-id> --status done",
+              "closeyourit workload update <action-id> --title \"Fiera 2027\" --due-at 2027-09-10T18:00:00Z",
+              "closeyourit workload update <action-id> --ticket \"\""
             ]
           }
         ]
-      },
-      {
-        "name": "whoami",
-        "description": "Show the authenticated account, organization, token prefix and permissions",
-        "examples": [
-          "closeyourit whoami",
-          "closeyourit whoami --json"
-        ]
       }
     ]
   }