@kolatts/pncli 1.18.0 → 1.19.0

package/dist/cli.js

@@ -8,7 +8,7 @@ import {
   setRepoConfigValue,
   writeGlobalConfig,
   writeRepoConfig
-} from "./chunk-IVUDXPDP.js";
+} from "./chunk-FXY262BR.js";
 import {
   ExitCode,
   PncliError,
@@ -20,7 +20,7 @@ import {
   success,
   warn,
   writeRawOutput
-} from "./chunk-WX4ZRHIC.js";
+} from "./chunk-WM5NYVEO.js";
 import {
   AdoCoreClient
 } from "./chunk-VDL32PSG.js";
@@ -683,9 +683,9 @@ var BitbucketClient = class {
   async getDiff(project, repo, prId, file, contextLines) {
     const params = {};
     if (contextLines !== void 0) params.contextLines = contextLines;
-    if (file) params.path = file;
+    const diffPath = file ? `${API}/projects/${project}/repos/${repo}/pull-requests/${prId}/diff/${file}` : `${API}/projects/${project}/repos/${repo}/pull-requests/${prId}/diff`;
     const result = await this.http.bitbucket(
-      `${API}/projects/${project}/repos/${repo}/pull-requests/${prId}/diff`,
+      diffPath,
       { params }
     );
     return typeof result === "string" ? result : JSON.stringify(result);
@@ -5639,9 +5639,9 @@ function registerConfigCommands(program2) {
       } else {
         results.udeploy = { ok: null, message: "not configured" };
       }
-      if (cfg.checkmarx.baseUrl && cfg.checkmarx.username && cfg.checkmarx.password) {
+      if (cfg.checkmarx.baseUrl && cfg.checkmarx.tenantName && (cfg.checkmarx.apiKey || cfg.checkmarx.clientId && cfg.checkmarx.clientSecret)) {
         try {
-          await http.checkmarx("/cxrestapi/projects");
+          await http.checkmarx("/api/projects", { params: { limit: 1 } });
           results.checkmarx = { ok: true, message: "connected" };
         } catch (err) {
           results.checkmarx = { ok: false, message: err instanceof Error ? err.message : String(err) };
@@ -5690,6 +5690,37 @@ function registerConfigCommands(program2) {
       } else {
         results.openshift = { ok: null, message: "not configured" };
       }
+      if (cfg.dynatrace.baseUrl && cfg.dynatrace.apiToken) {
+        try {
+          await http.dynatrace("/api/v2/entities", {
+            params: { entitySelector: 'type("SERVICE")', pageSize: 1 }
+          });
+          results.dynatrace = { ok: true, message: "connected" };
+        } catch (err) {
+          results.dynatrace = { ok: false, message: err instanceof Error ? err.message : String(err) };
+        }
+      } else {
+        results.dynatrace = { ok: null, message: "not configured" };
+      }
+      if (cfg.dynatrace.platformUrl && cfg.dynatrace.platformToken) {
+        try {
+          await http.dynatracePlatform("/platform/storage/query/v1/query:execute", {
+            method: "POST",
+            body: {
+              query: "fetch spans | limit 1",
+              requestTimeoutMilliseconds: 5e3
+            },
+            timeoutMs: 1e4
+          });
+          results.dynatrace_platform = { ok: true, message: "connected" };
+        } catch (err) {
+          results.dynatrace_platform = { ok: false, message: err instanceof Error ? err.message : String(err) };
+        }
+      } else if (cfg.dynatrace.platformUrl || cfg.dynatrace.platformToken) {
+        results.dynatrace_platform = { ok: false, message: "platformUrl and platformToken must both be configured" };
+      } else {
+        results.dynatrace_platform = { ok: null, message: "not configured" };
+      }
       success(results, "config", "test", start);
     } catch (err) {
       fail(err, "config", "test", start);
@@ -5836,13 +5867,13 @@ function registerConfigCommands(program2) {
       } else {
         results.artifactory = { status: "valid", message: "ok" };
       }
-      if (!cfg.checkmarx.username || !cfg.checkmarx.password) {
+      if (!cfg.checkmarx.tenantName || !cfg.checkmarx.apiKey && (!cfg.checkmarx.clientId || !cfg.checkmarx.clientSecret)) {
         results.checkmarx = { status: "blank", message: "not configured" };
       } else if (!cfg.checkmarx.baseUrl) {
         results.checkmarx = { status: "error", message: "baseUrl not configured" };
       } else {
         try {
-          await http.checkmarx("/cxrestapi/projects", { timeoutMs: 1e4 });
+          await http.checkmarx("/api/projects", { params: { limit: 1 }, timeoutMs: 1e4 });
           results.checkmarx = { status: "valid", message: "ok" };
         } catch (err) {
           results.checkmarx = categorize2(err);
@@ -5897,11 +5928,48 @@ function registerConfigCommands(program2) {
           results.openshift = categorize2(err);
         }
       }
+      if (!cfg.dynatrace.apiToken) {
+        results.dynatrace = { status: "blank", message: "not configured" };
+      } else if (!cfg.dynatrace.baseUrl) {
+        results.dynatrace = { status: "error", message: "baseUrl not configured" };
+      } else {
+        try {
+          await http.dynatrace("/api/v2/entities", {
+            params: { entitySelector: 'type("SERVICE")', pageSize: 1 },
+            timeoutMs: 1e4
+          });
+          results.dynatrace = { status: "valid", message: "ok" };
+        } catch (err) {
+          results.dynatrace = categorize2(err);
+        }
+      }
+      if (!cfg.dynatrace.platformUrl && !cfg.dynatrace.platformToken) {
+        results.dynatrace_platform = { status: "blank", message: "not configured" };
+      } else if (!cfg.dynatrace.platformUrl || !cfg.dynatrace.platformToken) {
+        results.dynatrace_platform = {
+          status: "error",
+          message: "platformUrl and platformToken must both be configured"
+        };
+      } else {
+        try {
+          await http.dynatracePlatform("/platform/storage/query/v1/query:execute", {
+            method: "POST",
+            body: {
+              query: "fetch spans | limit 1",
+              requestTimeoutMilliseconds: 5e3
+            },
+            timeoutMs: 1e4
+          });
+          results.dynatrace_platform = { status: "valid", message: "ok" };
+        } catch (err) {
+          results.dynatrace_platform = categorize2(err);
+        }
+      }
       const statuses = Object.values(results).map((r) => r.status);
       if (statuses.includes("invalid")) process.exitCode = ExitCode.AUTH_ERROR;
       else if (statuses.includes("error")) process.exitCode = ExitCode.NETWORK_ERROR;
       if (cmdOpts.output === "table") {
-        const services = ["jira", "bitbucket", "github", "confluence", "sonar", "sde", "ado", "jenkins", "udeploy", "artifactory", "checkmarx", "servicenow", "contrast", "sonatypeiq", "openshift"];
+        const services = ["jira", "bitbucket", "github", "confluence", "sonar", "sde", "ado", "jenkins", "udeploy", "artifactory", "checkmarx", "servicenow", "contrast", "sonatypeiq", "openshift", "dynatrace", "dynatrace_platform"];
         const labelWidth = 14;
         const statusWidth = 9;
         for (const svc of services) {
@@ -5915,7 +5983,7 @@ function registerConfigCommands(program2) {
         process.stdout.write("\n");
       } else {
         if (opts.pretty) {
-          const services = ["jira", "bitbucket", "github", "confluence", "sonar", "sde", "ado", "jenkins", "udeploy", "artifactory", "checkmarx", "servicenow", "contrast", "sonatypeiq", "openshift"];
+          const services = ["jira", "bitbucket", "github", "confluence", "sonar", "sde", "ado", "jenkins", "udeploy", "artifactory", "checkmarx", "servicenow", "contrast", "sonatypeiq", "openshift", "dynatrace", "dynatrace_platform"];
           const labelWidth = 14;
           const statusWidth = 9;
           for (const svc of services) {
@@ -6248,38 +6316,51 @@ async function initGlobalConfig(start) {
   }
   process.stderr.write("\n\u2500\u2500 Checkmarx \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
   const useCheckmarx = await confirm({
-    message: "Configure Checkmarx CxSAST for vulnerability scanning?",
+    message: "Configure Checkmarx One for vulnerability scanning?",
     default: false
   });
   let checkmarxBaseUrl = "";
-  let checkmarxUsername = "";
-  let checkmarxPassword = "";
+  let checkmarxTenantName = "";
+  let checkmarxApiKey = "";
+  let checkmarxClientId = "";
+  let checkmarxClientSecret = "";
   if (useCheckmarx) {
     checkmarxBaseUrl = await input({
-      message: "Checkmarx base URL (e.g. cx.company.com):",
+      message: "Checkmarx One API base URL (e.g. https://ast.checkmarx.net):",
       default: ""
     });
-    checkmarxUsername = await input({
-      message: "Checkmarx username:",
+    checkmarxTenantName = await input({
+      message: "Checkmarx One tenant name (IAM realm, e.g. mycompany):",
       default: ""
     });
-    checkmarxPassword = await password({
-      message: "Checkmarx password:",
-      validate: (v) => v.length > 0 || "Password cannot be blank"
+    checkmarxApiKey = await password({
+      message: "Checkmarx One API key (leave blank to use an OAuth client):"
     });
-    if (checkmarxBaseUrl && checkmarxUsername && checkmarxPassword) {
+    if (!checkmarxApiKey) {
+      checkmarxClientId = await input({
+        message: "Checkmarx One OAuth client ID:",
+        default: ""
+      });
+      checkmarxClientSecret = await password({
+        message: "Checkmarx One OAuth client secret:",
+        validate: (v) => v.length > 0 || "Client secret cannot be blank"
+      });
+    }
+    if (checkmarxBaseUrl && checkmarxTenantName && (checkmarxApiKey || checkmarxClientId && checkmarxClientSecret)) {
       process.stderr.write("\n  Verifying connection...\n");
       try {
         const tempConfig = {
           ...loadConfig(),
           checkmarx: {
             baseUrl: normalizeBaseUrl(checkmarxBaseUrl),
-            username: checkmarxUsername,
-            password: checkmarxPassword
+            tenantName: checkmarxTenantName,
+            apiKey: checkmarxApiKey || void 0,
+            clientId: checkmarxClientId,
+            clientSecret: checkmarxClientSecret
           }
         };
         const tempHttp = createHttpClient(tempConfig);
-        await tempHttp.checkmarx("/cxrestapi/projects");
+        await tempHttp.checkmarx("/api/projects", { params: { limit: 1 } });
         process.stderr.write("  Connected.\n");
       } catch (err) {
         warn(`Could not connect to Checkmarx: ${err instanceof Error ? err.message : String(err)}`);
@@ -6472,6 +6553,59 @@ async function initGlobalConfig(start) {
       }
     }
   }
+  process.stderr.write("\n\u2500\u2500 Dynatrace \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  const useDynatrace = await confirm({
+    message: "Configure Dynatrace for services, problems, workloads, and traces?",
+    default: false
+  });
+  let dynatraceBaseUrl = "";
+  let dynatraceApiToken = "";
+  let dynatracePlatformUrl = "";
+  let dynatracePlatformToken = "";
+  if (useDynatrace) {
+    dynatraceBaseUrl = await input({
+      message: "Dynatrace environment URL (e.g. https://abc12345.live.dynatrace.com):",
+      default: ""
+    });
+    dynatraceApiToken = await password({
+      message: "Environment API token (entities.read and problems.read):"
+    });
+    const configureTraces = await confirm({
+      message: "Configure the latest Dynatrace platform for Grail trace queries?",
+      default: false
+    });
+    if (configureTraces) {
+      dynatracePlatformUrl = await input({
+        message: "Dynatrace platform URL (e.g. https://abc12345.apps.dynatrace.com):",
+        default: ""
+      });
+      dynatracePlatformToken = await password({
+        message: "Platform token with Grail span read permissions:"
+      });
+    }
+    if (dynatraceBaseUrl && dynatraceApiToken) {
+      process.stderr.write("\n  Verifying connection...\n");
+      try {
+        const tempConfig = {
+          ...loadConfig(),
+          dynatrace: {
+            baseUrl: normalizeBaseUrl(dynatraceBaseUrl),
+            apiToken: dynatraceApiToken,
+            platformUrl: normalizeBaseUrl(dynatracePlatformUrl) || void 0,
+            platformToken: dynatracePlatformToken || void 0
+          }
+        };
+        const tempHttp = createHttpClient(tempConfig);
+        await tempHttp.dynatrace("/api/v2/entities", {
+          params: { entitySelector: 'type("SERVICE")', pageSize: 1 }
+        });
+        process.stderr.write("  Connected.\n");
+      } catch (err) {
+        warn(`Could not connect to Dynatrace: ${err instanceof Error ? err.message : String(err)}`);
+        warn("Config will be saved anyway. Check your URLs and tokens and re-run pncli config test.");
+      }
+    }
+  }
   process.stderr.write("\n\u2500\u2500 Defaults \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
   const jiraProject = await input({
     message: "Default Jira project key (optional):",
@@ -6567,8 +6701,10 @@ async function initGlobalConfig(start) {
     ...useCheckmarx && checkmarxBaseUrl ? {
       checkmarx: {
         baseUrl: normalizeBaseUrl(checkmarxBaseUrl),
-        username: checkmarxUsername || void 0,
-        password: checkmarxPassword || void 0
+        tenantName: checkmarxTenantName || void 0,
+        apiKey: checkmarxApiKey || void 0,
+        clientId: checkmarxClientId || void 0,
+        clientSecret: checkmarxClientSecret || void 0
       }
     } : {},
     ...useServiceNow && servicenowBaseUrl ? {
@@ -6601,6 +6737,14 @@ async function initGlobalConfig(start) {
         token: openShiftToken || void 0
       }
     } : {},
+    ...useDynatrace && dynatraceBaseUrl ? {
+      dynatrace: {
+        baseUrl: normalizeBaseUrl(dynatraceBaseUrl),
+        apiToken: dynatraceApiToken || void 0,
+        platformUrl: normalizeBaseUrl(dynatracePlatformUrl) || void 0,
+        platformToken: dynatracePlatformToken || void 0
+      }
+    } : {},
     defaults: {
       jira: {
         project: jiraProject || void 0
@@ -7688,11 +7832,11 @@ function registerAdoRepoCommands(ado) {
       const start = Date.now();
       try {
         const globalOpts = ado.optsWithGlobals();
-        const { loadConfig: lc } = await import("./config-QN7KDHE4.js");
+        const { loadConfig: lc } = await import("./config-CPRXY5SN.js");
         const config = lc({ configPath: globalOpts.config });
         const { collection, project, repo: repo2, gitClient } = getAdoContext(ado, true);
         const { AdoCoreClient: AdoCoreClient2 } = await import("./core-SWYVXOQ4.js");
-        const { createHttpClient: createHttpClient2 } = await import("./http-DDY5DLF6.js");
+        const { createHttpClient: createHttpClient2 } = await import("./http-FNRE7NQU.js");
         const http = createHttpClient2(config, Boolean(globalOpts.dryRun));
         const coreClient = new AdoCoreClient2(http);
         const me = await coreClient.getConnectionData(collection);
@@ -8506,24 +8650,35 @@ var CheckmarxClient = class {
   }
   http;
   async listProjects() {
-    return this.http.checkmarx("/cxrestapi/projects");
+    const res = await this.http.checkmarx("projects", { params: { limit: 100 } });
+    const projects = res.projects ?? [];
+    if (res.filteredTotalCount > projects.length) {
+      process.stderr.write(`warning: ${res.filteredTotalCount} projects found; only showing first ${projects.length}
+`);
+    }
+    return projects;
   }
   async getProject(id) {
-    return this.http.checkmarx(`/cxrestapi/projects/${id}`);
+    return this.http.checkmarx(`projects/${id}`);
   }
   async listScans(opts = {}) {
-    return this.http.checkmarx("/cxrestapi/sast/scans", {
-      params: {
-        projectId: opts.projectId,
-        last: opts.last
-      }
-    });
+    const params = { limit: opts.last ?? 100 };
+    if (opts.projectId) params["project-id"] = opts.projectId;
+    const res = await this.http.checkmarx("scans", { params });
+    const scans = res.scans ?? [];
+    if (res.filteredTotalCount > scans.length) {
+      process.stderr.write(`warning: ${res.filteredTotalCount} scans found; only showing first ${scans.length}
+`);
+    }
+    return scans;
   }
   async getScan(id) {
-    return this.http.checkmarx(`/cxrestapi/sast/scans/${id}`);
+    return this.http.checkmarx(`scans/${id}`);
   }
   async getScanResultsStatistics(scanId) {
-    return this.http.checkmarx(`/cxrestapi/sast/scans/${scanId}/resultsStatistics`);
+    return this.http.checkmarx("results/summary", {
+      params: { "scan-id": scanId }
+    });
   }
 };
 
@@ -8536,7 +8691,7 @@ function getClient10(program2) {
   return new CheckmarxClient(http);
 }
 function registerCheckmarxCommands(program2) {
-  const cx = program2.command("checkmarx").description("Checkmarx CxSAST operations");
+  const cx = program2.command("checkmarx").description("Checkmarx One operations");
   const project = cx.command("project").description("Project operations");
   const scan = cx.command("scan").description("Scan operations");
   project.command("list").description("List all projects").action(async () => {
@@ -8548,47 +8703,39 @@ function registerCheckmarxCommands(program2) {
       fail(err, "checkmarx", "project-list", start);
     }
   });
-  project.command("get").description("Get a project by ID").requiredOption("--id <id>", "Project ID").action(async (opts) => {
+  project.command("get").description("Get a project by ID").requiredOption("--id <id>", "Project UUID").action(async (opts) => {
     const start = Date.now();
     try {
-      const id = parseInt(opts.id, 10);
-      if (isNaN(id)) throw new PncliError(`Invalid --id "${opts.id}". Expected an integer.`, 1);
-      const data = await getClient10(program2).getProject(id);
+      const data = await getClient10(program2).getProject(opts.id);
       success(data, "checkmarx", "project-get", start);
     } catch (err) {
       fail(err, "checkmarx", "project-get", start);
     }
   });
-  scan.command("list").description("List scans").option("--project <id>", "Filter by project ID").option("--last <n>", "Return only the last N scans per project").action(async (opts) => {
+  scan.command("list").description("List scans").option("--project <id>", "Filter by project UUID").option("--last <n>", "Return only the last N scans").action(async (opts) => {
     const start = Date.now();
     try {
-      const projectId = opts.project ? parseInt(opts.project, 10) : void 0;
       const last = opts.last ? parseInt(opts.last, 10) : void 0;
-      if (opts.project && isNaN(projectId)) throw new PncliError(`Invalid --project "${opts.project}". Expected an integer.`, 1);
       if (opts.last && isNaN(last)) throw new PncliError(`Invalid --last "${opts.last}". Expected an integer.`, 1);
-      const data = await getClient10(program2).listScans({ projectId, last });
+      const data = await getClient10(program2).listScans({ projectId: opts.project, last });
       success(data, "checkmarx", "scan-list", start);
     } catch (err) {
       fail(err, "checkmarx", "scan-list", start);
     }
   });
-  scan.command("get").description("Get a scan by ID").requiredOption("--id <id>", "Scan ID").action(async (opts) => {
+  scan.command("get").description("Get a scan by ID").requiredOption("--id <id>", "Scan UUID").action(async (opts) => {
     const start = Date.now();
     try {
-      const id = parseInt(opts.id, 10);
-      if (isNaN(id)) throw new PncliError(`Invalid --id "${opts.id}". Expected an integer.`, 1);
-      const data = await getClient10(program2).getScan(id);
+      const data = await getClient10(program2).getScan(opts.id);
       success(data, "checkmarx", "scan-get", start);
     } catch (err) {
       fail(err, "checkmarx", "scan-get", start);
     }
   });
-  scan.command("stats").description("Get results statistics for a scan").requiredOption("--id <id>", "Scan ID").action(async (opts) => {
+  scan.command("stats").description("Get results statistics for a scan").requiredOption("--id <id>", "Scan UUID").action(async (opts) => {
     const start = Date.now();
     try {
-      const id = parseInt(opts.id, 10);
-      if (isNaN(id)) throw new PncliError(`Invalid --id "${opts.id}". Expected an integer.`, 1);
-      const data = await getClient10(program2).getScanResultsStatistics(id);
+      const data = await getClient10(program2).getScanResultsStatistics(opts.id);
       success(data, "checkmarx", "scan-stats", start);
     } catch (err) {
       fail(err, "checkmarx", "scan-stats", start);
@@ -8899,18 +9046,52 @@ function getBundledSkillsDir() {
 function getInstalledMetaPath(targetDir) {
   return path7.join(targetDir, ".pncli-installed.json");
 }
+var SKILL_ORIGIN_FILENAME = "pncli-origin.json";
 function readInstalledMeta(targetDir) {
   const metaPath = getInstalledMetaPath(targetDir);
   const raw = loadJsonFile(metaPath);
   if (raw && raw.version === 1 && raw.skills) return raw;
   return { version: 1, skills: {} };
 }
+function getSkillOriginPath(skillDir) {
+  return path7.join(skillDir, SKILL_ORIGIN_FILENAME);
+}
+function readSkillOrigin(skillDir) {
+  const originPath = getSkillOriginPath(skillDir);
+  if (!fs4.existsSync(originPath)) return null;
+  try {
+    const raw = JSON.parse(fs4.readFileSync(originPath, "utf8"));
+    if (raw && raw.version === 1 && raw.source) return raw;
+  } catch {
+  }
+  return null;
+}
+function detectRepoBranch(repoPath) {
+  try {
+    const result = execFileSync3("git", ["-C", repoPath, "rev-parse", "--abbrev-ref", "HEAD"], {
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+    return result && result !== "HEAD" ? result : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function recordInstalledSkills(targetDir, skillNames, record) {
   if (skillNames.length === 0) return;
   const meta = readInstalledMeta(targetDir);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   for (const skillName of skillNames) {
-    meta.skills[skillName] = { ...record, installedAt: now };
+    const fullRecord = { ...record, installedAt: now };
+    meta.skills[skillName] = fullRecord;
+    const skillDir = path7.join(targetDir, skillName);
+    if (fs4.existsSync(skillDir)) {
+      const origin = { version: 1, ...fullRecord };
+      try {
+        fs4.writeFileSync(getSkillOriginPath(skillDir), JSON.stringify(origin, null, 2), "utf8");
+      } catch {
+      }
+    }
   }
   fs4.writeFileSync(getInstalledMetaPath(targetDir), JSON.stringify(meta, null, 2), "utf8");
 }
@@ -9024,6 +9205,7 @@ function pullMarketplace(marketplacePath, repoUrl, token, marketplaceName) {
 function installPluginsForMarketplace(marketplacePath, marketplaceName, repoUrl, pluginNames, targetDir) {
   const results = {};
   let totalInstalled = 0;
+  const branch = detectRepoBranch(marketplacePath);
   for (const pluginName of pluginNames) {
     const skillsSrc = resolveSkillsSrc(marketplacePath, pluginName);
     if (!fs4.existsSync(skillsSrc)) {
@@ -9034,7 +9216,8 @@ function installPluginsForMarketplace(marketplacePath, marketplaceName, repoUrl,
     const { installed, failed } = copyPluginSkills(skillsSrc, targetDir, {
       marketplace: marketplaceName,
       plugin: pluginName,
-      installedFrom: repoUrl ?? ""
+      installedFrom: repoUrl ?? "",
+      branch
     });
     results[pluginName] = { installed, failed };
     totalInstalled += installed.length;
@@ -9472,6 +9655,121 @@ function registerSkillsCommands(program2) {
       fail(err, "skills", "marketplace-sync", start);
     }
   });
+  marketplace.command("purge-plugin").description("Remove all skills installed from a specific plugin (or all plugins in a marketplace)").argument("<plugin>", 'Plugin name to purge, or "all" to remove every skill from the marketplace').option("--marketplace <name>", "Restrict purge to skills from this marketplace (by name or repo URL)").option("--agent <agent>", "Target agent host: github-copilot | claude-code (default: github-copilot)").option("--claude", "Shorthand for --agent claude-code").option("--scope <scope>", "Installation scope: project | user (default: user)").option("--target <dir>", "Override skills directory").action((plugin, opts) => {
+    const start = Date.now();
+    try {
+      let targetDir;
+      if (opts.target) {
+        targetDir = path7.resolve(opts.target);
+      } else {
+        const agentConfig = resolveAgentPaths(resolveAgentName(opts));
+        const scopePath = (opts.scope ?? "user") === "project" ? agentConfig.project : agentConfig.user;
+        targetDir = path7.resolve(scopePath);
+      }
+      const resolvedTarget = path7.resolve(targetDir);
+      if (!fs4.existsSync(targetDir)) {
+        success({ removed: [], total: 0, target: targetDir, message: "No skills directory found." }, "skills", "marketplace-purge-plugin", start);
+        return;
+      }
+      const meta = readInstalledMeta(targetDir);
+      const removed = [];
+      const skipped = [];
+      const skillDirs = fs4.readdirSync(targetDir).filter((name) => {
+        if (name.startsWith(".")) return false;
+        const p = path7.join(targetDir, name);
+        try {
+          return fs4.statSync(p).isDirectory();
+        } catch {
+          return false;
+        }
+      });
+      for (const skillName of skillDirs) {
+        const skillDir = path7.resolve(targetDir, skillName);
+        if (!skillDir.startsWith(resolvedTarget + path7.sep)) continue;
+        let record = meta.skills[skillName] ?? null;
+        if (!record) {
+          const perSkill = readSkillOrigin(skillDir);
+          if (perSkill) {
+            record = {
+              source: perSkill.source,
+              marketplace: perSkill.marketplace,
+              plugin: perSkill.plugin,
+              installedFrom: perSkill.installedFrom,
+              branch: perSkill.branch,
+              installedAt: perSkill.installedAt
+            };
+          }
+        }
+        if (!record || record.source !== "marketplace") {
+          skipped.push(skillName);
+          continue;
+        }
+        const matchesMarketplace = !opts.marketplace || record.marketplace === opts.marketplace || record.installedFrom === opts.marketplace;
+        const matchesPlugin = plugin === "all" || record.plugin === plugin;
+        if (!matchesMarketplace || !matchesPlugin) {
+          skipped.push(skillName);
+          continue;
+        }
+        fs4.rmSync(skillDir, { recursive: true, force: true });
+        delete meta.skills[skillName];
+        removed.push(skillName);
+      }
+      if (removed.length > 0) {
+        fs4.writeFileSync(getInstalledMetaPath(targetDir), JSON.stringify(meta, null, 2), "utf8");
+      }
+      success({
+        removed,
+        skipped: skipped.length,
+        total: removed.length,
+        target: targetDir,
+        plugin,
+        ...opts.marketplace ? { marketplace: opts.marketplace } : {}
+      }, "skills", "marketplace-purge-plugin", start);
+    } catch (err) {
+      fail(err, "skills", "marketplace-purge-plugin", start);
+    }
+  });
+  skills.command("purge-user").description("Remove all skills from the user-level skills folder for the target agent").option("--agent <agent>", "Target agent host: github-copilot | claude-code (default: github-copilot)").option("--claude", "Shorthand for --agent claude-code").option("--force", "Skip confirmation \u2014 remove all skills without prompting").action((opts) => {
+    const start = Date.now();
+    try {
+      const userDir = resolveAgentPaths(resolveAgentName(opts)).user;
+      if (!fs4.existsSync(userDir)) {
+        success({ removed: 0, target: userDir, message: "No user-level skills directory found \u2014 nothing to purge." }, "skills", "purge-user", start);
+        return;
+      }
+      const skillDirs = fs4.readdirSync(userDir).filter((name) => {
+        if (name.startsWith(".")) return false;
+        const p = path7.join(userDir, name);
+        try {
+          return fs4.statSync(p).isDirectory();
+        } catch {
+          return false;
+        }
+      });
+      if (skillDirs.length === 0) {
+        success({ removed: 0, target: userDir, message: "No skills found in user-level skills directory." }, "skills", "purge-user", start);
+        return;
+      }
+      if (!opts.force) {
+        throw new Error(
+          `This will remove ${skillDirs.length} skill(s) from ${userDir}: ${skillDirs.join(", ")}.
+Re-run with --force to confirm, or use \`pncli skills marketplace purge-plugin\` to target a specific plugin.`
+        );
+      }
+      for (const name of skillDirs) {
+        const skillDir = path7.resolve(userDir, name);
+        if (!skillDir.startsWith(path7.resolve(userDir) + path7.sep)) continue;
+        fs4.rmSync(skillDir, { recursive: true, force: true });
+      }
+      const metaPath = getInstalledMetaPath(userDir);
+      if (fs4.existsSync(metaPath)) {
+        fs4.writeFileSync(metaPath, JSON.stringify({ version: 1, skills: {} }, null, 2), "utf8");
+      }
+      success({ removed: skillDirs.length, skills: skillDirs, target: userDir }, "skills", "purge-user", start);
+    } catch (err) {
+      fail(err, "skills", "purge-user", start);
+    }
+  });
 }
 function resolvePluginChoices(marketplacePath) {
   const marketplaceJsonPath = path7.join(marketplacePath, ".claude-plugin", "marketplace.json");
@@ -9521,7 +9819,8 @@ function copyPluginSkills(skillsSrc, targetDir, meta) {
       source: "marketplace",
       marketplace: meta.marketplace,
       plugin: meta.plugin,
-      installedFrom: meta.installedFrom
+      installedFrom: meta.installedFrom,
+      ...meta.branch ? { branch: meta.branch } : {}
     });
   }
   return { installed, failed };
@@ -9783,6 +10082,170 @@ function registerOpenShiftCommands(program2) {
   });
 }
 
+// src/services/dynatrace/commands.ts
+function getHttp3(program2) {
+  const opts = program2.optsWithGlobals();
+  return createHttpClient(
+    loadConfig({ configPath: opts.config }),
+    Boolean(opts.dryRun)
+  );
+}
+async function allPages(fetchPage) {
+  const items = [];
+  let nextPageKey;
+  do {
+    const page = await fetchPage(nextPageKey);
+    items.push(...page.items);
+    nextPageKey = page.nextPageKey;
+  } while (nextPageKey);
+  return { items, totalCount: items.length };
+}
+async function listEntities(http, entitySelector, opts) {
+  return allPages(async (nextPageKey) => {
+    const page = await http.dynatrace("/api/v2/entities", {
+      params: nextPageKey ? { nextPageKey } : {
+        entitySelector,
+        from: opts.from,
+        to: opts.to,
+        fields: opts.fields,
+        pageSize: 500
+      }
+    });
+    return {
+      items: page.entities,
+      nextPageKey: page.nextPageKey,
+      totalCount: page.totalCount
+    };
+  });
+}
+async function runTraceQuery(http, traceId) {
+  if (!/^[0-9a-f]{16,32}$/i.test(traceId)) {
+    throw new PncliError("Trace ID must be a 16- or 32-character hexadecimal value");
+  }
+  const deadline = Date.now() + 6e4;
+  let response = await http.dynatracePlatform(
+    "/platform/storage/query/v1/query:execute",
+    {
+      method: "POST",
+      body: {
+        query: `fetch spans | filter trace.id == "${traceId.toLowerCase()}" | sort start_time asc`,
+        requestTimeoutMilliseconds: 5e3
+      },
+      timeoutMs: 1e4
+    }
+  );
+  while (response.state === "RUNNING" || response.state === "NOT_STARTED") {
+    if (!response.requestToken) throw new PncliError("Dynatrace did not return a query request token");
+    const remainingMs = deadline - Date.now();
+    if (remainingMs <= 0) throw new PncliError("Dynatrace trace query did not finish within 60 seconds");
+    const pollStarted = Date.now();
+    response = await http.dynatracePlatform(
+      "/platform/storage/query/v1/query:poll",
+      {
+        params: {
+          "request-token": response.requestToken,
+          "request-timeout": Math.min(5e3, remainingMs)
+        },
+        timeoutMs: 1e4
+      }
+    );
+    if (response.state === "RUNNING" || response.state === "NOT_STARTED") {
+      const delayMs = Math.min(1e3 - (Date.now() - pollStarted), deadline - Date.now());
+      if (delayMs > 0) await new Promise((resolve) => setTimeout(resolve, delayMs));
+    }
+  }
+  if (response.state !== "SUCCEEDED") {
+    throw new PncliError(response.error?.message ?? `Dynatrace trace query ${response.state.toLowerCase()}`);
+  }
+  return response.result;
+}
+function registerDynatraceCommands(program2) {
+  const dynatrace = program2.command("dynatrace").description("Dynatrace observability operations");
+  const entities = dynatrace.command("entities").description("Monitored entity operations");
+  entities.command("list").description("List monitored entities using an entity selector").requiredOption("--selector <selector>", 'Dynatrace entity selector, e.g. type("SERVICE")').option("--from <time>", "Start time (ISO 8601 or relative, e.g. now-2h)").option("--to <time>", "End time (ISO 8601 or relative)").option("--fields <fields>", "Additional entity fields").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const data = await listEntities(getHttp3(program2), opts.selector, opts);
+      success({ totalCount: data.totalCount, entities: data.items }, "dynatrace", "entities list", start);
+    } catch (err) {
+      fail(err, "dynatrace", "entities list", start);
+    }
+  });
+  entities.command("get").description("Get a monitored entity by ID").requiredOption("--id <id>", "Entity ID, e.g. SERVICE-1234567890ABCDEF").option("--from <time>", "Start time").option("--to <time>", "End time").option("--fields <fields>", "Additional entity fields").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const data = await getHttp3(program2).dynatrace(
+        `/api/v2/entities/${encodeURIComponent(opts.id)}`,
+        { params: { from: opts.from, to: opts.to, fields: opts.fields } }
+      );
+      success(data, "dynatrace", "entities get", start);
+    } catch (err) {
+      fail(err, "dynatrace", "entities get", start);
+    }
+  });
+  dynatrace.command("services").description("List monitored services").option("--from <time>", "Start time").option("--to <time>", "End time").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const data = await listEntities(getHttp3(program2), 'type("SERVICE")', opts);
+      success({ totalCount: data.totalCount, services: data.items }, "dynatrace", "services", start);
+    } catch (err) {
+      fail(err, "dynatrace", "services", start);
+    }
+  });
+  dynatrace.command("workloads").description("List monitored Kubernetes workloads").option("--from <time>", "Start time").option("--to <time>", "End time").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const selector = 'type("CLOUD_APPLICATION")';
+      const data = await listEntities(getHttp3(program2), selector, opts);
+      success({ totalCount: data.totalCount, workloads: data.items }, "dynatrace", "workloads", start);
+    } catch (err) {
+      fail(err, "dynatrace", "workloads", start);
+    }
+  });
+  const problems = dynatrace.command("problems").description("Problem operations");
+  problems.command("list").description("List problems").option("--from <time>", "Start time (default: now-2h)").option("--to <time>", "End time (default: now)").option("--problem-selector <selector>", "Dynatrace problem selector").option("--entity-selector <selector>", "Affected entity selector").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const data = await allPages(async (nextPageKey) => {
+        const page = await getHttp3(program2).dynatrace("/api/v2/problems", {
+          params: nextPageKey ? { nextPageKey } : {
+            from: opts.from ?? "now-2h",
+            to: opts.to ?? "now",
+            problemSelector: opts.problemSelector,
+            entitySelector: opts.entitySelector,
+            pageSize: 500
+          }
+        });
+        return { items: page.problems, nextPageKey: page.nextPageKey, totalCount: page.totalCount };
+      });
+      success({ totalCount: data.totalCount, problems: data.items }, "dynatrace", "problems list", start);
+    } catch (err) {
+      fail(err, "dynatrace", "problems list", start);
+    }
+  });
+  problems.command("get").description("Get a problem by ID").requiredOption("--id <id>", "Problem ID").option("--fields <fields>", "Additional fields").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const data = await getHttp3(program2).dynatrace(
+        `/api/v2/problems/${encodeURIComponent(opts.id)}`,
+        { params: { fields: opts.fields } }
+      );
+      success(data, "dynatrace", "problems get", start);
+    } catch (err) {
+      fail(err, "dynatrace", "problems get", start);
+    }
+  });
+  dynatrace.command("trace").description("Get distributed-trace spans from Grail").requiredOption("--id <trace-id>", "16- or 32-character hexadecimal trace ID").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const result = await runTraceQuery(getHttp3(program2), opts.id);
+      success(result, "dynatrace", "trace", start);
+    } catch (err) {
+      fail(err, "dynatrace", "trace", start);
+    }
+  });
+}
+
 // src/cli.ts
 if (!process.env.PNCLI_VERIFY_TLS) {
   process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
@@ -9826,6 +10289,7 @@ registerSonatypeIqCommands(program);
 registerSkillsCommands(program);
 registerJwtCommands(program);
 registerOpenShiftCommands(program);
+registerDynatraceCommands(program);
 program.addHelpText("after", `
 Services:
   git          Local git operations (status, diff, log, branch)
@@ -9840,11 +10304,12 @@ Services:
   jenkins      Jenkins Data Center (jobs, builds, logs)
   artifactory  Artifactory (repos, artifact search, build info, properties)
   udeploy      IBM UrbanCode Deploy (component versions, deployment processes)
-  checkmarx    Checkmarx CxSAST (projects, scans, scan statistics)
+  checkmarx    Checkmarx One (projects, scans, scan statistics)
   servicenow   ServiceNow (change requests)
   contrast     Contrast IAST (applications, vulnerability findings)
   sonatypeiq   Sonatype IQ Server (applications, organizations, policies)
   openshift    OpenShift / Kubernetes (pods, events, logs, metrics)
+  dynatrace    Dynatrace (services, entities, problems, traces, Kubernetes workloads)
   config       Manage pncli configuration
   skills       Download and manage Claude Code skills
   jwt          JWT token utilities (decode header and payload)