@ganakailabs/cloudeval-cli 0.28.1 → 0.29.1

package/dist/cli.js

@@ -24,7 +24,7 @@ import {
   searchSessions,
   unsetCliConfigValue,
   writeCliConfigValue
-} from "./chunk-QSBGUI25.js";
+} from "./chunk-CS4NE336.js";
 import {
   clearActiveCLITraceContext,
   createCLITraceContext,
@@ -36,10 +36,10 @@ import {
   redactSensitiveSecrets,
   redactSensitiveText,
   setActiveCLITraceContext
-} from "./chunk-USSCB2ZU.js";
+} from "./chunk-ERGQHMNT.js";
 import {
   CLI_VERSION
-} from "./chunk-XDMPAWK2.js";
+} from "./chunk-AO4LJZTG.js";
 
 // src/runtime/prepareInk.ts
 import fs from "fs";
@@ -681,6 +681,33 @@ var cliCommands = [
     ],
     workflows: ["connections list", "connections get", "connections open"]
   },
+  {
+    name: "actions",
+    description: "Cross-project action center inventory",
+    domain: "reports",
+    options: [
+      "list",
+      "get",
+      "open",
+      "--project",
+      "--type",
+      "--severity",
+      "--pillar",
+      "--category",
+      "--resource-type",
+      "--q",
+      "--min-monthly-savings",
+      "--sort",
+      "--limit",
+      "--offset",
+      "--allow-full-scan",
+      ...outputOptions,
+      ...authOptions,
+      "--profile",
+      "--help"
+    ],
+    workflows: ["actions list", "actions get", "actions open"]
+  },
   {
     name: "billing",
     description: "Billing and usage utilities",
@@ -1653,7 +1680,7 @@ var resolveReportProjectId = async ({
   if (!token) {
     throw new Error("No project specified. Use --project <id> for report access.");
   }
-  const resolvedWorkspace = workspace ?? await import("./dist-PEYJDO7A.js").then((core) => ({
+  const resolvedWorkspace = workspace ?? await import("./dist-QYIPN7MD.js").then((core) => ({
     checkUserStatus: core.checkUserStatus,
     getProjects: core.getProjects
   }));
@@ -1682,7 +1709,7 @@ var warnIfAccessKeyFromCliOption = (options, command) => {
 };
 var resolveAuthContext = async (options, command, deps) => {
   const baseUrl = await deps.resolveBaseUrl(options, command);
-  const core = await import("./dist-PEYJDO7A.js");
+  const core = await import("./dist-QYIPN7MD.js");
   core.assertSecureBaseUrl(baseUrl);
   warnIfAccessKeyFromCliOption(options, command);
   let accessKey = options.accessKey;
@@ -1768,7 +1795,7 @@ var resolveToken = async (options, baseUrl, deps, command) => {
   if (options.accessKey) {
     return options.accessKey;
   }
-  const { getAuthToken } = await import("./dist-PEYJDO7A.js");
+  const { getAuthToken } = await import("./dist-QYIPN7MD.js");
   try {
     return await getAuthToken({
       accessKey: options.accessKey,
@@ -1779,7 +1806,7 @@ var resolveToken = async (options, baseUrl, deps, command) => {
     if (!canLogin) {
       throw error;
     }
-    const { login } = await import("./dist-PEYJDO7A.js");
+    const { login } = await import("./dist-QYIPN7MD.js");
     process.stderr.write("Authentication required. Starting login flow...\n");
     const token = await login(baseUrl, {
       headless: Boolean(process.env.SSH_TTY || process.env.CLOUDEVAL_HEADLESS_LOGIN)
@@ -1945,7 +1972,7 @@ var registerReportsCommand = (program2, deps) => {
         token,
         requestedProjectId: options.project
       });
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
       const reports2 = await core.listReports({
         baseUrl,
@@ -1967,7 +1994,7 @@ var registerReportsCommand = (program2, deps) => {
     try {
       const baseUrl = await deps.resolveBaseUrl(options, command);
       const token = await resolveToken(options, baseUrl, deps, command);
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
       const projectId = await resolveReportProjectId({
         baseUrl,
@@ -2070,7 +2097,7 @@ var registerReportsCommand = (program2, deps) => {
       try {
         const baseUrl = await deps.resolveBaseUrl(options, command);
         const token = await resolveToken(options, baseUrl, deps, command);
-        const core = await import("./dist-PEYJDO7A.js");
+        const core = await import("./dist-QYIPN7MD.js");
         const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
         const projectId = await resolveReportProjectId({
           baseUrl,
@@ -2140,7 +2167,7 @@ var registerReportsCommand = (program2, deps) => {
         token,
         requestedProjectId: options.project
       });
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
       const report = await core.getWafReport({
         baseUrl,
@@ -2179,7 +2206,7 @@ var registerReportsCommand = (program2, deps) => {
         token,
         requestedProjectId: options.project
       });
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
       const report = await core.getReport({
         baseUrl,
@@ -2207,7 +2234,7 @@ var registerReportsCommand = (program2, deps) => {
         token,
         requestedProjectId: options.project
       });
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
       const report = await core.getCostReport({
         baseUrl,
@@ -2236,7 +2263,7 @@ var registerReportsCommand = (program2, deps) => {
           token,
           requestedProjectId: options.project
         });
-        const core = await import("./dist-PEYJDO7A.js");
+        const core = await import("./dist-QYIPN7MD.js");
         const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
         const report = await core.getWafReport({
           baseUrl,
@@ -2271,14 +2298,14 @@ var responseErrorMessage = async (response) => {
     const payload = JSON.parse(text);
     const detail = payload?.detail ?? payload?.message ?? payload?.error;
     if (typeof detail === "string") {
-      return detail;
+      return redactSensitiveText(detail);
     }
     if (detail) {
-      return JSON.stringify(detail);
+      return redactSensitiveText(JSON.stringify(detail));
     }
   } catch {
   }
-  return text;
+  return redactSensitiveText(text);
 };
 var fetchCloudEvalJson = async ({
   baseUrl,
@@ -5217,7 +5244,7 @@ var runChatRecipe = async (recipe, prompt2, options, command, deps) => {
   });
   progressWriter.write({ type: "auth", step: "auth", message: "Resolving authentication" });
   const context = await resolveAuthContext(options, command, deps);
-  const core = await import("./dist-PEYJDO7A.js");
+  const core = await import("./dist-QYIPN7MD.js");
   progressWriter.write({
     type: "request",
     step: "project",
@@ -5938,6 +5965,36 @@ var registerOpenCommand = (program2, deps) => {
     });
     await emitOrOpen(url, options);
   });
+  addOpenOptions(
+    open.command("issues").description("Open issues inventory"),
+    deps.defaultBaseUrl
+  ).option("--project <id>", "Project id").option("--type <types>", "Item types").option("--severity <levels>", "Severity filters").option("--q <query>", "Search query").option("--sort <sort>", "Sort order").action(async (options, command) => {
+    const url = buildFrontendUrl({
+      baseUrl: await base(options, command, deps),
+      target: "issues",
+      projectId: options.project,
+      type: options.type,
+      severity: options.severity,
+      q: options.q,
+      sort: options.sort
+    });
+    await emitOrOpen(url, options);
+  });
+  addOpenOptions(
+    open.command("action-center").description("Open issues inventory (alias)"),
+    deps.defaultBaseUrl
+  ).option("--project <id>", "Project id").option("--type <types>", "Item types").option("--severity <levels>", "Severity filters").option("--q <query>", "Search query").option("--sort <sort>", "Sort order").action(async (options, command) => {
+    const url = buildFrontendUrl({
+      baseUrl: await base(options, command, deps),
+      target: "issues",
+      projectId: options.project,
+      type: options.type,
+      severity: options.severity,
+      q: options.q,
+      sort: options.sort
+    });
+    await emitOrOpen(url, options);
+  });
   addOpenOptions(
     open.command("billing").description("Open billing"),
     deps.defaultBaseUrl
@@ -6287,6 +6344,28 @@ var fileBlob = async (filePath) => {
   };
 };
 var normalizeWorkspacePath = (value) => value.replace(/\\/g, "/").replace(/^\/+/, "").replace(/^\.\//, "").split("/").filter((part) => part && part !== ".").join("/");
+var SENSITIVE_WORKSPACE_DIR_NAMES = /* @__PURE__ */ new Set([
+  ".aws",
+  ".azure",
+  ".kube",
+  ".terraform"
+]);
+var SENSITIVE_WORKSPACE_FILENAMES = /* @__PURE__ */ new Set([
+  ".env",
+  "credentials",
+  "id_rsa",
+  "id_ed25519",
+  "kubeconfig"
+]);
+var isSensitiveWorkspacePath = (relativePath) => {
+  const normalized = normalizeWorkspacePath(relativePath);
+  const parts = normalized.split("/");
+  if (parts.some((part) => SENSITIVE_WORKSPACE_DIR_NAMES.has(part))) {
+    return true;
+  }
+  const basename = parts.at(-1) ?? "";
+  return SENSITIVE_WORKSPACE_FILENAMES.has(basename) || /^\.env\./i.test(basename) || /\.(?:pem|key|pfx|p12)$/i.test(basename) || /\.tfstate(?:\..*)?$/i.test(basename);
+};
 var isIgnoredWorkspacePath = (relativePath) => {
   const normalized = normalizeWorkspacePath(relativePath);
   return normalized === ".DS_Store" || normalized.endsWith("/.DS_Store") || normalized.startsWith(".git/") || normalized.startsWith("node_modules/") || normalized.startsWith(".cloudeval/bundles/") || normalized.startsWith(".cloudeval/connections/") || normalized.startsWith(".cloudeval/reports/") || normalized.startsWith(".cloudeval/share/") || normalized.startsWith(".cloudeval/shares/") || normalized.startsWith(".cloudeval/snapshots/") || normalized.startsWith(".cloudeval/template-cache/") || normalized === ".cloudeval/ps-rule.yaml";
@@ -6398,14 +6477,14 @@ var compileBicepEntry = async (root, entry) => {
     await fs6.rm(tempDir, { recursive: true, force: true });
   }
 };
-var collectWorkspacePaths = async (root) => {
+var collectWorkspacePaths = async (root, allowedSensitivePaths = /* @__PURE__ */ new Set()) => {
   const paths = [];
   const visit = async (directory) => {
     const entries = await fs6.readdir(directory, { withFileTypes: true });
     for (const entry of entries) {
       const absolute = path4.join(directory, entry.name);
       const relative = normalizeWorkspacePath(path4.relative(root, absolute));
-      if (!relative || isIgnoredWorkspacePath(relative)) {
+      if (!relative || isIgnoredWorkspacePath(relative) || isSensitiveWorkspacePath(relative) && !allowedSensitivePaths.has(relative)) {
         continue;
       }
       if (entry.isDirectory()) {
@@ -6476,11 +6555,21 @@ var collectWorkspaceFiles = async (workspaceDir, options) => {
   if (!stat?.isDirectory()) {
     throw new Error(`--workspace-dir '${workspaceDir}' is not a directory.`);
   }
-  const paths = await collectWorkspacePaths(root);
+  const allowedSensitivePaths = new Set(
+    [options.workspaceEntry, options.workspaceParameters].filter((value) => Boolean(value)).map((value) => normalizeWorkspacePath(value))
+  );
+  const paths = await collectWorkspacePaths(root, allowedSensitivePaths);
   const existingConfigPath = paths.find(
     (filePath) => filePath.toLowerCase() === ".cloudeval/config.yaml"
   );
   const config = existingConfigPath ? readWorkspaceConfig(await fs6.readFile(path4.join(root, existingConfigPath), "utf8")) : void 0;
+  if (config?.parameters && isSensitiveWorkspacePath(config.parameters) && !paths.includes(config.parameters)) {
+    const parameterStat = await fs6.stat(path4.join(root, config.parameters)).catch(() => void 0);
+    if (parameterStat?.isFile()) {
+      paths.push(config.parameters);
+      paths.sort((left, right) => left.localeCompare(right));
+    }
+  }
   const entry = detectWorkspaceEntry(paths, options.workspaceEntry, config);
   const parameters = resolveWorkspaceParameters(paths, options.workspaceParameters, config);
   const compiledEntry = isBicepPath(entry) ? await compileBicepEntry(root, entry) : void 0;
@@ -6517,13 +6606,31 @@ var collectResourceGroups = (options) => {
   const commaSeparated = options.resourceGroups ? options.resourceGroups.split(",").map((value) => value.trim()) : [];
   return [...repeated, ...commaSeparated].map((value) => value.trim()).filter(Boolean);
 };
-var resolveAzureCloudSyncInput = (options) => {
+var readSecretFromStdin = async () => {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+  }
+  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+};
+var resolveAzureCloudSyncInput = async (options) => {
   if (!options.cloudSync) {
     return void 0;
   }
   const tenantId = options.azureTenantId || process.env.AZURE_TENANT_ID;
   const clientId = options.azureClientId || process.env.AZURE_CLIENT_ID;
-  const clientSecret = options.azureClientSecret || process.env.AZURE_CLIENT_SECRET;
+  if (options.azureClientSecret && options.azureClientSecretStdin) {
+    throw new Error("Use either --azure-client-secret or --azure-client-secret-stdin, not both.");
+  }
+  let clientSecret = process.env.AZURE_CLIENT_SECRET;
+  if (options.azureClientSecretStdin) {
+    clientSecret = await readSecretFromStdin();
+  } else if (options.azureClientSecret) {
+    process.stderr.write(
+      "Warning: --azure-client-secret can be exposed in shell history. Prefer AZURE_CLIENT_SECRET or --azure-client-secret-stdin.\n"
+    );
+    clientSecret = options.azureClientSecret;
+  }
   const subscriptionId = options.azureSubscriptionId || process.env.AZURE_SUBSCRIPTION_ID;
   const missing = [
     ["--azure-tenant-id or AZURE_TENANT_ID", tenantId],
@@ -6701,7 +6808,7 @@ var configureDiagramExportCommand = (command, deps) => addAuthOptions(command, d
       const context = requireAuthUser(
         await resolveAuthContext(options, actionCommand, deps)
       );
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       const projects = await core.getProjects(
         context.baseUrl,
         context.token,
@@ -6778,7 +6885,7 @@ var registerProjectsCommand = (program2, deps) => {
   addCommon(addAuthOptions(projects.command("list").description("List projects"), deps.defaultBaseUrl)).action(async (options, command) => {
     try {
       const context = await resolveAuthContext(options, command, deps);
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       const data = await listProjectsForContext(core, context);
       const url = buildFrontendUrl({ baseUrl: frontendBase(context, options), target: "projects" });
       await writeProjectListOutput({ data, options, frontendUrl: url });
@@ -6796,7 +6903,7 @@ var registerProjectsCommand = (program2, deps) => {
   ).action(async (id, options, command) => {
     try {
       const context = await resolveAuthContext(options, command, deps);
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       const list = await listProjectsForContext(core, context);
       const data = list.find((project) => project.id === id);
       if (!data) {
@@ -6857,15 +6964,19 @@ var registerProjectsCommand = (program2, deps) => {
     deps
   );
   configureGraphCommands(projects, deps);
-  addCommon(addAuthOptions(projects.command("create").description("Create a CloudEval project"), deps.defaultBaseUrl)).option("--template-url <url>", "Template URL").option("--template-file <path>", "Local JSON template file").option("--parameters-file <path>", "Local JSON parameters file").option("--parameters-url <url>", "Parameters file URL").option("--workspace-dir <path>", "Upload an Infrastructure as code folder").option("--workspace-entry <path>", "Workspace visualization entry file").option("--workspace-parameters <path>", "Workspace parameters file").option("--cloud-sync", "Create a Cloud sync project from Azure credentials", false).option("--azure-tenant-id <id>", "Azure tenant id for Cloud sync").option("--azure-client-id <id>", "Azure service principal client id for Cloud sync").option("--azure-client-secret <secret>", "Azure service principal client secret for Cloud sync").option("--azure-subscription-id <id>", "Azure subscription id for Cloud sync").option("--resource-group <name>", "Azure resource group scope for Cloud sync", appendOptionValue, []).option("--resource-groups <list>", "Comma-separated Azure resource group scopes for Cloud sync").option("--name <name>", "Project name").option("--description <text>", "Project description").option("--provider <provider>", "Cloud provider: azure, aws, gcp").action(async (options, command) => {
+  addCommon(addAuthOptions(projects.command("create").description("Create a CloudEval project"), deps.defaultBaseUrl)).option("--template-url <url>", "Template URL").option("--template-file <path>", "Local JSON template file").option("--parameters-file <path>", "Local JSON parameters file").option("--parameters-url <url>", "Parameters file URL").option("--workspace-dir <path>", "Upload an Infrastructure as code folder").option("--workspace-entry <path>", "Workspace visualization entry file").option("--workspace-parameters <path>", "Workspace parameters file").option("--cloud-sync", "Create a Cloud sync project from Azure credentials", false).option("--azure-tenant-id <id>", "Azure tenant id for Cloud sync").option("--azure-client-id <id>", "Azure service principal client id for Cloud sync").option("--azure-client-secret <secret>", "Azure service principal client secret for Cloud sync").option(
+    "--azure-client-secret-stdin",
+    "Read Azure service principal client secret for Cloud sync from stdin",
+    false
+  ).option("--azure-subscription-id <id>", "Azure subscription id for Cloud sync").option("--resource-group <name>", "Azure resource group scope for Cloud sync", appendOptionValue, []).option("--resource-groups <list>", "Comma-separated Azure resource group scopes for Cloud sync").option("--name <name>", "Project name").option("--description <text>", "Project description").option("--provider <provider>", "Cloud provider: azure, aws, gcp").action(async (options, command) => {
     try {
       assertSingleProjectSource(options);
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       const template = await fileBlob(options.templateFile);
       const parameters = await fileBlob(options.parametersFile);
       const workspace = options.workspaceDir ? await collectWorkspaceFiles(options.workspaceDir, options) : void 0;
-      const cloudSync = resolveAzureCloudSyncInput(options);
+      const cloudSync = await resolveAzureCloudSyncInput(options);
       const inferredName = options.name || (options.workspaceDir ? path4.basename(path4.resolve(options.workspaceDir)) : void 0) || (cloudSync ? "Cloud sync" : void 0) || (options.templateFile ? path4.basename(options.templateFile, path4.extname(options.templateFile)) : void 0);
       const result = await core.createQuickProject({
         baseUrl: context.baseUrl,
@@ -6912,7 +7023,7 @@ var registerProjectsCommand = (program2, deps) => {
   });
 };
 
-// src/connectionsCommand.ts
+// src/actionsCommand.ts
 var addCommon2 = (command) => command.option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--output <file>", "Output file").option("--open", "Open the matching frontend page", false).option("--print-url", "Print the matching frontend URL", false).option("--no-open", "Do not launch the browser when a URL is printed").option("--frontend-url <url>", "Frontend base URL");
 var frontendBase2 = (context, options) => resolveFrontendBaseUrl({
   frontendUrl: options.frontendUrl,
@@ -6927,6 +7038,13 @@ var maybeOpen2 = async (url, options) => {
     await openExternalUrl(url);
   }
 };
+var splitCsv = (value) => {
+  if (!value) {
+    return void 0;
+  }
+  const parts = value.split(",").map((entry) => entry.trim()).filter(Boolean);
+  return parts.length > 0 ? parts : void 0;
+};
 var scalar = (value, fallback = "-") => {
   if (value === null || value === void 0 || value === "") {
     return fallback;
@@ -6936,19 +7054,177 @@ var scalar = (value, fallback = "-") => {
   }
   return fallback;
 };
-var syncStatus = (connection) => scalar(
+var renderActionsListText = (payload) => {
+  const items = Array.isArray(payload.items) ? payload.items : [];
+  return formatTextTable(
+    items.map((item) => {
+      const record = item && typeof item === "object" && !Array.isArray(item) ? item : {};
+      return {
+        id: scalar(record.id),
+        type: scalar(record.type),
+        severity: scalar(record.severity),
+        project: scalar(record.project_name),
+        title: scalar(record.title),
+        resource: scalar(record.resource_name ?? record.resource_id),
+        savings: scalar(record.monthly_savings)
+      };
+    }),
+    [
+      { key: "id", header: "ID", width: 12 },
+      { key: "type", header: "Type", width: 12 },
+      { key: "severity", header: "Severity", width: 10 },
+      { key: "project", header: "Project", maxWidth: 18 },
+      { key: "title", header: "Title", maxWidth: 32 },
+      { key: "resource", header: "Resource", maxWidth: 20 },
+      { key: "savings", header: "Savings", width: 10 }
+    ],
+    { emptyMessage: "No issues inventory items found." }
+  );
+};
+var buildIssuesFrontendUrl = (context, options) => buildFrontendUrl({
+  baseUrl: frontendBase2(context, options),
+  target: "issues",
+  projectId: options.project,
+  severity: options.severity,
+  type: options.type,
+  q: options.q,
+  sort: options.sort
+});
+var registerIssuesInventoryCommand = (program2, deps) => {
+  const commandName = deps.commandName || "issues";
+  const commandDescription = deps.commandDescription || (commandName === "actions" ? "Cross-project action center inventory (deprecated; use issues)" : "Cross-project issues inventory");
+  const inventory = program2.command(commandName).description(commandDescription);
+  addCommon2(addAuthOptions(inventory.command("list").description("List issues inventory items"), deps.defaultBaseUrl)).option("--project <id>", "Filter by project id").option("--type <types>", "Filter by type: architecture,cost,unit-tests").option("--severity <levels>", "Filter by severity: critical,high,medium,low").option("--pillar <pillars>", "Filter by pillar").option("--category <categories>", "Filter by category").option("--resource-type <types>", "Filter by resource type").option("--q <query>", "Search query").option("--min-monthly-savings <amount>", "Minimum monthly savings for cost items").option("--sort <sort>", "Sort: priority, severity, savings, project", "priority").option("--limit <n>", "Page size (1-500)", "50").option("--offset <n>", "Page offset", "0").option("--allow-full-scan", "Allow scanning large portfolios without project filter", true).option("--no-allow-full-scan", "Require project scoping for large portfolios").action(async (options, command) => {
+    try {
+      const context = requireAuthUser(await resolveAuthContext(options, command, deps));
+      const core = await import("./dist-QYIPN7MD.js");
+      const data = await core.listIssuesItems({
+        baseUrl: context.baseUrl,
+        authToken: context.token,
+        userId: context.user.id,
+        projectIds: splitCsv(options.project),
+        types: splitCsv(options.type),
+        severities: splitCsv(options.severity),
+        pillars: splitCsv(options.pillar),
+        categories: splitCsv(options.category),
+        resourceTypes: splitCsv(options.resourceType),
+        q: options.q,
+        minMonthlySavings: options.minMonthlySavings !== void 0 ? Number(options.minMonthlySavings) : void 0,
+        sort: options.sort || "priority",
+        limit: Number(options.limit || 50),
+        offset: Number(options.offset || 0),
+        allowFullScan: options.allowFullScan !== false
+      });
+      const url = buildIssuesFrontendUrl(context, options);
+      const format = options.format ?? "text";
+      if (format === "text") {
+        const text = renderActionsListText(
+          data && typeof data === "object" ? data : {}
+        );
+        if (options.output) {
+          const fs14 = await import("fs/promises");
+          await fs14.writeFile(options.output, text, "utf8");
+        } else {
+          process.stdout.write(text);
+        }
+      } else {
+        await writeFormattedOutput({
+          command: `${commandName} list`,
+          data,
+          format,
+          output: options.output,
+          frontendUrl: url
+        });
+      }
+      await maybeOpen2(url, options);
+    } catch (error) {
+      console.error(`Failed to list issues inventory: ${error?.message ?? "Unknown error"}`);
+      process.exit(1);
+    }
+  });
+  addCommon2(addAuthOptions(inventory.command("get <item-id>").description("Get one issues inventory item"), deps.defaultBaseUrl)).option("--project <id>", "Optional project scope").option("--allow-full-scan", "Allow scanning large portfolios", true).option("--no-allow-full-scan", "Require project scoping for large portfolios").action(async (itemId, options, command) => {
+    try {
+      const context = requireAuthUser(await resolveAuthContext(options, command, deps));
+      const core = await import("./dist-QYIPN7MD.js");
+      const data = await core.getIssuesItem({
+        baseUrl: context.baseUrl,
+        authToken: context.token,
+        userId: context.user.id,
+        itemId,
+        projectIds: splitCsv(options.project),
+        allowFullScan: options.allowFullScan !== false
+      });
+      const payload = data && typeof data === "object" ? data : {};
+      const items = Array.isArray(payload.items) ? payload.items : [];
+      if (items.length === 0) {
+        console.error(`Issues item not found: ${itemId}`);
+        process.exit(5);
+      }
+      await writeFormattedOutput({
+        command: `${commandName} get`,
+        data: items[0],
+        format: options.format ?? "json",
+        output: options.output
+      });
+    } catch (error) {
+      console.error(`Failed to get issues item: ${error?.message ?? "Unknown error"}`);
+      process.exit(1);
+    }
+  });
+  addCommon2(addAuthOptions(inventory.command("open").description("Open the issues inventory in the browser"), deps.defaultBaseUrl)).option("--project <id>", "Filter by project id").option("--type <types>", "Filter by type").option("--severity <levels>", "Filter by severity").option("--q <query>", "Search query").option("--sort <sort>", "Sort order", "priority").action(async (options, command) => {
+    try {
+      const context = requireAuthUser(await resolveAuthContext(options, command, deps));
+      const url = buildIssuesFrontendUrl(context, options);
+      await maybeOpen2(url, { ...options, open: true, printUrl: true });
+    } catch (error) {
+      console.error(`Failed to open issues inventory: ${error?.message ?? "Unknown error"}`);
+      process.exit(1);
+    }
+  });
+};
+var registerActionsCommand = (program2, deps) => registerIssuesInventoryCommand(program2, {
+  ...deps,
+  commandName: "actions",
+  commandDescription: "Cross-project action center inventory (deprecated; use issues)"
+});
+
+// src/connectionsCommand.ts
+var addCommon3 = (command) => command.option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--output <file>", "Output file").option("--open", "Open the matching frontend page", false).option("--print-url", "Print the matching frontend URL", false).option("--no-open", "Do not launch the browser when a URL is printed").option("--frontend-url <url>", "Frontend base URL");
+var frontendBase3 = (context, options) => resolveFrontendBaseUrl({
+  frontendUrl: options.frontendUrl,
+  apiBaseUrl: context.baseUrl
+});
+var maybeOpen3 = async (url, options) => {
+  if (options.printUrl) {
+    process.stdout.write(`${url}
+`);
+  }
+  if (options.open !== false && (options.open || options.printUrl)) {
+    await openExternalUrl(url);
+  }
+};
+var scalar2 = (value, fallback = "-") => {
+  if (value === null || value === void 0 || value === "") {
+    return fallback;
+  }
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+    return String(value);
+  }
+  return fallback;
+};
+var syncStatus = (connection) => scalar2(
   connection.last_sync_status ?? connection.sync_status?.status ?? connection.status
 );
 var renderConnectionsListText = (connections) => formatTextTable(
   connections.map((connection) => {
     const record = connection && typeof connection === "object" && !Array.isArray(connection) ? connection : {};
     return {
-      id: scalar(record.id),
-      name: scalar(record.name),
-      provider: scalar(record.cloud_provider),
-      type: scalar(record.type),
+      id: scalar2(record.id),
+      name: scalar2(record.name),
+      provider: scalar2(record.cloud_provider),
+      type: scalar2(record.type),
       sync: syncStatus(record),
-      updated: scalar(record.last_synced ?? record.updated_at ?? record.created_at)
+      updated: scalar2(record.last_synced ?? record.updated_at ?? record.created_at)
     };
   }),
   [
@@ -6987,27 +7263,27 @@ var writeConnectionsListOutput = async ({
 };
 var registerConnectionsCommand = (program2, deps) => {
   const connections = program2.command("connections").description("Connection utilities");
-  addCommon2(addAuthOptions(connections.command("list").description("List connections"), deps.defaultBaseUrl)).action(async (options, command) => {
+  addCommon3(addAuthOptions(connections.command("list").description("List connections"), deps.defaultBaseUrl)).action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       const data = await core.listConnections({
         baseUrl: context.baseUrl,
         authToken: context.token,
         userId: context.user.id
       });
       const url = buildFrontendUrl({
-        baseUrl: frontendBase2(context, options),
+        baseUrl: frontendBase3(context, options),
         target: "connections"
       });
       await writeConnectionsListOutput({ data, options, frontendUrl: url });
-      await maybeOpen2(url, options);
+      await maybeOpen3(url, options);
     } catch (error) {
       console.error(`Failed to list connections: ${error?.message ?? "Unknown error"}`);
       process.exit(1);
     }
   });
-  addCommon2(
+  addCommon3(
     addAuthOptions(
       connections.command("get").description("Show a connection").argument("<id>", "Connection id"),
       deps.defaultBaseUrl
@@ -7015,7 +7291,7 @@ var registerConnectionsCommand = (program2, deps) => {
   ).action(async (id, options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       const data = await core.getConnection({
         baseUrl: context.baseUrl,
         authToken: context.token,
@@ -7026,7 +7302,7 @@ var registerConnectionsCommand = (program2, deps) => {
         throw new Error(`Connection ${id} was not found.`);
       }
       const url = buildFrontendUrl({
-        baseUrl: frontendBase2(context, options),
+        baseUrl: frontendBase3(context, options),
         target: "connection",
         connectionId: id
       });
@@ -7037,13 +7313,13 @@ var registerConnectionsCommand = (program2, deps) => {
         output: options.output,
         frontendUrl: url
       });
-      await maybeOpen2(url, options);
+      await maybeOpen3(url, options);
     } catch (error) {
       console.error(`Failed to show connection: ${error?.message ?? "Unknown error"}`);
       process.exit(1);
     }
   });
-  addCommon2(
+  addCommon3(
     addAuthOptions(
       connections.command("open").description("Open a connection").argument("<id>", "Connection id"),
       deps.defaultBaseUrl
@@ -7052,7 +7328,7 @@ var registerConnectionsCommand = (program2, deps) => {
     try {
       const context = await resolveAuthContext(options, command, deps);
       const url = buildFrontendUrl({
-        baseUrl: frontendBase2(context, options),
+        baseUrl: frontendBase3(context, options),
         target: "connection",
         connectionId: id
       });
@@ -7063,7 +7339,7 @@ var registerConnectionsCommand = (program2, deps) => {
         output: options.output,
         frontendUrl: url
       });
-      await maybeOpen2(url, { ...options, open: options.open || true });
+      await maybeOpen3(url, { ...options, open: options.open || true });
     } catch (error) {
       console.error(`Failed to open connection: ${error?.message ?? "Unknown error"}`);
       process.exit(1);
@@ -7072,7 +7348,7 @@ var registerConnectionsCommand = (program2, deps) => {
 };
 
 // src/billingCommand.ts
-var addCommon3 = (command) => command.option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--output <file>", "Output file").option("--open", "Open the matching frontend page", false).option("--print-url", "Print the matching frontend URL", false).option("--no-open", "Do not launch the browser when a URL is printed").option("--frontend-url <url>", "Frontend base URL");
+var addCommon4 = (command) => command.option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--output <file>", "Output file").option("--open", "Open the matching frontend page", false).option("--print-url", "Print the matching frontend URL", false).option("--no-open", "Do not launch the browser when a URL is printed").option("--frontend-url <url>", "Frontend base URL");
 var billingUrl = (context, options) => buildFrontendUrl({
   baseUrl: resolveFrontendBaseUrl({
     frontendUrl: options.frontendUrl,
@@ -7081,7 +7357,7 @@ var billingUrl = (context, options) => buildFrontendUrl({
   target: "billing",
   tab: options.tab
 });
-var maybeOpen3 = async (url, options) => {
+var maybeOpen4 = async (url, options) => {
   if (options.printUrl) {
     const isMachineReadable = options.format === "json" || options.format === "ndjson";
     (isMachineReadable ? process.stderr : process.stdout).write(`${url}
@@ -7305,8 +7581,7 @@ var write = async (command, data, options, frontendUrl) => {
     const text = renderBillingText(command, data);
     if (text) {
       if (options.output) {
-        const fs14 = await import("fs/promises");
-        await fs14.writeFile(options.output, text, "utf8");
+        await writePrivateOutputFile(options.output, text);
         return;
       }
       process.stdout.write(text);
@@ -7353,7 +7628,7 @@ var checkoutReturnUrl = (context, options) => options.returnTo || billingUrl(con
 var runTopUpCheckout = async (commandName, packId, options, command, deps) => {
   try {
     const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-QYIPN7MD.js");
     const returnTo = checkoutReturnUrl(context, options);
     const session = await core.createTopUpCheckoutSession({
       baseUrl: context.baseUrl,
@@ -7378,14 +7653,14 @@ var runTopUpCheckout = async (commandName, packId, options, command, deps) => {
       checkoutUrl
     );
     if (checkoutUrl) {
-      await maybeOpen3(checkoutUrl, options);
+      await maybeOpen4(checkoutUrl, options);
     }
   } catch (error) {
     failBillingCommand(commandName, "Failed to start top-up checkout", error, options);
   }
 };
 var registerBillingCommands = (program2, deps) => {
-  addCommon3(
+  addCommon4(
     addAuthOptions(
       program2.command("credits").description("Show current credit stats"),
       deps.defaultBaseUrl
@@ -7393,7 +7668,7 @@ var registerBillingCommands = (program2, deps) => {
   ).action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       const range = rangeToDates("30d");
       const [entitlement, usageSummary] = await Promise.all([
         core.getBillingEntitlement({
@@ -7414,16 +7689,16 @@ var registerBillingCommands = (program2, deps) => {
       });
       const url = billingUrl(context, { ...options, tab: "usage" });
       await write("credits", { status, entitlement, usageCreditsUsed }, options, url);
-      await maybeOpen3(url, options);
+      await maybeOpen4(url, options);
     } catch (error) {
       failBillingCommand("credits", "Failed to show credits", error, options);
     }
   });
   const billing = program2.command("billing").description("Billing and usage utilities");
-  addCommon3(addAuthOptions(billing.command("summary").description("Show billing summary"), deps.defaultBaseUrl)).action(async (options, command) => {
+  addCommon4(addAuthOptions(billing.command("summary").description("Show billing summary"), deps.defaultBaseUrl)).action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       const range = rangeToDates("30d");
       const [entitlement, subscriptionStatus, usageSummary] = await Promise.all([
         core.getBillingEntitlement({ baseUrl: context.baseUrl, authToken: context.token }),
@@ -7451,27 +7726,27 @@ var registerBillingCommands = (program2, deps) => {
         options,
         url
       );
-      await maybeOpen3(url, options);
+      await maybeOpen4(url, options);
     } catch (error) {
       failBillingCommand("billing summary", "Failed to show billing summary", error, options);
     }
   });
-  addCommon3(addAuthOptions(billing.command("plans").description("Show billing plans"), deps.defaultBaseUrl)).action(async (options, command) => {
+  addCommon4(addAuthOptions(billing.command("plans").description("Show billing plans"), deps.defaultBaseUrl)).action(async (options, command) => {
     try {
       const context = await resolveAuthContext(options, command, deps);
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       const data = await core.getBillingConfig({ baseUrl: context.baseUrl, authToken: context.token });
       const url = billingUrl(context, { ...options, tab: "plans" });
       await write("billing plans", data, options, url);
-      await maybeOpen3(url, options);
+      await maybeOpen4(url, options);
     } catch (error) {
       failBillingCommand("billing plans", "Failed to show billing plans", error, options);
     }
   });
-  addCommon3(addAuthOptions(billing.command("usage").description("Show billing usage summary"), deps.defaultBaseUrl)).option("--range <range>", "Usage range: 7d, 30d, 90d, all", "30d").option("--start-at <iso>", "Start timestamp").option("--end-at <iso>", "End timestamp").option("--granularity <value>", "Granularity: hour, day, month", "day").option("--action-type <type>", "Action type filter").option("--model <name>", "Model filter").option("--outcome <outcome>", "Outcome filter").option("--charge-status <status>", "Charge status filter").action(async (options, command) => {
+  addCommon4(addAuthOptions(billing.command("usage").description("Show billing usage summary"), deps.defaultBaseUrl)).option("--range <range>", "Usage range: 7d, 30d, 90d, all", "30d").option("--start-at <iso>", "Start timestamp").option("--end-at <iso>", "End timestamp").option("--granularity <value>", "Granularity: hour, day, month", "day").option("--action-type <type>", "Action type filter").option("--model <name>", "Model filter").option("--outcome <outcome>", "Outcome filter").option("--charge-status <status>", "Charge status filter").action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       const range = rangeToDates(options.range);
       const data = await core.getBillingUsageSummary({
         baseUrl: context.baseUrl,
@@ -7486,15 +7761,15 @@ var registerBillingCommands = (program2, deps) => {
       });
       const url = billingUrl(context, { ...options, tab: "usage" });
       await write("billing usage", data, options, url);
-      await maybeOpen3(url, options);
+      await maybeOpen4(url, options);
     } catch (error) {
       failBillingCommand("billing usage", "Failed to show billing usage", error, options);
     }
   });
-  addCommon3(addAuthOptions(billing.command("ledger").description("Show billing ledger"), deps.defaultBaseUrl)).option("--range <range>", "Usage range: 7d, 30d, 90d, all", "30d").option("--start-at <iso>", "Start timestamp").option("--end-at <iso>", "End timestamp").option("--action-type <type>", "Action type filter").option("--model <name>", "Model filter").option("--outcome <outcome>", "Outcome filter").option("--charge-status <status>", "Charge status filter").option("--limit <n>", "Page size", "25").option("--cursor <cursor>", "Pagination cursor").action(async (options, command) => {
+  addCommon4(addAuthOptions(billing.command("ledger").description("Show billing ledger"), deps.defaultBaseUrl)).option("--range <range>", "Usage range: 7d, 30d, 90d, all", "30d").option("--start-at <iso>", "Start timestamp").option("--end-at <iso>", "End timestamp").option("--action-type <type>", "Action type filter").option("--model <name>", "Model filter").option("--outcome <outcome>", "Outcome filter").option("--charge-status <status>", "Charge status filter").option("--limit <n>", "Page size", "25").option("--cursor <cursor>", "Pagination cursor").action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       const range = rangeToDates(options.range);
       const data = await core.getBillingUsageLedger({
         baseUrl: context.baseUrl,
@@ -7510,7 +7785,7 @@ var registerBillingCommands = (program2, deps) => {
       });
       const url = billingUrl(context, { ...options, tab: "usage" });
       await write("billing ledger", data, options, url);
-      await maybeOpen3(url, options);
+      await maybeOpen4(url, options);
     } catch (error) {
       failBillingCommand("billing ledger", "Failed to show billing ledger", error, options);
     }
@@ -7519,10 +7794,10 @@ var registerBillingCommands = (program2, deps) => {
     ["invoices", "getSubscriptionBillingInfo", "billing"],
     ["notifications", "getBillingNotifications", "billing"]
   ]) {
-    addCommon3(addAuthOptions(billing.command(name).description(`Show billing ${name}`), deps.defaultBaseUrl)).option("--limit <n>", "Result limit", "25").action(async (options, command) => {
+    addCommon4(addAuthOptions(billing.command(name).description(`Show billing ${name}`), deps.defaultBaseUrl)).option("--limit <n>", "Result limit", "25").action(async (options, command) => {
       try {
         const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-        const core = await import("./dist-PEYJDO7A.js");
+        const core = await import("./dist-QYIPN7MD.js");
         const data = await core[getter]({
           baseUrl: context.baseUrl,
           authToken: context.token,
@@ -7530,30 +7805,30 @@ var registerBillingCommands = (program2, deps) => {
         });
         const url = billingUrl(context, { ...options, tab });
         await write(`billing ${name}`, data, options, url);
-        await maybeOpen3(url, options);
+        await maybeOpen4(url, options);
       } catch (error) {
         failBillingCommand(`billing ${name}`, `Failed to show billing ${name}`, error, options);
       }
     });
   }
   const topups = billing.command("topups").description("Show billing top-ups");
-  addCommon3(addAuthOptions(topups, deps.defaultBaseUrl)).option("--limit <n>", "Result limit", "25").action(async (options, command) => {
+  addCommon4(addAuthOptions(topups, deps.defaultBaseUrl)).option("--limit <n>", "Result limit", "25").action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       const data = await core.getTopUpPacks({
         baseUrl: context.baseUrl,
         authToken: context.token
       });
       const url = billingUrl(context, { ...options, tab: "billing" });
       await write("billing topups", data, options, url);
-      await maybeOpen3(url, options);
+      await maybeOpen4(url, options);
     } catch (error) {
       failBillingCommand("billing topups", "Failed to show billing topups", error, options);
     }
   });
   addTopUpCheckoutOptions(
-    addCommon3(
+    addCommon4(
       addAuthOptions(
         topups.command("buy <pack-id>").description("Buy a credit top-up pack"),
         deps.defaultBaseUrl
@@ -7563,7 +7838,7 @@ var registerBillingCommands = (program2, deps) => {
     (packId, options, command) => runTopUpCheckout("billing topups buy", packId, options, command, deps)
   );
   addTopUpCheckoutOptions(
-    addCommon3(
+    addCommon4(
       addAuthOptions(
         billing.command("topup <pack-id>").description("Buy a credit top-up pack"),
         deps.defaultBaseUrl
@@ -7600,7 +7875,7 @@ var normalizeMcpSetupClient = (value) => {
   throw new Error(`MCP setup client must be one of: ${MCP_SETUP_CLIENTS.join(", ")}.`);
 };
 var normalizeMcpSetupToolset = (value) => {
-  const normalized = (value ?? "all").toLowerCase();
+  const normalized = (value ?? "readonly").toLowerCase();
   if (TOOLSETS.has(normalized)) {
     return normalized;
   }
@@ -7639,7 +7914,7 @@ var writtenSetupNextStep = (client) => client === "claude" ? "Restart Claude Des
 var buildMcpClientSetup = ({
   client,
   command = "cloudeval",
-  toolset = "all",
+  toolset = "readonly",
   configPath
 }) => {
   const normalizedClient = normalizeMcpSetupClient(client);
@@ -10332,7 +10607,7 @@ var MCP_TOOLSETS = {
 };
 var MCP_TOOLSET_NAMES = Object.keys(MCP_TOOLSETS);
 var normalizeMcpToolset = (value) => {
-  const normalized = (value ?? "all").toLowerCase();
+  const normalized = (value ?? "readonly").toLowerCase();
   if (MCP_TOOLSET_NAMES.includes(normalized)) {
     return normalized;
   }
@@ -10580,12 +10855,12 @@ var resolveInvocationConfig = async (serverOptions, args) => {
     accessKey: serverOptions.accessKey
   };
 };
-var frontendBase3 = (config) => resolveFrontendBaseUrl({
+var frontendBase4 = (config) => resolveFrontendBaseUrl({
   frontendUrl: config.frontendUrl,
   apiBaseUrl: config.baseUrl
 });
 var reportsFrontendUrl = (config, input) => buildFrontendUrl({
-  baseUrl: frontendBase3(config),
+  baseUrl: frontendBase4(config),
   target: "reports",
   projectId: input.projectId,
   tab: input.tab ?? (input.type === "cost" ? "cost" : input.type === "waf" || input.type === "architecture" ? "architecture" : "overview"),
@@ -10595,7 +10870,7 @@ var reportsFrontendUrl = (config, input) => buildFrontendUrl({
   reportVerbosity: input.reportVerbosity
 });
 var resolveAuth = async (config, options = {}) => {
-  const core = await import("./dist-PEYJDO7A.js");
+  const core = await import("./dist-QYIPN7MD.js");
   core.assertSecureBaseUrl(config.baseUrl);
   let token;
   try {
@@ -10691,7 +10966,7 @@ var assertModelAvailable = async (config, token) => {
   if (!config.model) {
     return;
   }
-  const core = await import("./dist-PEYJDO7A.js");
+  const core = await import("./dist-QYIPN7MD.js");
   try {
     const response = await fetch(
       `${core.normalizeApiBase(config.baseUrl)}/models`,
@@ -10948,7 +11223,7 @@ var buildToolHandlers = (serverOptions) => {
   });
   handlers.set("agent_profiles_list", async (args) => {
     const config = await resolveInvocationConfig(serverOptions, args);
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-QYIPN7MD.js");
     const data = await listProfilesForDiscovery(core, config.baseUrl);
     return withEnvelope({
       command: "agents list",
@@ -10961,7 +11236,7 @@ var buildToolHandlers = (serverOptions) => {
       throw new Error("profileId is required.");
     }
     const config = await resolveInvocationConfig(serverOptions, args);
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-QYIPN7MD.js");
     const data = await getProfileForDiscovery(core, config.baseUrl, profileId);
     return withEnvelope({
       command: "agents show",
@@ -11025,7 +11300,7 @@ var buildToolHandlers = (serverOptions) => {
     }
     const finalMessage = [...chatState.messages].reverse().find((message) => message.role === "assistant");
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "chat",
       threadId
     });
@@ -11050,7 +11325,7 @@ var buildToolHandlers = (serverOptions) => {
       auth.user.id
     );
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "projects"
     });
     return withEnvelope({
@@ -11076,7 +11351,7 @@ var buildToolHandlers = (serverOptions) => {
       throw new Error(`Project ${projectId} was not found.`);
     }
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "project",
       projectId
     });
@@ -11095,7 +11370,7 @@ var buildToolHandlers = (serverOptions) => {
       userId: auth.user.id
     });
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "connections"
     });
     return withEnvelope({
@@ -11121,7 +11396,7 @@ var buildToolHandlers = (serverOptions) => {
       throw new Error(`Connection ${connectionId} was not found.`);
     }
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "connection",
       connectionId
     });
@@ -11466,7 +11741,7 @@ var buildToolHandlers = (serverOptions) => {
       finalMessage?.content || responseText || ""
     );
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "chat",
       threadId: chatState.threadId
     });
@@ -11607,7 +11882,7 @@ var buildToolHandlers = (serverOptions) => {
   });
   handlers.set("auth_status", async (args) => {
     const config = await resolveInvocationConfig(serverOptions, args);
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-QYIPN7MD.js");
     const data = await core.getAuthStatus(config.baseUrl, { validate: true });
     return withEnvelope({
       command: "auth status",
@@ -11616,7 +11891,7 @@ var buildToolHandlers = (serverOptions) => {
   });
   handlers.set("status", async (args) => {
     const config = await resolveInvocationConfig(serverOptions, args);
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-QYIPN7MD.js");
     const auth = await core.getAuthStatus(config.baseUrl, { validate: true });
     return withEnvelope({
       command: "status",
@@ -11647,7 +11922,7 @@ var buildToolHandlers = (serverOptions) => {
       }
     ];
     try {
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       core.assertSecureBaseUrl(config.baseUrl);
       checks.push({
         id: "base-url-secure",
@@ -12080,7 +12355,7 @@ var buildToolHandlers = (serverOptions) => {
       }).catch(() => null)
     ]);
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "billing",
       tab: "plans"
     });
@@ -12118,7 +12393,7 @@ var buildToolHandlers = (serverOptions) => {
       chargeStatus: stringValue(args.chargeStatus)
     });
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "billing",
       tab: "usage"
     });
@@ -12148,7 +12423,7 @@ var buildToolHandlers = (serverOptions) => {
       cursor: stringValue(args.cursor)
     });
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "billing",
       tab: "usage"
     });
@@ -12167,13 +12442,13 @@ var buildToolHandlers = (serverOptions) => {
     } catch {
       token = config.accessKey;
     }
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-QYIPN7MD.js");
     const data = await core.getBillingConfig({
       baseUrl: config.baseUrl,
       authToken: token
     });
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "billing",
       tab: "plans"
     });
@@ -12191,7 +12466,7 @@ var buildToolHandlers = (serverOptions) => {
       authToken: auth.token
     });
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "billing",
       tab: "billing"
     });
@@ -12210,7 +12485,7 @@ var buildToolHandlers = (serverOptions) => {
       limit: boundedLimit(args.limit, 25, 50)
     });
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "billing",
       tab: "billing"
     });
@@ -12229,7 +12504,7 @@ var buildToolHandlers = (serverOptions) => {
       limit: boundedLimit(args.limit, 25, 100)
     });
     const frontendUrl = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "billing",
       tab: "billing"
     });
@@ -12247,7 +12522,7 @@ var buildToolHandlers = (serverOptions) => {
     const config = await resolveInvocationConfig(serverOptions, args);
     const auth = await resolveAuth(config, { requireUser: true });
     const returnTo = stringValue(args.returnTo) ?? buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target: "billing",
       tab: "billing"
     });
@@ -12278,7 +12553,7 @@ var buildToolHandlers = (serverOptions) => {
     }
     const config = await resolveInvocationConfig(serverOptions, args);
     const url = buildFrontendUrl({
-      baseUrl: frontendBase3(config),
+      baseUrl: frontendBase4(config),
       target,
       threadId: stringValue(args.threadId),
       projectId: stringValue(args.projectId),
@@ -12914,7 +13189,7 @@ var registerMcpCommand = (program2, deps) => {
   ).option(
     "--toolset <name>",
     "Toolset to expose: all, readonly, projects, reports, billing",
-    "all"
+    "readonly"
   ).option("--config-path <path>", "Override MCP client config path").option(
     "--format <format>",
     "Output format: text, json, ndjson, markdown",
@@ -12963,7 +13238,7 @@ var registerMcpCommand = (program2, deps) => {
   ).option(
     "--toolset <name>",
     `Expose a focused MCP toolset: ${MCP_TOOLSET_NAMES.join(", ")}`,
-    "all"
+    "readonly"
   ).option(
     "-v, --verbose",
     "Write detailed MCP server diagnostics to stderr",
@@ -13063,7 +13338,7 @@ var registerCapabilitiesCommand = (program2, deps) => {
     warnIfAccessKeyFromCliOption(options, command);
     let data = capabilities;
     if (options.live) {
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       const baseUrl = await deps.resolveBaseUrl(options, command);
       const accessKey = options.accessKeyStdin ? await deps.readStdinValue() : options.accessKey;
       const token = await core.getAuthToken({ accessKey, baseUrl });
@@ -13196,19 +13471,19 @@ var writeCredentialOutput = async (input) => {
     data: input.data,
     format: input.format,
     output: input.output,
-    redactSensitiveSecrets: input.command !== "credentials create"
+    redactSensitiveSecrets: !(input.command === "credentials create" && input.showSecret === true)
   });
 };
 var resolveCoreAuth = async (options, command, deps) => {
   const context = await resolveAuthContext(options, command, deps);
-  const core = await import("./dist-PEYJDO7A.js");
+  const core = await import("./dist-QYIPN7MD.js");
   return { ...context, core };
 };
 var parseCapabilities = (value) => value?.split(",").map((item) => item.trim()).filter(Boolean);
-var addCommon4 = (command, deps) => addAuthOptions(command, deps.defaultBaseUrl).option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--output <file>", "Output file");
+var addCommon5 = (command, deps) => addAuthOptions(command, deps.defaultBaseUrl).option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--output <file>", "Output file");
 var registerCredentialsCommand = (program2, deps) => {
   const credentials = program2.command("credentials").description("Manage CloudEval access-key credentials");
-  addCommon4(credentials.command("templates").description("List credential templates"), deps).action(async (options, command) => {
+  addCommon5(credentials.command("templates").description("List credential templates"), deps).action(async (options, command) => {
     const auth = await resolveCoreAuth(options, command, deps);
     const data = await auth.core.getCredentialTemplates({
       baseUrl: auth.baseUrl,
@@ -13221,7 +13496,7 @@ var registerCredentialsCommand = (program2, deps) => {
       output: options.output
     });
   });
-  addCommon4(credentials.command("list").description("List credentials"), deps).option("--project <id>", "Filter by project id").action(async (options, command) => {
+  addCommon5(credentials.command("list").description("List credentials"), deps).option("--project <id>", "Filter by project id").action(async (options, command) => {
     const auth = await resolveCoreAuth(options, command, deps);
     const data = await auth.core.listCredentials({
       baseUrl: auth.baseUrl,
@@ -13235,7 +13510,7 @@ var registerCredentialsCommand = (program2, deps) => {
       output: options.output
     });
   });
-  addCommon4(credentials.command("inspect").description("Inspect a credential").argument("<credential_id>"), deps).action(async (credentialId, options, command) => {
+  addCommon5(credentials.command("inspect").description("Inspect a credential").argument("<credential_id>"), deps).action(async (credentialId, options, command) => {
     const auth = await resolveCoreAuth(options, command, deps);
     const data = await auth.core.getCredential({
       baseUrl: auth.baseUrl,
@@ -13249,7 +13524,11 @@ var registerCredentialsCommand = (program2, deps) => {
       output: options.output
     });
   });
-  addAuthOptions(credentials.command("create").description("Create an access-key credential"), deps.defaultBaseUrl).requiredOption("--template <id>", "Credential template id").requiredOption("--name <name>", "Credential name").requiredOption("--project <id>", "Project scope").option("--expires <duration>", "Expiration duration, for example 90d").option("--capabilities <list>", "Comma-separated capability override").option("--idempotency-key <key>", "Idempotency key for safe retries").option("--format <format>", "Output format: text, json, ndjson, markdown, github-actions", "text").option("--output <file>", "Output file").action(async (options, command) => {
+  addAuthOptions(credentials.command("create").description("Create an access-key credential"), deps.defaultBaseUrl).requiredOption("--template <id>", "Credential template id").requiredOption("--name <name>", "Credential name").requiredOption("--project <id>", "Project scope").option("--expires <duration>", "Expiration duration, for example 90d").option("--capabilities <list>", "Comma-separated capability override").option("--idempotency-key <key>", "Idempotency key for safe retries").option("--format <format>", "Output format: text, json, ndjson, markdown, github-actions", "text").option("--output <file>", "Output file").option(
+    "--show-secret",
+    "Include the one-time access key in machine-readable create output",
+    false
+  ).action(async (options, command) => {
     const auth = await resolveCoreAuth(options, command, deps);
     const data = await auth.core.createCredential({
       baseUrl: auth.baseUrl,
@@ -13266,10 +13545,11 @@ var registerCredentialsCommand = (program2, deps) => {
       data,
       format: options.format,
       output: options.output,
-      projectId: options.project
+      projectId: options.project,
+      showSecret: options.showSecret
     });
   });
-  addCommon4(credentials.command("revoke").description("Revoke a credential").argument("<credential_id>"), deps).option("--reason <reason>", "Revocation reason").option("--idempotency-key <key>", "Idempotency key for safe retries").action(async (credentialId, options, command) => {
+  addCommon5(credentials.command("revoke").description("Revoke a credential").argument("<credential_id>"), deps).option("--reason <reason>", "Revocation reason").option("--idempotency-key <key>", "Idempotency key for safe retries").action(async (credentialId, options, command) => {
     const auth = await resolveCoreAuth(options, command, deps);
     const data = await auth.core.revokeCredential({
       baseUrl: auth.baseUrl,
@@ -13287,7 +13567,7 @@ var registerCredentialsCommand = (program2, deps) => {
   });
 };
 var registerIdentityCommand = (program2, deps) => {
-  addCommon4(program2.command("identity").description("Show the current CloudEval identity"), deps).action(async (options, command) => {
+  addCommon5(program2.command("identity").description("Show the current CloudEval identity"), deps).action(async (options, command) => {
     const auth = await resolveCoreAuth(options, command, deps);
     const data = await auth.core.getIdentity({
       baseUrl: auth.baseUrl,
@@ -13320,6 +13600,17 @@ var normalizeHooks = (config, event) => {
     (hook) => hook && typeof hook.id === "string" && typeof hook.command === "string" && hook.id.trim() && hook.command.trim()
   ) : [];
 };
+var HOOK_SECRET_ENV_KEY_PATTERN = /(?:TOKEN|SECRET|PASSWORD|CREDENTIAL|ACCESS_KEY|API_KEY|PRIVATE_KEY|SESSION|COOKIE|AUTH|AZURE_CLIENT_SECRET|CLOUDEVAL_ACCESS_KEY)/i;
+var buildLocalHookBaseEnv = (source = process.env) => {
+  const env = {};
+  for (const [key, value] of Object.entries(source)) {
+    if (value === void 0 || HOOK_SECRET_ENV_KEY_PATTERN.test(key)) {
+      continue;
+    }
+    env[key] = value;
+  }
+  return env;
+};
 var writeHookPayload = async (input, hook) => {
   const filePath = path7.join(
     os4.tmpdir(),
@@ -13354,7 +13645,7 @@ var runShellHook = async (hook, input, payloadPath) => {
       cwd: hook.cwd || process.cwd(),
       timeout: timeoutSeconds * 1e3,
       env: {
-        ...process.env,
+        ...buildLocalHookBaseEnv(),
         CLOUDEVAL_HOOK_EVENT: input.event,
         CLOUDEVAL_HOOK_EVENT_FILE: payloadPath,
         CLOUDEVAL_PROFILE: input.profile,
@@ -13518,7 +13809,7 @@ var registerAgentsCommand = (program2, deps) => {
   const agents = program2.command("agents").description("CloudEval Agent Profile utilities");
   addAgentOutputOptions(agents.command("list").description("List Agent Profiles"), deps).action(async (options, command) => {
     const baseUrl = await deps.resolveBaseUrl(options, command);
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-QYIPN7MD.js");
     core.assertSecureBaseUrl(baseUrl);
     const data = await listProfilesForDiscovery2(core, baseUrl);
     await writeProfiles({
@@ -13534,7 +13825,7 @@ var registerAgentsCommand = (program2, deps) => {
     deps
   ).action(async (profileId, options, command) => {
     const baseUrl = await deps.resolveBaseUrl(options, command);
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-QYIPN7MD.js");
     core.assertSecureBaseUrl(baseUrl);
     const data = await getProfileForDiscovery2(core, baseUrl, profileId);
     await writeProfiles({
@@ -13553,7 +13844,7 @@ var registerAgentsCommand = (program2, deps) => {
       const cliProfile = getActiveConfigProfile(command);
       const cliConfig = await loadCliConfig(cliProfile);
       const auth = await resolveAuthContext(options, command, deps);
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       const profileResponse = await core.getAgentProfile({
         baseUrl: auth.baseUrl,
         authToken: auth.token,
@@ -13753,7 +14044,7 @@ var createTemplateProgressReporter = (command, progress) => {
     }
   };
 };
-var addCommon5 = (command, deps) => addAuthOptions(command, deps.defaultBaseUrl).requiredOption("--template-file <path>", "Cloud template JSON file").option("--parameters-file <path>", "Optional parameters JSON file").option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--output <file>", "Output file");
+var addCommon6 = (command, deps) => addAuthOptions(command, deps.defaultBaseUrl).requiredOption("--template-file <path>", "Cloud template JSON file").option("--parameters-file <path>", "Optional parameters JSON file").option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--output <file>", "Output file");
 var parsePositiveInteger2 = (value, optionName = "--max-results") => {
   if (!value) {
     return void 0;
@@ -13770,7 +14061,7 @@ var collectRule = (value, previous = []) => [
 ];
 var registerValidateCommand = (program2, deps) => {
   const validate = program2.command("validate").description("Validate and parse cloud templates");
-  addCommon5(validate.command("template").description("Validate a cloud template"), deps).option("--failed-only", "Return failed validation checks only", false).option(
+  addCommon6(validate.command("template").description("Validate a cloud template"), deps).option("--failed-only", "Return failed validation checks only", false).option(
     "--rule <id>",
     "Run a specific validation check id; repeat for multiple checks",
     collectRule
@@ -13828,7 +14119,7 @@ var registerValidateCommand = (program2, deps) => {
       process.exit(1);
     }
   });
-  addCommon5(validate.command("parse").description("Parse a cloud template"), deps).option("--location <region>", "Default location for resolved resources").action(async (options, command) => {
+  addCommon6(validate.command("parse").description("Parse a cloud template"), deps).option("--location <region>", "Default location for resolved resources").action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
       const data = await parseTemplate({
@@ -13851,7 +14142,7 @@ var registerValidateCommand = (program2, deps) => {
       process.exit(1);
     }
   });
-  addCommon5(validate.command("tests").description("Run cloud template test checks"), deps).option("--test <name>", "Run a specific template test; repeat for multiple tests", collectRule).option("--skip-test <name>", "Skip a specific template test; repeat for multiple tests", collectRule).option("--category <name>", "Template test category").option("--group <name>", "Template test group; repeat for multiple groups", collectRule).option("--verbose", "Request verbose template test output", false).option("--wait", "Poll an async template test job until results are ready", false).option("--poll-interval <ms>", "Polling interval when --wait is set", "2500").option("--wait-timeout <ms>", "Maximum time to wait when --wait is set", "600000").option(
+  addCommon6(validate.command("tests").description("Run cloud template test checks"), deps).option("--test <name>", "Run a specific template test; repeat for multiple tests", collectRule).option("--skip-test <name>", "Skip a specific template test; repeat for multiple tests", collectRule).option("--category <name>", "Template test category").option("--group <name>", "Template test group; repeat for multiple groups", collectRule).option("--verbose", "Request verbose template test output", false).option("--wait", "Poll an async template test job until results are ready", false).option("--poll-interval <ms>", "Polling interval when --wait is set", "2500").option("--wait-timeout <ms>", "Maximum time to wait when --wait is set", "600000").option(
     "--progress [mode]",
     "Progress events while waiting: auto, stderr, ndjson, none",
     "none"
@@ -13907,10 +14198,10 @@ var registerValidateCommand = (program2, deps) => {
 };
 
 // src/rulesCommand.ts
-var addCommon6 = (command, deps) => addAuthOptions(command, deps.defaultBaseUrl).option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--output <file>", "Output file");
+var addCommon7 = (command, deps) => addAuthOptions(command, deps.defaultBaseUrl).option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--output <file>", "Output file");
 var registerRulesCommand = (program2, deps) => {
   const rules = program2.command("rules").description("Browse cloud validation checks");
-  addCommon6(rules.command("categories").description("List validation check categories"), deps).action(async (options, command) => {
+  addCommon7(rules.command("categories").description("List validation check categories"), deps).action(async (options, command) => {
     try {
       const context = await resolveAuthContext(options, command, deps);
       const data = await getRuleCategories({
@@ -13928,7 +14219,7 @@ var registerRulesCommand = (program2, deps) => {
       process.exit(1);
     }
   });
-  addCommon6(
+  addCommon7(
     rules.command("search").description("Search validation checks").argument("<query>", "Search query"),
     deps
   ).option("--category <name>", "Category filter").option("--pillar <name>", "Architecture pillar filter").action(async (query, options, command) => {
@@ -13952,7 +14243,7 @@ var registerRulesCommand = (program2, deps) => {
       process.exit(1);
     }
   });
-  addCommon6(
+  addCommon7(
     rules.command("show").description("Show a validation check").argument("<rule_id>", "Rule id"),
     deps
   ).action(async (ruleId, options, command) => {
@@ -14115,7 +14406,7 @@ var registerDiagnosticsCommands = (program2, deps) => {
     const baseUrl = await deps.resolveBaseUrl(options, command);
     const profile = getActiveConfigProfile(command);
     const config = await loadCliConfig(profile);
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-QYIPN7MD.js");
     const auth = await core.getAuthStatus(baseUrl, { validate: true });
     if (options.format === "text" || !options.format) {
       process.stdout.write(
@@ -14165,7 +14456,7 @@ var registerDiagnosticsCommands = (program2, deps) => {
       detail: getCliConfigPath(profile)
     });
     try {
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       core.assertSecureBaseUrl(baseUrl);
       checks.push({
         id: "base-url-secure",
@@ -14265,7 +14556,7 @@ var resolveToken2 = async (options, deps, baseUrl, command) => {
     return options.accessKey;
   }
   try {
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-QYIPN7MD.js");
     return await core.getAuthToken({
       baseUrl
     });
@@ -14349,7 +14640,7 @@ var registerModelsCommand = (program2, deps) => {
     let source = "fallback";
     let modelList = fallbackModels;
     try {
-      const core = await import("./dist-PEYJDO7A.js");
+      const core = await import("./dist-QYIPN7MD.js");
       const response = await fetch(`${core.normalizeApiBase(baseUrl)}/models`, {
         headers: {
           Accept: "application/json",
@@ -15528,7 +15819,7 @@ var uninstallCompletionScript = async (shell) => {
 var runInteractiveLoginOnboarding = async (baseUrl, token) => {
   const [{ render }, { Onboarding }] = await Promise.all([
     import("ink"),
-    import("./Onboarding-GAN3Q5TS.js")
+    import("./Onboarding-HCORVZMZ.js")
   ]);
   await new Promise((resolve) => {
     let app;
@@ -15862,7 +16153,7 @@ var resolveBaseUrl = async (options, command) => {
     });
   }
   try {
-    const { getAuthStatus } = await import("./dist-PEYJDO7A.js");
+    const { getAuthStatus } = await import("./dist-QYIPN7MD.js");
     const status = await getAuthStatus();
     const storedBaseUrl = status.baseUrl;
     if (storedBaseUrl && shouldUseStoredBaseUrl(storedBaseUrl)) {
@@ -15936,7 +16227,7 @@ program.command("login").description("Authenticate with Cloudeval").option(
       checkUserStatus,
       ensurePlaygroundProject,
       login
-    } = await import("./dist-PEYJDO7A.js");
+    } = await import("./dist-QYIPN7MD.js");
     assertSecureBaseUrl(options.baseUrl);
     const headlessEnvironment = isHeadlessEnvironment();
     const headlessLogin = options.headless || headlessEnvironment;
@@ -16011,7 +16302,7 @@ program.command("logout").description("Log out and clear stored authentication s
   DEFAULT_BASE_URL
 ).option("--all-devices", "Revoke sessions on all devices", false).action(async (options) => {
   try {
-    const { assertSecureBaseUrl, logout } = await import("./dist-PEYJDO7A.js");
+    const { assertSecureBaseUrl, logout } = await import("./dist-QYIPN7MD.js");
     assertSecureBaseUrl(options.baseUrl);
     const result = await logout({
       baseUrl: options.baseUrl,
@@ -16045,7 +16336,7 @@ authCommand.command("status").description("Show current authentication status").
   DEFAULT_BASE_URL
 ).option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--show-sensitive-ids", "Show full account/session identifiers in command output", false).option("-v, --verbose", "Enable verbose logging and show full non-token identifiers", false).action(async (options, command) => {
   try {
-    const { assertSecureBaseUrl, getAuthStatus } = await import("./dist-PEYJDO7A.js");
+    const { assertSecureBaseUrl, getAuthStatus } = await import("./dist-QYIPN7MD.js");
     const effectiveBaseUrl = await resolveBaseUrl(options, command);
     assertSecureBaseUrl(effectiveBaseUrl);
     const status = await getAuthStatus(effectiveBaseUrl, { validate: true });
@@ -16132,6 +16423,18 @@ registerConnectionsCommand(program, {
   readStdinValue,
   isHeadlessEnvironment
 });
+registerIssuesInventoryCommand(program, {
+  defaultBaseUrl: DEFAULT_BASE_URL,
+  resolveBaseUrl,
+  readStdinValue,
+  isHeadlessEnvironment
+});
+registerActionsCommand(program, {
+  defaultBaseUrl: DEFAULT_BASE_URL,
+  resolveBaseUrl,
+  readStdinValue,
+  isHeadlessEnvironment
+});
 registerValidateCommand(program, {
   defaultBaseUrl: DEFAULT_BASE_URL,
   resolveBaseUrl,
@@ -16262,10 +16565,10 @@ program.command("tui").description("Open the CloudEval Terminal UI").option(
   "Access key for automation",
   process.env.CLOUDEVAL_ACCESS_KEY
 ).option("--access-key-stdin", "Read access key from stdin (recommended for automation)", false).option("--model <name>", "Model name").option("--debug", "Log raw chunks", false).option("--health-check", "Enable health check (disabled by default)").option("--no-banner", "Disable ASCII banner").option("--animate", "Enable TUI animations (default)").option("--no-anim", "Disable TUI animations").option("-v, --verbose", "Enable verbose logging", false).action(async (options, command) => {
-  const { assertSecureBaseUrl } = await import("./dist-PEYJDO7A.js");
+  const { assertSecureBaseUrl } = await import("./dist-QYIPN7MD.js");
   const [{ render }, { App }] = await Promise.all([
     import("ink"),
-    import("./App-FRLV34U4.js")
+    import("./App-OLD5LMTA.js")
   ]);
   const baseUrl = await resolveBaseUrl(options, command);
   assertSecureBaseUrl(baseUrl);
@@ -16320,10 +16623,10 @@ program.command("chat").description("Start an interactive chat session").option(
   "Access key for automation",
   process.env.CLOUDEVAL_ACCESS_KEY
 ).option("--access-key-stdin", "Read access key from stdin (recommended for automation)", false).option("--conversation <id>", "Conversation/thread id to resume").option("--continue", "Resume the most recent local chat session", false).option("--resume <id-or-title>", "Resume a local chat session by thread id or title").option("--model <name>", "Model name").option("--mode <mode>", "Initial chat mode: ask, agent").option("--debug", "Log raw chunks", false).option("--health-check", "Enable health check (disabled by default)").option("--no-banner", "Disable ASCII banner").option("--animate", "Enable TUI animations (default)").option("--no-anim", "Disable TUI animations").option("-v, --verbose", "Enable verbose logging", false).action(async (options, command) => {
-  const { assertSecureBaseUrl } = await import("./dist-PEYJDO7A.js");
+  const { assertSecureBaseUrl } = await import("./dist-QYIPN7MD.js");
   const [{ render }, { App }] = await Promise.all([
     import("ink"),
-    import("./App-FRLV34U4.js")
+    import("./App-OLD5LMTA.js")
   ]);
   const baseUrl = await resolveBaseUrl(options, command);
   assertSecureBaseUrl(baseUrl);
@@ -16398,7 +16701,7 @@ program.command("ask").alias("agent").description("Ask a single question or run
   const question = Array.isArray(questionParts) ? questionParts.join(" ") : String(questionParts);
   const commandName = command.parent?.args?.[0] === "agent" ? "agent" : "ask";
   const selectedMode = commandName === "agent" ? "agent" : "ask";
-  const { assertSecureBaseUrl } = await import("./dist-PEYJDO7A.js");
+  const { assertSecureBaseUrl } = await import("./dist-QYIPN7MD.js");
   const baseUrl = await resolveBaseUrl(options, command);
   assertSecureBaseUrl(baseUrl);
   const selectedProfile = getActiveConfigProfile(command);
@@ -16439,7 +16742,7 @@ program.command("ask").alias("agent").description("Ask a single question or run
     const fs14 = await import("fs");
     const fsPromises = await import("fs/promises");
     const { randomUUID: randomUUID5 } = await import("crypto");
-    const core = await import("./dist-PEYJDO7A.js");
+    const core = await import("./dist-QYIPN7MD.js");
     const {
       streamChat,
       reduceChunk,
@@ -16495,7 +16798,7 @@ program.command("ask").alias("agent").description("Ask a single question or run
             console.error("Authentication required. Starting login process...\n");
           }
           try {
-            const { login } = await import("./dist-PEYJDO7A.js");
+            const { login } = await import("./dist-QYIPN7MD.js");
             verboseLog("Calling interactive login", { baseUrl });
             token = await login(baseUrl, {
               headless: isHeadlessEnvironment()
@@ -16559,7 +16862,7 @@ program.command("ask").alias("agent").description("Ask a single question or run
         message: error.message
       });
     }
-    const { resolveAskProject } = await import("./resolveAskProject-DQJXPS5G.js");
+    const { resolveAskProject } = await import("./resolveAskProject-CL25APSQ.js");
     let project;
     try {
       project = await resolveAskProject({
@@ -17077,7 +17380,7 @@ Error: ${errorMsg}
 program.command("banner").description("Preview the startup banner and terminal capabilities").action(async () => {
   const { render } = await import("ink");
   const BannerPreview = React.lazy(async () => ({
-    default: (await import("./Banner-IFLO2NC6.js")).Banner
+    default: (await import("./Banner-6W7U2C44.js")).Banner
   }));
   render(
     /* @__PURE__ */ jsx(React.Suspense, { fallback: null, children: /* @__PURE__ */ jsx(BannerPreview, { disable: false }) })