@knowttl/artium-axi 0.0.17 → 0.0.19

package/README.md

@@ -155,6 +155,7 @@ Use `--host codex`, `--host opencode` or `--host pi` without `--hook` for those
 Only Claude Code supports the optional `SessionStart` hook, which injects the `tools` discovery output.
 Setup preserves unrelated settings and refuses edited/unmanaged skills unless `--force` is explicit.
 Re-run setup after moving the executable or changing grants; skills for removed grants are retained and reported.
+On Windows, installed skills include labelled PowerShell and Git Bash invocations; use the command for your shell.
 See [installation paths and manual removal](docs/client-reference.md#agent-installation) before uninstalling.
 Artium's authenticated setup fetches managed skills; a standalone skill installer does not configure this server account.
 

package/bin/artium-axi.mjs

@@ -20748,7 +20748,7 @@ import { resolve } from "node:path";
 // package.json
 var package_default = {
   name: "artium-axi",
-  version: "0.0.17",
+  version: "0.0.19",
   private: true,
   license: "MIT",
   type: "module",
@@ -21236,13 +21236,13 @@ var falcon_axi_default = {
   generatedBy: "scripts/falcon-inventory.mjs",
   tool: "falcon-axi",
   repository: "https://github.com/knowttl/falcon-axi.git",
-  tag: "v0.7.2",
-  commit: "96392a6b2afeb86d5422e3ff55e5a3d5e8af769f",
-  version: "0.7.2",
+  tag: "v0.7.4",
+  commit: "bca4a08c71beb415e3fabb37443aea8ad61bc08c",
+  version: "0.7.4",
   distribution: {
-    filename: "falcon_axi-0.7.2-py3-none-any.whl",
-    sha256: "8b87c8047f782a6d390324a26179def0f77e6c7c5bf4212012d5802a249132b6",
-    provenance: "https://pypi.org/integrity/falcon-axi/0.7.2/falcon_axi-0.7.2-py3-none-any.whl/provenance"
+    filename: "falcon_axi-0.7.4-py3-none-any.whl",
+    sha256: "bce4cfb033fd6537eb8a518fe3286799884f6b7a5ef95faffc347ac6c336d28e",
+    provenance: "https://pypi.org/integrity/falcon-axi/0.7.4/falcon_axi-0.7.4-py3-none-any.whl/provenance"
   },
   parser: {
     path: "falcon_axi/cli.py",
@@ -21521,7 +21521,9 @@ var falcon_axi_default = {
         profile: "value",
         filter: "value",
         limit: "value",
-        cursor: "value"
+        cursor: "value",
+        fields: "value",
+        full: "boolean"
       },
       input: "No file or raw URL input; cursors and queries remain native values"
     },
@@ -25025,10 +25027,10 @@ var vectra_axi_default = {
 var az_axi_default = {
   generatedBy: "scripts/upstream-inventory.mjs",
   tool: "az-axi",
-  version: "0.1.11",
-  integrity: "sha512-XiCwLaSh6A6xb9sk7RQ7T3FvkYpkWFIoGUCi7HxYlHF4kssVpF5gun4V7Taw9eKcm0HEWftnLci9l4EBSaFj0w==",
+  version: "0.1.12",
+  integrity: "sha512-xPhoFLQ8XWjWqLR2e80apWA1pkCqQcFZ5r5V7XW+uj0zXKaO9RHfjG7gsxkrMa44jWqWLiU8ssZxWZPl6uj8KQ==",
   parserEvidence: "Installed pinned catalogue exports, provisional until adapter acceptance",
-  packageManifestSha256: "8bdf756d4f0b3d006543471320eb14d83f258122752bd1e07c76a2a74868691c",
+  packageManifestSha256: "2d829dc31fd552a154b439ad40c39ff8fd53b35527d8134a0dd18f4ffab09334",
   environment: [
     {
       name: "AZ_AXI_CONFIG",
@@ -25287,7 +25289,7 @@ var az_axi_default = {
   tokenResourceSources: [
     {
       path: "dist/lib/registry.js",
-      sha256: "1b0354317f721989465190b4a276fce811d559bcbbd9871129b02dd366a5beb5"
+      sha256: "67a29a57b906ee0a17dc0bf917123308ee2d160ef43106f5d15bf73f8cb874d3"
     },
     {
       path: "dist/lib/client.js",
@@ -25315,11 +25317,11 @@ var az_axi_default = {
     },
     {
       path: "dist/commands/logs.js",
-      sha256: "07fc272e2947f12f8c03b9f818ec98fe2fb35beee43f544dcd0d0db15f37574b"
+      sha256: "f3c0112c4be7a8996163d323bd9945950ab1a212eae2cc42af044388adc77199"
     },
     {
       path: "dist/commands/doctor.js",
-      sha256: "3c5e9c56bf0371a3654c04c296291c8d8a95dc05f9c5679b5544e0b2c3a5c475"
+      sha256: "02f26a4af30ed142b4187394c356e2204ad80f03fee52f65c2daf5c312150b06"
     },
     {
       path: "dist/commands/api.js",
@@ -40052,13 +40054,13 @@ var awx_axi_default = {
 var tenable_axi_default = {
   generatedBy: "scripts/tenable-inventory.mjs",
   tool: "tenable-axi",
-  version: "0.1.2",
-  integrity: "sha512-csjV0urIUbZZlkA9VQpEGbsOWOnLgZTFMi0yRQD3uGlmlyPIxA6gKyvMzifSqcRvfyOaBEv7U5OjcWL1rs5NAw==",
+  version: "0.1.3",
+  integrity: "sha512-1Ji117XJv7tssAgqq0vQyQP6m3llQdqOoM6TG7tmMrma9iH9tqq+eESkXGnmHqUuJFjlS8TyyctViWk+zpTTjA==",
   parserEvidence: "Published command catalogue, mutation registry and reviewed native parsers and transport gates",
   sources: [
     {
       path: "dist/src/attack-catalogue.js",
-      sha256: "022f9d46c0e0a76b62ed528b17552fccae9634208698e541146f8af2f6107316"
+      sha256: "8e691131c15c0a25703a2f3c53f9e6f081b13d83e41b132df47f0196b9f3a192"
     },
     {
       path: "dist/src/attack-export-catalogue.js",
@@ -40070,11 +40072,11 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/attack.js",
-      sha256: "76905fe54d1038ffbaa6b4a82b4cb4fadb6473462d28679319a98ab7cdd08650"
+      sha256: "9e37ff7bb1371f3b16b36fe18ecc0286f6f89956d96d3b243c7c37538a9504be"
     },
     {
       path: "dist/src/catalogue.js",
-      sha256: "d99e739f4a9d61cf13c91fd18e69a248f639c33d3e2e5b37efb320f0f50cef16"
+      sha256: "44e7f1adc29b56741b71af0fb1b95239f4fa7c0293f137b8fb9e5e03befcbd72"
     },
     {
       path: "dist/src/cli.js",
@@ -40090,7 +40092,7 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/exposure.js",
-      sha256: "ef5fbe0d3525b741cc14a51b2ab9cc0cbd5289a1ec97fe01312b4d351beaf0b0"
+      sha256: "db005db00fbf1dba311bad8e78a872836994909a9ce46b9bd8d498d72cfc7d2d"
     },
     {
       path: "dist/src/hook-install.js",
@@ -40098,7 +40100,7 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/inventory-catalogue.js",
-      sha256: "a0cc6abc55f11815fbacf4e7f869ce0e70e06f678ebbb012afe7500a26fb4de8"
+      sha256: "9000156bdbc7e9e8a461f89a602f6fa1e9d7217eabe30a67195be79442f8afe6"
     },
     {
       path: "dist/src/inventory-export-catalogue.js",
@@ -40110,7 +40112,7 @@ var tenable_axi_default = {
     },
     {
       path: "dist/src/inventory.js",
-      sha256: "bc712463ee14db76ff511c4b3ec8d6cadd43b3895e08f1baee785fe3a415916f"
+      sha256: "700efba15d086ba88be5444d66f131c9d7482e198dfd050eefc7ecd4f1b96bfe"
     },
     {
       path: "dist/src/inventory/schema.js",
@@ -40252,7 +40254,7 @@ var tenable_axi_default = {
       }
     }
   },
-  skillSha256: "ea35fe90d39fee3982f731ccc3c717c92aabd0799ff2371f6f3cc5e12d7aea9a",
+  skillSha256: "788b612b4b89f6e390e42ca1619da3a7c146599284ff8ebd69c9e5e42aae5ae0",
   nativeWriteSettings: {
     supportedOperations: [
       "apa-export-attack-path",
@@ -40342,7 +40344,7 @@ var tenable_axi_default = {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
         fields: "Comma-separated display or wire properties; display names: id, name, class, exposureScore; default compact view",
-        full: "Show full text; default false",
+        full: "Show untruncated text; does not add fields or rows; default false",
         help: "Show help",
         limit: "Maximum emitted rows, 1-10000; default 100",
         all: "Read up to 10000 rows within invocation budgets; excludes --limit",
@@ -40350,7 +40352,7 @@ var tenable_axi_default = {
         query: "Simple query text",
         filter: 'Repeatable: <property> <operator> <JSON string array>, e.g. asset_class = ["DEVICE"]',
         "filter-file": "JSON flat array of {property, operator, value: string[]}; '-' reads stdin; excludes --filter",
-        sort: "Wire property:asc|desc",
+        sort: "Sortable display or wire property:asc|desc; unknown names report valid choices",
         "extra-properties": "Comma-separated extra wire properties",
         offset: "Starting record; default 0; excludes --cursor",
         class: "Server-side asset class filter"
@@ -40363,7 +40365,7 @@ var tenable_axi_default = {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
         fields: "Comma-separated output fields; accepted: key, readable_name, operators, sortable, filterable, control, description; default compact view",
-        full: "Show full text; default false",
+        full: "Show untruncated text; does not add fields or rows; default false",
         help: "Show help",
         limit: "Maximum emitted rows, 1-10000; default 100",
         all: "Read up to 10000 rows within invocation budgets; excludes --limit",
@@ -40377,8 +40379,8 @@ var tenable_axi_default = {
       flags: {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
-        fields: "Comma-separated display or wire properties; display names: id, name, class, exposureScore; default compact view",
-        full: "Show full text; default false",
+        fields: "Comma-separated display or wire properties; display names: id, name, class, exposureScore, fqdns, last_observed_at; default compact view",
+        full: "Show untruncated text; does not add fields or rows; default false",
         help: "Show help",
         id: "Required exact inventory ID",
         "extra-properties": "Comma-separated extra wire properties"
@@ -40770,8 +40772,8 @@ var tenable_axi_default = {
       flags: {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
-        fields: "Comma-separated display or wire properties; display names: id, name, severity, state; default compact view",
-        full: "Show full text; default false",
+        fields: "Comma-separated display or wire properties; display names: id, name, severity, state, sensor_type; default compact view",
+        full: "Show untruncated text; does not add fields or rows; default false",
         help: "Show help",
         limit: "Maximum emitted rows, 1-10000; default 100",
         all: "Read up to 10000 rows within invocation budgets; excludes --limit",
@@ -40779,7 +40781,7 @@ var tenable_axi_default = {
         query: "Simple query text",
         filter: 'Repeatable: <property> <operator> <JSON string array>, e.g. severity = ["HIGH"]',
         "filter-file": "JSON flat array of {property, operator, value: string[]}; '-' reads stdin; excludes --filter",
-        sort: "Wire property:asc|desc",
+        sort: "Sortable display or wire property:asc|desc; unknown names report valid choices",
         "extra-properties": "Comma-separated extra wire properties",
         offset: "Starting record; default 0; excludes --cursor"
       }
@@ -40791,7 +40793,7 @@ var tenable_axi_default = {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
         fields: "Comma-separated output fields; accepted: key, readable_name, operators, sortable, filterable, control, description; default compact view",
-        full: "Show full text; default false",
+        full: "Show untruncated text; does not add fields or rows; default false",
         help: "Show help",
         limit: "Maximum emitted rows, 1-10000; default 100",
         all: "Read up to 10000 rows within invocation budgets; excludes --limit",
@@ -40804,13 +40806,22 @@ var tenable_axi_default = {
       flags: {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
-        fields: "Comma-separated display or wire properties; display names: id, name, severity, state; default compact view",
-        full: "Show full text; default false",
+        fields: "Comma-separated display or wire properties; display names: id, name, severity, state, sensor_type, asset_id, cves; default compact view",
+        full: "Show untruncated text; does not add fields or rows; default false",
         help: "Show help",
         id: "Required exact inventory ID",
         "extra-properties": "Comma-separated extra wire properties"
       }
     },
+    {
+      command: "finding summary",
+      effect: "read",
+      flags: {
+        config: "Config path; default credential precedence",
+        profile: "Profile name; default credential precedence",
+        help: "Show help"
+      }
+    },
     {
       command: "home",
       effect: "read",
@@ -40931,7 +40942,7 @@ var tenable_axi_default = {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
         fields: "Comma-separated display or wire properties; display names: name, version, publisher; default compact view",
-        full: "Show full text; default false",
+        full: "Show untruncated text; does not add fields or rows; default false",
         help: "Show help",
         limit: "Maximum emitted rows, 1-10000; default 100",
         all: "Read up to 10000 rows within invocation budgets; excludes --limit",
@@ -40939,7 +40950,7 @@ var tenable_axi_default = {
         query: "Simple query text",
         filter: 'Repeatable: <property> <operator> <JSON string array>, e.g. application = ["example-app"]',
         "filter-file": "JSON flat array of {property, operator, value: string[]}; '-' reads stdin; excludes --filter",
-        sort: "Wire property:asc|desc",
+        sort: "Sortable display or wire property:asc|desc; unknown names report valid choices",
         "extra-properties": "Comma-separated extra wire properties",
         offset: "Starting record; default 0; excludes --cursor"
       }
@@ -40951,7 +40962,7 @@ var tenable_axi_default = {
         config: "Config path; default credential precedence",
         profile: "Profile name; default credential precedence",
         fields: "Comma-separated output fields; accepted: key, readable_name, operators, sortable, filterable, control, description; default compact view",
-        full: "Show full text; default false",
+        full: "Show untruncated text; does not add fields or rows; default false",
         help: "Show help",
         limit: "Maximum emitted rows, 1-10000; default 100",
         all: "Read up to 10000 rows within invocation budgets; excludes --limit",
@@ -41254,13 +41265,13 @@ var tenable_axi_default = {
 var hybrid_axi_default = {
   generatedBy: "scripts/hybrid-inventory.mjs",
   tool: "hybrid-axi",
-  version: "0.1.1",
-  integrity: "sha512-8K39EZadEq302GcuCKrWmdKJ6NvtFegpGWiStTF8T8gn+lbzbYNiBnRMt5lI0o+hCm7glUdOFahZqw62ylpi7w==",
+  version: "0.1.2",
+  integrity: "sha512-rveeeytckjW+8lFwKQppSEAncC3yk8KpGqI7Qh3ziJvQtf4ycUrOw+6Tzp9a69gcTamGiYf805OC0+rhIhh6ag==",
   parserEvidence: "Published command catalogue, mutation registry and reviewed native parsers and transport gates",
   sources: [
     {
       path: "dist/src/catalogue.js",
-      sha256: "0244f912f05d7a491651b70015a80bfa15d39ed57b691174d8d4f15d89e8a907"
+      sha256: "cf353500382a0c33a6fa2c1735543ae43ecc10eb53c68e727a8940f7f881b380"
     },
     {
       path: "dist/src/cli.js",
@@ -41300,7 +41311,7 @@ var hybrid_axi_default = {
     },
     {
       path: "dist/src/report-catalogue.js",
-      sha256: "387cbfd2c687cb0ec4a4813132057fdd3cf1145cb8a9760ccdaad99ed9732169"
+      sha256: "3c3346176cf5aabaf177c40a03efd1c67683640a95c8899f71cab1ec4bd95195"
     },
     {
       path: "dist/src/report-file.js",
@@ -41308,11 +41319,11 @@ var hybrid_axi_default = {
     },
     {
       path: "dist/src/reports.js",
-      sha256: "be256f71a04c2f19371b6eb862b88caff9f2e481b95551749bca172058d70396"
+      sha256: "167fa9b8a542b149b8056dbb5f27bbe70c0ed4385662fc6ae9698c40e421a8d7"
     },
     {
       path: "dist/src/search-catalogue.js",
-      sha256: "e5cba3e769308123a560f7e9bcbb0f0ab36e428ce3631a173298953f063b8f7e"
+      sha256: "42fa4e7e979914c67f99fd9b083f18030ed58c01dc6cbaddea3a03553ac2a353"
     },
     {
       path: "dist/src/search-contracts.js",
@@ -41320,11 +41331,11 @@ var hybrid_axi_default = {
     },
     {
       path: "dist/src/search.js",
-      sha256: "bd9362c96f6ff2a90c3297308cb7e1ef91469a4b233228abfa3d7a8849d28204"
+      sha256: "cf6192817869625e1d70030c2df748535c39d48632d8e5604cd020003807ef37"
     },
     {
       path: "dist/src/session.js",
-      sha256: "e75476c1db36aa635d6f3f675e95dfcde6bdda5c66abd0f8f905db881c7d9cf5"
+      sha256: "c55dce9aea70c4f213a040968783bb81296127395367136593985bfe99b4788c"
     },
     {
       path: "dist/src/setup.js",
@@ -41435,7 +41446,7 @@ var hybrid_axi_default = {
       }
     }
   },
-  skillSha256: "1d0266cf0237630d063531b567a6b960dca48a731e7917e72b50fb59f757d384",
+  skillSha256: "0dc43810bcc0774457a33dba2454849e2c8588f0607bd770b30fefe09cd0d26c",
   nativeWriteSettings: {
     supportedOperations: [
       "convertQuickScan",
@@ -44214,7 +44225,7 @@ import { homedir as homedir2 } from "node:os";
 import { dirname as dirname2, join as join2, resolve as resolve2 } from "node:path";
 
 // skill/artium-axi/SKILL.md
-var SKILL_default = "---\nname: artium-axi\ndescription: Discover and run managed commands through Artium, using the signed-in account and its granted tools.\n---\n\nUse artium-axi tools first for requests involving data from Artium-managed tools.\nRun `artium-axi tools` to discover the tools available to this account before choosing a tool.\nRun `artium-axi tools show <tool>` for its commands and a vetted example, then run `artium-axi <tool> <args>`.\nFollow the returned next commands; they already include the Artium prefix.\nKeep upstream arguments intact and use the managed credentials rather than configuring an upstream CLI directly.\n\nIf artium-axi is absent from PATH, use the installed command below in place of `artium-axi` in every example:\n\n<!-- artium-axi executable -->\nThe setup command records the standalone bundle's Node invocation here.\n<!-- /artium-axi executable -->\n\nIf sign-in is required, ask the user to follow `artium-axi login --help` for their SSO or local account.\nNever request or print tokens or put passwords in arguments.\nAn empty tool list means no enabled runtime tool is available through the account's roles; ask an administrator to check grants and enabled tools.\nUse `artium-axi doctor` for connection or cached health diagnostics.\nDo not retry an uncertain command outcome, especially a write.\n";
+var SKILL_default = "---\nname: artium-axi\ndescription: Discover and run managed commands through Artium, using the signed-in account and its granted tools.\n---\n\nUse artium-axi tools first for requests involving data from Artium-managed tools.\nRun `artium-axi tools` to discover the tools available to this account before choosing a tool.\nRun `artium-axi tools show <tool>` for its commands and a vetted example, then run `artium-axi <tool> <args>`.\nFollow the returned next commands; they already include the Artium prefix.\nKeep upstream arguments intact and use the managed credentials rather than configuring an upstream CLI directly.\nSee [client input handling](https://github.com/knowttl/artium-axi/blob/main/docs/client-reference.md#command-surface-and-subcommands) for Azure stdin selection and Tenable local uploads or explicit stdin.\n\nIf artium-axi is absent from PATH, use the installed command below in place of `artium-axi` in every example:\nOn Windows, choose the labelled PowerShell or Git Bash command for your shell.\n\n<!-- artium-axi executable -->\nThe setup command records the standalone bundle's Node invocation here.\n<!-- /artium-axi executable -->\n\nIf sign-in is required, ask the user to follow `artium-axi login --help` for their SSO or local account.\nNever request or print tokens or put passwords in arguments.\nAn empty tool list means no enabled runtime tool is available through the account's roles; ask an administrator to check grants and enabled tools.\nUse `artium-axi doctor` for connection or cached health diagnostics.\nDo not retry an uncertain command outcome, especially a write.\n";
 
 // src/cli/setup.ts
 var hosts = {
@@ -44311,12 +44322,23 @@ async function setup(args) {
     throw new ArtiumError("INVALID_INPUT", `Hook installation is unsupported for ${host}: this installer has no verified ${host} hook implementation. No files were written.`, `Install the skill with artium-axi setup --host ${host} without --hook; Claude Code supports --hook.`);
   }
   const executable = resolve2(process.argv[1]);
-  const invocation = process.platform === "win32" ? `& '${process.execPath.replaceAll("'", "''")}' '${executable.replaceAll("'", "''")}'` : `${quote(process.execPath)} ${quote(executable)}`;
-  const executableBlock = `<!-- artium-axi executable -->
+  const gitBashQuote = (path) => `"${path.replaceAll("\\", "/").replaceAll(/["$`]/g, "\\$&")}"`;
+  const invocation = process.platform === "win32" ? `PowerShell:
+
+\`\`\`powershell
+& '${process.execPath.replaceAll("'", "''")}' '${executable.replaceAll("'", "''")}'
+\`\`\`
+
+Git Bash:
 
 \`\`\`sh
+${gitBashQuote(process.execPath)} ${gitBashQuote(executable)}
+\`\`\`` : `\`\`\`sh
+${quote(process.execPath)} ${quote(executable)}
+\`\`\``;
+  const executableBlock = `<!-- artium-axi executable -->
+
 ${invocation}
-\`\`\`
 
 <!-- /artium-axi executable -->`;
   const content = SKILL_default.replace(/<!-- artium-axi executable -->[\s\S]*?<!-- \/artium-axi executable -->/, () => executableBlock);
@@ -44380,15 +44402,15 @@ async function toolInput(tool, original) {
   const input2 = {};
   let totalFileBytes = 0;
   const hunting = tool === "mg-axi" && args.slice(0, 3).join(" ") === "security hunting query";
-  if ((tool === "az-axi" || tool === "hybrid-axi" || hunting) && !args.some((arg) => ["--help", "-h", "--version", "-v", "-V"].includes(arg))) {
-    const fileFlags = hunting ? ["file"] : tool === "hybrid-axi" ? hybrid_axi_default.adapterBoundary.inputFileFlags : az_axi_default.adapterBoundary.inputFileFlags;
+  if ((tool === "az-axi" || tool === "hybrid-axi" || tool === "tenable-axi" || hunting) && !args.some((arg) => ["--help", "-h", "--version", "-v", "-V"].includes(arg))) {
+    const fileFlags = hunting ? ["file"] : tool === "tenable-axi" ? tenable_axi_default.adapterBoundary.inputFileFlags : tool === "hybrid-axi" ? hybrid_axi_default.adapterBoundary.inputFileFlags : az_axi_default.adapterBoundary.inputFileFlags;
     for (let index = 0; index < args.length; index++) {
       if (args[index] === "--") break;
       const [flag] = args[index].split("=");
       if (!fileFlags.some((name2) => flag === `--${name2}`)) continue;
       const equals = args[index].indexOf("=");
       const path = equals < 0 ? args[++index] : args[index].slice(equals + 1);
-      if (path === "-" && tool === "hybrid-axi" && flag === "--body-file") {
+      if (path === "-" && (tool === "tenable-axi" || tool === "hybrid-axi" && flag === "--body-file")) {
         input2.stdin = (await readBounded(process.stdin, inputLimits.stdinBytes)).toString("utf8");
         continue;
       }
@@ -44412,8 +44434,35 @@ async function toolInput(tool, original) {
       leading++;
       if (!token.includes("=") && (name !== "full" || ["true", "false"].includes(args[leading]))) leading++;
     }
-    const consumesStdin = az_axi_default.commands.some((route) => ["rg query", "logs query", "api"].includes(route.handlerCommand) && route.command.split(" ").every((word, index) => args[leading + index] === word));
-    if (tool === "az-axi" && consumesStdin && !process.stdin.isTTY) {
+    const route = az_axi_default.commands.find((route2) => ["rg query", "logs query", "api"].includes(route2.handlerCommand) && route2.command.split(" ").every((word, index) => args[leading + index] === word));
+    let positional = false;
+    if (route) {
+      for (let index = leading + route.command.split(" ").length; index < args.length; index++) {
+        const token = args[index];
+        if (token === "--") {
+          positional = index + 1 < args.length;
+          break;
+        }
+        if (!token.startsWith("-") || token === "-") {
+          positional = true;
+          break;
+        }
+        const raw = token.slice(token.startsWith("--") ? 2 : 1).split("=")[0];
+        const expanded = token.startsWith("--") ? raw : route.shortFlags[raw] ?? raw;
+        const name = route.flagAliases[expanded] ?? expanded;
+        const kind = route.flags[name];
+        if (token.includes("=") || !kind) continue;
+        if (kind === "boolean") {
+          if (["true", "false"].includes(args[index + 1])) index++;
+        } else {
+          while (args[index + 1] !== void 0 && (!args[index + 1].startsWith("-") || /^-\d/.test(args[index + 1]) || az_axi_default.adapterBoundary.inputFileFlags.includes(name) && input2.files?.some((file2) => file2.name === args[index + 1]))) {
+            index++;
+            if (!["list", "literal-list"].includes(kind) || route.positionalInput) break;
+          }
+        }
+      }
+    }
+    if (tool === "az-axi" && route && !input2.files?.length && !positional && !process.stdin.isTTY) {
       const stdin = await readBounded(process.stdin, inputLimits.stdinBytes);
       if (stdin.length) input2.stdin = stdin.toString("utf8");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knowttl/artium-axi",
-  "version": "0.0.17",
+  "version": "0.0.19",
   "description": "Client CLI and embedded skill for the Artium managed tools server.",
   "license": "MIT",
   "type": "module",

package/skill/artium-axi/SKILL.md

@@ -8,8 +8,10 @@ Run `artium-axi tools` to discover the tools available to this account before ch
 Run `artium-axi tools show <tool>` for its commands and a vetted example, then run `artium-axi <tool> <args>`.
 Follow the returned next commands; they already include the Artium prefix.
 Keep upstream arguments intact and use the managed credentials rather than configuring an upstream CLI directly.
+See [client input handling](https://github.com/knowttl/artium-axi/blob/main/docs/client-reference.md#command-surface-and-subcommands) for Azure stdin selection and Tenable local uploads or explicit stdin.
 
 If artium-axi is absent from PATH, use the installed command below in place of `artium-axi` in every example:
+On Windows, choose the labelled PowerShell or Git Bash command for your shell.
 
 <!-- artium-axi executable -->
 The setup command records the standalone bundle's Node invocation here.