@kolatts/pncli 1.12.0 → 1.14.0

package/dist/cli.js

@@ -8,7 +8,7 @@ import {
   setRepoConfigValue,
   writeGlobalConfig,
   writeRepoConfig
-} from "./chunk-AWSXVWRN.js";
+} from "./chunk-CFUUOW7B.js";
 import {
   ExitCode,
   PncliError,
@@ -18,8 +18,9 @@ import {
   setGlobalOptions,
   setGlobalUser,
   success,
-  warn
-} from "./chunk-SLQOSGZJ.js";
+  warn,
+  writeRawOutput
+} from "./chunk-BNMFIGXF.js";
 import {
   AdoCoreClient
 } from "./chunk-VDL32PSG.js";
@@ -276,21 +277,30 @@ function parseBranchReportOutput(raw, branchName, opts) {
     }
   }
   if (current) commits.push(current);
-  const totalInsertions = commits.reduce((sum, c) => sum + c.insertions, 0);
-  const totalDeletions = commits.reduce((sum, c) => sum + c.deletions, 0);
+  const isAbsoluteDate = (s) => /^\d{4}-\d{2}-\d{2}/.test(s);
+  const sinceDate = opts.since && isAbsoluteDate(opts.since) ? opts.since.slice(0, 10) : null;
+  const untilDate = opts.until && isAbsoluteDate(opts.until) ? opts.until.slice(0, 10) : null;
+  const filteredCommits = sinceDate || untilDate ? commits.filter((c) => {
+    const d = c.date.slice(0, 10);
+    if (sinceDate && d < sinceDate) return false;
+    if (untilDate && d > untilDate) return false;
+    return true;
+  }) : commits;
+  const totalInsertions = filteredCommits.reduce((sum, c) => sum + c.insertions, 0);
+  const totalDeletions = filteredCommits.reduce((sum, c) => sum + c.deletions, 0);
   return {
     branch: branchName,
     since: opts.since ?? null,
     until: opts.until ?? null,
-    commits,
-    weeks: buildWeeklyBreakdown(commits),
-    byAuthor: buildByAuthor(commits),
+    commits: filteredCommits,
+    weeks: buildWeeklyBreakdown(filteredCommits),
+    byAuthor: buildByAuthor(filteredCommits),
     summary: {
-      commitCount: commits.length,
+      commitCount: filteredCommits.length,
       totalInsertions,
       totalDeletions,
       totalNetLines: totalInsertions - totalDeletions,
-      totalFilesChanged: commits.reduce((sum, c) => sum + c.filesChanged, 0)
+      totalFilesChanged: filteredCommits.reduce((sum, c) => sum + c.filesChanged, 0)
     }
   };
 }
@@ -411,34 +421,34 @@ function parseAdoRemote(remoteUrl, adoBaseUrl) {
   } catch {
     baseHostname = adoBaseUrl.replace(/\/$/, "").replace(/^https?:\/\//, "").split(/[:/]/)[0].toLowerCase();
   }
-  let path6 = remoteUrl;
+  let path8 = remoteUrl;
   let remoteHostname = "";
-  const sshProtoMatch = path6.match(/^ssh:\/\/[^@]*@?([^/:]+)(?::\d+)?(.*)/);
+  const sshProtoMatch = path8.match(/^ssh:\/\/[^@]*@?([^/:]+)(?::\d+)?(.*)/);
   if (sshProtoMatch) {
     remoteHostname = sshProtoMatch[1].toLowerCase();
-    path6 = sshProtoMatch[2];
+    path8 = sshProtoMatch[2];
   } else {
-    const gitAtMatch = path6.match(/^git@([^:]+)(?::\d+)?:(.*)/);
+    const gitAtMatch = path8.match(/^git@([^:]+)(?::\d+)?:(.*)/);
     if (gitAtMatch) {
       remoteHostname = gitAtMatch[1].toLowerCase();
-      path6 = "/" + gitAtMatch[2];
+      path8 = "/" + gitAtMatch[2];
     } else {
-      const httpsMatch = path6.match(/^https?:\/\/([^/:]+)(?::\d+)?(.*)/);
+      const httpsMatch = path8.match(/^https?:\/\/([^/:]+)(?::\d+)?(.*)/);
       if (httpsMatch) {
         remoteHostname = httpsMatch[1].toLowerCase();
-        path6 = httpsMatch[2];
+        path8 = httpsMatch[2];
       }
     }
   }
   if (!remoteHostname || remoteHostname !== baseHostname) return null;
-  path6 = path6.replace(/\.git$/, "");
-  const gitIdx = path6.indexOf("/_git/");
-  const sshIdx = path6.indexOf("/_ssh/");
+  path8 = path8.replace(/\.git$/, "");
+  const gitIdx = path8.indexOf("/_git/");
+  const sshIdx = path8.indexOf("/_ssh/");
   const markerIdx = gitIdx !== -1 ? gitIdx : sshIdx;
   if (markerIdx === -1) return null;
-  const repo = decodeURIComponent(path6.slice(markerIdx + 6));
+  const repo = decodeURIComponent(path8.slice(markerIdx + 6));
   if (!repo) return null;
-  const before = path6.slice(1, markerIdx);
+  const before = path8.slice(1, markerIdx);
   const parts = before.split("/").filter(Boolean);
   if (parts.length < 2) return null;
   const project = decodeURIComponent(parts[parts.length - 1]);
@@ -742,7 +752,7 @@ function registerGitCommands(program2) {
         until: opts.until
       });
       if (opts.csv) {
-        process.stdout.write(formatBranchReportCsv(report));
+        writeRawOutput(formatBranchReportCsv(report));
       } else {
         success(report, "git", "report", start);
       }
@@ -783,7 +793,42 @@ function registerGitCommands(program2) {
 }
 
 // src/services/jira/commands.ts
+import { readFileSync as readFileSync2, existsSync, writeFileSync, mkdirSync } from "fs";
+import path from "path";
+
+// src/services/jira/client.ts
 import { readFileSync } from "fs";
+import { basename } from "path";
+
+// src/lib/mime.ts
+import { extname } from "path";
+function guessMimeType(filePath) {
+  const ext = extname(filePath).toLowerCase();
+  const map = {
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".png": "image/png",
+    ".gif": "image/gif",
+    ".svg": "image/svg+xml",
+    ".pdf": "application/pdf",
+    ".txt": "text/plain",
+    ".log": "text/plain",
+    ".csv": "text/csv",
+    ".json": "application/json",
+    ".xml": "application/xml",
+    ".zip": "application/zip",
+    ".tar": "application/x-tar",
+    ".gz": "application/gzip",
+    ".md": "text/markdown",
+    ".html": "text/html",
+    ".htm": "text/html",
+    ".doc": "application/msword",
+    ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    ".xls": "application/vnd.ms-excel",
+    ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
+  };
+  return map[ext] ?? "application/octet-stream";
+}
 
 // src/services/jira/client.ts
 var API2 = "/rest/api/2";
@@ -925,6 +970,36 @@ var JiraClient = class {
     }
     return result;
   }
+  async addLabels(key, labels) {
+    await this.http.jira(`${API2}/issue/${key}`, {
+      method: "PUT",
+      body: { update: { labels: labels.map((l) => ({ add: l })) } }
+    });
+  }
+  async removeLabels(key, labels) {
+    await this.http.jira(`${API2}/issue/${key}`, {
+      method: "PUT",
+      body: { update: { labels: labels.map((l) => ({ remove: l })) } }
+    });
+  }
+  async uploadAttachment(key, filePath) {
+    const fileContent = readFileSync(filePath);
+    const fileName = basename(filePath);
+    const mimeType = guessMimeType(filePath);
+    const formData = new FormData();
+    formData.append("file", new Blob([fileContent], { type: mimeType }), fileName);
+    return this.http.jiraUpload(`${API2}/issue/${key}/attachments`, formData);
+  }
+  async listAttachments(key) {
+    const result = await this.http.jira(
+      `${API2}/issue/${key}`,
+      { params: { fields: "attachment" } }
+    );
+    return result.fields.attachment ?? [];
+  }
+  async downloadAttachment(contentUrl) {
+    return this.http.jiraBuffer(contentUrl);
+  }
   async assignIssue(key, accountId) {
     await this.http.jira(`${API2}/issue/${key}/assignee`, {
       method: "PUT",
@@ -1191,6 +1266,28 @@ function registerJiraCommands(program2) {
       fail(err, "jira", "search", start);
     }
   });
+  jira.command("add-label").description("Add one or more labels to a Jira issue (non-destructive)").requiredOption("--key <issue-key>", "Issue key").requiredOption("--labels <labels>", "Comma-separated labels to add").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const client = getClient(program2);
+      const labels = opts.labels.split(",").map((s) => s.trim()).filter(Boolean);
+      await client.addLabels(opts.key, labels);
+      success({ updated: opts.key, labelsAdded: labels }, "jira", "add-label", start);
+    } catch (err) {
+      fail(err, "jira", "add-label", start);
+    }
+  });
+  jira.command("remove-label").description("Remove one or more labels from a Jira issue (non-destructive)").requiredOption("--key <issue-key>", "Issue key").requiredOption("--labels <labels>", "Comma-separated labels to remove").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const client = getClient(program2);
+      const labels = opts.labels.split(",").map((s) => s.trim()).filter(Boolean);
+      await client.removeLabels(opts.key, labels);
+      success({ updated: opts.key, labelsRemoved: labels }, "jira", "remove-label", start);
+    } catch (err) {
+      fail(err, "jira", "remove-label", start);
+    }
+  });
   jira.command("assign").description("Assign a Jira issue to a user").requiredOption("--key <issue-key>", "Issue key").requiredOption("--assignee <accountId>", "Assignee account ID").action(async (opts) => {
     const start = Date.now();
     try {
@@ -1211,6 +1308,44 @@ function registerJiraCommands(program2) {
       fail(err, "jira", "link-issue", start);
     }
   });
+  jira.command("add-attachment").description("Upload a file as an attachment to a Jira issue").requiredOption("--key <issue-key>", "Issue key (e.g. PROJ-123)").requiredOption("--file <path>", "Path to the file to upload").action(async (opts) => {
+    const start = Date.now();
+    try {
+      if (!existsSync(opts.file)) throw new PncliError(`File not found: ${opts.file}`, 1);
+      const client = getClient(program2);
+      const data = await client.uploadAttachment(opts.key, opts.file);
+      success(data, "jira", "add-attachment", start);
+    } catch (err) {
+      fail(err, "jira", "add-attachment", start);
+    }
+  });
+  jira.command("list-attachments").description("List attachments on a Jira issue").requiredOption("--key <issue-key>", "Issue key (e.g. PROJ-123)").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const client = getClient(program2);
+      const data = await client.listAttachments(opts.key);
+      success(data, "jira", "list-attachments", start);
+    } catch (err) {
+      fail(err, "jira", "list-attachments", start);
+    }
+  });
+  jira.command("download-attachment").description("Download a Jira issue attachment to .pncli/ (or --dir)").requiredOption("--key <issue-key>", "Issue key (e.g. PROJ-123)").requiredOption("--attachment-id <id>", "Attachment ID from list-attachments output").option("--dir <path>", "Output directory (default: .pncli relative to cwd)").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const client = getClient(program2);
+      const attachments = await client.listAttachments(opts.key);
+      const attachment = attachments.find((a) => a.id === opts.attachmentId);
+      if (!attachment) throw new PncliError(`Attachment not found: ${opts.attachmentId}`, 1);
+      const outDir = opts.dir ?? path.join(process.cwd(), ".pncli");
+      mkdirSync(outDir, { recursive: true });
+      const outPath = path.join(outDir, path.basename(attachment.filename));
+      const buffer = await client.downloadAttachment(attachment.content);
+      writeFileSync(outPath, buffer);
+      success({ saved: outPath, filename: attachment.filename, size: buffer.length }, "jira", "download-attachment", start);
+    } catch (err) {
+      fail(err, "jira", "download-attachment", start);
+    }
+  });
   jira.command("fields").description("List custom fields (configured or discovered from Jira API) (consider --output-file for large results)").option("--discover", "Fetch field metadata from Jira API").option("--custom-only", "Show only custom fields (requires --discover)").option("--project <key>", "Project key \u2014 fetches allowedValues for select fields via createmeta (requires --discover)").option("--issue-type <type>", "Filter allowedValues to a specific issue type (requires --project)").action(async (opts) => {
     const start = Date.now();
     try {
@@ -1244,7 +1379,7 @@ function parseFieldArgs(fieldArgs, fieldMap) {
       const filePath = value.slice(1);
       let raw;
       try {
-        raw = readFileSync(filePath, "utf8").trim();
+        raw = readFileSync2(filePath, "utf8").trim();
       } catch (e) {
         throw new PncliError(`Cannot read file "${filePath}": ${e.message}`, 1);
       }
@@ -1262,7 +1397,7 @@ function parseFieldArgs(fieldArgs, fieldMap) {
 function parseFieldsFile(filePath, fieldMap) {
   let raw;
   try {
-    raw = readFileSync(filePath, "utf8");
+    raw = readFileSync2(filePath, "utf8");
   } catch (e) {
     throw new PncliError(`Cannot read fields file "${filePath}": ${e.message}`, 1);
   }
@@ -1562,9 +1697,9 @@ var ConfluenceClient = class {
     const initialStart = opts.start ?? 0;
     return this.http.confluencePaginate(async (start, limit) => {
       return this.http.confluence(`${API3}/content`, {
-        params: { spaceKey, type: "page", expand: "version", start: initialStart + start, limit: opts.limit ?? limit }
+        params: { spaceKey, type: "page", expand: "version", start: initialStart + start, limit }
       });
-    });
+    }, opts.limit);
   }
   async getPageChildren(id) {
     return this.http.confluencePaginate(async (start, limit) => {
@@ -1667,11 +1802,11 @@ var ConfluenceClient = class {
       return this.http.confluence(`${API3}/space`, {
         params: {
           start: initialStart + start,
-          limit: opts.limit ?? limit,
+          limit,
           ...opts.type ? { type: opts.type } : {}
         }
       });
-    });
+    }, opts.limit);
   }
   async getSpace(key) {
     return this.http.confluence(`${API3}/space/${key}`, {
@@ -1718,7 +1853,7 @@ function registerConfluenceCommands(program2) {
       fail(err, "confluence", "get-page-by-title", start);
     }
   });
-  confluence.command("list-pages").description("List pages in a Confluence space (consider --output-file for large results)").requiredOption("--space <key>", "Space key").option("--limit <n>", "Max results per page (default: all)").option("--start <n>", "Offset for first result").action(async (opts) => {
+  confluence.command("list-pages").description("List pages in a Confluence space (consider --output-file for large results)").requiredOption("--space <key>", "Space key").option("--limit <n>", "Max total pages to return (default: all)").option("--start <n>", "Offset for first result").action(async (opts) => {
     const start = Date.now();
     try {
       const client = getClient3(program2);
@@ -1850,7 +1985,7 @@ function registerConfluenceCommands(program2) {
       fail(err, "confluence", "remove-label", start);
     }
   });
-  confluence.command("list-spaces").description("List Confluence spaces").option("--type <type>", "Space type: global or personal").option("--limit <n>", "Max results (default: all)").action(async (opts) => {
+  confluence.command("list-spaces").description("List Confluence spaces").option("--type <type>", "Space type: global or personal").option("--limit <n>", "Max total spaces to return (default: all)").action(async (opts) => {
     const start = Date.now();
     try {
       const client = getClient3(program2);
@@ -2426,23 +2561,23 @@ import { Option } from "commander";
 
 // src/services/deps/parsers/index.ts
 import fs from "fs";
-import path4 from "path";
+import path5 from "path";
 import { execSync as execSync3, execFileSync as execFileSync2 } from "child_process";
 
 // src/services/deps/parsers/npm.ts
-import path from "path";
+import path2 from "path";
 function findNpmManifests(files) {
   const lockFiles = new Set(
     files.filter((f) => {
-      const base = path.basename(f);
+      const base = path2.basename(f);
       return base === "package-lock.json" || base === "yarn.lock" || base === "pnpm-lock.yaml";
     })
   );
   const manifests = [];
   for (const file of files) {
-    if (path.basename(file) !== "package.json") continue;
+    if (path2.basename(file) !== "package.json") continue;
     if (file.split("/").includes("node_modules")) continue;
-    const dir = path.dirname(file);
+    const dir = path2.dirname(file);
     let lockFile;
     for (const lf of ["package-lock.json", "yarn.lock", "pnpm-lock.yaml"]) {
       const candidate = dir === "." ? lf : `${dir}/${lf}`;
@@ -2457,7 +2592,7 @@ function findNpmManifests(files) {
 }
 function parseNpmPackages(content, manifest, opts, lockContent) {
   if (lockContent && manifest.lockFile) {
-    const base = path.basename(manifest.lockFile);
+    const base = path2.basename(manifest.lockFile);
     if (base === "package-lock.json") {
       const pkgs = parsePackageLock(lockContent, manifest.lockFile, opts);
       if (pkgs.length > 0) return pkgs;
@@ -2605,26 +2740,26 @@ function parsePnpmLock(content, lockFilePath, opts, packageJsonContent) {
 }
 
 // src/services/deps/parsers/nuget.ts
-import path2 from "path";
+import path3 from "path";
 var PROJ_EXTENSIONS = /* @__PURE__ */ new Set([".csproj", ".fsproj", ".vbproj"]);
 function findNugetManifests(files) {
   const lockFiles = /* @__PURE__ */ new Map();
   for (const f of files) {
-    if (path2.basename(f) === "packages.lock.json") {
-      lockFiles.set(path2.dirname(f), f);
+    if (path3.basename(f) === "packages.lock.json") {
+      lockFiles.set(path3.dirname(f), f);
     }
   }
   const manifests = [];
   for (const file of files) {
-    const base = path2.basename(file);
-    const ext = path2.extname(file);
+    const base = path3.basename(file);
+    const ext = path3.extname(file);
     if (PROJ_EXTENSIONS.has(ext) || base === "packages.config") {
-      const dir = path2.dirname(file);
+      const dir = path3.dirname(file);
       const lockFile = lockFiles.get(dir);
       manifests.push({ file, ecosystem: "nuget", lockFile });
     }
     if (base === "Directory.Packages.props") {
-      const dir = path2.dirname(file);
+      const dir = path3.dirname(file);
       manifests.push({ file, ecosystem: "nuget", lockFile: lockFiles.get(dir) });
     }
   }
@@ -2643,7 +2778,7 @@ function findNugetManifests(files) {
   return deduped;
 }
 function parseNugetPackages(content, manifest, opts, lockContent, propsContent) {
-  const base = path2.basename(manifest.file);
+  const base = path3.basename(manifest.file);
   if (lockContent) {
     return parsePackagesLock(lockContent, manifest.lockFile ?? manifest.file, opts);
   }
@@ -2764,14 +2899,14 @@ function parsePackagesLock(content, filePath, opts) {
 }
 
 // src/services/deps/parsers/maven.ts
-import path3 from "path";
+import path4 from "path";
 function findMavenManifests(files) {
-  const lockFiles = new Set(files.filter((f) => path3.basename(f) === "gradle.lockfile"));
+  const lockFiles = new Set(files.filter((f) => path4.basename(f) === "gradle.lockfile"));
   const manifests = [];
   for (const file of files) {
-    const base = path3.basename(file);
+    const base = path4.basename(file);
     if (base === "pom.xml" || base === "build.gradle" || base === "build.gradle.kts") {
-      const dir = path3.dirname(file);
+      const dir = path4.dirname(file);
       const lockCandidate = dir === "." ? "gradle.lockfile" : `${dir}/gradle.lockfile`;
       const lockFile = lockFiles.has(lockCandidate) ? lockCandidate : void 0;
       manifests.push({ file, ecosystem: "maven", lockFile });
@@ -2780,7 +2915,7 @@ function findMavenManifests(files) {
   return manifests;
 }
 function parseMavenPackages(content, manifest, opts, lockContent) {
-  const base = path3.basename(manifest.file);
+  const base = path4.basename(manifest.file);
   if (lockContent && manifest.lockFile) {
     return parseGradleLock(lockContent, manifest.lockFile, opts);
   }
@@ -2941,7 +3076,7 @@ function getRepoFiles(repoRoot) {
 }
 function readFile(repoRoot, relPath) {
   try {
-    return fs.readFileSync(path4.join(repoRoot, relPath), "utf8");
+    return fs.readFileSync(path5.join(repoRoot, relPath), "utf8");
   } catch {
     return null;
   }
@@ -2959,13 +3094,13 @@ function readFileAtRef(repoRoot, ref, relPath) {
   }
 }
 function findPropsContent(manifestFile, readFn) {
-  let dir = path4.dirname(manifestFile);
+  let dir = path5.dirname(manifestFile);
   for (let depth = 0; depth < 10; depth++) {
     const candidate = dir === "." ? "Directory.Packages.props" : `${dir}/Directory.Packages.props`;
     const content = readFn(candidate);
     if (content) return content;
     if (dir === ".") break;
-    dir = path4.dirname(dir);
+    dir = path5.dirname(dir);
   }
   return null;
 }
@@ -4201,6 +4336,8 @@ import password from "@inquirer/password";
 import confirm from "@inquirer/confirm";
 
 // src/services/ado/client/work.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { basename as basename2 } from "path";
 var API6 = "7.1";
 var API_PREVIEW = "7.1-preview.4";
 var AdoWorkClient = class {
@@ -4243,6 +4380,24 @@ var AdoWorkClient = class {
       { method: "POST", body: { text } }
     );
   }
+  async addTags(collection, id, tags) {
+    const item = await this.getWorkItem(collection, id);
+    const existing = item.fields["System.Tags"] ?? "";
+    const current = existing.split(";").map((t) => t.trim()).filter(Boolean);
+    const lowerSet = new Set(current.map((t) => t.toLowerCase()));
+    const toAdd = tags.filter((t) => !lowerSet.has(t.toLowerCase()));
+    const merged = [...current, ...toAdd];
+    const patch = [{ op: "add", path: "/fields/System.Tags", value: merged.join("; ") }];
+    return this.updateWorkItem(collection, id, patch);
+  }
+  async removeTags(collection, id, tags) {
+    const item = await this.getWorkItem(collection, id);
+    const existing = item.fields["System.Tags"] ?? "";
+    const lower = new Set(tags.map((t) => t.toLowerCase()));
+    const remaining = existing.split(";").map((t) => t.trim()).filter((t) => t && !lower.has(t.toLowerCase()));
+    const patch = [{ op: "add", path: "/fields/System.Tags", value: remaining.join("; ") }];
+    return this.updateWorkItem(collection, id, patch);
+  }
   async listWorkItemTypes(collection, project) {
     const result = await this.http.ado(
       `/${encodeURIComponent(collection)}/${encodeURIComponent(project)}/_apis/wit/workitemtypes?api-version=${API6}`
@@ -4268,6 +4423,44 @@ var AdoWorkClient = class {
     );
     return result.value ?? [];
   }
+  async listAttachments(collection, workItemId) {
+    const item = await this.getWorkItem(collection, workItemId);
+    return (item.relations ?? []).filter((r) => r.rel === "AttachedFile").map((r) => {
+      const attrs = r.attributes ?? {};
+      return {
+        id: new URL(r.url).pathname.split("/").pop() ?? "",
+        name: String(attrs["name"] ?? ""),
+        url: r.url,
+        comment: attrs["comment"] !== void 0 ? String(attrs["comment"]) : void 0,
+        resourceSize: typeof attrs["resourceSize"] === "number" ? attrs["resourceSize"] : void 0,
+        resourceCreatedDate: attrs["resourceCreatedDate"] !== void 0 ? String(attrs["resourceCreatedDate"]) : void 0,
+        resourceModifiedDate: attrs["resourceModifiedDate"] !== void 0 ? String(attrs["resourceModifiedDate"]) : void 0
+      };
+    });
+  }
+  async downloadAttachment(absoluteUrl) {
+    return this.http.adoBuffer(absoluteUrl);
+  }
+  async uploadAttachment(collection, workItemId, filePath, comment) {
+    const fileContent = readFileSync3(filePath);
+    const fileName = basename2(filePath);
+    const mimeType = guessMimeType(filePath);
+    const attachment = await this.http.adoUpload(
+      `/${encodeURIComponent(collection)}/_apis/wit/attachments?fileName=${encodeURIComponent(fileName)}&api-version=${API6}`,
+      fileContent,
+      mimeType
+    );
+    const relationValue = {
+      rel: "AttachedFile",
+      url: attachment.url,
+      ...comment ? { attributes: { comment } } : {}
+    };
+    await this.http.ado(
+      `/${encodeURIComponent(collection)}/_apis/wit/workitems/${workItemId}?api-version=${API6}`,
+      { method: "PATCH", body: [{ op: "add", path: "/relations/-", value: relationValue }], headers: { "Content-Type": "application/json-patch+json" } }
+    );
+    return attachment;
+  }
 };
 
 // src/services/ado/discovery.ts
@@ -4441,8 +4634,8 @@ function registerConfigCommands(program2) {
       if (cfg.ado.baseUrl) {
         try {
           const collection = cfg.defaults.ado?.collection;
-          const path6 = collection ? `/${encodeURIComponent(collection)}/_apis/connectionData?api-version=7.1-preview.1` : "/_apis/projectCollections?api-version=7.1";
-          await http.ado(path6);
+          const path8 = collection ? `/${encodeURIComponent(collection)}/_apis/connectionData?api-version=7.1-preview.1` : "/_apis/projectCollections?api-version=7.1";
+          await http.ado(path8);
           results.ado = { ok: true, message: "connected" };
         } catch (err) {
           results.ado = { ok: false, message: err instanceof Error ? err.message : String(err) };
@@ -4521,6 +4714,16 @@ function registerConfigCommands(program2) {
       } else {
         results.sonatypeiq = { ok: null, message: "not configured" };
       }
+      if (cfg.openshift.baseUrl && cfg.openshift.token) {
+        try {
+          await http.openshift("/api/v1");
+          results.openshift = { ok: true, message: "connected" };
+        } catch (err) {
+          results.openshift = { ok: false, message: err instanceof Error ? err.message : String(err) };
+        }
+      } else {
+        results.openshift = { ok: null, message: "not configured" };
+      }
       success(results, "config", "test", start);
     } catch (err) {
       fail(err, "config", "test", start);
@@ -4614,8 +4817,8 @@ function registerConfigCommands(program2) {
       } else {
         try {
           const collection = cfg.defaults.ado?.collection;
-          const path6 = collection ? `/${encodeURIComponent(collection)}/_apis/connectionData?api-version=7.1-preview.1` : "/_apis/projectCollections?api-version=7.1";
-          await http.ado(path6, { timeoutMs: 1e4 });
+          const path8 = collection ? `/${encodeURIComponent(collection)}/_apis/connectionData?api-version=7.1-preview.1` : "/_apis/projectCollections?api-version=7.1";
+          await http.ado(path8, { timeoutMs: 1e4 });
           results.ado = { status: "valid", message: "ok" };
         } catch (err) {
           results.ado = categorize2(err);
@@ -4704,11 +4907,23 @@ function registerConfigCommands(program2) {
           results.sonatypeiq = categorize2(err);
         }
       }
+      if (!cfg.openshift.token) {
+        results.openshift = { status: "blank", message: "not configured" };
+      } else if (!cfg.openshift.baseUrl) {
+        results.openshift = { status: "error", message: "baseUrl not configured" };
+      } else {
+        try {
+          await http.openshift("/api/v1", { timeoutMs: 1e4 });
+          results.openshift = { status: "valid", message: "ok" };
+        } catch (err) {
+          results.openshift = categorize2(err);
+        }
+      }
       const statuses = Object.values(results).map((r) => r.status);
       if (statuses.includes("invalid")) process.exitCode = ExitCode.AUTH_ERROR;
       else if (statuses.includes("error")) process.exitCode = ExitCode.NETWORK_ERROR;
       if (cmdOpts.output === "table") {
-        const services = ["jira", "bitbucket", "confluence", "sonar", "sde", "ado", "jenkins", "udeploy", "artifactory", "checkmarx", "servicenow", "contrast", "sonatypeiq"];
+        const services = ["jira", "bitbucket", "confluence", "sonar", "sde", "ado", "jenkins", "udeploy", "artifactory", "checkmarx", "servicenow", "contrast", "sonatypeiq", "openshift"];
         const labelWidth = 14;
         const statusWidth = 9;
         for (const svc of services) {
@@ -4722,7 +4937,7 @@ function registerConfigCommands(program2) {
         process.stdout.write("\n");
       } else {
         if (opts.pretty) {
-          const services = ["jira", "bitbucket", "confluence", "sonar", "sde", "ado", "jenkins", "udeploy", "artifactory", "checkmarx", "servicenow", "contrast", "sonatypeiq"];
+          const services = ["jira", "bitbucket", "confluence", "sonar", "sde", "ado", "jenkins", "udeploy", "artifactory", "checkmarx", "servicenow", "contrast", "sonatypeiq", "openshift"];
           const labelWidth = 14;
           const statusWidth = 9;
           for (const svc of services) {
@@ -5210,6 +5425,41 @@ async function initGlobalConfig(start) {
       }
     }
   }
+  process.stderr.write("\n\u2500\u2500 OpenShift / Kubernetes \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  const useOpenShift = await confirm({
+    message: "Configure OpenShift / Kubernetes for pod health monitoring?",
+    default: false
+  });
+  let openShiftBaseUrl = "";
+  let openShiftToken = "";
+  if (useOpenShift) {
+    process.stderr.write("  Service account token: cat /var/run/secrets/kubernetes.io/serviceaccount/token\n");
+    openShiftBaseUrl = await input({
+      message: "OpenShift API server URL (e.g. https://api.cluster.example.com:6443):",
+      default: ""
+    });
+    openShiftToken = await password({
+      message: "Service account token:"
+    });
+    if (openShiftBaseUrl && openShiftToken) {
+      process.stderr.write("\n  Verifying connection...\n");
+      try {
+        const tempConfig = {
+          ...loadConfig(),
+          openshift: {
+            baseUrl: normalizeBaseUrl(openShiftBaseUrl),
+            token: openShiftToken
+          }
+        };
+        const tempHttp = createHttpClient(tempConfig);
+        await tempHttp.openshift("/api/v1");
+        process.stderr.write("  Connected.\n");
+      } catch (err) {
+        warn(`Could not connect to OpenShift: ${err instanceof Error ? err.message : String(err)}`);
+        warn("Config will be saved anyway. Check your URL and token and re-run pncli config init or pncli config test.");
+      }
+    }
+  }
   process.stderr.write("\n\u2500\u2500 Defaults \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
   const jiraProject = await input({
     message: "Default Jira project key (optional):",
@@ -5327,6 +5577,12 @@ async function initGlobalConfig(start) {
         passcode: sonatypeIqPasscode || void 0
       }
     } : {},
+    ...useOpenShift && openShiftBaseUrl ? {
+      openshift: {
+        baseUrl: normalizeBaseUrl(openShiftBaseUrl),
+        token: openShiftToken || void 0
+      }
+    } : {},
     defaults: {
       jira: {
         project: jiraProject || void 0
@@ -5777,6 +6033,8 @@ function registerAdoProjectCommands(ado) {
 }
 
 // src/services/ado/commands/work.ts
+import fs3 from "fs";
+import path6 from "path";
 function registerAdoWorkCommands(ado) {
   const work = ado.command("work").description("Azure DevOps work item operations");
   work.command("get").description("Get a work item by ID").requiredOption("--id <n>", "Work item ID").action(async (opts) => {
@@ -5917,6 +6175,65 @@ function registerAdoWorkCommands(ado) {
       fail(err, "ado", "work-add-comment", start);
     }
   });
+  work.command("add-tag").description("Add one or more tags to a work item (non-destructive)").requiredOption("--id <n>", "Work item ID").requiredOption("--tags <tags>", "Semicolon- or comma-separated tags to add").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { collection, workClient } = getAdoContext(ado);
+      const tags = opts.tags.split(/[;,]/).map((t) => t.trim()).filter(Boolean);
+      const data = await workClient.addTags(collection, parseInt(opts.id, 10), tags);
+      success(data, "ado", "work-add-tag", start);
+    } catch (err) {
+      fail(err, "ado", "work-add-tag", start);
+    }
+  });
+  work.command("remove-tag").description("Remove one or more tags from a work item (non-destructive)").requiredOption("--id <n>", "Work item ID").requiredOption("--tags <tags>", "Semicolon- or comma-separated tags to remove").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { collection, workClient } = getAdoContext(ado);
+      const tags = opts.tags.split(/[;,]/).map((t) => t.trim()).filter(Boolean);
+      const data = await workClient.removeTags(collection, parseInt(opts.id, 10), tags);
+      success(data, "ado", "work-remove-tag", start);
+    } catch (err) {
+      fail(err, "ado", "work-remove-tag", start);
+    }
+  });
+  work.command("list-attachments").description("List attachments on a work item").requiredOption("--id <n>", "Work item ID").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { collection, workClient } = getAdoContext(ado);
+      const data = await workClient.listAttachments(collection, parseInt(opts.id, 10));
+      success(data, "ado", "work-list-attachments", start);
+    } catch (err) {
+      fail(err, "ado", "work-list-attachments", start);
+    }
+  });
+  work.command("add-attachment").description("Upload a local file and attach it to a work item").requiredOption("--id <n>", "Work item ID").requiredOption("--file <path>", "Path to the file to upload").option("--comment <text>", "Optional comment for the attachment").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { collection, workClient } = getAdoContext(ado);
+      const data = await workClient.uploadAttachment(collection, parseInt(opts.id, 10), opts.file, opts.comment);
+      success(data, "ado", "work-add-attachment", start);
+    } catch (err) {
+      fail(err, "ado", "work-add-attachment", start);
+    }
+  });
+  work.command("download-attachment").description("Download a work item attachment to .pncli/ (or --dir)").requiredOption("--id <n>", "Work item ID").requiredOption("--attachment-id <guid>", "Attachment ID from work list-attachments output").option("--dir <path>", "Output directory (default: .pncli relative to cwd)").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { collection, workClient } = getAdoContext(ado);
+      const attachments = await workClient.listAttachments(collection, parseInt(opts.id, 10));
+      const attachment = attachments.find((a) => a.id === opts.attachmentId);
+      if (!attachment) throw new PncliError(`Attachment not found: ${opts.attachmentId}`, 1);
+      const outDir = opts.dir ?? path6.join(process.cwd(), ".pncli");
+      fs3.mkdirSync(outDir, { recursive: true });
+      const outPath = path6.join(outDir, path6.basename(attachment.name));
+      const buffer = await workClient.downloadAttachment(attachment.url);
+      fs3.writeFileSync(outPath, buffer);
+      success({ saved: outPath, name: attachment.name, size: buffer.length }, "ado", "work-download-attachment", start);
+    } catch (err) {
+      fail(err, "ado", "work-download-attachment", start);
+    }
+  });
   work.command("types").description("List work item types in the project").option("--discover", "Fetch from server (always true for this command)").option("--save", "Save discovered types to ~/.pncli/config.json").action(async (opts) => {
     const start = Date.now();
     try {
@@ -5925,10 +6242,10 @@ function registerAdoWorkCommands(ado) {
       const types = await discoverTypes(workClient, collection, project);
       if (opts.save) {
         const globalConfigPath = getGlobalConfigPath(globalOpts.config);
-        const fs4 = await import("fs");
-        const existing = JSON.parse(fs4.readFileSync(globalConfigPath, "utf8") || "{}");
+        const fs5 = await import("fs");
+        const existing = JSON.parse(fs5.readFileSync(globalConfigPath, "utf8") || "{}");
         existing.ado = { ...existing.ado ?? {}, discoveredTypes: types };
-        fs4.writeFileSync(globalConfigPath, JSON.stringify(existing, null, 2) + "\n", "utf8");
+        fs5.writeFileSync(globalConfigPath, JSON.stringify(existing, null, 2) + "\n", "utf8");
         warn(`Saved ${types.length} types to ${globalConfigPath}`);
       }
       success(types, "ado", "work-types", start);
@@ -5957,11 +6274,11 @@ function registerAdoWorkCommands(ado) {
       ) : allFields;
       if (opts.save) {
         const globalConfigPath = getGlobalConfigPath(globalOpts.config);
-        const fs4 = await import("fs");
-        const existing = JSON.parse(fs4.readFileSync(globalConfigPath, "utf8") || "{}");
+        const fs5 = await import("fs");
+        const existing = JSON.parse(fs5.readFileSync(globalConfigPath, "utf8") || "{}");
         const aliases = buildDefaultAliases(allFields);
         existing.ado = { ...existing.ado ?? {}, discoveredFields: allFields, fieldAliases: aliases };
-        fs4.writeFileSync(globalConfigPath, JSON.stringify(existing, null, 2) + "\n", "utf8");
+        fs5.writeFileSync(globalConfigPath, JSON.stringify(existing, null, 2) + "\n", "utf8");
         warn(`Saved ${allFields.length} fields and ${Object.keys(aliases).length} aliases to ${globalConfigPath}`);
       }
       success(fields, "ado", "work-fields", start);
@@ -6238,11 +6555,11 @@ function registerAdoRepoCommands(ado) {
       const start = Date.now();
       try {
         const globalOpts = ado.optsWithGlobals();
-        const { loadConfig: lc } = await import("./config-OFLPO5DN.js");
+        const { loadConfig: lc } = await import("./config-TL5X47RY.js");
         const config = lc({ configPath: globalOpts.config });
         const { collection, project, repo: repo2, gitClient } = getAdoContext(ado, true);
         const { AdoCoreClient: AdoCoreClient2 } = await import("./core-SWYVXOQ4.js");
-        const { createHttpClient: createHttpClient2 } = await import("./http-5GDQYH62.js");
+        const { createHttpClient: createHttpClient2 } = await import("./http-UN6N4WIB.js");
         const http = createHttpClient2(config, Boolean(globalOpts.dryRun));
         const coreClient = new AdoCoreClient2(http);
         const me = await coreClient.getConnectionData(collection);
@@ -6643,18 +6960,18 @@ var ArtifactoryClient = class {
       }
     });
   }
-  async getStorageInfo(repo, path6) {
-    const cleanPath = path6.startsWith("/") ? path6.slice(1) : path6;
+  async getStorageInfo(repo, path8) {
+    const cleanPath = path8.startsWith("/") ? path8.slice(1) : path8;
     return this.http.artifactory(`${API9}/storage/${repo}/${cleanPath}`);
   }
-  async getProperties(repo, path6) {
-    const cleanPath = path6.startsWith("/") ? path6.slice(1) : path6;
+  async getProperties(repo, path8) {
+    const cleanPath = path8.startsWith("/") ? path8.slice(1) : path8;
     return this.http.artifactory(`${API9}/storage/${repo}/${cleanPath}`, {
       params: { properties: "" }
     });
   }
-  async setProperties(repo, path6, properties, opts = {}) {
-    const cleanPath = path6.startsWith("/") ? path6.slice(1) : path6;
+  async setProperties(repo, path8, properties, opts = {}) {
+    const cleanPath = path8.startsWith("/") ? path8.slice(1) : path8;
     const propString = Object.entries(properties).map(([k, v]) => `${k}=${v}`).join(";");
     await this.http.artifactory(`${API9}/storage/${repo}/${cleanPath}`, {
       method: "PUT",
@@ -6736,27 +7053,27 @@ function registerArtifactoryCommands(program2) {
       fail(err, "artifactory", "repos", start);
     }
   });
-  art.command("artifact-info <repo> <path>").description("Get metadata for an artifact or folder (checksums, size, timestamps)").action(async (repo, path6) => {
+  art.command("artifact-info <repo> <path>").description("Get metadata for an artifact or folder (checksums, size, timestamps)").action(async (repo, path8) => {
     const start = Date.now();
     try {
       const client = getClient7(program2);
-      const data = await client.getStorageInfo(repo, path6);
+      const data = await client.getStorageInfo(repo, path8);
       success(data, "artifactory", "artifact-info", start);
     } catch (err) {
       fail(err, "artifactory", "artifact-info", start);
     }
   });
-  art.command("properties-get <repo> <path>").description("Read custom properties on an artifact").action(async (repo, path6) => {
+  art.command("properties-get <repo> <path>").description("Read custom properties on an artifact").action(async (repo, path8) => {
     const start = Date.now();
     try {
       const client = getClient7(program2);
-      const data = await client.getProperties(repo, path6);
+      const data = await client.getProperties(repo, path8);
       success(data, "artifactory", "properties-get", start);
     } catch (err) {
       fail(err, "artifactory", "properties-get", start);
     }
   });
-  art.command("properties-set <repo> <path> [keyvals...]").description("Set custom properties on an artifact (format: key=value key=value...)").option("--recursive", "Apply recursively to folder contents", false).action(async (repo, path6, keyvals, opts) => {
+  art.command("properties-set <repo> <path> [keyvals...]").description("Set custom properties on an artifact (format: key=value key=value...)").option("--recursive", "Apply recursively to folder contents", false).action(async (repo, path8, keyvals, opts) => {
     const start = Date.now();
     try {
       if (!keyvals.length) throw new PncliError("Provide at least one key=value pair");
@@ -6767,8 +7084,8 @@ function registerArtifactoryCommands(program2) {
         properties[kv.slice(0, eq)] = kv.slice(eq + 1);
       }
       const client = getClient7(program2);
-      await client.setProperties(repo, path6, properties, { recursive: opts.recursive });
-      success({ repo, path: path6, properties }, "artifactory", "properties-set", start);
+      await client.setProperties(repo, path8, properties, { recursive: opts.recursive });
+      success({ repo, path: path8, properties }, "artifactory", "properties-set", start);
     } catch (err) {
       fail(err, "artifactory", "properties-set", start);
     }
@@ -7372,8 +7689,8 @@ function registerSonatypeIqCommands(program2) {
     const startTime = Date.now();
     try {
       const http = getHttpClient(program2);
-      const path6 = opts.organizationId ? `/api/v2/policies/organization/${encodeURIComponent(opts.organizationId)}` : "/api/v2/policies";
-      const data = await http.sonatypeiq(path6);
+      const path8 = opts.organizationId ? `/api/v2/policies/organization/${encodeURIComponent(opts.organizationId)}` : "/api/v2/policies";
+      const data = await http.sonatypeiq(path8);
       success(data, "sonatypeiq", "policies list", startTime);
     } catch (err) {
       fail(err, "sonatypeiq", "policies list", startTime);
@@ -7382,8 +7699,8 @@ function registerSonatypeIqCommands(program2) {
 }
 
 // src/services/skills/commands.ts
-import fs3 from "fs";
-import path5 from "path";
+import fs4 from "fs";
+import path7 from "path";
 import os from "os";
 import { fileURLToPath } from "url";
 import { execFileSync as execFileSync3 } from "child_process";
@@ -7409,16 +7726,16 @@ function repoNameFromUrl(url) {
   }
 }
 function defaultMarketplacePath(url) {
-  return path5.join(os.homedir(), ".agents", "marketplaces", repoNameFromUrl(url));
+  return path7.join(os.homedir(), ".agents", "marketplaces", repoNameFromUrl(url));
 }
 var AGENT_PATHS = {
-  "github-copilot": { project: ".agents/skills", user: path5.join(os.homedir(), ".copilot/skills") },
-  "claude-code": { project: ".claude/skills", user: path5.join(os.homedir(), ".claude/skills") }
+  "github-copilot": { project: ".agents/skills", user: path7.join(os.homedir(), ".copilot/skills") },
+  "claude-code": { project: ".claude/skills", user: path7.join(os.homedir(), ".claude/skills") }
 };
 function getBundledSkillsDir() {
   try {
     const thisFile = fileURLToPath(import.meta.url);
-    return path5.resolve(path5.dirname(thisFile), "..", "skills");
+    return path7.resolve(path7.dirname(thisFile), "..", "skills");
   } catch {
     return "";
   }
@@ -7430,22 +7747,22 @@ function registerSkillsCommands(program2) {
     try {
       let targetDir;
       if (opts.target) {
-        targetDir = path5.resolve(opts.target);
+        targetDir = path7.resolve(opts.target);
       } else {
         const agentConfig = AGENT_PATHS[opts.agent];
         if (!agentConfig) {
           throw new Error(`Unknown agent: "${opts.agent}". Use: ${Object.keys(AGENT_PATHS).join(" | ")}`);
         }
         const scopePath = opts.scope === "user" ? agentConfig.user : agentConfig.project;
-        targetDir = path5.resolve(scopePath);
+        targetDir = path7.resolve(scopePath);
       }
-      const resolvedTarget = path5.resolve(targetDir);
+      const resolvedTarget = path7.resolve(targetDir);
       const bundledDir = getBundledSkillsDir();
       let skillDirs = [];
       if (bundledDir !== "") {
         try {
-          skillDirs = fs3.readdirSync(bundledDir).filter(
-            (name) => fs3.existsSync(path5.join(bundledDir, name, "SKILL.md"))
+          skillDirs = fs4.readdirSync(bundledDir).filter(
+            (name) => fs4.existsSync(path7.join(bundledDir, name, "SKILL.md"))
           );
         } catch {
         }
@@ -7456,25 +7773,25 @@ function registerSkillsCommands(program2) {
       const installed = [];
       const failed = [];
       for (const skillName of skillDirs) {
-        const existingDir = path5.resolve(targetDir, skillName);
-        if (!existingDir.startsWith(resolvedTarget + path5.sep)) continue;
-        if (fs3.existsSync(existingDir)) {
-          fs3.rmSync(existingDir, { recursive: true, force: true });
+        const existingDir = path7.resolve(targetDir, skillName);
+        if (!existingDir.startsWith(resolvedTarget + path7.sep)) continue;
+        if (fs4.existsSync(existingDir)) {
+          fs4.rmSync(existingDir, { recursive: true, force: true });
         }
       }
       warn(`Installing ${skillDirs.length} bundled skill(s) to ${targetDir}...`);
       for (const skillName of skillDirs) {
-        const skillDir = path5.resolve(targetDir, skillName);
-        if (!skillDir.startsWith(resolvedTarget + path5.sep)) {
+        const skillDir = path7.resolve(targetDir, skillName);
+        if (!skillDir.startsWith(resolvedTarget + path7.sep)) {
           failed.push(skillName);
           continue;
         }
         try {
-          const mdFiles = fs3.readdirSync(path5.join(bundledDir, skillName)).filter((f) => f.endsWith(".md"));
-          fs3.mkdirSync(skillDir, { recursive: true });
+          const mdFiles = fs4.readdirSync(path7.join(bundledDir, skillName)).filter((f) => f.endsWith(".md"));
+          fs4.mkdirSync(skillDir, { recursive: true });
           for (const mdFile of mdFiles) {
-            const content = fs3.readFileSync(path5.join(bundledDir, skillName, mdFile), "utf8");
-            fs3.writeFileSync(path5.join(skillDir, mdFile), content, "utf8");
+            const content = fs4.readFileSync(path7.join(bundledDir, skillName, mdFile), "utf8");
+            fs4.writeFileSync(path7.join(skillDir, mdFile), content, "utf8");
           }
           installed.push(skillName);
         } catch {
@@ -7503,25 +7820,25 @@ function registerSkillsCommands(program2) {
     try {
       let targetDir;
       if (opts.target) {
-        targetDir = path5.resolve(opts.target);
+        targetDir = path7.resolve(opts.target);
       } else {
         const agentConfig = AGENT_PATHS[opts.agent];
         if (!agentConfig) {
           throw new Error(`Unknown agent: "${opts.agent}". Use: ${Object.keys(AGENT_PATHS).join(" | ")}`);
         }
         const scopePath = opts.scope === "user" ? agentConfig.user : agentConfig.project;
-        targetDir = path5.resolve(scopePath);
+        targetDir = path7.resolve(scopePath);
       }
-      if (!fs3.existsSync(targetDir)) {
+      if (!fs4.existsSync(targetDir)) {
         success({ skills: [], message: `No skills directory found at ${targetDir}. Run: pncli skills install` }, "skills", "list", start);
         return;
       }
-      const skillDirs = fs3.readdirSync(targetDir).filter((name) => {
-        const skillPath = path5.join(targetDir, name, "SKILL.md");
-        return fs3.existsSync(skillPath);
+      const skillDirs = fs4.readdirSync(targetDir).filter((name) => {
+        const skillPath = path7.join(targetDir, name, "SKILL.md");
+        return fs4.existsSync(skillPath);
       });
       const skillsList = skillDirs.map((name) => {
-        const content = fs3.readFileSync(path5.join(targetDir, name, "SKILL.md"), "utf8");
+        const content = fs4.readFileSync(path7.join(targetDir, name, "SKILL.md"), "utf8");
         const frontmatter = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
         const data = {};
         const metadata = {};
@@ -7563,9 +7880,9 @@ function registerSkillsCommands(program2) {
   marketplace.command("setup").description("Clone a skills marketplace repo and register it in global config").argument("<url>", "Git clone URL of the marketplace repository").argument("[localPath]", "Local directory to clone into (default: ~/.agents/marketplaces/<repo-name>)").option("--branch <branch>", "Branch to clone (default: remote HEAD)").option("--token <token>", "HTTP access token for authenticated clone and pull (GitHub PAT or Bitbucket token)").action(async (url, localPath, opts) => {
     const start = Date.now();
     try {
-      const resolvedPath = path5.resolve(localPath ?? defaultMarketplacePath(url));
-      const hasGit = fs3.existsSync(path5.join(resolvedPath, ".git"));
-      if (fs3.existsSync(resolvedPath) && !hasGit && fs3.readdirSync(resolvedPath).length > 0) {
+      const resolvedPath = path7.resolve(localPath ?? defaultMarketplacePath(url));
+      const hasGit = fs4.existsSync(path7.join(resolvedPath, ".git"));
+      if (fs4.existsSync(resolvedPath) && !hasGit && fs4.readdirSync(resolvedPath).length > 0) {
         throw new Error(`Directory already exists and is not a git repo: ${resolvedPath}`);
       }
       if (hasGit) {
@@ -7599,7 +7916,7 @@ function registerSkillsCommands(program2) {
       const configPath = getGlobalConfigPath();
       const globalConfig = loadJsonFile(configPath) ?? {};
       const marketplacePath = globalConfig.marketplace?.localPath;
-      if (!marketplacePath || !fs3.existsSync(marketplacePath)) {
+      if (!marketplacePath || !fs4.existsSync(marketplacePath)) {
         throw new Error("Marketplace not configured. Run: pncli skills marketplace setup <url> <localPath>");
       }
       warn("Pulling latest marketplace content...");
@@ -7636,13 +7953,13 @@ function registerSkillsCommands(program2) {
       if (pluginChoices.length === 0) {
         throw new Error("No plugins found in marketplace. Check the marketplace repository structure.");
       }
-      const targetDir = opts.claude ? path5.join(os.homedir(), ".claude", "skills") : path5.join(os.homedir(), ".agents", "skills");
+      const targetDir = opts.claude ? path7.join(os.homedir(), ".claude", "skills") : path7.join(os.homedir(), ".agents", "skills");
       if (plugin === "all") {
         const results = {};
         let totalInstalled = 0;
         for (const pluginChoice of pluginChoices) {
           const skillsSrc2 = resolveSkillsSrc(marketplacePath, pluginChoice.name);
-          if (!fs3.existsSync(skillsSrc2)) {
+          if (!fs4.existsSync(skillsSrc2)) {
             results[pluginChoice.name] = { installed: [], failed: [] };
             warn(`No skills directory found for plugin "${pluginChoice.name}" \u2014 skipping.`);
             continue;
@@ -7650,6 +7967,9 @@ function registerSkillsCommands(program2) {
           const { installed: installed2, failed: failed2 } = copyPluginSkills(skillsSrc2, targetDir);
           results[pluginChoice.name] = { installed: installed2, failed: failed2 };
           totalInstalled += installed2.length;
+          for (const skill of installed2) {
+            warn(`  ${skill}: ${path7.join(skillsSrc2, skill)} \u2192 ${path7.join(targetDir, skill)}`);
+          }
           if (failed2.length > 0) {
             warn(`Skipped ${failed2.length} skill(s) with invalid names in "${pluginChoice.name}": ${failed2.join(", ")}`);
           }
@@ -7678,10 +7998,13 @@ function registerSkillsCommands(program2) {
         });
       }
       const skillsSrc = resolveSkillsSrc(marketplacePath, selectedPlugin);
-      if (!fs3.existsSync(skillsSrc)) {
+      if (!fs4.existsSync(skillsSrc)) {
         throw new Error(`No skills directory found at ${skillsSrc}`);
       }
       const { installed, failed } = copyPluginSkills(skillsSrc, targetDir);
+      for (const skill of installed) {
+        warn(`  ${skill}: ${path7.join(skillsSrc, skill)} \u2192 ${path7.join(targetDir, skill)}`);
+      }
       if (failed.length > 0) {
         warn(`Skipped ${failed.length} skill(s) with invalid names: ${failed.join(", ")}`);
       }
@@ -7699,51 +8022,307 @@ function registerSkillsCommands(program2) {
   });
 }
 function resolvePluginChoices(marketplacePath) {
-  const marketplaceJsonPath = path5.join(marketplacePath, ".claude-plugin", "marketplace.json");
-  if (fs3.existsSync(marketplaceJsonPath)) {
+  const marketplaceJsonPath = path7.join(marketplacePath, ".claude-plugin", "marketplace.json");
+  if (fs4.existsSync(marketplaceJsonPath)) {
     try {
-      const meta = JSON.parse(fs3.readFileSync(marketplaceJsonPath, "utf8"));
+      const meta = JSON.parse(fs4.readFileSync(marketplaceJsonPath, "utf8"));
       if (Array.isArray(meta.plugins) && meta.plugins.length > 0) {
         return meta.plugins.map((p) => ({ name: p.name, description: p.description ?? "" }));
       }
     } catch {
     }
   }
-  const pluginsDir = path5.join(marketplacePath, "plugins");
-  if (fs3.existsSync(pluginsDir)) {
-    return fs3.readdirSync(pluginsDir).filter((name) => fs3.statSync(path5.join(pluginsDir, name)).isDirectory()).map((name) => ({ name, description: "" }));
+  const pluginsDir = path7.join(marketplacePath, "plugins");
+  if (fs4.existsSync(pluginsDir)) {
+    return fs4.readdirSync(pluginsDir).filter((name) => fs4.statSync(path7.join(pluginsDir, name)).isDirectory()).map((name) => ({ name, description: "" }));
   }
   return [];
 }
 function resolveSkillsSrc(marketplacePath, selectedPlugin) {
-  const pluginsBase = path5.resolve(marketplacePath, "plugins");
-  const skillsSrc = path5.resolve(pluginsBase, selectedPlugin, "skills");
-  if (!skillsSrc.startsWith(pluginsBase + path5.sep)) {
+  const pluginsBase = path7.resolve(marketplacePath, "plugins");
+  const skillsSrc = path7.resolve(pluginsBase, selectedPlugin, "skills");
+  if (!skillsSrc.startsWith(pluginsBase + path7.sep)) {
     throw new Error(`Invalid plugin name: "${selectedPlugin}"`);
   }
   return skillsSrc;
 }
 function copyPluginSkills(skillsSrc, targetDir) {
-  fs3.mkdirSync(targetDir, { recursive: true });
-  const resolvedTarget = path5.resolve(targetDir);
-  const skillNames = fs3.readdirSync(skillsSrc).filter(
-    (name) => fs3.statSync(path5.join(skillsSrc, name)).isDirectory()
+  fs4.mkdirSync(targetDir, { recursive: true });
+  const resolvedTarget = path7.resolve(targetDir);
+  const skillNames = fs4.readdirSync(skillsSrc).filter(
+    (name) => fs4.statSync(path7.join(skillsSrc, name)).isDirectory()
   );
   const installed = [];
   const failed = [];
   for (const skillName of skillNames) {
-    const dest = path5.resolve(targetDir, skillName);
-    if (!dest.startsWith(resolvedTarget + path5.sep)) {
+    const dest = path7.resolve(targetDir, skillName);
+    if (!dest.startsWith(resolvedTarget + path7.sep)) {
       failed.push(skillName);
       continue;
     }
-    fs3.rmSync(dest, { recursive: true, force: true });
-    fs3.cpSync(path5.join(skillsSrc, skillName), dest, { recursive: true });
+    fs4.rmSync(dest, { recursive: true, force: true });
+    fs4.cpSync(path7.join(skillsSrc, skillName), dest, { recursive: true });
     installed.push(skillName);
   }
   return { installed, failed };
 }
 
+// src/services/jwt/commands.ts
+function base64urlDecode(input2) {
+  const base64 = input2.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+  return Buffer.from(padded, "base64").toString("utf8");
+}
+function decodeJwt(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    throw new PncliError("Invalid JWT: expected 3 dot-separated parts", 1);
+  }
+  const [rawHeader, rawPayload, signature] = parts;
+  let header;
+  let payload;
+  try {
+    header = JSON.parse(base64urlDecode(rawHeader));
+  } catch {
+    throw new PncliError("Invalid JWT: header is not valid JSON", 1);
+  }
+  try {
+    payload = JSON.parse(base64urlDecode(rawPayload));
+  } catch {
+    throw new PncliError("Invalid JWT: payload is not valid JSON", 1);
+  }
+  return { header, payload, signature };
+}
+function registerJwtCommands(program2) {
+  const jwt = program2.command("jwt").description("JWT token utilities");
+  jwt.command("decode <token>").description("Decode a JWT token and output header, payload, and signature as JSON").action((token) => {
+    const start = Date.now();
+    try {
+      const data = decodeJwt(token);
+      success(data, "jwt", "decode", start);
+    } catch (err) {
+      fail(err, "jwt", "decode", start);
+    }
+  });
+}
+
+// src/services/openshift/commands.ts
+function containerState(s) {
+  if (!s) return "unknown";
+  if (s.waiting) return s.waiting.reason ?? "Waiting";
+  if (s.terminated) return s.terminated.reason ?? "Terminated";
+  if (s.running) return "Running";
+  return "unknown";
+}
+function getHttp2(program2) {
+  const opts = program2.optsWithGlobals();
+  const config = loadConfig({ configPath: opts.config });
+  if (!config.openshift.baseUrl) {
+    throw new PncliError("OpenShift not configured. Run: pncli config init");
+  }
+  return createHttpClient(config, Boolean(opts.dryRun));
+}
+function podAge(creationTimestamp) {
+  if (!creationTimestamp) return "unknown";
+  const ageMs = Date.now() - new Date(creationTimestamp).getTime();
+  const ageSeconds = Math.floor(ageMs / 1e3);
+  if (ageSeconds < 60) return `${ageSeconds}s`;
+  const ageMinutes = Math.floor(ageSeconds / 60);
+  if (ageMinutes < 60) return `${ageMinutes}m`;
+  const ageHours = Math.floor(ageMinutes / 60);
+  if (ageHours < 24) return `${ageHours}h`;
+  return `${Math.floor(ageHours / 24)}d`;
+}
+function registerOpenShiftCommands(program2) {
+  const oc = program2.command("openshift").description("OpenShift / Kubernetes operations");
+  oc.command("pods").description("List pod health summary for a namespace \u2014 pre-processed for LLM analysis").requiredOption("--namespace <ns>", "Kubernetes namespace").option("--label-selector <selector>", "Label selector (e.g. app=my-app)").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const http = getHttp2(program2);
+      const params = {};
+      if (opts.labelSelector) params["labelSelector"] = opts.labelSelector;
+      const podList = await http.openshift(
+        `/api/v1/namespaces/${encodeURIComponent(opts.namespace)}/pods`,
+        { params }
+      );
+      const summaryCounters = {
+        total: podList.items.length,
+        running: 0,
+        pending: 0,
+        failed: 0,
+        succeeded: 0,
+        unknown: 0,
+        crashLoopBackOff: 0,
+        oomKilled: 0,
+        imagePullBackOff: 0,
+        totalRestarts: 0
+      };
+      const pods = podList.items.map((pod) => {
+        const phase = pod.status.phase ?? "Unknown";
+        switch (phase.toLowerCase()) {
+          case "running":
+            summaryCounters.running++;
+            break;
+          case "pending":
+            summaryCounters.pending++;
+            break;
+          case "failed":
+            summaryCounters.failed++;
+            break;
+          case "succeeded":
+            summaryCounters.succeeded++;
+            break;
+          default:
+            summaryCounters.unknown++;
+            break;
+        }
+        const allStatuses = [
+          ...pod.status.containerStatuses ?? [],
+          ...pod.status.initContainerStatuses ?? []
+        ];
+        let podRestarts = 0;
+        const containers = allStatuses.map((cs) => {
+          podRestarts += cs.restartCount;
+          summaryCounters.totalRestarts += cs.restartCount;
+          const currentState = containerState(cs.state);
+          const lastState = containerState(cs.lastState);
+          if (currentState === "CrashLoopBackOff") summaryCounters.crashLoopBackOff++;
+          if (currentState === "ImagePullBackOff" || currentState === "ErrImagePull") summaryCounters.imagePullBackOff++;
+          if (lastState === "OOMKilled" || cs.lastState?.terminated?.reason === "OOMKilled") summaryCounters.oomKilled++;
+          const entry2 = {
+            name: cs.name,
+            ready: cs.ready,
+            restartCount: cs.restartCount,
+            state: currentState
+          };
+          if (cs.lastState?.terminated) {
+            entry2["lastExitCode"] = cs.lastState.terminated.exitCode;
+            entry2["lastReason"] = cs.lastState.terminated.reason;
+          }
+          return entry2;
+        });
+        const readyCount = allStatuses.filter((cs) => cs.ready).length;
+        const totalCount = pod.spec.containers?.length ?? allStatuses.length;
+        const entry = {
+          name: pod.metadata.name,
+          phase,
+          ready: `${readyCount}/${totalCount}`,
+          restartCount: podRestarts,
+          age: podAge(pod.metadata.creationTimestamp)
+        };
+        const podReason = pod.status.reason ?? pod.status.conditions?.find((c) => c.status === "False")?.reason;
+        if (podReason) entry["reason"] = podReason;
+        if (pod.status.message) entry["message"] = pod.status.message;
+        if (containers.length > 0) entry["containers"] = containers;
+        if (pod.metadata.labels && Object.keys(pod.metadata.labels).length > 0) {
+          entry["labels"] = pod.metadata.labels;
+        }
+        return entry;
+      });
+      pods.sort((a, b) => {
+        const phasePriority = (p) => {
+          if (p === "Failed") return 0;
+          if (p === "Pending") return 1;
+          if (p === "Unknown") return 2;
+          return 3;
+        };
+        const pDiff = phasePriority(a["phase"]) - phasePriority(b["phase"]);
+        if (pDiff !== 0) return pDiff;
+        return (b["restartCount"] ?? 0) - (a["restartCount"] ?? 0);
+      });
+      success({ namespace: opts.namespace, summary: summaryCounters, pods }, "openshift", "pods", start);
+    } catch (err) {
+      fail(err, "openshift", "pods", start);
+    }
+  });
+  oc.command("events").description("List Warning events for a namespace \u2014 pre-filtered for LLM analysis").requiredOption("--namespace <ns>", "Kubernetes namespace").option("--field-selector <selector>", "Additional field selector (e.g. involvedObject.name=my-pod)").option("--all", "Include Normal events in addition to Warning events", false).action(async (opts) => {
+    const start = Date.now();
+    try {
+      const http = getHttp2(program2);
+      const params = {};
+      const selectors = [];
+      if (!opts.all) selectors.push("type=Warning");
+      if (opts.fieldSelector) selectors.push(opts.fieldSelector);
+      if (selectors.length > 0) params["fieldSelector"] = selectors.join(",");
+      const eventList = await http.openshift(
+        `/api/v1/namespaces/${encodeURIComponent(opts.namespace)}/events`,
+        { params }
+      );
+      const events = eventList.items.map((ev) => {
+        const obj = ev.involvedObject ?? ev.regarding;
+        const entry = {
+          type: ev.type ?? "Normal",
+          reason: ev.reason,
+          object: obj ? `${obj.kind ?? "Object"}/${obj.name ?? "?"}` : void 0,
+          message: ev.message,
+          count: ev.count ?? 1,
+          firstTime: ev.firstTimestamp ?? ev.eventTime,
+          lastTime: ev.lastTimestamp ?? ev.eventTime
+        };
+        const source = ev.source?.component ?? ev.reportingComponent;
+        if (source) entry["source"] = source;
+        return entry;
+      });
+      events.sort((a, b) => (b["count"] ?? 0) - (a["count"] ?? 0));
+      success({ namespace: opts.namespace, count: events.length, events }, "openshift", "events", start);
+    } catch (err) {
+      fail(err, "openshift", "events", start);
+    }
+  });
+  oc.command("logs").description("Get recent log lines from a pod container").requiredOption("--namespace <ns>", "Kubernetes namespace").requiredOption("--pod <name>", "Pod name").option("--container <name>", "Container name (defaults to first container)").option("--lines <n>", "Number of most-recent lines to return", "100").option("--previous", "Return logs from the previous container instance", false).action(async (opts) => {
+    const start = Date.now();
+    try {
+      const http = getHttp2(program2);
+      const lines = opts.lines ? parseInt(opts.lines, 10) : 100;
+      const logText = await http.openshiftText(
+        `/api/v1/namespaces/${encodeURIComponent(opts.namespace)}/pods/${encodeURIComponent(opts.pod)}/log`,
+        {
+          lines,
+          params: {
+            ...opts.container ? { container: opts.container } : {},
+            ...opts.previous ? { previous: "true" } : {}
+          }
+        }
+      );
+      success(
+        {
+          pod: opts.pod,
+          namespace: opts.namespace,
+          container: opts.container ?? "(default)",
+          previous: opts.previous ?? false,
+          lines,
+          log: logText
+        },
+        "openshift",
+        "logs",
+        start
+      );
+    } catch (err) {
+      fail(err, "openshift", "logs", start);
+    }
+  });
+  oc.command("pod-metrics").description("Get CPU and memory usage for pods in a namespace (requires metrics-server)").requiredOption("--namespace <ns>", "Kubernetes namespace").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const http = getHttp2(program2);
+      const metricsList = await http.openshift(
+        `/apis/metrics.k8s.io/v1beta1/namespaces/${encodeURIComponent(opts.namespace)}/pods`
+      );
+      const pods = metricsList.items.map((pm) => ({
+        name: pm.metadata.name,
+        containers: pm.containers.map((c) => ({
+          name: c.name,
+          cpu: c.usage.cpu,
+          memory: c.usage.memory
+        }))
+      }));
+      success({ namespace: opts.namespace, pods }, "openshift", "pod-metrics", start);
+    } catch (err) {
+      fail(err, "openshift", "pod-metrics", start);
+    }
+  });
+}
+
 // src/cli.ts
 if (!process.env.PNCLI_VERIFY_TLS) {
   process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
@@ -7783,6 +8362,8 @@ registerServiceNowCommands(program);
 registerContrastCommands(program);
 registerSonatypeIqCommands(program);
 registerSkillsCommands(program);
+registerJwtCommands(program);
+registerOpenShiftCommands(program);
 program.addHelpText("after", `
 Services:
   git          Local git operations (status, diff, log, branch)
@@ -7800,8 +8381,10 @@ Services:
   servicenow   ServiceNow (change requests)
   contrast     Contrast IAST (applications, vulnerability findings)
   sonatypeiq   Sonatype IQ Server (applications, organizations, policies)
+  openshift    OpenShift / Kubernetes (pods, events, logs, metrics)
   config       Manage pncli configuration
   skills       Download and manage Claude Code skills
+  jwt          JWT token utilities (decode header and payload)
 `);
 program.parseAsync(process.argv).catch((err) => {
   if (process.exitCode !== void 0) return;