@kolatts/pncli 1.26.0 → 3.0.0

package/dist/{config-SQ3YHJHI.js → config-JGBUUXQX.js}

@@ -4,19 +4,21 @@ import {
   loadConfig,
   loadJsonFile,
   maskConfig,
+  normalizeBaseUrl,
   setConfigValue,
   setRepoConfigValue,
   writeGlobalConfig,
   writeRepoConfig
-} from "./chunk-JOAWUILY.js";
+} from "./chunk-LH7WBP7W.js";
 export {
   getGlobalConfigPath,
   loadConfig,
   loadJsonFile,
   maskConfig,
+  normalizeBaseUrl,
   setConfigValue,
   setRepoConfigValue,
   writeGlobalConfig,
   writeRepoConfig
 };
-//# sourceMappingURL=config-SQ3YHJHI.js.map
+//# sourceMappingURL=config-JGBUUXQX.js.map

package/dist/{http-WCDXXCKQ.js → http-6QJU2SWP.js}

@@ -2,9 +2,10 @@
 import {
   HttpClient,
   createHttpClient
-} from "./chunk-AGELHQKO.js";
+} from "./chunk-ZDJYOI3W.js";
+import "./chunk-HZF6WQPU.js";
 export {
   HttpClient,
   createHttpClient
 };
-//# sourceMappingURL=http-WCDXXCKQ.js.map
+//# sourceMappingURL=http-6QJU2SWP.js.map

package/dist/output-XT3WT5L5.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+import {
+  debug,
+  fail,
+  isDebugEnabled,
+  log,
+  setGlobalOptions,
+  setGlobalUser,
+  success,
+  warn,
+  writeRawOutput
+} from "./chunk-HZF6WQPU.js";
+export {
+  debug,
+  fail,
+  isDebugEnabled,
+  log,
+  setGlobalOptions,
+  setGlobalUser,
+  success,
+  warn,
+  writeRawOutput
+};
+//# sourceMappingURL=output-XT3WT5L5.js.map

package/dist/output-XT3WT5L5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kolatts/pncli",
-  "version": "1.26.0",
+  "version": "3.0.0",
   "description": "The Paperwork Nightmare CLI — One command does what three meetings couldn't.",
   "type": "module",
   "bin": {
@@ -15,8 +15,7 @@
     "lint": "eslint src/",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
-    "test:watch": "vitest",
-    "prepare": "husky"
+    "test:watch": "vitest"
   },
   "dependencies": {
     "@inquirer/checkbox": "^5.2.1",
@@ -32,7 +31,6 @@
     "@typescript-eslint/eslint-plugin": "^8.31.0",
     "@typescript-eslint/parser": "^8.31.0",
     "eslint": "^9.25.1",
-    "husky": "^9.1.7",
     "tsup": "^8.4.0",
     "tsx": "^4.19.3",
     "typescript": "^5.8.3",
@@ -57,7 +55,6 @@
     "skills",
     "LICENSE",
     "NOTICE",
-    "README.md",
-    "copilot-instructions.md"
+    "README.md"
   ]
 }

package/skills/pncli/SKILL.md

@@ -9,7 +9,38 @@ metadata:
   services: config
 ---
 
-pncli gives AI agents and humans unified CLI access to enterprise tools: Jira, Bitbucket, Confluence, SonarQube, SDElements, Azure DevOps, Jenkins, Artifactory, IBM UrbanCode Deploy, Checkmarx, ServiceNow, Contrast Security IAST, Sonatype IQ Server, OpenShift / Kubernetes, Dynatrace, and LogScale.
+pncli gives AI agents and humans unified CLI access to enterprise tools: Jira, Bitbucket, GitHub, Confluence, SonarQube, SDElements, Azure DevOps, Jenkins, Artifactory, Checkmarx, ServiceNow, Contrast Security IAST, Sonatype IQ Server, OpenShift / Kubernetes, Dynatrace, LogScale, Split.IO, and Figma.
+
+Every service authenticates the same way: a personal access token you generate in that tool's own UI and put in an env var or the config file. If a tool you need is missing from the table below, it is not out of scope by default — pncli covers enterprise tooling broadly, and the only hard requirement is personal-access-token auth.
+
+## Output and errors
+
+All commands return JSON to stdout — parse it rather than scraping text.
+
+- Success: `{ "ok": true, "data": { ... }, "meta": { "service": "...", "action": "...", "timestamp": "...", "duration_ms": N } }`
+- Error: `{ "ok": false, "error": { "status": N, "message": "...", "url": "..." }, "meta": { ... } }` (`url` is null when the failure was not an HTTP call)
+
+Always check `ok` before reading `data`. Errors are JSON too, so a non-zero exit still gives you a structured reason.
+
+Run commands from the repository root — project and repo are auto-detected from git remotes.
+
+## Provider detection
+
+Before running provider-specific commands, establish which tools the repo actually uses:
+
+1. **Work item tracking** — Jira or Azure DevOps? Determines `pncli jira ...` vs `pncli ado work ...`.
+2. **Source control** — GitHub, Bitbucket, or Azure DevOps? Determines `pncli github ...`, `pncli bitbucket ...`, or `pncli ado repo ...`.
+
+Ask the user and cache the answers for the session. If they don't know, run `git remote -v`: a URL containing `/_git/` is Azure DevOps, `/scm/` is Bitbucket, `github.com` (or a GitHub Enterprise host) is GitHub.
+
+## Useful flags
+
+- `--dry-run` — print the API request without executing it
+- `--verbose` — extra progress detail on stderr (stdout stays pure JSON)
+- `--debug` — trace every API call (method, URL, status) on stderr; never logs credentials
+- `--pretty` — human-readable output when running by hand
+- `--output-file <path>` — write JSON to a file instead of stdout; use it for large payloads (search, logs, `--all` pagination) so they don't flood agent context
+- Defaults from `.pncli.json` are applied automatically — you rarely need `--project`, `--repo`, `--type`, or `--priority`
 
 ## Two config levels
 
@@ -34,7 +65,7 @@ For commands with long rich-text fields (Jira `create-issue`/`update-issue`, ADO
 
 ## Available services
 
-For detailed setup of any service, read the included file for that service.
+Each service has its own file in this skill with the config keys and example values for it.
 
 | Service | File | Commands unlocked |
 |---------|------|-------------------|
@@ -47,7 +78,6 @@ For detailed setup of any service, read the included file for that service.
 | SonarQube | `sonarqube.md` | Code quality issues |
 | SDElements | `sde.md` | Threat model tasks |
 | Checkmarx | `checkmarx.md` | SAST findings |
-| IBM UrbanCode Deploy | `udeploy.md` | Component versions, deployments |
 | Jenkins | `jenkins.md` | Builds, job status |
 | Artifactory | `artifactory.md` | Packages, repos |
 | ServiceNow | `servicenow.md` | Change requests, incidents |
@@ -56,8 +86,16 @@ For detailed setup of any service, read the included file for that service.
 | OpenShift / Kubernetes | `openshift.md` | Pod health, events, logs, metrics |
 | Dynatrace | `dynatrace.md` | Services, entities, problems, traces, Kubernetes workloads |
 | LogScale | `logscale.md` | Log queries, repository listing |
+| Split.IO | `splitio.md` | Feature flag discovery, targeting updates, Change Requests |
+| Figma | `figma.md` | Design files, comments, version history |
 | Skills Marketplace | `marketplace.md` | Install org-internal skills |
 
+## Installing skills
+
+The skills bundled with pncli install into a repo with `pncli skills install` (default target `.agents/skills/`, which GitHub Copilot and Codex both read; add `--agent claude-code` for `.claude/skills`). Add `--scope user` to install them globally instead.
+
+Org-internal skills come from a git-hosted marketplace: `pncli skills marketplace setup <git-clone-url>` registers one, and `pncli skills marketplace sync` keeps everything installed from it current. `pncli skills status` and `pncli skills locations` show what is installed and where. The full workflow is in the `marketplace.md` file that ships inside the installed skill.
+
 ## Setup walkthrough
 
 **Step 1 — Identity**

package/skills/pncli/dynatrace.md

@@ -4,6 +4,8 @@ pncli uses Dynatrace's REST APIs directly; no Dynatrace CLI is required.
 
 ## Configuration
 
+### Single environment (legacy)
+
 | Key | Environment variable | Purpose |
 |---|---|---|
 | `dynatrace.baseUrl` | `PNCLI_DYNATRACE_BASE_URL` | Classic environment URL, such as `https://abc12345.live.dynatrace.com` |
@@ -27,8 +29,48 @@ pncli config test
 When platform credentials are present, `config test` and `config check` also run a minimal Grail
 spans query and report it separately as `dynatrace_platform`.
 
+### Multiple named environments
+
+Dynatrace is commonly deployed per-environment (e.g. QA and PROD), each with its own base URL and
+API token. pncli supports named environment profiles so you can switch between them with a flag rather
+than rewriting `dynatrace.baseUrl` and `dynatrace.apiToken` before every command.
+
+```bash
+# Set up named environments
+pncli config set dynatrace.environments.qa.baseUrl https://abc11111.live.dynatrace.com
+pncli config set dynatrace.environments.qa.apiToken dt0c01...
+pncli config set dynatrace.environments.prod.baseUrl https://abc22222.live.dynatrace.com
+pncli config set dynatrace.environments.prod.apiToken dt0c01...
+
+# Optional: include Grail platform credentials per environment
+pncli config set dynatrace.environments.prod.platformUrl https://abc22222.apps.dynatrace.com
+pncli config set dynatrace.environments.prod.platformToken dt0s16...
+
+# Optional: set a default named environment (used when --env is omitted)
+pncli config set dynatrace.defaultEnvironment prod
+```
+
+`config test` and `config check` report the connectivity status of each named environment
+separately as `dynatrace.<name>` (and `dynatrace.<name>_platform` when platform credentials are set).
+
+Environment variables (`PNCLI_DYNATRACE_BASE_URL`, etc.) continue to apply to the legacy flat config
+and take precedence over stored values, but do not override named environments.
+
 ## Commands
 
+```bash
+# Using the default (legacy flat config or defaultEnvironment)
+pncli dynatrace services --from now-2h
+
+# Targeting a named environment
+pncli dynatrace --env qa services --from now-2h
+pncli dynatrace --env prod problems list --from now-24h
+
+# Compare QA and PROD in one session
+pncli dynatrace --env qa entities list --selector 'type("SERVICE")'
+pncli dynatrace --env prod entities list --selector 'type("SERVICE")'
+```
+
 ```bash
 pncli dynatrace services --from now-2h
 pncli dynatrace workloads --from now-2h
@@ -44,3 +86,7 @@ pncli dynatrace trace --id 0123456789abcdef0123456789abcdef
 
 Entity and problem list commands automatically follow Dynatrace pagination. Use Dynatrace selector
 syntax for advanced filtering.
+
+The `--env <name>` option is available on the `dynatrace` parent command and applies to all
+subcommands: `entities list`, `entities get`, `services`, `workloads`, `problems list`,
+`problems get`, and `trace`.

package/skills/pncli/figma.md

@@ -0,0 +1,62 @@
+# Figma
+
+pncli uses the Figma REST API directly; no external CLI is required.
+
+## Configuration
+
+| Key | Environment variable | Purpose |
+|---|---|---|
+| `figma.baseUrl` | `PNCLI_FIGMA_BASE_URL` | Figma API base URL — always `https://api.figma.com` |
+| `figma.token` | `PNCLI_FIGMA_TOKEN` | Personal access token |
+
+Generate a personal access token in Figma under **Account Settings → Personal access tokens**.
+
+```bash
+pncli config set figma.baseUrl https://api.figma.com
+pncli config set figma.token <your-token>
+pncli config test
+```
+
+## Finding a Figma file key
+
+The file key is the alphanumeric segment in a Figma URL. Both URL formats are accepted:
+
+```
+https://www.figma.com/design/ABCDEFGH1234/My-Design-Name
+                              ^^^^^^^^^^^^
+https://www.figma.com/file/ABCDEFGH1234/My-Design-Name
+                            ^^^^^^^^^^^^
+```
+
+You can pass either the raw file key or the full URL to any `figma` command.
+
+## Commands
+
+```bash
+# Get current user — useful for verifying credentials
+pncli figma me
+
+# Get file metadata and structure summary (component and style counts)
+pncli figma file ABCDEFGH1234
+pncli figma file "https://www.figma.com/design/ABCDEFGH1234/My-Design"
+
+# Include the full document node tree (can be large)
+pncli figma file ABCDEFGH1234 --document
+
+# Get all comments on a file
+pncli figma comments ABCDEFGH1234
+
+# Get comments as of a specific point in time
+pncli figma comments ABCDEFGH1234 --as-of 2026-08-01T00:00:00Z
+
+# Get version history
+pncli figma versions ABCDEFGH1234
+
+# List files in a Figma project (project ID is visible in the project URL)
+pncli figma project-files 123456789
+```
+
+## Notes
+
+- `figma file` returns a summary by default: name, last-modified, version, thumbnail URL, role, editor type, schema version, and counts of components and styles. Pass `--document` to include the full document node tree (this can be very large for complex designs).
+- Passing a Figma image (screenshot or export) rather than a link is **not supported** — pncli works with the Figma REST API only, not image analysis. Use the file key or URL instead.

package/skills/pncli/jenkins.md

@@ -49,3 +49,50 @@ pncli config set --repo defaults.jenkins.baseUrl https://jenkins.myteam.imagile.
 ```
 
 Resolution order (highest to lowest): project `.pncli.json` → global config → `PNCLI_JENKINS_BASE_URL` env var.
+
+## Multiple Jenkins instances
+
+When you work with more than one Jenkins controller (e.g. a stable production instance plus ephemeral pipeline-as-code instances), add a `jenkinsInstances` array to your global config:
+
+```json
+{
+  "jenkinsInstances": [
+    {
+      "name": "prod",
+      "baseUrl": "https://jenkins.imagile.dev",
+      "username": "you@example.com",
+      "apiToken": "abc12345"
+    },
+    {
+      "name": "ephemeral",
+      "baseUrl": "https://jenkins-tmp.imagile.dev",
+      "username": "you@example.com",
+      "apiToken": "abc12345"
+    }
+  ]
+}
+```
+
+Manage the array with the `instance` subcommands, which append rather than replace:
+
+```
+pncli jenkins instance add --name prod --base-url jenkins.imagile.dev --username you@example.com --api-token abc12345
+pncli jenkins instance add --name ephemeral --base-url jenkins-tmp.imagile.dev --username you@example.com
+pncli jenkins instance list
+pncli jenkins instance remove --name ephemeral
+```
+
+Omit `--api-token` on an interactive terminal and pncli prompts for it, which keeps the token out of your shell history. `instance list` masks every token as `***`. Adding a name that already exists is rejected unless you pass `--force`, which overwrites that entry in place.
+
+`pncli config set jenkinsInstances '[...]'` also works, but it **replaces** the whole array — you must re-supply every instance you want to keep, including tokens that `config check` masks. Prefer `instance add`.
+
+Then select an instance at run-time with `--instance`:
+
+```
+pncli jenkins --instance ephemeral pipeline list
+pncli jenkins --instance prod pipeline run --name my-job --wait
+```
+
+When `--instance` is omitted, pncli uses the default `jenkins.*` config as usual.
+
+**Note:** Per-instance credentials are read only from the global config file — there is no env-var override for a named instance. To override Jenkins credentials at runtime (CI/CD, GitHub Actions), use the default `jenkins.*` config with `PNCLI_JENKINS_BASE_URL`, `PNCLI_JENKINS_USERNAME`, and `PNCLI_JENKINS_API_TOKEN`, and omit `--instance`.

package/skills/pncli/marketplace.md

@@ -26,11 +26,11 @@ pncli skills marketplace list
 pncli skills marketplace plugins <name>
 ```
 
-`list` shows every registered marketplace. `plugins` shows the plugins available inside one of them, without installing anything.
+`list` shows every registered marketplace, including `upstreamRemote` — the `origin` fetch URL read from the local clone, with any injected token scrubbed. It is `null` when the clone is missing or has no `origin`, which is the quickest way to spot a marketplace whose local path has drifted from the URL it was registered with. `plugins` shows the plugins available inside one of them, without installing anything.
 
 ## Sync (pull + install)
 
-Install to `~/.agents/skills` (GitHub Copilot / Codex):
+Install to `~/.agents/skills` (Codex / GitHub Copilot — the default):
 ```
 pncli skills marketplace sync
 ```
@@ -64,6 +64,16 @@ pncli skills marketplace sync --marketplace all
 
 `sync` skips reinstalling when a marketplace has no new upstream changes (single-plugin and `all` installs alike). Pass `--force` to reinstall anyway.
 
+### Update what you already have, without picking up new plugins
+
+By default an `all` sync installs every plugin the marketplace offers, including ones added upstream since you last synced. Pass `--installed-only` to update just the plugins already on disk:
+
+```
+pncli skills marketplace sync --marketplace all --installed-only
+```
+
+Plugins are matched by the marketplace name recorded at install time, falling back to the clone URL — so a marketplace you have since renamed still resolves. Disabled plugins count as installed and are refreshed in place, staying disabled. If a marketplace has no installed plugins at all, it is reported as `skipped` with `installedOnly: true` rather than silently installing everything.
+
 ## Enable / disable installed plugins
 
 Temporarily switch a plugin's skills off without deleting them (no re-download needed to switch back on):
@@ -93,6 +103,47 @@ It loops through a menu until you're done:
 
 Everything the session changed is emitted as one JSON summary at the end. Agents should use the scriptable equivalents instead: `enable`, `disable`, `add`, `remove`.
 
+## Where skills are installed
+
+Every command that installs or reads skills takes `--agent` and `--scope`. Those resolve to:
+
+| `--agent` | `--scope project` | `--scope user` |
+|---|---|---|
+| `codex` (default) | `.agents/skills` | `~/.agents/skills` |
+| `github-copilot` | `.github/skills` | `~/.copilot/skills` |
+| `claude-code` | `.claude/skills` | `~/.claude/skills` |
+
+`.agents/skills` is the cross-tool convention — both Codex and GitHub Copilot read it — which is why it is the default. Use `--agent github-copilot` only when you specifically want Copilot's own directories, and `--agent claude-code` (or the `--claude` shorthand) for Claude Code.
+
+Project-scope paths resolve against the repository root, so you get the same directory whichever subdirectory you run from. Outside a git repository they fall back to the current working directory.
+
+`--target <dir>` overrides all of this and installs wherever you point it. `skills install --target` records the directory in your global config so it still shows up in the commands below; `pncli skills forget-target <dir>` stops tracking it (it deletes nothing).
+
+### List the install paths
+
+```
+pncli skills locations
+```
+
+Reports every path pncli knows about — each agent host at both scopes, plus any recorded custom targets — with whether the directory exists and how many skills are in it. The `marketplaceSkills`, `bundledSkills`, and `untrackedSkills` counts are mutually exclusive and always add up to `totalSkills`; anything in `untrackedSkills` was dropped in by hand or installed before pncli recorded provenance.
+
+`disabledStashMissing` names disabled skills whose stashed copy has been deleted out from under pncli — those cannot be re-enabled and need a fresh `sync`.
+
+### Trace a skill back to its repository
+
+```
+pncli skills status
+```
+
+Walks every known location and emits one record per installed skill joining it to the plugin, marketplace, clone URL, and the live `origin` remote of the local clone. This is the command to reach for when you need to know where a skill actually came from rather than just where it sits.
+
+Narrow it with `--marketplace <name-or-url>`, `--plugin <name>`, `--source marketplace|bundled|untracked`, `--agent`, or `--scope`:
+
+```
+pncli skills status --source untracked
+pncli skills status --marketplace internal-ai
+```
+
 ## Remove a marketplace
 
 ```

package/skills/pncli/openshift.md

@@ -3,13 +3,54 @@
 pncli connects to the OpenShift / Kubernetes REST API using a service account bearer token.
 No `kubectl` or `oc` CLI is required.
 
-## Required config keys
+## Configuration
+
+pncli supports two configuration models for OpenShift clusters, which can be used together:
+
+### Legacy flat config (single cluster)
 
 | Key | Env var | Description |
 |-----|---------|-------------|
 | `openshift.baseUrl` | `PNCLI_OPENSHIFT_BASE_URL` | API server URL, e.g. `https://api.cluster.imagile.dev:6443` |
 | `openshift.token` | `PNCLI_OPENSHIFT_TOKEN` | Service account bearer token |
 
+### Named two-level config (multiple environments and instances)
+
+| Key | Description |
+|-----|-------------|
+| `openshift.environments.<env>.instances.<instance>.baseUrl` | API server URL for this cluster |
+| `openshift.environments.<env>.instances.<instance>.token` | Bearer token for this cluster |
+| `openshift.defaultEnvironment` | Default environment name (used when `--env` is omitted) |
+| `openshift.defaultInstance` | Default instance name (used when `--instance` is omitted) |
+
+Example:
+
+```bash
+pncli config set openshift.environments.non-prod.instances.us-east.baseUrl https://api.np-us-east.imagile.dev:6443
+pncli config set openshift.environments.non-prod.instances.us-east.token eyJhbGciOiJSUzI1NiI...
+pncli config set openshift.environments.non-prod.instances.eu-west.baseUrl https://api.np-eu-west.imagile.dev:6443
+pncli config set openshift.environments.non-prod.instances.eu-west.token eyJhbGciOiJSUzI1NiI...
+pncli config set openshift.environments.prod-us.instances.primary.baseUrl https://api.prod-us.imagile.dev:6443
+pncli config set openshift.environments.prod-us.instances.primary.token eyJhbGciOiJSUzI1NiI...
+
+# Set defaults so --env / --instance can be omitted
+pncli config set openshift.defaultEnvironment non-prod
+pncli config set openshift.defaultInstance us-east
+```
+
+## Selecting a target cluster
+
+All `pncli openshift` subcommands accept `--env` and `--instance` to choose a named cluster:
+
+```bash
+pncli openshift --env non-prod --instance us-east pods --namespace my-namespace
+pncli openshift --env prod-us --instance primary events --namespace my-namespace
+```
+
+If `--env`/`--instance` are omitted, pncli resolves the cluster in this order:
+1. `openshift.defaultEnvironment` + `openshift.defaultInstance`
+2. Legacy flat `openshift.baseUrl` / `openshift.token`
+
 ## Getting your service account token
 
 **Inside a pod** (recommended for CI):
@@ -46,11 +87,21 @@ pncli config init
 
 ## Commands
 
+### List configured clusters
+
+```bash
+pncli openshift cluster list
+```
+
+Returns all configured environments/instances and the flat legacy cluster (if set), plus the
+configured defaults.
+
 ### List pod health summary
 
 ```bash
 pncli openshift pods --namespace my-namespace
 pncli openshift pods --namespace my-namespace --label-selector app=my-app
+pncli openshift --env non-prod --instance us-east pods --namespace my-namespace
 ```
 
 Returns a pre-processed summary with phase counts (running/pending/failed), restart counts,
@@ -62,6 +113,7 @@ CrashLoopBackOff/OOMKilled/ImagePullBackOff indicators, and per-pod container st
 pncli openshift events --namespace my-namespace
 pncli openshift events --namespace my-namespace --field-selector involvedObject.name=my-pod
 pncli openshift events --namespace my-namespace --all   # include Normal events
+pncli openshift --env prod-us --instance primary events --namespace my-namespace
 ```
 
 Returns Warning events sorted by count (highest-frequency first), filtered to surface problems.
@@ -85,15 +137,40 @@ pncli openshift pod-metrics --namespace my-namespace
 Returns per-pod, per-container CPU and memory usage. Requires the metrics-server to be
 installed in the cluster (`GET /apis/metrics.k8s.io/v1beta1/...`).
 
+### Get combined resource usage, limits, and requests
+
+```bash
+pncli openshift resource-usage --namespace my-namespace
+pncli openshift resource-usage --namespace my-namespace --label-selector app=my-app
+pncli openshift resource-usage --namespace my-namespace --csv
+```
+
+Fetches pod specs (limits/requests) and metrics-server usage in parallel, joins them by
+pod + container, and normalizes all values to **millicores (m)** for CPU and **mebibytes (Mi)**
+for memory. Pods without metrics (e.g. not Running) appear with empty usage columns.
+
+Use `--csv` to emit a spreadsheet-ready CSV suitable for Excel:
+
+```
+Pod,Container,CPU Usage (m),Memory Usage (Mi),CPU Limits (m),Memory Limits (Mi),CPU Requests (m),Memory Requests (Mi)
+my-pod-abc,app,45,128,500,256,100,128
+```
+
+Requires the metrics-server (`GET /apis/metrics.k8s.io/v1beta1/...`) — same as `pod-metrics`.
+
 ## Test connectivity
 
 ```bash
-pncli config test
+pncli config test    # tests flat config + all named clusters
+pncli config check   # structured status per cluster
 ```
 
+Named clusters appear in `config check` output with keys like `openshift:non-prod/us-east`.
+
 ## Minimum RBAC permissions
 
-The service account needs read access to pods, events, logs, and metrics in the target namespace:
+The service account needs read access to pods, events, logs, and metrics in the target namespace.
+`resource-usage` requires the same metrics-server permission as `pod-metrics`:
 
 ```yaml
 rules: