@chainpatrol/cli 0.15.0 → 0.15.1

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @chainpatrol/cli
 
+## 0.15.1
+
+### Patch Changes
+
+- 92df1cd: Tighten the skill content so agents stop bailing on cross-customer
+  totals.
+
+  After the multi-org `--slugs` shipped in #6555, an agent on the
+  new CLI was still answering "I can't easily get this — no `--all`
+  aggregation in the CLI" to "how many takedowns across all clients
+  in the last 7 days?", because the existing `--slugs` section was
+  buried below the per-subcommand details and the agent anchored on
+  `metrics summary` (which is single-org and has no `--slugs`).
+
+  Two changes to fix that without touching code:
+
+  1. **Frontload a decision rule.** A new "read this before picking a
+     metrics subcommand" block sits at the top of the metrics section,
+     names the cross-org phrases ("across all clients", "company-wide",
+     "total takedowns", "how many takedowns in the last N days?" with
+     no org named, etc.), points at `metrics organization --slugs`,
+     and explicitly anti-patterns the common wrong moves (routing to
+     Metabase, looping `metrics summary`, bailing with "no cross-org
+     aggregation in the CLI"). Includes a copy-and-run two-step
+     recipe (`orgs list` → `metrics organization --slugs`).
+  2. **Broaden the `Use when` trigger phrases** to cover the cross-org
+     wording explicitly: "how many takedowns", "across all
+     clients/customers/orgs/brands", "company-wide", "total/average
+     takedowns/threats/reports", "rollup across customers", etc., so
+     the skill itself loads when the user asks this kind of question.
+
+  Skill-only change; no API, handler, or response shape changes.
+
 ## 0.15.0
 
 ### Minor Changes

package/dist/{chunk-QGKR7EPH.js → chunk-IPN6O3N4.js}

@@ -198,7 +198,13 @@ description: |
   "orgs with takedowns off", "automation off across orgs",
   "which customers have X enabled", "service toggles by org",
   "is this URL blocked", "is this domain blocked", "is this address blocked",
-  "check this asset", "asset check", "lookup asset status".
+  "check this asset", "asset check", "lookup asset status",
+  "how many takedowns", "takedowns in the last", "threats taken down",
+  "across all clients", "across all customers", "across all orgs",
+  "across all brands", "company-wide", "total takedowns", "total threats",
+  "total reports", "average takedowns", "average threats", "average per day",
+  "average per customer", "average per org", "rollup across customers",
+  "sum across orgs", "sum across customers".
 allowed-tools:
   - Bash
   - Read
@@ -661,6 +667,66 @@ and summarize patterns by service or by subscription tier.
 
 ### \`metrics summary | found | breakdown | organization\` \u2014 Org metrics for spike/drop analysis
 
+#### Decision rule \u2014 read this before picking a metrics subcommand
+
+When the user asks for a number that **spans more than one customer/org/brand**
+\u2014 phrases like "across all clients", "across all customers", "across all orgs",
+"across all brands", "company-wide", "total takedowns", "total threats",
+"average takedowns per day across customers", "rollup across customers",
+"how many takedowns in the last 7 days?" (no org named) \u2014 the answer is
+**\`chainpatrol metrics organization --slugs <comma-list>\`**, *not*
+\`metrics summary\`. \`summary\`, \`found\`, and \`breakdown\` are
+single-org commands and have no \`--slugs\`; only \`organization\` does.
+The \`--slugs\` form rolls totals + per-day / per-org-per-day averages
+server-side in **one** HTTP call. Full recipe is in the \`--slugs\`
+section below.
+
+**Anti-patterns to avoid:**
+
+- \u274C "There's no cross-org aggregation in the CLI." There is \u2014 \`metrics
+  organization --slugs\`. Don't bail out citing the docs without
+  searching for \`--slugs\`.
+- \u274C Looping \`metrics summary --org X\` once per customer to sum
+  client-side. \`--slugs\` is one round-trip; the loop is what made
+  the endpoint 503-prone in the first place.
+- \u274C Routing the user to Metabase / the data warehouse for a question
+  the CLI can answer. Reach for Metabase only when the metric isn't
+  in the \`--include\` list (\`reports\`, \`newThreats\`,
+  \`threatsWatchlisted\`, \`takedownsFiled\`, \`takedownsCompleted\`,
+  \`domainThreats\`, \`twitterThreats\`, \`telegramThreats\`,
+  \`otherThreats\`, \`blockedByType\`, \`blockedByDay\`).
+- \u274C "Iterating 100+ orgs one-by-one isn't practical here." Right \u2014
+  that's why you don't iterate. You pass \`--slugs\` (cap 50; if more,
+  split the list into batches and sum) with \`--include <metric>\`
+  to keep each per-org aggregate cheap.
+
+#### Common cross-org recipe (copy and run)
+
+\`\`\`bash
+# Step 1: get the slugs of every active customer with takedowns enabled
+chainpatrol --json orgs list \\
+  --subscription-status ACTIVE \\
+  --service-active takedowns
+
+# Step 2: feed the slugs into one metrics call. Server fans out and rolls up.
+chainpatrol --json metrics organization \\
+  --slugs <comma-list from step 1> \\
+  --include takedownsCompleted \\
+  --from <YYYY-MM-DD 7 days ago> --to <YYYY-MM-DD today>
+
+# Read these fields from the JSON:
+#   .metrics.takedownsCompleted         \u2190 grand total across all orgs
+#   .averages.perDay.takedownsCompleted \u2190 total / windowDays
+#   .averages.perOrgPerDay.takedownsCompleted \u2190 total / numOrgs / windowDays
+#   .perOrg[slug].metrics.takedownsCompleted  \u2190 per-customer breakdown
+\`\`\`
+
+Replace \`takedownsCompleted\` with whatever metric the user asked about.
+Replace the date range with whatever window they asked about (default
+3 months if they didn't say).
+
+#### Single-org examples
+
 \`\`\`bash
 chainpatrol --json metrics summary      --org <slug>                                  # defaults to last 3 months
 chainpatrol --json metrics summary      --org <slug> --this-week

package/dist/cli.js

@@ -13,7 +13,7 @@ import {
   getCliVersion,
   isSkillInstalled,
   readInstalledSkillVersion
-} from "./chunk-QGKR7EPH.js";
+} from "./chunk-IPN6O3N4.js";
 import "./chunk-NQT77IB7.js";
 import {
   DateTime
@@ -1632,12 +1632,12 @@ async function main() {
     case "setup":
     case "install":
     case "i": {
-      const { setupSkill } = await import("./setup-skill-ENJSVGLR.js");
+      const { setupSkill } = await import("./setup-skill-6SDQXFTR.js");
       setupSkill({ json: jsonMode, cloud: cli.flags.cloud });
       break;
     }
     case "uninstall": {
-      const { uninstallSkill } = await import("./setup-skill-ENJSVGLR.js");
+      const { uninstallSkill } = await import("./setup-skill-6SDQXFTR.js");
       uninstallSkill({ json: jsonMode });
       break;
     }

package/dist/{setup-skill-ENJSVGLR.js → setup-skill-6SDQXFTR.js}

@@ -6,7 +6,7 @@ import {
   readInstalledSkillVersion,
   setupSkill,
   uninstallSkill
-} from "./chunk-QGKR7EPH.js";
+} from "./chunk-IPN6O3N4.js";
 import "./chunk-NQT77IB7.js";
 export {
   getBundledSkillContent,

package/package.json

@@ -2,7 +2,7 @@
   "name": "@chainpatrol/cli",
   "description": "The official ChainPatrol CLI — terminal interface for threat detection",
   "author": "Umar Ahmed <umar@chainpatrol.io>",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "license": "UNLICENSED",
   "homepage": "https://chainpatrol.com/docs/cli",
   "keywords": [