@corelayer-ai/cli 0.5.2 → 0.5.3

package/README.md

@@ -1,17 +1,3 @@
-# CLI credential security
+# Corelayer CLI
 
-Browser login requires a user session and issues a key valid for 24 hours. API keys cannot authorize another CLI login. Sign in again when the key expires.
-
-User-owned API keys require a current organization membership on every authentication. Their effective role cannot exceed either the key's stored role or the owner's current role. Removing a user blocks their keys once the membership change reaches Corelayer; demoting an admin immediately limits their keys after synchronization. This also applies to user-owned automation keys. Keys with no user owner retain their existing service-key behavior and require explicit revocation/expiry management.
-
-`corelayer logout` revokes the credential saved in `~/.corelayer/config.json` at its saved API URL before clearing the file. A failed revocation leaves the credential available for retry. `corelayer logout --local-only` explicitly removes the local copy without revoking the remote credential, for offline cleanup or an already expired/revoked key. A key in `CORELAYER_API_KEY` is not revoked by logout; unset that variable to stop using it and revoke it through key management when needed. Revoking a shared saved API key also affects other consumers of that same key.
-
-`corelayer config get` and its JSON output omit the token. Preflight invokes Git without a shell, resolves refs to commit IDs, and disables external diff/text-conversion helpers.
-
-## Deploying the fix
-
-Deploy the platform database service and API server changes before distributing the updated CLI: logout requires the new `cli-auth.logout` operation and `/api/v1/cli/logout` endpoint. No schema migration is required.
-
-Existing CLI keys do not retroactively acquire the new 24-hour expiry. Revoke those old keys through key management and have users log in again. Live membership/role enforcement applies to existing user-owned keys once the server change is deployed. For incident response, explicitly revoke affected keys rather than relying only on local logout or identity-provider synchronization.
-
-These changes address the audited defects. They do not introduce OAuth PKCE, granular read-only/resource scopes, OS-keychain storage, npm provenance, or enterprise SSO-policy configuration; those remain separate enterprise-readiness work.
+Source and packaging for the `@corelayer-ai/cli` command-line client. Provides authentication, production issue investigation and actions, organization memory queries, schedules, preflight checks, and MCP integration. The `skill/` folder contains the agent instructions distributed with the CLI.

package/dist/commands/issue-tickets.js

@@ -0,0 +1,163 @@
+import { randomUUID } from "node:crypto";
+import { readFlag } from "../lib/args.js";
+import { fail, printJson } from "../lib/output.js";
+function ticketInput(args, config) {
+    const provider = readFlag(args, "--provider");
+    if (provider !== "jira" && provider !== "linear")
+        fail("--provider jira|linear is required.");
+    const groupId = readFlag(args, "--group") || config.defaults?.group;
+    if (!groupId)
+        fail("--group is required (or configure default-group).");
+    const input = { groupId, provider };
+    for (const [flag, key] of [
+        ["--account", "accountId"],
+        ["--project", "projectId"],
+        ["--team", "teamId"],
+        ["--type", "issueTypeId"],
+        ["--query", "query"],
+        ["--ticket", "ticketId"],
+    ]) {
+        const value = readFlag(args, flag);
+        if (value)
+            input[key] = value;
+    }
+    const revision = readFlag(args, "--revision");
+    if (revision) {
+        const value = Number(revision);
+        if (!Number.isSafeInteger(value) || value < 1)
+            fail("--revision must be a positive integer from ticket destinations.");
+        input.expectedRevision = value;
+    }
+    const fields = readFlag(args, "--fields");
+    if (fields) {
+        try {
+            const parsed = JSON.parse(fields);
+            if (!parsed || Array.isArray(parsed) || typeof parsed !== "object")
+                fail("--fields must be a JSON object.");
+            input.fields = parsed;
+        }
+        catch {
+            fail("--fields must be a JSON object.");
+        }
+    }
+    return input;
+}
+function ticketIdentity(args, mutating) {
+    const suppliedId = readFlag(args, "--request-id");
+    const requestId = suppliedId || (mutating ? randomUUID() : undefined);
+    if ((mutating || suppliedId !== undefined) &&
+        (!requestId ||
+            !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(requestId)))
+        fail("A valid --request-id UUID is required.");
+    return requestId;
+}
+function mutationInput(action, input, requestId) {
+    if (!input.accountId)
+        fail("--account is required; use ticket destinations to discover accounts.");
+    if (action === "link" && !input.ticketId)
+        fail("--ticket is required for link.");
+    input.requestId = requestId;
+    input.intent =
+        action === "create"
+            ? "create_new"
+            : action === "link"
+                ? "link_existing"
+                : "find_or_create";
+    process.stderr.write(`Ticket request: ${requestId}\n`);
+}
+function interruptedRequest(error) {
+    return (error instanceof Error &&
+        (/timed out|fetch failed|socket|network/i.test(error.message) ||
+            ("status" in error &&
+                typeof error.status === "number" &&
+                error.status >= 500)));
+}
+function resultExitCode(status) {
+    const codes = {
+        needs_input: 2,
+        pending: 3,
+        in_progress: 3,
+        recovery_required: 4,
+        blocked: 4,
+        stale_request: 2,
+        failed: 1,
+        error: 1,
+    };
+    return typeof status === "string" ? codes[status] || 0 : 0;
+}
+function shellArgument(value) {
+    return `'${String(value).replaceAll("'", "'\"'\"'")}'`;
+}
+function resumeFlags(input, requestId) {
+    const flags = [
+        ["groupId", "--group"],
+        ["provider", "--provider"],
+        ["accountId", "--account"],
+        ["projectId", "--project"],
+        ["teamId", "--team"],
+        ["issueTypeId", "--type"],
+        ["expectedRevision", "--revision"],
+    ];
+    const values = flags
+        .filter(([key]) => input[key] !== undefined)
+        .map(([key, flag]) => `${flag} ${shellArgument(input[key])}`);
+    if (input.fields)
+        values.push(`--fields ${shellArgument(JSON.stringify(input.fields))}`);
+    values.push(`--request-id ${shellArgument(requestId)}`);
+    return values.join(" ");
+}
+function humanTicketResult(result, issueId, input, requestId) {
+    const lines = [
+        String(result.message || result.status || JSON.stringify(result, null, 2)),
+    ];
+    const candidates = Array.isArray(result.candidates)
+        ? result.candidates.filter((candidate) => candidate !== null && typeof candidate === "object")
+        : [];
+    for (const [index, candidate] of candidates.entries()) {
+        lines.push(`${index + 1}. ${candidate.identifier || candidate.id}: ${candidate.title || ""}${candidate.evidence ? ` — ${candidate.evidence}` : ""}`);
+        if (candidate.url)
+            lines.push(`   ${candidate.url}`);
+    }
+    const resumeId = typeof result.requestId === "string" ? result.requestId : requestId;
+    if (result.status === "needs_input" && resumeId) {
+        const flags = resumeFlags(input, resumeId);
+        const firstTicket = candidates[0]?.id;
+        if (firstTicket)
+            lines.push(`Link an existing ticket: corelayer issues ticket link ${shellArgument(issueId)} ${flags} --ticket ${shellArgument(firstTicket)}`);
+        lines.push(`Create a new ticket: corelayer issues ticket create ${shellArgument(issueId)} ${flags}`);
+        if (result.requirements)
+            lines.push(`Required ticket details: ${JSON.stringify(result.requirements, null, 2)}`);
+    }
+    return lines.join("\n");
+}
+export async function runIssueTickets(args, client, config, ctx) {
+    const [action, issueId] = args;
+    if (!issueId ||
+        !["destinations", "search", "ensure", "create", "link", "status"].includes(action))
+        fail("Usage: corelayer issues ticket <destinations|search|ensure|create|link|status> <id|slug> --provider jira|linear --group <id>");
+    const input = ticketInput(args, config);
+    const mutating = ["ensure", "create", "link"].includes(action);
+    const requestId = ticketIdentity(args, mutating);
+    if (mutating)
+        mutationInput(action, input, requestId);
+    const suffixes = {
+        destinations: "/destinations",
+        search: "/search",
+        status: `/requests/${encodeURIComponent(requestId || "current")}`,
+    };
+    let result;
+    try {
+        result = await client.ticketRequest(mutating || action === "search" ? "POST" : "GET", issueId, suffixes[action] || "", input);
+    }
+    catch (error) {
+        if (!mutating || !interruptedRequest(error))
+            throw error;
+        process.stderr.write("Response interrupted; checking the same ticket request.\n");
+        result = await client.ticketRequest("GET", issueId, `/requests/${encodeURIComponent(requestId)}`, { groupId: input.groupId, provider: input.provider });
+    }
+    if (ctx.json)
+        printJson(result);
+    else
+        process.stdout.write(`${humanTicketResult(result, issueId, input, requestId)}\n`);
+    process.exitCode = resultExitCode(result.status);
+}

package/dist/commands/issues.js

@@ -4,6 +4,7 @@ import { CorelayerClient } from "../lib/api-client.js";
 import { readFlag } from "../lib/args.js";
 import { readConfig, resolveApiUrl, resolveToken } from "../lib/config.js";
 import { fail, formatDate, printJson, printTable } from "../lib/output.js";
+import { runIssueTickets } from "./issue-tickets.js";
 function hasFlag(args, flag) {
     return args.includes(flag);
 }
@@ -53,6 +54,7 @@ USAGE:
 SUBCOMMANDS:
   list                  List issues in a group
   get <id|slug>         Show details for one issue
+  ticket <action> <id>  Jira/Linear destinations, search, ensure, create, link, status
   summary               Summarize issue health for a group
   diff                  Show issues new or changed since a timestamp
   close <id|slug>       Close an issue (write operation)
@@ -75,6 +77,15 @@ OPTIONS:
                         Diff: ISO 8601 timestamp or preset (1hour, 24hours, 7days, 14days, 30days)
   --duration <duration>
                         Diff: human-friendly duration (e.g. 2hours, 4hours, 30m, 1d)
+  --provider jira|linear Ticket provider
+  --account <id>        Connected ticket account
+  --project <id>        Ticket project
+  --team <id>           Linear team
+  --type <id>           Jira issue type
+  --ticket <id>         Selected existing ticket (link)
+  --request-id <uuid>   Resume the same mutation or read its status
+  --revision <n>        Jira account revision from ticket destinations
+  --fields <json>       Required provider creation fields
   --yes                 Skip confirmation prompt (delete)
   --json                Output as JSON
   -h, --help            Print help
@@ -299,6 +310,10 @@ export async function runIssues(args, ctx) {
     }
     const apiUrl = resolveApiUrl(ctx.apiUrlOverride);
     const client = new CorelayerClient(apiUrl, token);
+    if (sub === "ticket") {
+        await runIssueTickets(args.slice(1), client, config, ctx);
+        return;
+    }
     const commandArgs = removeFlags(args.slice(1));
     const handler = ISSUE_COMMAND_HANDLERS[sub];
     if (!handler) {

package/dist/commands/preflight.js

@@ -129,6 +129,10 @@ function buildPreflightContext(args) {
     return { base, description, repo, title };
 }
 function printPreflightResult(result, ctx) {
+    if (result.degraded) {
+        process.stderr.write(`⚠ Preflight could not run (${result.reason ?? "unknown reason"}). This is not an all-clear.\n`);
+        return;
+    }
     if (result.checks.length === 0) {
         if (!ctx.quiet) {
             process.stdout.write("✓ Preflight: nothing in org memory to double-check for this change.\n");

package/dist/lib/api-client.js

@@ -25,9 +25,9 @@ export class CorelayerClient {
         this.token = token;
         this.anomalies = new AnomalyApiClient((method, path) => this.request(method, path));
     }
-    async request(method, path, body) {
+    async request(method, path, body, timeoutMs = 30_000) {
         const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), 30_000);
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
         let res;
         try {
             res = await fetch(`${this.baseUrl}${path}`, {
@@ -51,10 +51,17 @@ export class CorelayerClient {
             clearTimeout(timer);
         }
         if (!res.ok) {
-            throw new Error(await parseError(res));
+            throw Object.assign(new Error(await parseError(res)), {
+                status: res.status,
+            });
         }
         return (await res.json());
     }
+    async ticketRequest(method, issueId, action, input) {
+        const base = `/api/v1/issues/${encodeURIComponent(issueId)}/tickets${action}`;
+        const query = new URLSearchParams(Object.entries(input).map(([key, value]) => [key, String(value)]));
+        return this.request(method, method === "GET" ? `${base}?${query}` : base, method === "POST" ? input : undefined, 120_000);
+    }
     async listIssues(groupId, filters) {
         const params = new URLSearchParams({ groupId });
         for (const [key, value] of Object.entries(filters)) {
@@ -196,7 +203,9 @@ export async function exchangeCliCode(baseUrl, code) {
         clearTimeout(timer);
     }
     if (!res.ok) {
-        throw new Error(await parseError(res));
+        throw Object.assign(new Error(await parseError(res)), {
+            status: res.status,
+        });
     }
     return (await res.json());
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corelayer-ai/cli",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "Corelayer CLI",
   "type": "module",
   "bin": {
@@ -22,7 +22,7 @@
     "@corelayer-ai/sdk": "^0.2.1"
   },
   "devDependencies": {
-    "@types/node": "^20.17.57",
+    "@types/node": "^24.19.2",
     "tsx": "^4.22.4",
     "typescript": "^5.8.3"
   }

package/skill/SKILL.md

@@ -22,6 +22,7 @@ Corelayer is an AI-native production support platform. Use it to inspect live is
 - **[Production health](#production-health)** — Summarize and list current issues
 - **[Issue investigation](#issue-investigation)** — Read evidence, root cause, and next steps
 - **[Post-deploy triage](#post-deploy-triage)** — Find issues new or changed after a release
+- **[ECS monitoring recovery](references/ecs-monitor-recovery.md)** — Preview and explicitly acknowledge skipped coverage in a validated AWS tenant runtime
 - **[Preflight](#preflight-before-a-pull-request)** — Check a change against the organization's memory
 - **[Issue actions](#issue-actions)** — Close, reopen, bulk-close, or delete with approval
 - **[MCP server](#mcp-server)** — Give agents Corelayer tools directly
@@ -303,7 +304,6 @@ Remote MCP is read-only. It exposes:
 - `corelayer.get_issue`
 - `corelayer.get_issue_summary`
 - `corelayer.list_integrations`
-- `corelayer.search_org_memory`
 - `corelayer.preflight`
 
 Call `corelayer.list_groups` first and pass the selected `id` as `groupId` to group-scoped tools.

package/skill/references/ecs-monitor-recovery.md

@@ -0,0 +1,67 @@
+# ECS monitoring cursor recovery
+
+Use this procedure only when an operator explicitly asks to recover an expired ECS monitoring cursor.
+
+Supported scope: an enabled, validated tenant runtime with both deployment and organization binding, AWS data-plane mode, and the tenant monitoring table. The legacy `infra/environments/customer-template` ECS deployment has no such binding and is deliberately unsupported by this command. Do not enable global tenant mode, copy credentials, or broaden its `__system__` policy to bypass that boundary. A caller rejected as unbound needs the supported tenant deployment contract before this procedure applies.
+
+ECS stopped-task history is finite. Normal polling refuses a cursor outside its
+supported history window rather than silently skipping evidence. Fix the original
+polling failure before recovery. CloudWatch log-only cursors can catch up normally;
+this tool is only for an active monitored AWS ECS service in an enabled customer
+runtime using AWS DynamoDB.
+
+The release includes `dist/bin/recover-ecs-monitor-cursor.js` in the engine's
+`controls` container. An authorized operator runs it through the installation's
+normal private Kubernetes access. It uses the runtime's organization, deployment,
+region, table and AWS identity; it accepts no scope or endpoint overrides.
+
+Preview without writing:
+
+```sh
+kubectl -n corelayer exec deploy/engine -c controls -- \
+  node dist/bin/recover-ecs-monitor-cursor.js --resource RESOURCE_UUID \
+  --reason 'Resume after fixing the monitoring outage'
+```
+
+Review the returned `scope`, `intent` and `skippedInterval`. The interval
+`[expectedCursor, resumeAt)` has **unverified coverage**. Acknowledging it does not
+recover historical events or mark them processed. Review any independent retained
+logs and incident evidence separately. The preview is not a successful recovery.
+
+Apply the exact reviewed intent, replacing every placeholder with the preview's
+value. Approval expires after ten minutes; the resume point must still be within
+the last fifty minutes and must not be in the future.
+
+```sh
+kubectl -n corelayer exec deploy/engine -c controls -- \
+  node dist/bin/recover-ecs-monitor-cursor.js --resource RESOURCE_UUID \
+  --expected-cursor EXPECTED_MS --resume-at RESUME_MS \
+  --request-id REQUEST_UUID --approved-at APPROVED_MS \
+  --reason 'Resume after fixing the monitoring outage' --apply --acknowledge-gap
+```
+
+One transaction compares the stored cursor to the reviewed value, confirms that no migration hold exists, advances the cursor and creates an immutable recovery audit record in the same customer table. The audit retains `ApprovedAt`; this recovery write uses that same approved intent time for the cursor's `UpdatedAt`. It does not claim a server commit time. No fresh wall-clock value enters the transaction, so identical retries retain both the token and transaction parameters while the first attempt is pending. Normal
+polling cannot erase that separate record. The operation affects only the selected
+normal ECS cursor; anomaly cursors are unchanged. Concurrent progress or recovery
+causes the conditional write to fail without discarding the newer cursor. Obtain
+a fresh preview if the cursor or selected resource changed.
+
+If the response is ambiguous, retry the **same** reviewed inputs and request ID.
+A matching durable audit returns `already_applied`, including after the preview
+expires. A request ID reused with different intent is rejected. Do not delete the
+cursor or use integration disconnect cleanup to bypass this protocol.
+
+After `applied` or `already_applied`, verify normal polling and durable alert
+publication, then run a fresh controlled error and follow issue creation, analysis
+completion, and its rendered customer UI. Recovery alone is not analysis success.
+
+## Local transaction verification
+
+`scripts/ecs-cursor-recovery.dynamodb.ts` exercises the production recovery module
+against an isolated DynamoDB Local endpoint. It creates and removes one test table
+and rejects non-loopback targets:
+
+```sh
+DYNAMODB_LOCAL_ENDPOINT=http://127.0.0.1:58039 \
+  node --import tsx scripts/ecs-cursor-recovery.dynamodb.ts
+```

package/skill/references/preflight.md

@@ -57,6 +57,8 @@ Each check is one reminder plus its grounding:
   (it never blocks a push). Surface them to the user and let them decide.
 - An **empty result is normal and useful** — it means nothing in memory maps to this change.
   Don't manufacture concerns; say memory had nothing to flag.
+- A result with `degraded: true` means the check **did not run** (its `reason` says why).
+  Tell the user preflight could not run; never report it as an all-clear.
 - Higher `seen N×` and `critical`/`high` severity deserve the most attention.
 
 ## MCP equivalent