@ganakailabs/cloudeval-cli 0.28.0 → 0.29.0

package/dist/cli.js

@@ -24,7 +24,7 @@ import {
   searchSessions,
   unsetCliConfigValue,
   writeCliConfigValue
-} from "./chunk-QSBGUI25.js";
+} from "./chunk-CS4NE336.js";
 import {
   clearActiveCLITraceContext,
   createCLITraceContext,
@@ -36,10 +36,10 @@ import {
   redactSensitiveSecrets,
   redactSensitiveText,
   setActiveCLITraceContext
-} from "./chunk-USSCB2ZU.js";
+} from "./chunk-Z3REBOP5.js";
 import {
   CLI_VERSION
-} from "./chunk-JFJQZGZH.js";
+} from "./chunk-SLZ2XYAT.js";
 
 // src/runtime/prepareInk.ts
 import fs from "fs";
@@ -609,6 +609,7 @@ var cliCommands = [
       "--wait",
       "--poll-interval",
       "--wait-timeout",
+      "--progress",
       "--location",
       ...outputOptions,
       ...authOptions,
@@ -680,6 +681,33 @@ var cliCommands = [
     ],
     workflows: ["connections list", "connections get", "connections open"]
   },
+  {
+    name: "actions",
+    description: "Cross-project action center inventory",
+    domain: "reports",
+    options: [
+      "list",
+      "get",
+      "open",
+      "--project",
+      "--type",
+      "--severity",
+      "--pillar",
+      "--category",
+      "--resource-type",
+      "--q",
+      "--min-monthly-savings",
+      "--sort",
+      "--limit",
+      "--offset",
+      "--allow-full-scan",
+      ...outputOptions,
+      ...authOptions,
+      "--profile",
+      "--help"
+    ],
+    workflows: ["actions list", "actions get", "actions open"]
+  },
   {
     name: "billing",
     description: "Billing and usage utilities",
@@ -1652,7 +1680,7 @@ var resolveReportProjectId = async ({
   if (!token) {
     throw new Error("No project specified. Use --project <id> for report access.");
   }
-  const resolvedWorkspace = workspace ?? await import("./dist-PEYJDO7A.js").then((core) => ({
+  const resolvedWorkspace = workspace ?? await import("./dist-V2L4CPTU.js").then((core) => ({
     checkUserStatus: core.checkUserStatus,
     getProjects: core.getProjects
   }));
@@ -1681,7 +1709,7 @@ var warnIfAccessKeyFromCliOption = (options, command) => {
 };
 var resolveAuthContext = async (options, command, deps) => {
   const baseUrl = await deps.resolveBaseUrl(options, command);
-  const core = await import("./dist-PEYJDO7A.js");
+  const core = await import("./dist-V2L4CPTU.js");
   core.assertSecureBaseUrl(baseUrl);
   warnIfAccessKeyFromCliOption(options, command);
   let accessKey = options.accessKey;
@@ -1767,7 +1795,7 @@ var resolveToken = async (options, baseUrl, deps, command) => {
   if (options.accessKey) {
     return options.accessKey;
   }
-  const { getAuthToken } = await import("./dist-PEYJDO7A.js");
+  const { getAuthToken } = await import("./dist-V2L4CPTU.js");
   try {
     return await getAuthToken({
       accessKey: options.accessKey,
@@ -1778,7 +1806,7 @@ var resolveToken = async (options, baseUrl, deps, command) => {
     if (!canLogin) {
       throw error;
     }
-    const { login } = await import("./dist-PEYJDO7A.js");
+    const { login } = await import("./dist-V2L4CPTU.js");
     process.stderr.write("Authentication required. Starting login flow...\n");
     const token = await login(baseUrl, {
       headless: Boolean(process.env.SSH_TTY || process.env.CLOUDEVAL_HEADLESS_LOGIN)
@@ -1944,7 +1972,7 @@ var registerReportsCommand = (program2, deps) => {
         token,
         requestedProjectId: options.project
       });
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
       const reports2 = await core.listReports({
         baseUrl,
@@ -1966,7 +1994,7 @@ var registerReportsCommand = (program2, deps) => {
     try {
       const baseUrl = await deps.resolveBaseUrl(options, command);
       const token = await resolveToken(options, baseUrl, deps, command);
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
       const projectId = await resolveReportProjectId({
         baseUrl,
@@ -2069,7 +2097,7 @@ var registerReportsCommand = (program2, deps) => {
       try {
         const baseUrl = await deps.resolveBaseUrl(options, command);
         const token = await resolveToken(options, baseUrl, deps, command);
-        const core = await import("./dist-PEYJDO7A.js");
+        const core = await import("./dist-V2L4CPTU.js");
         const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
         const projectId = await resolveReportProjectId({
           baseUrl,
@@ -2139,7 +2167,7 @@ var registerReportsCommand = (program2, deps) => {
         token,
         requestedProjectId: options.project
       });
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
       const report = await core.getWafReport({
         baseUrl,
@@ -2178,7 +2206,7 @@ var registerReportsCommand = (program2, deps) => {
         token,
         requestedProjectId: options.project
       });
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
       const report = await core.getReport({
         baseUrl,
@@ -2206,7 +2234,7 @@ var registerReportsCommand = (program2, deps) => {
         token,
         requestedProjectId: options.project
       });
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
       const report = await core.getCostReport({
         baseUrl,
@@ -2235,7 +2263,7 @@ var registerReportsCommand = (program2, deps) => {
           token,
           requestedProjectId: options.project
         });
-        const core = await import("./dist-PEYJDO7A.js");
+        const core = await import("./dist-V2L4CPTU.js");
         const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
         const report = await core.getWafReport({
           baseUrl,
@@ -2270,14 +2298,14 @@ var responseErrorMessage = async (response) => {
     const payload = JSON.parse(text);
     const detail = payload?.detail ?? payload?.message ?? payload?.error;
     if (typeof detail === "string") {
-      return detail;
+      return redactSensitiveText(detail);
     }
     if (detail) {
-      return JSON.stringify(detail);
+      return redactSensitiveText(JSON.stringify(detail));
     }
   } catch {
   }
-  return text;
+  return redactSensitiveText(text);
 };
 var fetchCloudEvalJson = async ({
   baseUrl,
@@ -3883,12 +3911,13 @@ var registerReviewCommand = (program2, deps) => {
         filesWritten
       });
       if (data.gate.status === "fail") {
-        process.exit(1);
+        process.exitCode = 1;
+        return;
       }
-      process.exit(0);
+      process.exitCode = 0;
     } catch (error) {
       console.error(error?.message ?? "Review failed");
-      process.exit(1);
+      process.exitCode = 1;
     }
   });
 };
@@ -5215,7 +5244,7 @@ var runChatRecipe = async (recipe, prompt2, options, command, deps) => {
   });
   progressWriter.write({ type: "auth", step: "auth", message: "Resolving authentication" });
   const context = await resolveAuthContext(options, command, deps);
-  const core = await import("./dist-PEYJDO7A.js");
+  const core = await import("./dist-V2L4CPTU.js");
   progressWriter.write({
     type: "request",
     step: "project",
@@ -5936,6 +5965,36 @@ var registerOpenCommand = (program2, deps) => {
     });
     await emitOrOpen(url, options);
   });
+  addOpenOptions(
+    open.command("issues").description("Open issues inventory"),
+    deps.defaultBaseUrl
+  ).option("--project <id>", "Project id").option("--type <types>", "Item types").option("--severity <levels>", "Severity filters").option("--q <query>", "Search query").option("--sort <sort>", "Sort order").action(async (options, command) => {
+    const url = buildFrontendUrl({
+      baseUrl: await base(options, command, deps),
+      target: "issues",
+      projectId: options.project,
+      type: options.type,
+      severity: options.severity,
+      q: options.q,
+      sort: options.sort
+    });
+    await emitOrOpen(url, options);
+  });
+  addOpenOptions(
+    open.command("action-center").description("Open issues inventory (alias)"),
+    deps.defaultBaseUrl
+  ).option("--project <id>", "Project id").option("--type <types>", "Item types").option("--severity <levels>", "Severity filters").option("--q <query>", "Search query").option("--sort <sort>", "Sort order").action(async (options, command) => {
+    const url = buildFrontendUrl({
+      baseUrl: await base(options, command, deps),
+      target: "issues",
+      projectId: options.project,
+      type: options.type,
+      severity: options.severity,
+      q: options.q,
+      sort: options.sort
+    });
+    await emitOrOpen(url, options);
+  });
   addOpenOptions(
     open.command("billing").description("Open billing"),
     deps.defaultBaseUrl
@@ -6285,6 +6344,28 @@ var fileBlob = async (filePath) => {
   };
 };
 var normalizeWorkspacePath = (value) => value.replace(/\\/g, "/").replace(/^\/+/, "").replace(/^\.\//, "").split("/").filter((part) => part && part !== ".").join("/");
+var SENSITIVE_WORKSPACE_DIR_NAMES = /* @__PURE__ */ new Set([
+  ".aws",
+  ".azure",
+  ".kube",
+  ".terraform"
+]);
+var SENSITIVE_WORKSPACE_FILENAMES = /* @__PURE__ */ new Set([
+  ".env",
+  "credentials",
+  "id_rsa",
+  "id_ed25519",
+  "kubeconfig"
+]);
+var isSensitiveWorkspacePath = (relativePath) => {
+  const normalized = normalizeWorkspacePath(relativePath);
+  const parts = normalized.split("/");
+  if (parts.some((part) => SENSITIVE_WORKSPACE_DIR_NAMES.has(part))) {
+    return true;
+  }
+  const basename = parts.at(-1) ?? "";
+  return SENSITIVE_WORKSPACE_FILENAMES.has(basename) || /^\.env\./i.test(basename) || /\.(?:pem|key|pfx|p12)$/i.test(basename) || /\.tfstate(?:\..*)?$/i.test(basename);
+};
 var isIgnoredWorkspacePath = (relativePath) => {
   const normalized = normalizeWorkspacePath(relativePath);
   return normalized === ".DS_Store" || normalized.endsWith("/.DS_Store") || normalized.startsWith(".git/") || normalized.startsWith("node_modules/") || normalized.startsWith(".cloudeval/bundles/") || normalized.startsWith(".cloudeval/connections/") || normalized.startsWith(".cloudeval/reports/") || normalized.startsWith(".cloudeval/share/") || normalized.startsWith(".cloudeval/shares/") || normalized.startsWith(".cloudeval/snapshots/") || normalized.startsWith(".cloudeval/template-cache/") || normalized === ".cloudeval/ps-rule.yaml";
@@ -6396,14 +6477,14 @@ var compileBicepEntry = async (root, entry) => {
     await fs6.rm(tempDir, { recursive: true, force: true });
   }
 };
-var collectWorkspacePaths = async (root) => {
+var collectWorkspacePaths = async (root, allowedSensitivePaths = /* @__PURE__ */ new Set()) => {
   const paths = [];
   const visit = async (directory) => {
     const entries = await fs6.readdir(directory, { withFileTypes: true });
     for (const entry of entries) {
       const absolute = path4.join(directory, entry.name);
       const relative = normalizeWorkspacePath(path4.relative(root, absolute));
-      if (!relative || isIgnoredWorkspacePath(relative)) {
+      if (!relative || isIgnoredWorkspacePath(relative) || isSensitiveWorkspacePath(relative) && !allowedSensitivePaths.has(relative)) {
         continue;
       }
       if (entry.isDirectory()) {
@@ -6474,11 +6555,21 @@ var collectWorkspaceFiles = async (workspaceDir, options) => {
   if (!stat?.isDirectory()) {
     throw new Error(`--workspace-dir '${workspaceDir}' is not a directory.`);
   }
-  const paths = await collectWorkspacePaths(root);
+  const allowedSensitivePaths = new Set(
+    [options.workspaceEntry, options.workspaceParameters].filter((value) => Boolean(value)).map((value) => normalizeWorkspacePath(value))
+  );
+  const paths = await collectWorkspacePaths(root, allowedSensitivePaths);
   const existingConfigPath = paths.find(
     (filePath) => filePath.toLowerCase() === ".cloudeval/config.yaml"
   );
   const config = existingConfigPath ? readWorkspaceConfig(await fs6.readFile(path4.join(root, existingConfigPath), "utf8")) : void 0;
+  if (config?.parameters && isSensitiveWorkspacePath(config.parameters) && !paths.includes(config.parameters)) {
+    const parameterStat = await fs6.stat(path4.join(root, config.parameters)).catch(() => void 0);
+    if (parameterStat?.isFile()) {
+      paths.push(config.parameters);
+      paths.sort((left, right) => left.localeCompare(right));
+    }
+  }
   const entry = detectWorkspaceEntry(paths, options.workspaceEntry, config);
   const parameters = resolveWorkspaceParameters(paths, options.workspaceParameters, config);
   const compiledEntry = isBicepPath(entry) ? await compileBicepEntry(root, entry) : void 0;
@@ -6515,13 +6606,31 @@ var collectResourceGroups = (options) => {
   const commaSeparated = options.resourceGroups ? options.resourceGroups.split(",").map((value) => value.trim()) : [];
   return [...repeated, ...commaSeparated].map((value) => value.trim()).filter(Boolean);
 };
-var resolveAzureCloudSyncInput = (options) => {
+var readSecretFromStdin = async () => {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+  }
+  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+};
+var resolveAzureCloudSyncInput = async (options) => {
   if (!options.cloudSync) {
     return void 0;
   }
   const tenantId = options.azureTenantId || process.env.AZURE_TENANT_ID;
   const clientId = options.azureClientId || process.env.AZURE_CLIENT_ID;
-  const clientSecret = options.azureClientSecret || process.env.AZURE_CLIENT_SECRET;
+  if (options.azureClientSecret && options.azureClientSecretStdin) {
+    throw new Error("Use either --azure-client-secret or --azure-client-secret-stdin, not both.");
+  }
+  let clientSecret = process.env.AZURE_CLIENT_SECRET;
+  if (options.azureClientSecretStdin) {
+    clientSecret = await readSecretFromStdin();
+  } else if (options.azureClientSecret) {
+    process.stderr.write(
+      "Warning: --azure-client-secret can be exposed in shell history. Prefer AZURE_CLIENT_SECRET or --azure-client-secret-stdin.\n"
+    );
+    clientSecret = options.azureClientSecret;
+  }
   const subscriptionId = options.azureSubscriptionId || process.env.AZURE_SUBSCRIPTION_ID;
   const missing = [
     ["--azure-tenant-id or AZURE_TENANT_ID", tenantId],
@@ -6699,7 +6808,7 @@ var configureDiagramExportCommand = (command, deps) => addAuthOptions(command, d
       const context = requireAuthUser(
         await resolveAuthContext(options, actionCommand, deps)
       );
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       const projects = await core.getProjects(
         context.baseUrl,
         context.token,
@@ -6776,7 +6885,7 @@ var registerProjectsCommand = (program2, deps) => {
   addCommon(addAuthOptions(projects.command("list").description("List projects"), deps.defaultBaseUrl)).action(async (options, command) => {
     try {
       const context = await resolveAuthContext(options, command, deps);
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       const data = await listProjectsForContext(core, context);
       const url = buildFrontendUrl({ baseUrl: frontendBase(context, options), target: "projects" });
       await writeProjectListOutput({ data, options, frontendUrl: url });
@@ -6794,7 +6903,7 @@ var registerProjectsCommand = (program2, deps) => {
   ).action(async (id, options, command) => {
     try {
       const context = await resolveAuthContext(options, command, deps);
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       const list = await listProjectsForContext(core, context);
       const data = list.find((project) => project.id === id);
       if (!data) {
@@ -6855,15 +6964,19 @@ var registerProjectsCommand = (program2, deps) => {
     deps
   );
   configureGraphCommands(projects, deps);
-  addCommon(addAuthOptions(projects.command("create").description("Create a CloudEval project"), deps.defaultBaseUrl)).option("--template-url <url>", "Template URL").option("--template-file <path>", "Local JSON template file").option("--parameters-file <path>", "Local JSON parameters file").option("--parameters-url <url>", "Parameters file URL").option("--workspace-dir <path>", "Upload an Infrastructure as code folder").option("--workspace-entry <path>", "Workspace visualization entry file").option("--workspace-parameters <path>", "Workspace parameters file").option("--cloud-sync", "Create a Cloud sync project from Azure credentials", false).option("--azure-tenant-id <id>", "Azure tenant id for Cloud sync").option("--azure-client-id <id>", "Azure service principal client id for Cloud sync").option("--azure-client-secret <secret>", "Azure service principal client secret for Cloud sync").option("--azure-subscription-id <id>", "Azure subscription id for Cloud sync").option("--resource-group <name>", "Azure resource group scope for Cloud sync", appendOptionValue, []).option("--resource-groups <list>", "Comma-separated Azure resource group scopes for Cloud sync").option("--name <name>", "Project name").option("--description <text>", "Project description").option("--provider <provider>", "Cloud provider: azure, aws, gcp").action(async (options, command) => {
+  addCommon(addAuthOptions(projects.command("create").description("Create a CloudEval project"), deps.defaultBaseUrl)).option("--template-url <url>", "Template URL").option("--template-file <path>", "Local JSON template file").option("--parameters-file <path>", "Local JSON parameters file").option("--parameters-url <url>", "Parameters file URL").option("--workspace-dir <path>", "Upload an Infrastructure as code folder").option("--workspace-entry <path>", "Workspace visualization entry file").option("--workspace-parameters <path>", "Workspace parameters file").option("--cloud-sync", "Create a Cloud sync project from Azure credentials", false).option("--azure-tenant-id <id>", "Azure tenant id for Cloud sync").option("--azure-client-id <id>", "Azure service principal client id for Cloud sync").option("--azure-client-secret <secret>", "Azure service principal client secret for Cloud sync").option(
+    "--azure-client-secret-stdin",
+    "Read Azure service principal client secret for Cloud sync from stdin",
+    false
+  ).option("--azure-subscription-id <id>", "Azure subscription id for Cloud sync").option("--resource-group <name>", "Azure resource group scope for Cloud sync", appendOptionValue, []).option("--resource-groups <list>", "Comma-separated Azure resource group scopes for Cloud sync").option("--name <name>", "Project name").option("--description <text>", "Project description").option("--provider <provider>", "Cloud provider: azure, aws, gcp").action(async (options, command) => {
     try {
       assertSingleProjectSource(options);
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       const template = await fileBlob(options.templateFile);
       const parameters = await fileBlob(options.parametersFile);
       const workspace = options.workspaceDir ? await collectWorkspaceFiles(options.workspaceDir, options) : void 0;
-      const cloudSync = resolveAzureCloudSyncInput(options);
+      const cloudSync = await resolveAzureCloudSyncInput(options);
       const inferredName = options.name || (options.workspaceDir ? path4.basename(path4.resolve(options.workspaceDir)) : void 0) || (cloudSync ? "Cloud sync" : void 0) || (options.templateFile ? path4.basename(options.templateFile, path4.extname(options.templateFile)) : void 0);
       const result = await core.createQuickProject({
         baseUrl: context.baseUrl,
@@ -6910,7 +7023,7 @@ var registerProjectsCommand = (program2, deps) => {
   });
 };
 
-// src/connectionsCommand.ts
+// src/actionsCommand.ts
 var addCommon2 = (command) => command.option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--output <file>", "Output file").option("--open", "Open the matching frontend page", false).option("--print-url", "Print the matching frontend URL", false).option("--no-open", "Do not launch the browser when a URL is printed").option("--frontend-url <url>", "Frontend base URL");
 var frontendBase2 = (context, options) => resolveFrontendBaseUrl({
   frontendUrl: options.frontendUrl,
@@ -6925,6 +7038,13 @@ var maybeOpen2 = async (url, options) => {
     await openExternalUrl(url);
   }
 };
+var splitCsv = (value) => {
+  if (!value) {
+    return void 0;
+  }
+  const parts = value.split(",").map((entry) => entry.trim()).filter(Boolean);
+  return parts.length > 0 ? parts : void 0;
+};
 var scalar = (value, fallback = "-") => {
   if (value === null || value === void 0 || value === "") {
     return fallback;
@@ -6934,19 +7054,177 @@ var scalar = (value, fallback = "-") => {
   }
   return fallback;
 };
-var syncStatus = (connection) => scalar(
+var renderActionsListText = (payload) => {
+  const items = Array.isArray(payload.items) ? payload.items : [];
+  return formatTextTable(
+    items.map((item) => {
+      const record = item && typeof item === "object" && !Array.isArray(item) ? item : {};
+      return {
+        id: scalar(record.id),
+        type: scalar(record.type),
+        severity: scalar(record.severity),
+        project: scalar(record.project_name),
+        title: scalar(record.title),
+        resource: scalar(record.resource_name ?? record.resource_id),
+        savings: scalar(record.monthly_savings)
+      };
+    }),
+    [
+      { key: "id", header: "ID", width: 12 },
+      { key: "type", header: "Type", width: 12 },
+      { key: "severity", header: "Severity", width: 10 },
+      { key: "project", header: "Project", maxWidth: 18 },
+      { key: "title", header: "Title", maxWidth: 32 },
+      { key: "resource", header: "Resource", maxWidth: 20 },
+      { key: "savings", header: "Savings", width: 10 }
+    ],
+    { emptyMessage: "No issues inventory items found." }
+  );
+};
+var buildIssuesFrontendUrl = (context, options) => buildFrontendUrl({
+  baseUrl: frontendBase2(context, options),
+  target: "issues",
+  projectId: options.project,
+  severity: options.severity,
+  type: options.type,
+  q: options.q,
+  sort: options.sort
+});
+var registerIssuesInventoryCommand = (program2, deps) => {
+  const commandName = deps.commandName || "issues";
+  const commandDescription = deps.commandDescription || (commandName === "actions" ? "Cross-project action center inventory (deprecated; use issues)" : "Cross-project issues inventory");
+  const inventory = program2.command(commandName).description(commandDescription);
+  addCommon2(addAuthOptions(inventory.command("list").description("List issues inventory items"), deps.defaultBaseUrl)).option("--project <id>", "Filter by project id").option("--type <types>", "Filter by type: architecture,cost,unit-tests").option("--severity <levels>", "Filter by severity: critical,high,medium,low").option("--pillar <pillars>", "Filter by pillar").option("--category <categories>", "Filter by category").option("--resource-type <types>", "Filter by resource type").option("--q <query>", "Search query").option("--min-monthly-savings <amount>", "Minimum monthly savings for cost items").option("--sort <sort>", "Sort: priority, severity, savings, project", "priority").option("--limit <n>", "Page size (1-500)", "50").option("--offset <n>", "Page offset", "0").option("--allow-full-scan", "Allow scanning large portfolios without project filter", true).option("--no-allow-full-scan", "Require project scoping for large portfolios").action(async (options, command) => {
+    try {
+      const context = requireAuthUser(await resolveAuthContext(options, command, deps));
+      const core = await import("./dist-V2L4CPTU.js");
+      const data = await core.listIssuesItems({
+        baseUrl: context.baseUrl,
+        authToken: context.token,
+        userId: context.user.id,
+        projectIds: splitCsv(options.project),
+        types: splitCsv(options.type),
+        severities: splitCsv(options.severity),
+        pillars: splitCsv(options.pillar),
+        categories: splitCsv(options.category),
+        resourceTypes: splitCsv(options.resourceType),
+        q: options.q,
+        minMonthlySavings: options.minMonthlySavings !== void 0 ? Number(options.minMonthlySavings) : void 0,
+        sort: options.sort || "priority",
+        limit: Number(options.limit || 50),
+        offset: Number(options.offset || 0),
+        allowFullScan: options.allowFullScan !== false
+      });
+      const url = buildIssuesFrontendUrl(context, options);
+      const format = options.format ?? "text";
+      if (format === "text") {
+        const text = renderActionsListText(
+          data && typeof data === "object" ? data : {}
+        );
+        if (options.output) {
+          const fs14 = await import("fs/promises");
+          await fs14.writeFile(options.output, text, "utf8");
+        } else {
+          process.stdout.write(text);
+        }
+      } else {
+        await writeFormattedOutput({
+          command: `${commandName} list`,
+          data,
+          format,
+          output: options.output,
+          frontendUrl: url
+        });
+      }
+      await maybeOpen2(url, options);
+    } catch (error) {
+      console.error(`Failed to list issues inventory: ${error?.message ?? "Unknown error"}`);
+      process.exit(1);
+    }
+  });
+  addCommon2(addAuthOptions(inventory.command("get <item-id>").description("Get one issues inventory item"), deps.defaultBaseUrl)).option("--project <id>", "Optional project scope").option("--allow-full-scan", "Allow scanning large portfolios", true).option("--no-allow-full-scan", "Require project scoping for large portfolios").action(async (itemId, options, command) => {
+    try {
+      const context = requireAuthUser(await resolveAuthContext(options, command, deps));
+      const core = await import("./dist-V2L4CPTU.js");
+      const data = await core.getIssuesItem({
+        baseUrl: context.baseUrl,
+        authToken: context.token,
+        userId: context.user.id,
+        itemId,
+        projectIds: splitCsv(options.project),
+        allowFullScan: options.allowFullScan !== false
+      });
+      const payload = data && typeof data === "object" ? data : {};
+      const items = Array.isArray(payload.items) ? payload.items : [];
+      if (items.length === 0) {
+        console.error(`Issues item not found: ${itemId}`);
+        process.exit(5);
+      }
+      await writeFormattedOutput({
+        command: `${commandName} get`,
+        data: items[0],
+        format: options.format ?? "json",
+        output: options.output
+      });
+    } catch (error) {
+      console.error(`Failed to get issues item: ${error?.message ?? "Unknown error"}`);
+      process.exit(1);
+    }
+  });
+  addCommon2(addAuthOptions(inventory.command("open").description("Open the issues inventory in the browser"), deps.defaultBaseUrl)).option("--project <id>", "Filter by project id").option("--type <types>", "Filter by type").option("--severity <levels>", "Filter by severity").option("--q <query>", "Search query").option("--sort <sort>", "Sort order", "priority").action(async (options, command) => {
+    try {
+      const context = requireAuthUser(await resolveAuthContext(options, command, deps));
+      const url = buildIssuesFrontendUrl(context, options);
+      await maybeOpen2(url, { ...options, open: true, printUrl: true });
+    } catch (error) {
+      console.error(`Failed to open issues inventory: ${error?.message ?? "Unknown error"}`);
+      process.exit(1);
+    }
+  });
+};
+var registerActionsCommand = (program2, deps) => registerIssuesInventoryCommand(program2, {
+  ...deps,
+  commandName: "actions",
+  commandDescription: "Cross-project action center inventory (deprecated; use issues)"
+});
+
+// src/connectionsCommand.ts
+var addCommon3 = (command) => command.option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--output <file>", "Output file").option("--open", "Open the matching frontend page", false).option("--print-url", "Print the matching frontend URL", false).option("--no-open", "Do not launch the browser when a URL is printed").option("--frontend-url <url>", "Frontend base URL");
+var frontendBase3 = (context, options) => resolveFrontendBaseUrl({
+  frontendUrl: options.frontendUrl,
+  apiBaseUrl: context.baseUrl
+});
+var maybeOpen3 = async (url, options) => {
+  if (options.printUrl) {
+    process.stdout.write(`${url}
+`);
+  }
+  if (options.open !== false && (options.open || options.printUrl)) {
+    await openExternalUrl(url);
+  }
+};
+var scalar2 = (value, fallback = "-") => {
+  if (value === null || value === void 0 || value === "") {
+    return fallback;
+  }
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+    return String(value);
+  }
+  return fallback;
+};
+var syncStatus = (connection) => scalar2(
   connection.last_sync_status ?? connection.sync_status?.status ?? connection.status
 );
 var renderConnectionsListText = (connections) => formatTextTable(
   connections.map((connection) => {
     const record = connection && typeof connection === "object" && !Array.isArray(connection) ? connection : {};
     return {
-      id: scalar(record.id),
-      name: scalar(record.name),
-      provider: scalar(record.cloud_provider),
-      type: scalar(record.type),
+      id: scalar2(record.id),
+      name: scalar2(record.name),
+      provider: scalar2(record.cloud_provider),
+      type: scalar2(record.type),
       sync: syncStatus(record),
-      updated: scalar(record.last_synced ?? record.updated_at ?? record.created_at)
+      updated: scalar2(record.last_synced ?? record.updated_at ?? record.created_at)
     };
   }),
   [
@@ -6985,27 +7263,27 @@ var writeConnectionsListOutput = async ({
 };
 var registerConnectionsCommand = (program2, deps) => {
   const connections = program2.command("connections").description("Connection utilities");
-  addCommon2(addAuthOptions(connections.command("list").description("List connections"), deps.defaultBaseUrl)).action(async (options, command) => {
+  addCommon3(addAuthOptions(connections.command("list").description("List connections"), deps.defaultBaseUrl)).action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       const data = await core.listConnections({
         baseUrl: context.baseUrl,
         authToken: context.token,
         userId: context.user.id
       });
       const url = buildFrontendUrl({
-        baseUrl: frontendBase2(context, options),
+        baseUrl: frontendBase3(context, options),
         target: "connections"
       });
       await writeConnectionsListOutput({ data, options, frontendUrl: url });
-      await maybeOpen2(url, options);
+      await maybeOpen3(url, options);
     } catch (error) {
       console.error(`Failed to list connections: ${error?.message ?? "Unknown error"}`);
       process.exit(1);
     }
   });
-  addCommon2(
+  addCommon3(
     addAuthOptions(
       connections.command("get").description("Show a connection").argument("<id>", "Connection id"),
       deps.defaultBaseUrl
@@ -7013,7 +7291,7 @@ var registerConnectionsCommand = (program2, deps) => {
   ).action(async (id, options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       const data = await core.getConnection({
         baseUrl: context.baseUrl,
         authToken: context.token,
@@ -7024,7 +7302,7 @@ var registerConnectionsCommand = (program2, deps) => {
         throw new Error(`Connection ${id} was not found.`);
       }
       const url = buildFrontendUrl({
-        baseUrl: frontendBase2(context, options),
+        baseUrl: frontendBase3(context, options),
         target: "connection",
         connectionId: id
       });
@@ -7035,13 +7313,13 @@ var registerConnectionsCommand = (program2, deps) => {
         output: options.output,
         frontendUrl: url
       });
-      await maybeOpen2(url, options);
+      await maybeOpen3(url, options);
     } catch (error) {
       console.error(`Failed to show connection: ${error?.message ?? "Unknown error"}`);
       process.exit(1);
     }
   });
-  addCommon2(
+  addCommon3(
     addAuthOptions(
       connections.command("open").description("Open a connection").argument("<id>", "Connection id"),
       deps.defaultBaseUrl
@@ -7050,7 +7328,7 @@ var registerConnectionsCommand = (program2, deps) => {
     try {
       const context = await resolveAuthContext(options, command, deps);
       const url = buildFrontendUrl({
-        baseUrl: frontendBase2(context, options),
+        baseUrl: frontendBase3(context, options),
         target: "connection",
         connectionId: id
       });
@@ -7061,7 +7339,7 @@ var registerConnectionsCommand = (program2, deps) => {
         output: options.output,
         frontendUrl: url
       });
-      await maybeOpen2(url, { ...options, open: options.open || true });
+      await maybeOpen3(url, { ...options, open: options.open || true });
     } catch (error) {
       console.error(`Failed to open connection: ${error?.message ?? "Unknown error"}`);
       process.exit(1);
@@ -7070,7 +7348,7 @@ var registerConnectionsCommand = (program2, deps) => {
 };
 
 // src/billingCommand.ts
-var addCommon3 = (command) => command.option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--output <file>", "Output file").option("--open", "Open the matching frontend page", false).option("--print-url", "Print the matching frontend URL", false).option("--no-open", "Do not launch the browser when a URL is printed").option("--frontend-url <url>", "Frontend base URL");
+var addCommon4 = (command) => command.option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--output <file>", "Output file").option("--open", "Open the matching frontend page", false).option("--print-url", "Print the matching frontend URL", false).option("--no-open", "Do not launch the browser when a URL is printed").option("--frontend-url <url>", "Frontend base URL");
 var billingUrl = (context, options) => buildFrontendUrl({
   baseUrl: resolveFrontendBaseUrl({
     frontendUrl: options.frontendUrl,
@@ -7079,7 +7357,7 @@ var billingUrl = (context, options) => buildFrontendUrl({
   target: "billing",
   tab: options.tab
 });
-var maybeOpen3 = async (url, options) => {
+var maybeOpen4 = async (url, options) => {
   if (options.printUrl) {
     const isMachineReadable = options.format === "json" || options.format === "ndjson";
     (isMachineReadable ? process.stderr : process.stdout).write(`${url}
@@ -7303,8 +7581,7 @@ var write = async (command, data, options, frontendUrl) => {
     const text = renderBillingText(command, data);
     if (text) {
       if (options.output) {
-        const fs14 = await import("fs/promises");
-        await fs14.writeFile(options.output, text, "utf8");
+        await writePrivateOutputFile(options.output, text);
         return;
       }
       process.stdout.write(text);
@@ -7351,7 +7628,7 @@ var checkoutReturnUrl = (context, options) => options.returnTo || billingUrl(con
 var runTopUpCheckout = async (commandName, packId, options, command, deps) => {
   try {
     const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-V2L4CPTU.js");
     const returnTo = checkoutReturnUrl(context, options);
     const session = await core.createTopUpCheckoutSession({
       baseUrl: context.baseUrl,
@@ -7376,14 +7653,14 @@ var runTopUpCheckout = async (commandName, packId, options, command, deps) => {
       checkoutUrl
     );
     if (checkoutUrl) {
-      await maybeOpen3(checkoutUrl, options);
+      await maybeOpen4(checkoutUrl, options);
     }
   } catch (error) {
     failBillingCommand(commandName, "Failed to start top-up checkout", error, options);
   }
 };
 var registerBillingCommands = (program2, deps) => {
-  addCommon3(
+  addCommon4(
     addAuthOptions(
       program2.command("credits").description("Show current credit stats"),
       deps.defaultBaseUrl
@@ -7391,7 +7668,7 @@ var registerBillingCommands = (program2, deps) => {
   ).action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       const range = rangeToDates("30d");
       const [entitlement, usageSummary] = await Promise.all([
         core.getBillingEntitlement({
@@ -7412,16 +7689,16 @@ var registerBillingCommands = (program2, deps) => {
       });
       const url = billingUrl(context, { ...options, tab: "usage" });
       await write("credits", { status, entitlement, usageCreditsUsed }, options, url);
-      await maybeOpen3(url, options);
+      await maybeOpen4(url, options);
     } catch (error) {
       failBillingCommand("credits", "Failed to show credits", error, options);
     }
   });
   const billing = program2.command("billing").description("Billing and usage utilities");
-  addCommon3(addAuthOptions(billing.command("summary").description("Show billing summary"), deps.defaultBaseUrl)).action(async (options, command) => {
+  addCommon4(addAuthOptions(billing.command("summary").description("Show billing summary"), deps.defaultBaseUrl)).action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       const range = rangeToDates("30d");
       const [entitlement, subscriptionStatus, usageSummary] = await Promise.all([
         core.getBillingEntitlement({ baseUrl: context.baseUrl, authToken: context.token }),
@@ -7449,27 +7726,27 @@ var registerBillingCommands = (program2, deps) => {
         options,
         url
       );
-      await maybeOpen3(url, options);
+      await maybeOpen4(url, options);
     } catch (error) {
       failBillingCommand("billing summary", "Failed to show billing summary", error, options);
     }
   });
-  addCommon3(addAuthOptions(billing.command("plans").description("Show billing plans"), deps.defaultBaseUrl)).action(async (options, command) => {
+  addCommon4(addAuthOptions(billing.command("plans").description("Show billing plans"), deps.defaultBaseUrl)).action(async (options, command) => {
     try {
       const context = await resolveAuthContext(options, command, deps);
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       const data = await core.getBillingConfig({ baseUrl: context.baseUrl, authToken: context.token });
       const url = billingUrl(context, { ...options, tab: "plans" });
       await write("billing plans", data, options, url);
-      await maybeOpen3(url, options);
+      await maybeOpen4(url, options);
     } catch (error) {
       failBillingCommand("billing plans", "Failed to show billing plans", error, options);
     }
   });
-  addCommon3(addAuthOptions(billing.command("usage").description("Show billing usage summary"), deps.defaultBaseUrl)).option("--range <range>", "Usage range: 7d, 30d, 90d, all", "30d").option("--start-at <iso>", "Start timestamp").option("--end-at <iso>", "End timestamp").option("--granularity <value>", "Granularity: hour, day, month", "day").option("--action-type <type>", "Action type filter").option("--model <name>", "Model filter").option("--outcome <outcome>", "Outcome filter").option("--charge-status <status>", "Charge status filter").action(async (options, command) => {
+  addCommon4(addAuthOptions(billing.command("usage").description("Show billing usage summary"), deps.defaultBaseUrl)).option("--range <range>", "Usage range: 7d, 30d, 90d, all", "30d").option("--start-at <iso>", "Start timestamp").option("--end-at <iso>", "End timestamp").option("--granularity <value>", "Granularity: hour, day, month", "day").option("--action-type <type>", "Action type filter").option("--model <name>", "Model filter").option("--outcome <outcome>", "Outcome filter").option("--charge-status <status>", "Charge status filter").action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       const range = rangeToDates(options.range);
       const data = await core.getBillingUsageSummary({
         baseUrl: context.baseUrl,
@@ -7484,15 +7761,15 @@ var registerBillingCommands = (program2, deps) => {
       });
       const url = billingUrl(context, { ...options, tab: "usage" });
       await write("billing usage", data, options, url);
-      await maybeOpen3(url, options);
+      await maybeOpen4(url, options);
     } catch (error) {
       failBillingCommand("billing usage", "Failed to show billing usage", error, options);
     }
   });
-  addCommon3(addAuthOptions(billing.command("ledger").description("Show billing ledger"), deps.defaultBaseUrl)).option("--range <range>", "Usage range: 7d, 30d, 90d, all", "30d").option("--start-at <iso>", "Start timestamp").option("--end-at <iso>", "End timestamp").option("--action-type <type>", "Action type filter").option("--model <name>", "Model filter").option("--outcome <outcome>", "Outcome filter").option("--charge-status <status>", "Charge status filter").option("--limit <n>", "Page size", "25").option("--cursor <cursor>", "Pagination cursor").action(async (options, command) => {
+  addCommon4(addAuthOptions(billing.command("ledger").description("Show billing ledger"), deps.defaultBaseUrl)).option("--range <range>", "Usage range: 7d, 30d, 90d, all", "30d").option("--start-at <iso>", "Start timestamp").option("--end-at <iso>", "End timestamp").option("--action-type <type>", "Action type filter").option("--model <name>", "Model filter").option("--outcome <outcome>", "Outcome filter").option("--charge-status <status>", "Charge status filter").option("--limit <n>", "Page size", "25").option("--cursor <cursor>", "Pagination cursor").action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       const range = rangeToDates(options.range);
       const data = await core.getBillingUsageLedger({
         baseUrl: context.baseUrl,
@@ -7508,7 +7785,7 @@ var registerBillingCommands = (program2, deps) => {
       });
       const url = billingUrl(context, { ...options, tab: "usage" });
       await write("billing ledger", data, options, url);
-      await maybeOpen3(url, options);
+      await maybeOpen4(url, options);
     } catch (error) {
       failBillingCommand("billing ledger", "Failed to show billing ledger", error, options);
     }
@@ -7517,10 +7794,10 @@ var registerBillingCommands = (program2, deps) => {
     ["invoices", "getSubscriptionBillingInfo", "billing"],
     ["notifications", "getBillingNotifications", "billing"]
   ]) {
-    addCommon3(addAuthOptions(billing.command(name).description(`Show billing ${name}`), deps.defaultBaseUrl)).option("--limit <n>", "Result limit", "25").action(async (options, command) => {
+    addCommon4(addAuthOptions(billing.command(name).description(`Show billing ${name}`), deps.defaultBaseUrl)).option("--limit <n>", "Result limit", "25").action(async (options, command) => {
       try {
         const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-        const core = await import("./dist-PEYJDO7A.js");
+        const core = await import("./dist-V2L4CPTU.js");
         const data = await core[getter]({
           baseUrl: context.baseUrl,
           authToken: context.token,
@@ -7528,30 +7805,30 @@ var registerBillingCommands = (program2, deps) => {
         });
         const url = billingUrl(context, { ...options, tab });
         await write(`billing ${name}`, data, options, url);
-        await maybeOpen3(url, options);
+        await maybeOpen4(url, options);
       } catch (error) {
         failBillingCommand(`billing ${name}`, `Failed to show billing ${name}`, error, options);
       }
     });
   }
   const topups = billing.command("topups").description("Show billing top-ups");
-  addCommon3(addAuthOptions(topups, deps.defaultBaseUrl)).option("--limit <n>", "Result limit", "25").action(async (options, command) => {
+  addCommon4(addAuthOptions(topups, deps.defaultBaseUrl)).option("--limit <n>", "Result limit", "25").action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       const data = await core.getTopUpPacks({
         baseUrl: context.baseUrl,
         authToken: context.token
       });
       const url = billingUrl(context, { ...options, tab: "billing" });
       await write("billing topups", data, options, url);
-      await maybeOpen3(url, options);
+      await maybeOpen4(url, options);
     } catch (error) {
       failBillingCommand("billing topups", "Failed to show billing topups", error, options);
     }
   });
   addTopUpCheckoutOptions(
-    addCommon3(
+    addCommon4(
       addAuthOptions(
         topups.command("buy <pack-id>").description("Buy a credit top-up pack"),
         deps.defaultBaseUrl
@@ -7561,7 +7838,7 @@ var registerBillingCommands = (program2, deps) => {
     (packId, options, command) => runTopUpCheckout("billing topups buy", packId, options, command, deps)
   );
   addTopUpCheckoutOptions(
-    addCommon3(
+    addCommon4(
       addAuthOptions(
         billing.command("topup <pack-id>").description("Buy a credit top-up pack"),
         deps.defaultBaseUrl
@@ -7598,7 +7875,7 @@ var normalizeMcpSetupClient = (value) => {
   throw new Error(`MCP setup client must be one of: ${MCP_SETUP_CLIENTS.join(", ")}.`);
 };
 var normalizeMcpSetupToolset = (value) => {
-  const normalized = (value ?? "all").toLowerCase();
+  const normalized = (value ?? "readonly").toLowerCase();
   if (TOOLSETS.has(normalized)) {
     return normalized;
   }
@@ -7637,7 +7914,7 @@ var writtenSetupNextStep = (client) => client === "claude" ? "Restart Claude Des
 var buildMcpClientSetup = ({
   client,
   command = "cloudeval",
-  toolset = "all",
+  toolset = "readonly",
   configPath
 }) => {
   const normalizedClient = normalizeMcpSetupClient(client);
@@ -7837,6 +8114,51 @@ var isSuccessfulJobStatus = (value) => ["completed", "succeeded"].includes(norma
 var compactRecord = (value) => Object.fromEntries(
   Object.entries(value).filter(([, item]) => item !== void 0)
 );
+var basenameFromPath = (value) => {
+  const trimmed = value?.trim();
+  if (!trimmed) {
+    return void 0;
+  }
+  const normalized = trimmed.replace(/\\/g, "/");
+  return normalized.split("/").filter(Boolean).pop() ?? trimmed;
+};
+var isBackendTempLocation = (value) => {
+  const trimmed = value?.trim();
+  if (!trimmed) {
+    return false;
+  }
+  const normalized = trimmed.replace(/\\/g, "/").toLowerCase();
+  const basename = basenameFromPath(trimmed) ?? "";
+  return normalized.startsWith("/tmp/") || normalized.startsWith("/private/tmp/") || normalized.includes("/var/folders/") || normalized.includes("/appdata/local/temp/") || normalized.includes("/windows/temp/") || /^tmp[\w.-]*\.json$/i.test(basename);
+};
+var displayTemplateLocation = (rawLocation, context) => {
+  const trimmed = rawLocation?.trim();
+  if (!trimmed) {
+    return void 0;
+  }
+  if (isBackendTempLocation(trimmed)) {
+    return basenameFromPath(context?.templatePath);
+  }
+  return trimmed;
+};
+var sanitizeTemplateLocationFields = (value, context) => {
+  if (Array.isArray(value)) {
+    return value.map((item) => sanitizeTemplateLocationFields(item, context));
+  }
+  const record = recordValue(value);
+  if (!record) {
+    return value;
+  }
+  return Object.fromEntries(
+    Object.entries(record).flatMap(([key, item]) => {
+      if (["file_path", "filePath", "location"].includes(key) && typeof item === "string") {
+        const publicLocation = displayTemplateLocation(item, context);
+        return publicLocation === void 0 ? [] : [[key, publicLocation]];
+      }
+      return [[key, sanitizeTemplateLocationFields(item, context)]];
+    })
+  );
+};
 var arrayValue = (value) => Array.isArray(value) ? value : [];
 var firstString = (record, fields) => {
   for (const field of fields) {
@@ -7847,6 +8169,283 @@ var firstString = (record, fields) => {
   }
   return void 0;
 };
+var publicValidationText = (value) => value?.replace(/\bPSRule(?:\s+for\s+Azure)?\b/gi, "validation rules").replace(/\bARM\s+TTK\b/gi, "template validation");
+var sanitizeTemplateOperationText = (value) => {
+  if (typeof value === "string") {
+    return publicValidationText(value) ?? value;
+  }
+  if (Array.isArray(value)) {
+    return value.map(sanitizeTemplateOperationText);
+  }
+  const record = recordValue(value);
+  if (record) {
+    return Object.fromEntries(
+      Object.entries(record).map(([key, item]) => [
+        key,
+        sanitizeTemplateOperationText(item)
+      ])
+    );
+  }
+  return value;
+};
+var firstNumber = (record, fields) => {
+  for (const field of fields) {
+    const value = record?.[field];
+    if (typeof value === "number" && Number.isFinite(value)) {
+      return value;
+    }
+    if (typeof value === "string" && value.trim()) {
+      const parsed = Number(value);
+      if (Number.isFinite(parsed)) {
+        return parsed;
+      }
+    }
+  }
+  return void 0;
+};
+var firstArray2 = (record, fields) => {
+  for (const field of fields) {
+    const value = record?.[field];
+    if (Array.isArray(value)) {
+      return value;
+    }
+  }
+  return [];
+};
+var normalizeProgressItem = (value, context) => {
+  const record = recordValue(value) ?? {};
+  const passed = typeof record.passed === "boolean" ? record.passed : void 0;
+  return compactRecord({
+    name: firstString(record, [
+      "name",
+      "test_name",
+      "testName",
+      "rule_name",
+      "ruleName",
+      "item",
+      "current_item",
+      "display_name",
+      "displayName"
+    ]),
+    status: firstString(record, ["status", "outcome", "result"]) ?? (passed === void 0 ? void 0 : passed ? "Pass" : "Fail"),
+    passed,
+    category: firstString(record, ["category", "test_category", "testCategory"]),
+    severity: firstString(record, ["severity", "level"]),
+    message: publicValidationText(firstString(record, ["message", "description"])),
+    recommendation: publicValidationText(
+      firstString(record, ["recommendation", "remediation"])
+    ),
+    location: displayTemplateLocation(
+      firstString(record, ["file_path", "filePath", "location"]),
+      context
+    ),
+    durationMs: firstNumber(record, ["duration_ms", "durationMs"]),
+    documentationUrl: firstString(record, [
+      "documentation_url",
+      "documentationUrl",
+      "help_url",
+      "helpUrl"
+    ])
+  });
+};
+var operationFromResult = (result) => {
+  const record = recordValue(result);
+  if (!record) {
+    return void 0;
+  }
+  if ("test_results" in record || "total_tests" in record) {
+    return "template_test";
+  }
+  if ("filtered_results" in record || "results" in record || "summary" in record) {
+    return "template_validate";
+  }
+  return void 0;
+};
+var progressEventFromStatus = (input) => {
+  const statusRecord = recordValue(input.status);
+  return compactRecord({
+    phase: input.phase,
+    jobId: input.jobId,
+    operation: firstString(statusRecord, ["operation", "operation_type", "operationType"]),
+    status: firstString(statusRecord, ["status", "state"]),
+    progress: firstNumber(statusRecord, [
+      "progress",
+      "progress_percent",
+      "progressPercent",
+      "percentage",
+      "percent"
+    ]),
+    completed: firstNumber(statusRecord, [
+      "completed_items",
+      "completedItems",
+      "completed_tests",
+      "completedTests",
+      "completed_rules",
+      "completedRules"
+    ]),
+    total: firstNumber(statusRecord, [
+      "total_items",
+      "totalItems",
+      "total_tests",
+      "totalTests",
+      "total_rules",
+      "totalRules"
+    ]),
+    currentItem: firstString(statusRecord, [
+      "current_item",
+      "currentItem",
+      "current_test",
+      "currentTest",
+      "current_rule",
+      "currentRule"
+    ]),
+    message: publicValidationText(
+      firstString(statusRecord, ["message", "detail", "description"])
+    ),
+    items: firstArray2(statusRecord, [
+      "recent_events",
+      "recentEvents",
+      "events",
+      "progress_events",
+      "progressEvents"
+    ]).map((item) => normalizeProgressItem(item, input.context)).filter((item) => item.name || item.message),
+    elapsedMs: input.elapsedMs
+  });
+};
+var failedStatus = (status) => ["fail", "failed", "error"].includes(String(status ?? "").trim().toLowerCase());
+var passedStatus = (status) => ["pass", "passed", "success", "succeeded"].includes(
+  String(status ?? "").trim().toLowerCase()
+);
+var progressItemsFromDetails = (details, nameFields, context) => {
+  const targetLocation = (target) => {
+    const name = firstString(target, ["name", "id"]);
+    const type = firstString(target, ["type"]);
+    if (name && type) {
+      return `${name} (${type})`;
+    }
+    return name ?? type;
+  };
+  return details.filter((detail) => failedStatus(firstString(detail, ["status", "outcome", "result"]))).map((detail) => {
+    const evidence = recordValue(detail.evidence);
+    return compactRecord({
+      name: firstString(detail, nameFields),
+      status: firstString(detail, ["status", "outcome", "result"]),
+      category: firstString(detail, ["category", "test_category", "testCategory"]),
+      severity: firstString(detail, ["severity", "level"]),
+      message: publicValidationText(
+        firstString(detail, ["message", "description"]) ?? firstString(evidence, ["description", "synopsis"])
+      ),
+      recommendation: publicValidationText(
+        firstString(detail, ["recommendation", "remediation"]) ?? firstString(evidence, ["recommendation", "remediation"])
+      ),
+      location: displayTemplateLocation(
+        firstString(detail, ["file_path", "filePath", "location"]),
+        context
+      ) ?? targetLocation(recordValue(detail.target)),
+      durationMs: firstNumber(detail, ["duration_ms", "durationMs"]),
+      documentationUrl: firstString(detail, [
+        "documentation_url",
+        "documentationUrl",
+        "help_url",
+        "helpUrl"
+      ]) ?? firstString(evidence, [
+        "documentation_url",
+        "documentationUrl",
+        "help_url",
+        "helpUrl"
+      ])
+    });
+  }).filter((item) => item.name || item.message);
+};
+var resultProgressSummary = (result, operation, context) => {
+  const resultRecord = recordValue(result) ?? {};
+  const summary = recordValue(resultRecord.summary) ?? {};
+  const detectedOperation = operationFromResult(result);
+  const resolvedOperation = detectedOperation ?? operation;
+  const operationText = String(resolvedOperation ?? "").toLowerCase();
+  if (detectedOperation === "template_test" || operationText.includes("test")) {
+    const details2 = normalizeTemplateTestDetails(result, context);
+    const passed2 = firstNumber(resultRecord, ["passed_tests", "passedTests"]) ?? details2.filter((detail) => detail.passed === true || passedStatus(firstString(detail, ["status"]))).length;
+    const failed2 = firstNumber(resultRecord, ["failed_tests", "failedTests"]) ?? details2.filter((detail) => detail.passed === false || failedStatus(firstString(detail, ["status"]))).length;
+    const skipped = firstNumber(resultRecord, ["skipped_tests", "skippedTests"]) ?? 0;
+    return {
+      operation: resolvedOperation,
+      progress: 100,
+      message: `Template tests complete: ${passed2} passed, ${failed2} failed, ${skipped} skipped`,
+      items: progressItemsFromDetails(details2, ["test_name", "testName", "name"], context)
+    };
+  }
+  const details = normalizeTemplateValidationDetails(result);
+  const passed = firstNumber(summary, ["passed_rules", "passedRules"]) ?? details.filter((detail) => passedStatus(firstString(detail, ["status"]))).length;
+  const failed = firstNumber(summary, ["failed_rules", "failedRules"]) ?? details.filter((detail) => failedStatus(firstString(detail, ["status"]))).length;
+  const total = firstNumber(summary, ["total_rules", "totalRules"]) ?? details.length;
+  return {
+    operation: resolvedOperation ?? "template_validate",
+    progress: 100,
+    message: `Validation complete: ${passed} passed, ${failed} failed across ${total} checks`,
+    items: progressItemsFromDetails(details, ["rule_id", "rule_name", "ruleName", "name"], context)
+  };
+};
+var formatTemplateProgressEvent = (event, command) => {
+  const appendItemDetails = (lines2, item) => {
+    const metadata = [
+      item.category ? `category: ${item.category}` : void 0,
+      item.severity ? `severity: ${item.severity}` : void 0,
+      item.location ? `location: ${item.location}` : void 0,
+      typeof item.durationMs === "number" ? `duration: ${item.durationMs}ms` : void 0
+    ].filter(Boolean);
+    if (metadata.length) {
+      lines2.push(`    ${metadata.join(" | ")}`);
+    }
+    if (item.name && item.message) {
+      lines2.push(`    message: ${item.message}`);
+    }
+    if (item.recommendation) {
+      lines2.push(`    recommendation: ${item.recommendation}`);
+    }
+    if (item.documentationUrl) {
+      lines2.push(`    docs: ${item.documentationUrl}`);
+    }
+  };
+  if (event.phase === "submitted") {
+    return [`${command} job ${event.jobId} submitted`];
+  }
+  if (event.phase === "result") {
+    const lines2 = event.message ? [event.message] : [`${command} job ${event.jobId} complete`];
+    for (const item of event.items ?? []) {
+      const status2 = item.status ? `${item.status} ` : "";
+      lines2.push(`  - ${status2}${item.name ?? item.message ?? "item"}`);
+      appendItemDetails(lines2, item);
+    }
+    return lines2;
+  }
+  const status = event.status ? event.status.toUpperCase() : "RUNNING";
+  const progress = typeof event.progress === "number" ? ` ${Math.round(event.progress)}%` : "";
+  const completed = typeof event.completed === "number" && typeof event.total === "number" ? ` (${event.completed}/${event.total})` : "";
+  const current = event.currentItem ? ` current: ${event.currentItem}` : "";
+  const message = event.message ? ` ${event.message}` : "";
+  const lines = [
+    `${command} job ${event.jobId}: ${status}${progress}${completed}${current}${message}`
+  ];
+  for (const item of event.items ?? []) {
+    const statusText = item.status ? `${item.status} ` : "";
+    const passedText = item.status || item.passed === void 0 ? "" : item.passed ? "Pass " : "Fail ";
+    lines.push(`  - ${statusText}${passedText}${item.name ?? item.message ?? "item"}`);
+    appendItemDetails(lines, item);
+  }
+  return lines;
+};
+var templateProgressEventKey = (event) => JSON.stringify({
+  phase: event.phase,
+  operation: event.operation,
+  status: event.status,
+  progress: event.progress,
+  completed: event.completed,
+  total: event.total,
+  currentItem: event.currentItem,
+  message: event.message,
+  items: event.items
+});
 var unwrapTemplateOperationResult = (value) => {
   const record = recordValue(value);
   if (!record) {
@@ -7858,9 +8457,9 @@ var unwrapTemplateOperationResult = (value) => {
   }
   const nestedResult = recordValue(result.result);
   if (nestedResult) {
-    return nestedResult;
+    return sanitizeTemplateOperationText(nestedResult);
   }
-  return result;
+  return sanitizeTemplateOperationText(result);
 };
 var resolvedOperationResult = (value) => recordValue(unwrapTemplateOperationResult(value));
 var validationResults = (result) => {
@@ -7892,9 +8491,15 @@ var normalizeTemplateValidationDetails = (result) => validationResults(recordVal
     pillar: firstString(row, ["pillar"]),
     ...Object.keys(target).length ? { target } : {},
     evidence: compactRecord({
-      description: firstString(row, ["description", "message"]) ?? firstString(info, ["description"]),
-      synopsis: firstString(row, ["synopsis"]) ?? firstString(info, ["synopsis"]),
-      recommendation: firstString(row, ["recommendation", "remediation"]),
+      description: publicValidationText(
+        firstString(row, ["description", "message"]) ?? firstString(info, ["description"])
+      ),
+      synopsis: publicValidationText(
+        firstString(row, ["synopsis"]) ?? firstString(info, ["synopsis"])
+      ),
+      recommendation: publicValidationText(
+        firstString(row, ["recommendation", "remediation"])
+      ),
       documentation_url: firstString(row, [
         "documentation_url",
         "documentationUrl",
@@ -7921,7 +8526,7 @@ var withTemplateValidationDetails = (value) => {
     details: normalizeTemplateValidationDetails(result)
   });
 };
-var normalizeTemplateTestDetails = (result) => arrayValue(recordValue(result)?.test_results).map((item) => {
+var normalizeTemplateTestDetails = (result, context) => arrayValue(recordValue(result)?.test_results).map((item) => {
   const row = recordValue(item) ?? {};
   const passed = typeof row.passed === "boolean" ? row.passed : void 0;
   return compactRecord({
@@ -7931,17 +8536,23 @@ var normalizeTemplateTestDetails = (result) => arrayValue(recordValue(result)?.t
     status: passed === void 0 ? firstString(row, ["status"]) : passed ? "Pass" : "Fail",
     passed,
     severity: firstString(row, ["severity", "level"]),
-    message: firstString(row, ["message", "description"]),
-    recommendation: firstString(row, ["recommendation", "remediation"]),
+    message: publicValidationText(firstString(row, ["message", "description"])),
+    recommendation: publicValidationText(
+      firstString(row, ["recommendation", "remediation"])
+    ),
     duration_ms: typeof row.duration_ms === "number" ? row.duration_ms : typeof row.durationMs === "number" ? row.durationMs : void 0,
-    file_path: firstString(row, ["file_path", "filePath"])
+    file_path: displayTemplateLocation(
+      firstString(row, ["file_path", "filePath"]),
+      context
+    )
   });
 });
-var withTemplateTestDetails = (value) => {
-  const result = resolvedOperationResult(value);
-  if (!result) {
+var withTemplateTestDetails = (value, context) => {
+  const rawResult = resolvedOperationResult(value);
+  if (!rawResult) {
     return value;
   }
+  const result = recordValue(sanitizeTemplateLocationFields(rawResult, context)) ?? rawResult;
   const original = recordValue(value);
   const jobFields = original && ("jobId" in original || "status" in original) ? compactRecord({
     submitted: original.submitted,
@@ -7957,7 +8568,7 @@ var withTemplateTestDetails = (value) => {
       failed_tests: result.failed_tests,
       skipped_tests: result.skipped_tests
     }),
-    details: normalizeTemplateTestDetails(result)
+    details: normalizeTemplateTestDetails(result, context)
   });
 };
 var getTemplateValidationJobStatus = async (input) => fetchCloudEvalJson({
@@ -7979,10 +8590,34 @@ var waitForTemplateValidationResult = async (input) => {
   }
   const waitTimeoutMs = Math.max(1, input.waitTimeoutMs ?? 6e5);
   const pollIntervalMs = Math.max(500, input.pollIntervalMs ?? 2500);
+  const progressContext = {
+    templatePath: input.templatePath,
+    parametersPath: input.parametersPath
+  };
   const deadline = Date.now() + waitTimeoutMs;
+  const startedAt = Date.now();
+  const elapsedMs = () => Date.now() - startedAt;
+  await input.onProgress?.(
+    progressEventFromStatus({
+      phase: "submitted",
+      jobId,
+      status: input.submitted,
+      elapsedMs: elapsedMs(),
+      context: progressContext
+    })
+  );
   let status;
   for (; ; ) {
     status = await getTemplateValidationJobStatus({ ...input, jobId });
+    await input.onProgress?.(
+      progressEventFromStatus({
+        phase: "status",
+        jobId,
+        status,
+        elapsedMs: elapsedMs(),
+        context: progressContext
+      })
+    );
     if (isTerminalJobStatus3(status)) {
       break;
     }
@@ -7998,13 +8633,32 @@ var waitForTemplateValidationResult = async (input) => {
       `Template validation job ${jobId} ended with status ${normalizedStatus(status) || "unknown"}.`
     );
   }
+  const result = sanitizeTemplateLocationFields(
+    unwrapTemplateOperationResult(
+      await getTemplateValidationJobResult({ ...input, jobId })
+    ),
+    progressContext
+  );
+  const statusEvent = progressEventFromStatus({
+    phase: "status",
+    jobId,
+    status,
+    elapsedMs: elapsedMs(),
+    context: progressContext
+  });
+  await input.onProgress?.(
+    compactRecord({
+      ...statusEvent,
+      phase: "result",
+      ...resultProgressSummary(result, statusEvent.operation, progressContext),
+      elapsedMs: elapsedMs()
+    })
+  );
   return {
     submitted: input.submitted,
     jobId,
     status,
-    result: unwrapTemplateOperationResult(
-      await getTemplateValidationJobResult({ ...input, jobId })
-    )
+    result
   };
 };
 var templateTestRequestBody = async (files, options) => {
@@ -9379,7 +10033,7 @@ var mcpToolDefinitions = [
         },
         wait: {
           type: "boolean",
-          description: "Poll an async validation job until results are ready.",
+          description: "Poll an async validation job until results are ready. When the MCP call includes _meta.progressToken, wait progress is emitted as notifications/progress.",
           default: false
         },
         pollIntervalMs: {
@@ -9436,7 +10090,7 @@ var mcpToolDefinitions = [
         verbose: { type: "boolean", default: false },
         wait: {
           type: "boolean",
-          description: "Poll an async template test job until results are ready.",
+          description: "Poll an async template test job until results are ready. When the MCP call includes _meta.progressToken, wait progress is emitted as notifications/progress.",
           default: false
         },
         pollIntervalMs: {
@@ -9953,7 +10607,7 @@ var MCP_TOOLSETS = {
 };
 var MCP_TOOLSET_NAMES = Object.keys(MCP_TOOLSETS);
 var normalizeMcpToolset = (value) => {
-  const normalized = (value ?? "all").toLowerCase();
+  const normalized = (value ?? "readonly").toLowerCase();
   if (MCP_TOOLSET_NAMES.includes(normalized)) {
     return normalized;
   }
@@ -10201,12 +10855,12 @@ var resolveInvocationConfig = async (serverOptions, args) => {
     accessKey: serverOptions.accessKey
   };
 };
-var frontendBase3 = (config) => resolveFrontendBaseUrl({
+var frontendBase4 = (config) => resolveFrontendBaseUrl({
   frontendUrl: config.frontendUrl,
   apiBaseUrl: config.baseUrl
 });
 var reportsFrontendUrl = (config, input) => buildFrontendUrl({
-  baseUrl: frontendBase3(config),
+  baseUrl: frontendBase4(config),
   target: "reports",
   projectId: input.projectId,
   tab: input.tab ?? (input.type === "cost" ? "cost" : input.type === "waf" || input.type === "architecture" ? "architecture" : "overview"),
@@ -10216,7 +10870,7 @@ var reportsFrontendUrl = (config, input) => buildFrontendUrl({
   reportVerbosity: input.reportVerbosity
 });
 var resolveAuth = async (config, options = {}) => {
-  const core = await import("./dist-PEYJDO7A.js");
+  const core = await import("./dist-V2L4CPTU.js");
   core.assertSecureBaseUrl(config.baseUrl);
   let token;
   try {
@@ -10312,7 +10966,7 @@ var assertModelAvailable = async (config, token) => {
   if (!config.model) {
     return;
   }
-  const core = await import("./dist-PEYJDO7A.js");
+  const core = await import("./dist-V2L4CPTU.js");
   try {
     const response = await fetch(
       `${core.normalizeApiBase(config.baseUrl)}/models`,
@@ -10569,7 +11223,7 @@ var buildToolHandlers = (serverOptions) => {
   });
   handlers.set("agent_profiles_list", async (args) => {
     const config = await resolveInvocationConfig(serverOptions, args);
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-V2L4CPTU.js");
     const data = await listProfilesForDiscovery(core, config.baseUrl);
     return withEnvelope({
       command: "agents list",
@@ -10582,7 +11236,7 @@ var buildToolHandlers = (serverOptions) => {
       throw new Error("profileId is required.");
     }
     const config = await resolveInvocationConfig(serverOptions, args);
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-V2L4CPTU.js");
     const data = await getProfileForDiscovery(core, config.baseUrl, profileId);
     return withEnvelope({
       command: "agents show",
@@ -10646,7 +11300,7 @@ var buildToolHandlers = (serverOptions) => {
     }
     const finalMessage = [...chatState.messages].reverse().find((message) => message.role === "assistant");
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "chat",
       threadId
     });
@@ -10671,7 +11325,7 @@ var buildToolHandlers = (serverOptions) => {
       auth.user.id
     );
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "projects"
     });
     return withEnvelope({
@@ -10697,7 +11351,7 @@ var buildToolHandlers = (serverOptions) => {
       throw new Error(`Project ${projectId} was not found.`);
     }
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "project",
       projectId
     });
@@ -10716,7 +11370,7 @@ var buildToolHandlers = (serverOptions) => {
       userId: auth.user.id
     });
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "connections"
     });
     return withEnvelope({
@@ -10742,7 +11396,7 @@ var buildToolHandlers = (serverOptions) => {
       throw new Error(`Connection ${connectionId} was not found.`);
     }
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "connection",
       connectionId
     });
@@ -10898,7 +11552,7 @@ var buildToolHandlers = (serverOptions) => {
     });
     return withEnvelope({ command: "projects graph sync-runs", data });
   });
-  handlers.set("template_validate", async (args) => {
+  handlers.set("template_validate", async (args, context) => {
     const config = await resolveInvocationConfig(serverOptions, args);
     const auth = await resolveAuth(config, { requireUser: true });
     const templatePath = stringValue(args.templatePath);
@@ -10931,14 +11585,17 @@ var buildToolHandlers = (serverOptions) => {
       userId: auth.user.id,
       submitted,
       pollIntervalMs: numberValue(args.pollIntervalMs),
-      waitTimeoutMs: numberValue(args.waitTimeoutMs)
+      waitTimeoutMs: numberValue(args.waitTimeoutMs),
+      templatePath,
+      parametersPath: stringValue(args.parametersPath),
+      onProgress: context?.sendProgress ? (event) => context.sendProgress(event, "validate template") : void 0
     }) : submitted;
     return withEnvelope({
       command: "validate template",
       data: booleanValue(args.details) ? withTemplateValidationDetails(data) : data
     });
   });
-  handlers.set("template_test", async (args) => {
+  handlers.set("template_test", async (args, context) => {
     const config = await resolveInvocationConfig(serverOptions, args);
     const auth = await resolveAuth(config, { requireUser: true });
     const templatePath = stringValue(args.templatePath);
@@ -10963,11 +11620,17 @@ var buildToolHandlers = (serverOptions) => {
       userId: auth.user.id,
       submitted,
       pollIntervalMs: numberValue(args.pollIntervalMs),
-      waitTimeoutMs: numberValue(args.waitTimeoutMs)
+      waitTimeoutMs: numberValue(args.waitTimeoutMs),
+      templatePath,
+      parametersPath: stringValue(args.parametersPath),
+      onProgress: context?.sendProgress ? (event) => context.sendProgress(event, "validate tests") : void 0
     }) : submitted;
     return withEnvelope({
       command: "validate tests",
-      data: withTemplateTestDetails(data)
+      data: withTemplateTestDetails(data, {
+        templatePath,
+        parametersPath: stringValue(args.parametersPath)
+      })
     });
   });
   handlers.set("template_parse", async (args) => {
@@ -11078,7 +11741,7 @@ var buildToolHandlers = (serverOptions) => {
       finalMessage?.content || responseText || ""
     );
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "chat",
       threadId: chatState.threadId
     });
@@ -11219,7 +11882,7 @@ var buildToolHandlers = (serverOptions) => {
   });
   handlers.set("auth_status", async (args) => {
     const config = await resolveInvocationConfig(serverOptions, args);
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-V2L4CPTU.js");
     const data = await core.getAuthStatus(config.baseUrl, { validate: true });
     return withEnvelope({
       command: "auth status",
@@ -11228,7 +11891,7 @@ var buildToolHandlers = (serverOptions) => {
   });
   handlers.set("status", async (args) => {
     const config = await resolveInvocationConfig(serverOptions, args);
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-V2L4CPTU.js");
     const auth = await core.getAuthStatus(config.baseUrl, { validate: true });
     return withEnvelope({
       command: "status",
@@ -11259,7 +11922,7 @@ var buildToolHandlers = (serverOptions) => {
       }
     ];
     try {
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       core.assertSecureBaseUrl(config.baseUrl);
       checks.push({
         id: "base-url-secure",
@@ -11692,7 +12355,7 @@ var buildToolHandlers = (serverOptions) => {
       }).catch(() => null)
     ]);
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "billing",
       tab: "plans"
     });
@@ -11730,7 +12393,7 @@ var buildToolHandlers = (serverOptions) => {
       chargeStatus: stringValue(args.chargeStatus)
     });
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "billing",
       tab: "usage"
     });
@@ -11760,7 +12423,7 @@ var buildToolHandlers = (serverOptions) => {
       cursor: stringValue(args.cursor)
     });
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "billing",
       tab: "usage"
     });
@@ -11779,13 +12442,13 @@ var buildToolHandlers = (serverOptions) => {
     } catch {
       token = config.accessKey;
     }
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-V2L4CPTU.js");
     const data = await core.getBillingConfig({
       baseUrl: config.baseUrl,
       authToken: token
     });
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "billing",
       tab: "plans"
     });
@@ -11803,7 +12466,7 @@ var buildToolHandlers = (serverOptions) => {
       authToken: auth.token
     });
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "billing",
       tab: "billing"
     });
@@ -11822,7 +12485,7 @@ var buildToolHandlers = (serverOptions) => {
       limit: boundedLimit(args.limit, 25, 50)
     });
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "billing",
       tab: "billing"
     });
@@ -11841,7 +12504,7 @@ var buildToolHandlers = (serverOptions) => {
       limit: boundedLimit(args.limit, 25, 100)
     });
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "billing",
       tab: "billing"
     });
@@ -11859,7 +12522,7 @@ var buildToolHandlers = (serverOptions) => {
     const config = await resolveInvocationConfig(serverOptions, args);
     const auth = await resolveAuth(config, { requireUser: true });
     const returnTo = stringValue(args.returnTo) ?? buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "billing",
       tab: "billing"
     });
@@ -11890,7 +12553,7 @@ var buildToolHandlers = (serverOptions) => {
     }
     const config = await resolveInvocationConfig(serverOptions, args);
     const url = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target,
       threadId: stringValue(args.threadId),
       projectId: stringValue(args.projectId),
@@ -12158,6 +12821,34 @@ var serveMcpServer = async (options) => {
       transport: outputTransport
     });
   };
+  const progressTokenFromParams = (params) => {
+    const meta = isObject(params?._meta) ? params?._meta : void 0;
+    const token = meta?.progressToken;
+    if (typeof token === "string") {
+      return token;
+    }
+    if (typeof token === "number" && Number.isFinite(token)) {
+      return token;
+    }
+    return void 0;
+  };
+  const sendTemplateProgress = (progressToken, event, command) => {
+    if (progressToken === void 0) {
+      return;
+    }
+    const progress = typeof event.progress === "number" ? event.progress : typeof event.completed === "number" ? event.completed : event.phase === "result" ? 100 : 0;
+    const total = typeof event.progress === "number" ? 100 : typeof event.total === "number" ? event.total : event.phase === "result" ? 100 : void 0;
+    send({
+      jsonrpc: "2.0",
+      method: "notifications/progress",
+      params: {
+        progressToken,
+        progress,
+        ...total === void 0 ? {} : { total },
+        message: formatTemplateProgressEvent(event, command).join("\n")
+      }
+    });
+  };
   const handleRequest = async (request) => {
     debug("request received", {
       id: request.id,
@@ -12241,9 +12932,23 @@ var serveMcpServer = async (options) => {
             `Tool has no handler: ${name}`
           );
         }
+        const progressToken = progressTokenFromParams(request.params);
+        let lastProgressKey;
         const startedAt = Date.now();
         try {
-          const envelope = await handler(args);
+          const envelope = await handler(args, {
+            progressToken,
+            sendProgress: (event, command) => {
+              if (event.phase === "status") {
+                const key = templateProgressEventKey(event);
+                if (key === lastProgressKey) {
+                  return;
+                }
+                lastProgressKey = key;
+              }
+              sendTemplateProgress(progressToken, event, command);
+            }
+          });
           debug("tool call completed", { tool: name, ok: envelope.ok });
           await options.telemetry?.track("cli.mcp.tool", {
             command: "mcp",
@@ -12484,7 +13189,7 @@ var registerMcpCommand = (program2, deps) => {
   ).option(
     "--toolset <name>",
     "Toolset to expose: all, readonly, projects, reports, billing",
-    "all"
+    "readonly"
   ).option("--config-path <path>", "Override MCP client config path").option(
     "--format <format>",
     "Output format: text, json, ndjson, markdown",
@@ -12533,7 +13238,7 @@ var registerMcpCommand = (program2, deps) => {
   ).option(
     "--toolset <name>",
     `Expose a focused MCP toolset: ${MCP_TOOLSET_NAMES.join(", ")}`,
-    "all"
+    "readonly"
   ).option(
     "-v, --verbose",
     "Write detailed MCP server diagnostics to stderr",
@@ -12633,7 +13338,7 @@ var registerCapabilitiesCommand = (program2, deps) => {
     warnIfAccessKeyFromCliOption(options, command);
     let data = capabilities;
     if (options.live) {
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       const baseUrl = await deps.resolveBaseUrl(options, command);
       const accessKey = options.accessKeyStdin ? await deps.readStdinValue() : options.accessKey;
       const token = await core.getAuthToken({ accessKey, baseUrl });
@@ -12766,19 +13471,19 @@ var writeCredentialOutput = async (input) => {
     data: input.data,
     format: input.format,
     output: input.output,
-    redactSensitiveSecrets: input.command !== "credentials create"
+    redactSensitiveSecrets: !(input.command === "credentials create" && input.showSecret === true)
   });
 };
 var resolveCoreAuth = async (options, command, deps) => {
   const context = await resolveAuthContext(options, command, deps);
-  const core = await import("./dist-PEYJDO7A.js");
+  const core = await import("./dist-V2L4CPTU.js");
   return { ...context, core };
 };
 var parseCapabilities = (value) => value?.split(",").map((item) => item.trim()).filter(Boolean);
-var addCommon4 = (command, deps) => addAuthOptions(command, deps.defaultBaseUrl).option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--output <file>", "Output file");
+var addCommon5 = (command, deps) => addAuthOptions(command, deps.defaultBaseUrl).option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--output <file>", "Output file");
 var registerCredentialsCommand = (program2, deps) => {
   const credentials = program2.command("credentials").description("Manage CloudEval access-key credentials");
-  addCommon4(credentials.command("templates").description("List credential templates"), deps).action(async (options, command) => {
+  addCommon5(credentials.command("templates").description("List credential templates"), deps).action(async (options, command) => {
     const auth = await resolveCoreAuth(options, command, deps);
     const data = await auth.core.getCredentialTemplates({
       baseUrl: auth.baseUrl,
@@ -12791,7 +13496,7 @@ var registerCredentialsCommand = (program2, deps) => {
       output: options.output
     });
   });
-  addCommon4(credentials.command("list").description("List credentials"), deps).option("--project <id>", "Filter by project id").action(async (options, command) => {
+  addCommon5(credentials.command("list").description("List credentials"), deps).option("--project <id>", "Filter by project id").action(async (options, command) => {
     const auth = await resolveCoreAuth(options, command, deps);
     const data = await auth.core.listCredentials({
       baseUrl: auth.baseUrl,
@@ -12805,7 +13510,7 @@ var registerCredentialsCommand = (program2, deps) => {
       output: options.output
     });
   });
-  addCommon4(credentials.command("inspect").description("Inspect a credential").argument("<credential_id>"), deps).action(async (credentialId, options, command) => {
+  addCommon5(credentials.command("inspect").description("Inspect a credential").argument("<credential_id>"), deps).action(async (credentialId, options, command) => {
     const auth = await resolveCoreAuth(options, command, deps);
     const data = await auth.core.getCredential({
       baseUrl: auth.baseUrl,
@@ -12819,7 +13524,11 @@ var registerCredentialsCommand = (program2, deps) => {
       output: options.output
     });
   });
-  addAuthOptions(credentials.command("create").description("Create an access-key credential"), deps.defaultBaseUrl).requiredOption("--template <id>", "Credential template id").requiredOption("--name <name>", "Credential name").requiredOption("--project <id>", "Project scope").option("--expires <duration>", "Expiration duration, for example 90d").option("--capabilities <list>", "Comma-separated capability override").option("--idempotency-key <key>", "Idempotency key for safe retries").option("--format <format>", "Output format: text, json, ndjson, markdown, github-actions", "text").option("--output <file>", "Output file").action(async (options, command) => {
+  addAuthOptions(credentials.command("create").description("Create an access-key credential"), deps.defaultBaseUrl).requiredOption("--template <id>", "Credential template id").requiredOption("--name <name>", "Credential name").requiredOption("--project <id>", "Project scope").option("--expires <duration>", "Expiration duration, for example 90d").option("--capabilities <list>", "Comma-separated capability override").option("--idempotency-key <key>", "Idempotency key for safe retries").option("--format <format>", "Output format: text, json, ndjson, markdown, github-actions", "text").option("--output <file>", "Output file").option(
+    "--show-secret",
+    "Include the one-time access key in machine-readable create output",
+    false
+  ).action(async (options, command) => {
     const auth = await resolveCoreAuth(options, command, deps);
     const data = await auth.core.createCredential({
       baseUrl: auth.baseUrl,
@@ -12836,10 +13545,11 @@ var registerCredentialsCommand = (program2, deps) => {
       data,
       format: options.format,
       output: options.output,
-      projectId: options.project
+      projectId: options.project,
+      showSecret: options.showSecret
     });
   });
-  addCommon4(credentials.command("revoke").description("Revoke a credential").argument("<credential_id>"), deps).option("--reason <reason>", "Revocation reason").option("--idempotency-key <key>", "Idempotency key for safe retries").action(async (credentialId, options, command) => {
+  addCommon5(credentials.command("revoke").description("Revoke a credential").argument("<credential_id>"), deps).option("--reason <reason>", "Revocation reason").option("--idempotency-key <key>", "Idempotency key for safe retries").action(async (credentialId, options, command) => {
     const auth = await resolveCoreAuth(options, command, deps);
     const data = await auth.core.revokeCredential({
       baseUrl: auth.baseUrl,
@@ -12857,7 +13567,7 @@ var registerCredentialsCommand = (program2, deps) => {
   });
 };
 var registerIdentityCommand = (program2, deps) => {
-  addCommon4(program2.command("identity").description("Show the current CloudEval identity"), deps).action(async (options, command) => {
+  addCommon5(program2.command("identity").description("Show the current CloudEval identity"), deps).action(async (options, command) => {
     const auth = await resolveCoreAuth(options, command, deps);
     const data = await auth.core.getIdentity({
       baseUrl: auth.baseUrl,
@@ -12890,6 +13600,17 @@ var normalizeHooks = (config, event) => {
     (hook) => hook && typeof hook.id === "string" && typeof hook.command === "string" && hook.id.trim() && hook.command.trim()
   ) : [];
 };
+var HOOK_SECRET_ENV_KEY_PATTERN = /(?:TOKEN|SECRET|PASSWORD|CREDENTIAL|ACCESS_KEY|API_KEY|PRIVATE_KEY|SESSION|COOKIE|AUTH|AZURE_CLIENT_SECRET|CLOUDEVAL_ACCESS_KEY)/i;
+var buildLocalHookBaseEnv = (source = process.env) => {
+  const env = {};
+  for (const [key, value] of Object.entries(source)) {
+    if (value === void 0 || HOOK_SECRET_ENV_KEY_PATTERN.test(key)) {
+      continue;
+    }
+    env[key] = value;
+  }
+  return env;
+};
 var writeHookPayload = async (input, hook) => {
   const filePath = path7.join(
     os4.tmpdir(),
@@ -12924,7 +13645,7 @@ var runShellHook = async (hook, input, payloadPath) => {
       cwd: hook.cwd || process.cwd(),
       timeout: timeoutSeconds * 1e3,
       env: {
-        ...process.env,
+        ...buildLocalHookBaseEnv(),
         CLOUDEVAL_HOOK_EVENT: input.event,
         CLOUDEVAL_HOOK_EVENT_FILE: payloadPath,
         CLOUDEVAL_PROFILE: input.profile,
@@ -13088,7 +13809,7 @@ var registerAgentsCommand = (program2, deps) => {
   const agents = program2.command("agents").description("CloudEval Agent Profile utilities");
   addAgentOutputOptions(agents.command("list").description("List Agent Profiles"), deps).action(async (options, command) => {
     const baseUrl = await deps.resolveBaseUrl(options, command);
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-V2L4CPTU.js");
     core.assertSecureBaseUrl(baseUrl);
     const data = await listProfilesForDiscovery2(core, baseUrl);
     await writeProfiles({
@@ -13104,7 +13825,7 @@ var registerAgentsCommand = (program2, deps) => {
     deps
   ).action(async (profileId, options, command) => {
     const baseUrl = await deps.resolveBaseUrl(options, command);
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-V2L4CPTU.js");
     core.assertSecureBaseUrl(baseUrl);
     const data = await getProfileForDiscovery2(core, baseUrl, profileId);
     await writeProfiles({
@@ -13123,7 +13844,7 @@ var registerAgentsCommand = (program2, deps) => {
       const cliProfile = getActiveConfigProfile(command);
       const cliConfig = await loadCliConfig(cliProfile);
       const auth = await resolveAuthContext(options, command, deps);
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       const profileResponse = await core.getAgentProfile({
         baseUrl: auth.baseUrl,
         authToken: auth.token,
@@ -13282,7 +14003,48 @@ var registerAgentsCommand = (program2, deps) => {
 };
 
 // src/validateCommand.ts
-var addCommon5 = (command, deps) => addAuthOptions(command, deps.defaultBaseUrl).requiredOption("--template-file <path>", "Cloud template JSON file").option("--parameters-file <path>", "Optional parameters JSON file").option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--output <file>", "Output file");
+var normalizeTemplateProgressMode = (value) => {
+  if (value === true) {
+    return "stderr";
+  }
+  if (value === void 0 || value === false || value === null) {
+    return "none";
+  }
+  const mode = String(value).trim().toLowerCase();
+  if (mode === "auto" || mode === "stderr" || mode === "ndjson" || mode === "none") {
+    return mode;
+  }
+  throw new Error("--progress must be one of: auto, stderr, ndjson, none");
+};
+var createTemplateProgressReporter = (command, progress) => {
+  const requestedMode = normalizeTemplateProgressMode(progress);
+  const mode = requestedMode === "auto" ? process.stderr.isTTY ? "stderr" : "none" : requestedMode;
+  if (mode === "none") {
+    return void 0;
+  }
+  let lastStatusKey;
+  return (event) => {
+    if (event.phase === "status") {
+      const key = templateProgressEventKey(event);
+      if (key === lastStatusKey) {
+        return;
+      }
+      lastStatusKey = key;
+    }
+    if (mode === "ndjson") {
+      process.stderr.write(
+        `${JSON.stringify({ type: "template_progress", command, ...event })}
+`
+      );
+      return;
+    }
+    for (const line of formatTemplateProgressEvent(event, command)) {
+      process.stderr.write(`${line}
+`);
+    }
+  };
+};
+var addCommon6 = (command, deps) => addAuthOptions(command, deps.defaultBaseUrl).requiredOption("--template-file <path>", "Cloud template JSON file").option("--parameters-file <path>", "Optional parameters JSON file").option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--output <file>", "Output file");
 var parsePositiveInteger2 = (value, optionName = "--max-results") => {
   if (!value) {
     return void 0;
@@ -13299,11 +14061,15 @@ var collectRule = (value, previous = []) => [
 ];
 var registerValidateCommand = (program2, deps) => {
   const validate = program2.command("validate").description("Validate and parse cloud templates");
-  addCommon5(validate.command("template").description("Validate a cloud template"), deps).option("--failed-only", "Return failed validation checks only", false).option(
+  addCommon6(validate.command("template").description("Validate a cloud template"), deps).option("--failed-only", "Return failed validation checks only", false).option(
     "--rule <id>",
     "Run a specific validation check id; repeat for multiple checks",
     collectRule
-  ).option("--category <name>", "Validation category filter").option("--pillar <name>", "Architecture pillar filter").option("--min-severity <level>", "Minimum severity level").option("--max-results <count>", "Maximum validation results").option("--project <id>", "Project id for saved validation results").option("--save-report", "Persist validation results when a project is provided", false).option("--details", "Include frontend-style per-check evidence details", false).option("--wait", "Poll an async validation job until results are ready", false).option("--poll-interval <ms>", "Polling interval when --wait is set", "2500").option("--wait-timeout <ms>", "Maximum time to wait when --wait is set", "600000").action(async (options, command) => {
+  ).option("--category <name>", "Validation category filter").option("--pillar <name>", "Architecture pillar filter").option("--min-severity <level>", "Minimum severity level").option("--max-results <count>", "Maximum validation results").option("--project <id>", "Project id for saved validation results").option("--save-report", "Persist validation results when a project is provided", false).option("--details", "Include frontend-style per-check evidence details", false).option("--wait", "Poll an async validation job until results are ready", false).option("--poll-interval <ms>", "Polling interval when --wait is set", "2500").option("--wait-timeout <ms>", "Maximum time to wait when --wait is set", "600000").option(
+    "--progress [mode]",
+    "Progress events while waiting: auto, stderr, ndjson, none",
+    "none"
+  ).action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
       const submitted = await validateTemplate({
@@ -13333,6 +14099,12 @@ var registerValidateCommand = (program2, deps) => {
         waitTimeoutMs: parsePositiveInteger2(
           options.waitTimeout,
           "--wait-timeout"
+        ),
+        templatePath: options.templateFile,
+        parametersPath: options.parametersFile,
+        onProgress: createTemplateProgressReporter(
+          "validate template",
+          options.progress
         )
       }) : submitted;
       const outputData = options.details ? withTemplateValidationDetails(data) : data;
@@ -13347,7 +14119,7 @@ var registerValidateCommand = (program2, deps) => {
       process.exit(1);
     }
   });
-  addCommon5(validate.command("parse").description("Parse a cloud template"), deps).option("--location <region>", "Default location for resolved resources").action(async (options, command) => {
+  addCommon6(validate.command("parse").description("Parse a cloud template"), deps).option("--location <region>", "Default location for resolved resources").action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
       const data = await parseTemplate({
@@ -13370,7 +14142,11 @@ var registerValidateCommand = (program2, deps) => {
       process.exit(1);
     }
   });
-  addCommon5(validate.command("tests").description("Run cloud template test checks"), deps).option("--test <name>", "Run a specific template test; repeat for multiple tests", collectRule).option("--skip-test <name>", "Skip a specific template test; repeat for multiple tests", collectRule).option("--category <name>", "Template test category").option("--group <name>", "Template test group; repeat for multiple groups", collectRule).option("--verbose", "Request verbose template test output", false).option("--wait", "Poll an async template test job until results are ready", false).option("--poll-interval <ms>", "Polling interval when --wait is set", "2500").option("--wait-timeout <ms>", "Maximum time to wait when --wait is set", "600000").action(async (options, command) => {
+  addCommon6(validate.command("tests").description("Run cloud template test checks"), deps).option("--test <name>", "Run a specific template test; repeat for multiple tests", collectRule).option("--skip-test <name>", "Skip a specific template test; repeat for multiple tests", collectRule).option("--category <name>", "Template test category").option("--group <name>", "Template test group; repeat for multiple groups", collectRule).option("--verbose", "Request verbose template test output", false).option("--wait", "Poll an async template test job until results are ready", false).option("--poll-interval <ms>", "Polling interval when --wait is set", "2500").option("--wait-timeout <ms>", "Maximum time to wait when --wait is set", "600000").option(
+    "--progress [mode]",
+    "Progress events while waiting: auto, stderr, ndjson, none",
+    "none"
+  ).action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
       const submitted = await testTemplate({
@@ -13397,11 +14173,20 @@ var registerValidateCommand = (program2, deps) => {
         waitTimeoutMs: parsePositiveInteger2(
           options.waitTimeout,
           "--wait-timeout"
+        ),
+        templatePath: options.templateFile,
+        parametersPath: options.parametersFile,
+        onProgress: createTemplateProgressReporter(
+          "validate tests",
+          options.progress
         )
       }) : submitted;
       await writeFormattedOutput({
         command: "validate tests",
-        data: withTemplateTestDetails(data),
+        data: withTemplateTestDetails(data, {
+          templatePath: options.templateFile,
+          parametersPath: options.parametersFile
+        }),
         format: options.format,
         output: options.output
       });
@@ -13413,10 +14198,10 @@ var registerValidateCommand = (program2, deps) => {
 };
 
 // src/rulesCommand.ts
-var addCommon6 = (command, deps) => addAuthOptions(command, deps.defaultBaseUrl).option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--output <file>", "Output file");
+var addCommon7 = (command, deps) => addAuthOptions(command, deps.defaultBaseUrl).option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--output <file>", "Output file");
 var registerRulesCommand = (program2, deps) => {
   const rules = program2.command("rules").description("Browse cloud validation checks");
-  addCommon6(rules.command("categories").description("List validation check categories"), deps).action(async (options, command) => {
+  addCommon7(rules.command("categories").description("List validation check categories"), deps).action(async (options, command) => {
     try {
       const context = await resolveAuthContext(options, command, deps);
       const data = await getRuleCategories({
@@ -13434,7 +14219,7 @@ var registerRulesCommand = (program2, deps) => {
       process.exit(1);
     }
   });
-  addCommon6(
+  addCommon7(
     rules.command("search").description("Search validation checks").argument("<query>", "Search query"),
     deps
   ).option("--category <name>", "Category filter").option("--pillar <name>", "Architecture pillar filter").action(async (query, options, command) => {
@@ -13458,7 +14243,7 @@ var registerRulesCommand = (program2, deps) => {
       process.exit(1);
     }
   });
-  addCommon6(
+  addCommon7(
     rules.command("show").description("Show a validation check").argument("<rule_id>", "Rule id"),
     deps
   ).action(async (ruleId, options, command) => {
@@ -13621,7 +14406,7 @@ var registerDiagnosticsCommands = (program2, deps) => {
     const baseUrl = await deps.resolveBaseUrl(options, command);
     const profile = getActiveConfigProfile(command);
     const config = await loadCliConfig(profile);
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-V2L4CPTU.js");
     const auth = await core.getAuthStatus(baseUrl, { validate: true });
     if (options.format === "text" || !options.format) {
       process.stdout.write(
@@ -13671,7 +14456,7 @@ var registerDiagnosticsCommands = (program2, deps) => {
       detail: getCliConfigPath(profile)
     });
     try {
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       core.assertSecureBaseUrl(baseUrl);
       checks.push({
         id: "base-url-secure",
@@ -13771,7 +14556,7 @@ var resolveToken2 = async (options, deps, baseUrl, command) => {
     return options.accessKey;
   }
   try {
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-V2L4CPTU.js");
     return await core.getAuthToken({
       baseUrl
     });
@@ -13855,7 +14640,7 @@ var registerModelsCommand = (program2, deps) => {
     let source = "fallback";
     let modelList = fallbackModels;
     try {
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-V2L4CPTU.js");
       const response = await fetch(`${core.normalizeApiBase(baseUrl)}/models`, {
         headers: {
           Accept: "application/json",
@@ -15034,7 +15819,7 @@ var uninstallCompletionScript = async (shell) => {
 var runInteractiveLoginOnboarding = async (baseUrl, token) => {
   const [{ render }, { Onboarding }] = await Promise.all([
     import("ink"),
-    import("./Onboarding-GAN3Q5TS.js")
+    import("./Onboarding-AFBWD2CE.js")
   ]);
   await new Promise((resolve) => {
     let app;
@@ -15368,7 +16153,7 @@ var resolveBaseUrl = async (options, command) => {
     });
   }
   try {
-    const { getAuthStatus } = await import("./dist-PEYJDO7A.js");
+    const { getAuthStatus } = await import("./dist-V2L4CPTU.js");
     const status = await getAuthStatus();
     const storedBaseUrl = status.baseUrl;
     if (storedBaseUrl && shouldUseStoredBaseUrl(storedBaseUrl)) {
@@ -15442,7 +16227,7 @@ program.command("login").description("Authenticate with Cloudeval").option(
       checkUserStatus,
       ensurePlaygroundProject,
       login
-    } = await import("./dist-PEYJDO7A.js");
+    } = await import("./dist-V2L4CPTU.js");
     assertSecureBaseUrl(options.baseUrl);
     const headlessEnvironment = isHeadlessEnvironment();
     const headlessLogin = options.headless || headlessEnvironment;
@@ -15517,7 +16302,7 @@ program.command("logout").description("Log out and clear stored authentication s
   DEFAULT_BASE_URL
 ).option("--all-devices", "Revoke sessions on all devices", false).action(async (options) => {
   try {
-    const { assertSecureBaseUrl, logout } = await import("./dist-PEYJDO7A.js");
+    const { assertSecureBaseUrl, logout } = await import("./dist-V2L4CPTU.js");
     assertSecureBaseUrl(options.baseUrl);
     const result = await logout({
       baseUrl: options.baseUrl,
@@ -15551,7 +16336,7 @@ authCommand.command("status").description("Show current authentication status").
   DEFAULT_BASE_URL
 ).option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--show-sensitive-ids", "Show full account/session identifiers in command output", false).option("-v, --verbose", "Enable verbose logging and show full non-token identifiers", false).action(async (options, command) => {
   try {
-    const { assertSecureBaseUrl, getAuthStatus } = await import("./dist-PEYJDO7A.js");
+    const { assertSecureBaseUrl, getAuthStatus } = await import("./dist-V2L4CPTU.js");
     const effectiveBaseUrl = await resolveBaseUrl(options, command);
     assertSecureBaseUrl(effectiveBaseUrl);
     const status = await getAuthStatus(effectiveBaseUrl, { validate: true });
@@ -15638,6 +16423,18 @@ registerConnectionsCommand(program, {
   readStdinValue,
   isHeadlessEnvironment
 });
+registerIssuesInventoryCommand(program, {
+  defaultBaseUrl: DEFAULT_BASE_URL,
+  resolveBaseUrl,
+  readStdinValue,
+  isHeadlessEnvironment
+});
+registerActionsCommand(program, {
+  defaultBaseUrl: DEFAULT_BASE_URL,
+  resolveBaseUrl,
+  readStdinValue,
+  isHeadlessEnvironment
+});
 registerValidateCommand(program, {
   defaultBaseUrl: DEFAULT_BASE_URL,
   resolveBaseUrl,
@@ -15768,10 +16565,10 @@ program.command("tui").description("Open the CloudEval Terminal UI").option(
   "Access key for automation",
   process.env.CLOUDEVAL_ACCESS_KEY
 ).option("--access-key-stdin", "Read access key from stdin (recommended for automation)", false).option("--model <name>", "Model name").option("--debug", "Log raw chunks", false).option("--health-check", "Enable health check (disabled by default)").option("--no-banner", "Disable ASCII banner").option("--animate", "Enable TUI animations (default)").option("--no-anim", "Disable TUI animations").option("-v, --verbose", "Enable verbose logging", false).action(async (options, command) => {
-  const { assertSecureBaseUrl } = await import("./dist-PEYJDO7A.js");
+  const { assertSecureBaseUrl } = await import("./dist-V2L4CPTU.js");
   const [{ render }, { App }] = await Promise.all([
     import("ink"),
-    import("./App-3RDW53BW.js")
+    import("./App-DHWSFME3.js")
   ]);
   const baseUrl = await resolveBaseUrl(options, command);
   assertSecureBaseUrl(baseUrl);
@@ -15826,10 +16623,10 @@ program.command("chat").description("Start an interactive chat session").option(
   "Access key for automation",
   process.env.CLOUDEVAL_ACCESS_KEY
 ).option("--access-key-stdin", "Read access key from stdin (recommended for automation)", false).option("--conversation <id>", "Conversation/thread id to resume").option("--continue", "Resume the most recent local chat session", false).option("--resume <id-or-title>", "Resume a local chat session by thread id or title").option("--model <name>", "Model name").option("--mode <mode>", "Initial chat mode: ask, agent").option("--debug", "Log raw chunks", false).option("--health-check", "Enable health check (disabled by default)").option("--no-banner", "Disable ASCII banner").option("--animate", "Enable TUI animations (default)").option("--no-anim", "Disable TUI animations").option("-v, --verbose", "Enable verbose logging", false).action(async (options, command) => {
-  const { assertSecureBaseUrl } = await import("./dist-PEYJDO7A.js");
+  const { assertSecureBaseUrl } = await import("./dist-V2L4CPTU.js");
   const [{ render }, { App }] = await Promise.all([
     import("ink"),
-    import("./App-3RDW53BW.js")
+    import("./App-DHWSFME3.js")
   ]);
   const baseUrl = await resolveBaseUrl(options, command);
   assertSecureBaseUrl(baseUrl);
@@ -15904,7 +16701,7 @@ program.command("ask").alias("agent").description("Ask a single question or run
   const question = Array.isArray(questionParts) ? questionParts.join(" ") : String(questionParts);
   const commandName = command.parent?.args?.[0] === "agent" ? "agent" : "ask";
   const selectedMode = commandName === "agent" ? "agent" : "ask";
-  const { assertSecureBaseUrl } = await import("./dist-PEYJDO7A.js");
+  const { assertSecureBaseUrl } = await import("./dist-V2L4CPTU.js");
   const baseUrl = await resolveBaseUrl(options, command);
   assertSecureBaseUrl(baseUrl);
   const selectedProfile = getActiveConfigProfile(command);
@@ -15945,7 +16742,7 @@ program.command("ask").alias("agent").description("Ask a single question or run
     const fs14 = await import("fs");
     const fsPromises = await import("fs/promises");
     const { randomUUID: randomUUID5 } = await import("crypto");
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-V2L4CPTU.js");
     const {
       streamChat,
       reduceChunk,
@@ -16001,7 +16798,7 @@ program.command("ask").alias("agent").description("Ask a single question or run
             console.error("Authentication required. Starting login process...\n");
           }
           try {
-            const { login } = await import("./dist-PEYJDO7A.js");
+            const { login } = await import("./dist-V2L4CPTU.js");
             verboseLog("Calling interactive login", { baseUrl });
             token = await login(baseUrl, {
               headless: isHeadlessEnvironment()
@@ -16065,7 +16862,7 @@ program.command("ask").alias("agent").description("Ask a single question or run
         message: error.message
       });
     }
-    const { resolveAskProject } = await import("./resolveAskProject-DQJXPS5G.js");
+    const { resolveAskProject } = await import("./resolveAskProject-FUNKDV4V.js");
     let project;
     try {
       project = await resolveAskProject({
@@ -16583,7 +17380,7 @@ Error: ${errorMsg}
 program.command("banner").description("Preview the startup banner and terminal capabilities").action(async () => {
   const { render } = await import("ink");
   const BannerPreview = React.lazy(async () => ({
-    default: (await import("./Banner-HGG5NHXF.js")).Banner
+    default: (await import("./Banner-774ZEOGC.js")).Banner
   }));
   render(
     /* @__PURE__ */ jsx(React.Suspense, { fallback: null, children: /* @__PURE__ */ jsx(BannerPreview, { disable: false }) })