@openbat/cli 0.2.3 → 0.4.0

package/README.md

@@ -1,8 +1,10 @@
 # @openbat/cli
 
 Command-line tool for managing OpenBat chatbots end-to-end — read
-analytics + conversations, manage settings + keys + webhooks + workflows
+analytics + conversations, pull daily eval digests (`review`), manage the
+live system prompt (`prompts`), manage settings + keys + webhooks + workflows
 + reports, run experiments, and help install the SDK in a target app.
+All commands operate on one **pinned chatbot** (`openbat use <id>`).
 
 > **Companion docs**: [`@openbat/mcp`](../mcp/README.md) (same surface
 > over MCP), [`lib/openbat-tools/`](../../lib/openbat-tools/README.md)
@@ -63,6 +65,25 @@ rejects it with a helpful error.
 
 ---
 
+## Pin to one chatbot (active-chatbot scope)
+
+`ob_read_*` / `ob_admin_*` keys are already scoped to one chatbot server-side.
+A `ob_pat_*` reaches many — pin one so every command stays on it:
+
+```bash
+openbat use <id|name>     # persists ~/.openbatrc.activeChatbotId
+openbat use               # no arg → shows the current pin + reachable options
+```
+
+Once pinned, every data command (`conversations`, `analytics`, `review`,
+`prompts`, …) targets that chatbot and prints a `→ chatbot: <name> (<id>)`
+banner to **stderr** so scope is never in doubt (and `--json | jq` stays
+clean). Active-chatbot resolution order: `--chatbot <id|name>` flag →
+`$OPENBAT_CHATBOT_ID` → `~/.openbatrc`. The MCP server reads the same pin and
+**hard-locks** to it (see [`@openbat/mcp`](../mcp/README.md)).
+
+---
+
 ## Command tree
 
 ```
@@ -70,7 +91,13 @@ openbat
 ├── config
 │   ├── set-key            Store / replace the key in ~/.openbatrc
 │   ├── set-url <baseUrl>  Override the API base URL
-│   └── show               Print the resolved config (key prefix only)
+│   ├── show               Print the resolved config (key prefix + active chatbot)
+│   ├── use-chatbot <id|name>  Pin the active chatbot (persists to ~/.openbatrc)
+│   └── clear-chatbot     Forget the pinned chatbot
+│
+├── use [id|name]                                             [any kind]
+│   └── Pin the active chatbot (shortcut for `config use-chatbot`).
+│       Omit the arg to print the current pin + the reachable list.
 │
 ├── auth                                                      [any kind]
 │   ├── whoami             Show kind, chatbots in scope, orgs (PAT only)
@@ -96,7 +123,11 @@ openbat
 │
 ├── conversations                                             [any kind]
 │   ├── list [--days N] [--from ISO] [--to ISO] [--limit N]
-│   └── show <id>
+│   └── show <id>             Messages + ALL analyses (issues/outcomes/flags/intents + reasoning)
+│
+├── review [--since 45m|6h|7d]                                [any kind]
+│   └── Daily eval digest: outcome/sentiment deltas + top issues/flags/intents
+│       with representative conversation pointers. Default window 24h.
 │
 ├── users                                                     [any kind]
 │   └── list --chatbot ID [--days] [--search]                 External users + health
@@ -124,6 +155,12 @@ openbat
 │   ├── list --chatbot ID
 │   └── create --chatbot ID [--name "..."]                    Returns org-private dashboard URL
 │
+├── prompts                                                   manage the LIVE published prompt
+│   ├── list                                                  [any kind] versions + active + kill-switch
+│   ├── publish --file PATH | --text "..."                    [admin/pat] create a version + set it LIVE
+│   ├── activate <versionId>                                  [admin/pat] roll back/forward to a version
+│   └── kill-switch --on | --off                              [admin/pat] emergency fallback toggle
+│
 ├── analysis                                                  [admin or pat]
 │   ├── list --chatbot ID [--type] [--pending]
 │   └── add --chatbot ID --type intent|flag|assistant_outcome|assistant_issue
@@ -272,6 +309,9 @@ Per-tool buckets keyed by credential. The strict ones to know about:
 | Create backtest | 10 per hour per PAT |
 | Invite org member | 20 per hour per PAT |
 | Chat with an AI report | 30 per minute per credential |
+| Daily review digest (`review`) | 30 per minute per credential |
+| Publish prompt | 20 per hour per credential |
+| Activate prompt / toggle kill switch | 30 per hour per credential |
 | Generic write | 60 per minute per credential |
 | Generic read | 600 per minute per credential |
 | Export | 30 per hour per credential |
@@ -290,11 +330,12 @@ install the OpenBat agent skill bundle:
 npx skills add openbat-dev/agent-skills
 ```
 
-Drops 8 `SKILL.md` files into your project's `.claude/skills/` (or the
+Drops the `SKILL.md` bundle into your project's `.claude/skills/` (or the
 equivalent for Cursor / Copilot / Gemini CLI / Codex / OpenCode / Amp).
 The bundle covers chatbot onboarding, key management, webhooks,
-workflows, AI reports, SDK install, and safety patterns — written
-specifically for the four-kind auth ladder this CLI exposes.
+workflows, AI reports, SDK install, the daily eval→fix loop
+(`openbat-optimize`), and safety patterns — written specifically for the
+four-kind auth ladder this CLI exposes.
 
 Source + docs: https://github.com/openbat-dev/agent-skills.
 

package/dist/api-client.js

@@ -32,7 +32,7 @@ __export(api_client_exports, {
 });
 module.exports = __toCommonJS(api_client_exports);
 var import_node_url = require("url");
-var CLI_VERSION = "0.2.3";
+var CLI_VERSION = "0.4.0";
 var KEY_REGEX = /ob_(?:live|read|admin|pat)_[0-9a-f]{32}/g;
 function redact(s) {
   return s.replace(KEY_REGEX, (k) => `${k.slice(0, 16)}\u2026<hidden>`);

package/dist/api-client.mjs

@@ -1,6 +1,6 @@
 import {
   ApiClient
-} from "./chunk-HBSCN3HV.mjs";
+} from "./chunk-RA36VFZI.mjs";
 export {
   ApiClient
 };

package/dist/{chunk-HBSCN3HV.mjs → chunk-RA36VFZI.mjs}

@@ -9,7 +9,7 @@ var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "acce
 
 // src/api-client.ts
 import { URL } from "url";
-var CLI_VERSION = "0.2.3";
+var CLI_VERSION = "0.4.0";
 var KEY_REGEX = /ob_(?:live|read|admin|pat)_[0-9a-f]{32}/g;
 function redact(s) {
   return s.replace(KEY_REGEX, (k) => `${k.slice(0, 16)}\u2026<hidden>`);

package/dist/index.js

@@ -32,7 +32,7 @@ var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "
 var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
 
 // src/index.ts
-var import_commander8 = require("commander");
+var import_commander11 = require("commander");
 
 // src/commands/config.ts
 var import_commander = require("commander");
@@ -163,7 +163,7 @@ function configPath() {
 
 // src/api-client.ts
 var import_node_url = require("url");
-var CLI_VERSION = "0.2.3";
+var CLI_VERSION = "0.4.0";
 var KEY_REGEX = /ob_(?:live|read|admin|pat)_[0-9a-f]{32}/g;
 function redact(s) {
   return s.replace(KEY_REGEX, (k) => `${k.slice(0, 16)}\u2026<hidden>`);
@@ -433,12 +433,24 @@ function configCommand() {
   cmd.command("show").description("Show the current resolved config (key prefix only)").action(async () => {
     const cfg = await resolveConfig({});
     const keyDisplay = cfg.apiKey ? `${cfg.apiKey.slice(0, 16)}\u2026<hidden>` : "(not set)";
+    let activeChatbot = cfg.activeChatbotId ?? "(not set)";
+    if (cfg.apiKey && cfg.activeChatbotId) {
+      try {
+        const api = new ApiClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl });
+        const list = await api.get("/api/v1/chatbots");
+        const hit = (list.chatbots ?? []).find(
+          (c) => c.id === cfg.activeChatbotId
+        );
+        if (hit) activeChatbot = `${hit.name} (${hit.id})`;
+      } catch {
+      }
+    }
     emit({
       apiKey: keyDisplay,
       apiKeySource: cfg.apiKeySource,
       baseUrl: cfg.baseUrl,
       baseUrlSource: cfg.baseUrlSource,
-      activeChatbotId: cfg.activeChatbotId ?? "(not set)",
+      activeChatbot,
       activeChatbotIdSource: cfg.activeChatbotIdSource,
       configFile: configPath()
     });
@@ -493,9 +505,46 @@ async function resolveTargetChatbotId(target) {
   }
   return matches[0].id;
 }
+async function showCurrentAndOptions() {
+  const cfg = await resolveConfig({});
+  if (!cfg.apiKey) {
+    fatal("No API key configured. Run `openbat config set-key` first.");
+  }
+  const api = new ApiClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl });
+  const list = await api.get(
+    "/api/v1/chatbots"
+  );
+  const chatbots = list.chatbots ?? [];
+  if (cfg.activeChatbotId) {
+    const hit = chatbots.find((c) => c.id === cfg.activeChatbotId);
+    process.stdout.write(
+      hit ? `Active chatbot: ${hit.name} (${hit.id})
+
+` : `Active chatbot: ${cfg.activeChatbotId} (not in reachable set)
+
+`
+    );
+  } else {
+    process.stdout.write("No active chatbot set.\n\n");
+  }
+  if (chatbots.length === 0) {
+    process.stdout.write("No chatbots reachable by this key.\n");
+    return;
+  }
+  process.stdout.write("Reachable chatbots \u2014 pin one with `openbat use <id>`:\n");
+  for (const c of chatbots) {
+    const marker = c.id === cfg.activeChatbotId ? "\u25CF" : "\u25CB";
+    process.stdout.write(`  ${marker} ${c.name}   ${c.id}
+`);
+  }
+}
 function useCommand() {
-  return new import_commander.Command("use").argument("<id-or-name>", "Chatbot UUID or exact name").description("Set the default chatbot for this CLI (shortcut for `config use-chatbot`)").action(async (target) => {
+  return new import_commander.Command("use").argument("[id-or-name]", "Chatbot UUID or exact name (omit to show current + options)").description("Set the active chatbot for this CLI (omit the arg to see current + options)").action(async (target) => {
     try {
+      if (!target) {
+        await showCurrentAndOptions();
+        return;
+      }
       const id = await resolveTargetChatbotId(target);
       await setActiveChatbotId(id);
       process.stdout.write(`Active chatbot saved: ${id}
@@ -525,6 +574,10 @@ async function client(globals) {
   };
 }
 var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function announceScope(name, id) {
+  process.stderr.write(`\u2192 chatbot: ${name} (${id})
+`);
+}
 async function resolveChatbotId(api, chatbotFlag) {
   const list = await api.get(
     "/api/v1/chatbots"
@@ -543,6 +596,7 @@ async function resolveChatbotId(api, chatbotFlag) {
           `Chatbot ${chatbotFlag} is not reachable by this API key. Run \`openbat chatbot list\` to see what is.`
         );
       }
+      announceScope(hit.name, hit.id);
       return hit.id;
     }
     const lower = chatbotFlag.toLowerCase();
@@ -557,9 +611,13 @@ async function resolveChatbotId(api, chatbotFlag) {
         `Multiple chatbots named "${chatbotFlag}". Use the UUID instead \u2014 list them with \`openbat chatbot list\`.`
       );
     }
+    announceScope(matches[0].name, matches[0].id);
     return matches[0].id;
   }
-  if (chatbots.length === 1) return chatbots[0].id;
+  if (chatbots.length === 1) {
+    announceScope(chatbots[0].name, chatbots[0].id);
+    return chatbots[0].id;
+  }
   const lines = chatbots.map((c) => `  \u2022 ${c.name}   ${c.id}`).join("\n");
   fatal(
     `This API key targets multiple chatbots. Pick one with \`openbat use <id>\` (persistent) or \`--chatbot <id>\` (one-off):
@@ -687,9 +745,10 @@ function exportCommand() {
         `/api/v1/export/${id}?format=${format}`
       );
       if (opts.out) {
-        const { createWriteStream } = await import("fs");
-        const { Writable } = await import("stream");
-        const { Readable } = await import("stream");
+        const [{ createWriteStream }, { Writable, Readable }] = await Promise.all([
+          import("fs"),
+          import("stream")
+        ]);
         const file = createWriteStream(opts.out);
         const nodeReadable = Readable.fromWeb(
           body
@@ -724,6 +783,13 @@ function detectKind(apiKey) {
   if (apiKey.startsWith("ob_pat_")) return "pat";
   return "unknown";
 }
+function activeChatbotDisplay(activeId, chatbots) {
+  if (!activeId) {
+    return chatbots.length > 1 ? `(not pinned \u2014 ${chatbots.length} reachable; run \`openbat use <id>\`)` : "(not pinned)";
+  }
+  const hit = chatbots.find((c) => c.id === activeId);
+  return hit ? `${hit.name} (${hit.id})` : `${activeId} (not in reachable set)`;
+}
 function authCommand() {
   const cmd = new import_commander3.Command("auth").description(
     "Inspect the current credential's scope and audit history"
@@ -747,6 +813,10 @@ function authCommand() {
           {
             kind,
             keyPrefix: `${cfg.apiKey.slice(0, 16)}\u2026<hidden>`,
+            activeChatbot: activeChatbotDisplay(
+              cfg.activeChatbotId,
+              chatbots.chatbots
+            ),
             orgs: orgs.orgs,
             chatbots: chatbots.chatbots
           },
@@ -760,6 +830,10 @@ function authCommand() {
           {
             kind,
             keyPrefix: `${cfg.apiKey.slice(0, 16)}\u2026<hidden>`,
+            activeChatbot: activeChatbotDisplay(
+              cfg.activeChatbotId,
+              chatbots.chatbots
+            ),
             chatbots: chatbots.chatbots
           },
           { json: !!globals.json }
@@ -772,8 +846,279 @@ function authCommand() {
   return cmd;
 }
 
-// src/commands/login.ts
+// src/commands/review.ts
 var import_commander4 = require("commander");
+function parseSinceToMinutes(s) {
+  const match = /^(\d+)\s*(m|h|d)?$/.exec(s.trim().toLowerCase());
+  if (!match) {
+    fatal(`Invalid --since "${s}". Use e.g. 45m, 6h, or 7d.`);
+  }
+  const n = Number(match[1]);
+  const unit = match[2] ?? "m";
+  const minutes = unit === "d" ? n * 1440 : unit === "h" ? n * 60 : n;
+  if (minutes < 1) fatal("--since must be at least 1 minute.");
+  if (minutes > 43200) fatal("--since cannot exceed 30 days (43200m / 720h / 30d).");
+  return minutes;
+}
+var arrow = (t) => t === "up" ? "\u25B2" : t === "down" ? "\u25BC" : "=";
+var pctDelta = (d) => d === null ? "(new)" : `${arrow(d >= 0 ? "up" : "down")} ${d >= 0 ? "+" : ""}${d}%`;
+var ptsDelta = (d) => `${arrow(d >= 0 ? "up" : "down")} ${d >= 0 ? "+" : ""}${d} pts`;
+function renderReview(r) {
+  const L = [];
+  const h = r.headline;
+  L.push(`OpenBat review \xB7 last ${r.window.since} \xB7 vs prior ${r.window.since}`);
+  L.push("");
+  L.push(`  Conversations  ${h.conversations.value}  ${pctDelta(h.conversations.delta_pct)}`);
+  L.push(`  Messages       ${h.messages.value}`);
+  L.push(`  Resolved       ${h.outcomes.resolved.pct}%  ${ptsDelta(h.outcomes.resolved.delta_pts)}`);
+  L.push(`  Partial        ${h.outcomes.partially_resolved.pct}%  ${ptsDelta(h.outcomes.partially_resolved.delta_pts)}`);
+  L.push(`  Failed         ${h.outcomes.failed.pct}%  ${ptsDelta(h.outcomes.failed.delta_pts)}`);
+  const sent = h.avg_sentiment.value ?? "\u2014";
+  const sentDelta = h.avg_sentiment.delta === null ? "" : `  ${arrow(h.avg_sentiment.delta >= 0 ? "up" : "down")} ${h.avg_sentiment.delta >= 0 ? "+" : ""}${h.avg_sentiment.delta}`;
+  L.push(`  Avg sentiment  ${sent}${sentDelta}`);
+  L.push(`  Flagged        ${h.flagged}`);
+  if (r.clusters.issues.length) {
+    L.push("");
+    L.push("Top issues");
+    for (const i of r.clusters.issues) {
+      const ans = i.answer_available.true + i.answer_available.false;
+      const ansStr = ans > 0 ? `  answer_available ${i.answer_available.true}/${ans}` : "";
+      L.push(
+        `  ${i.type}  ${i.count} ${arrow(i.trend)}  high ${i.severity.high} \xB7 med ${i.severity.medium} \xB7 low ${i.severity.low}${ansStr}`
+      );
+    }
+  }
+  if (r.clusters.flags.length) {
+    L.push("");
+    L.push(`Top flags      ${r.clusters.flags.map((f) => `${f.value} ${f.count} ${arrow(f.trend)}`).join(" \xB7 ")}`);
+  }
+  if (r.clusters.intents.length) {
+    L.push(`Top intents    ${r.clusters.intents.map((i) => `${i.value} ${i.count} ${arrow(i.trend)}`).join(" \xB7 ")}`);
+  }
+  const reps = [
+    ...r.clusters.issues.flatMap((i) => i.representatives),
+    ...r.clusters.failedOutcomes
+  ];
+  if (reps.length) {
+    L.push("");
+    L.push("Representative failures");
+    for (const rep of reps.slice(0, 8)) {
+      const tag = rep.type ? `[${rep.type} \xB7 ${rep.severity ?? "?"} \xB7 answer_available=${rep.answer_available ?? "?"} \xB7 source=${rep.verification_source ?? "?"}]` : `[failed outcome]`;
+      L.push(`  ${tag}`);
+      L.push(`    conv ${rep.conversationId ?? "?"} msg ${rep.messageId}`);
+      if (rep.reasoning) L.push(`    why: ${rep.reasoning}`);
+    }
+  }
+  L.push("");
+  L.push("Drill in: openbat conversations show <id>   \xB7   Fix: openbat-optimize skill");
+  return L.join("\n");
+}
+function reviewCommand() {
+  return new import_commander4.Command("review").description(
+    "Daily eval digest for the active chatbot \u2014 flags, issues, outcomes + reasonings"
+  ).option(
+    "--since <duration>",
+    "Look-back window: 45m, 6h, 7d (max 30d)",
+    "24h"
+  ).action(async function(opts) {
+    try {
+      const windowMinutes = parseSinceToMinutes(opts.since);
+      const globals = this.optsWithGlobals();
+      const { api, chatbotFlag } = await client(globals);
+      const id = await resolveChatbotId(api, chatbotFlag);
+      const params = new URLSearchParams({
+        windowMinutes: String(windowMinutes)
+      });
+      const result = await api.get(
+        `/api/v1/chatbots/${id}/review?${params}`
+      );
+      if (this.optsWithGlobals().json) {
+        emit(result, { json: true });
+      } else {
+        process.stdout.write(renderReview(result) + "\n");
+      }
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+}
+
+// src/commands/prompts.ts
+var import_commander5 = require("commander");
+var import_node_fs2 = require("fs");
+async function waitForActive(api, chatbotId, versionId) {
+  const deadlineMs = Date.now() + 15e3;
+  let attempt = 0;
+  while (Date.now() < deadlineMs) {
+    const res = await api.get(
+      `/api/v1/chatbots/${chatbotId}/prompts/active`
+    );
+    if (res.activeVersionId === versionId) {
+      process.stderr.write(
+        `
+Confirmed live (server): active version is ${versionId}. Live SDK processes converge within their ~60s fetch-cache TTL.
+`
+      );
+      return;
+    }
+    attempt++;
+    await new Promise((r) => setTimeout(r, Math.min(500 * attempt, 2e3)));
+  }
+  process.stderr.write(
+    "\nPublished, but timed out (15s) waiting for server confirmation \u2014 the active pointer may still be propagating.\n"
+  );
+}
+function promptsCommand() {
+  const cmd = new import_commander5.Command("prompts").description(
+    "Manage the live published system prompt (list / publish / activate / kill-switch)"
+  );
+  cmd.command("list").description("List system-prompt versions + live controls (active version, kill switch)").action(async function() {
+    try {
+      const { api, chatbotFlag } = await client(this.optsWithGlobals());
+      const id = await resolveChatbotId(api, chatbotFlag);
+      const result = await api.get(
+        `/api/v1/chatbots/${id}/prompts`
+      );
+      emit(result, { json: !!this.optsWithGlobals().json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("publish").description("Publish a template as the LIVE prompt (from --file or --text)").option("--file <path>", "Read the template text from a file").option("--text <text>", "Inline template text (prefer --file for long prompts)").option("--wait", "Block until the server confirms the new version is the active published prompt").action(async function(opts) {
+    try {
+      let templateText = opts.text;
+      if (opts.file) templateText = await import_node_fs2.promises.readFile(opts.file, "utf8");
+      if (!templateText || !templateText.trim()) {
+        fatal("Provide the prompt text via --file <path> or --text <text>.");
+      }
+      const { api, chatbotFlag } = await client(this.optsWithGlobals());
+      const id = await resolveChatbotId(api, chatbotFlag);
+      const result = await api.post(
+        `/api/v1/chatbots/${id}/prompts`,
+        { templateText }
+      );
+      emit(result, { json: !!this.optsWithGlobals().json });
+      if (opts.wait && result.versionId) {
+        await waitForActive(api, id, result.versionId);
+      } else {
+        process.stderr.write(
+          "\nPublished. Live within ~60s for chatbots that fetch their prompt from OpenBat.\n"
+        );
+      }
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("activate <versionId>").description("Point the live prompt at an existing version id (roll back/forward)").action(async function(versionId) {
+    try {
+      const { api, chatbotFlag } = await client(this.optsWithGlobals());
+      const id = await resolveChatbotId(api, chatbotFlag);
+      const result = await api.post(
+        `/api/v1/chatbots/${id}/prompts/activate`,
+        { versionId }
+      );
+      emit(result, { json: !!this.optsWithGlobals().json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("kill-switch").description("Toggle the remote prompt kill switch (--on / --off)").option("--on", "Enable: SDK falls back to its hardcoded prompt").option("--off", "Disable: SDK serves the active published prompt again").action(async function(opts) {
+    try {
+      if (!!opts.on === !!opts.off) {
+        fatal("Pass exactly one of --on or --off.");
+      }
+      const enabled = !!opts.on;
+      const { api, chatbotFlag } = await client(this.optsWithGlobals());
+      const id = await resolveChatbotId(api, chatbotFlag);
+      const result = await api.post(
+        `/api/v1/chatbots/${id}/prompts/kill-switch`,
+        { enabled }
+      );
+      emit(result, { json: !!this.optsWithGlobals().json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("show <versionId>").description("Show a version's full template text (list shows only hashes)").action(async function(versionId) {
+    try {
+      const { api, chatbotFlag } = await client(this.optsWithGlobals());
+      const id = await resolveChatbotId(api, chatbotFlag);
+      const result = await api.get(
+        `/api/v1/chatbots/${id}/prompts/${versionId}`
+      );
+      emit(result, { json: !!this.optsWithGlobals().json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("active").description("Show what the server resolves to RIGHT NOW (active version, kill switch)").action(async function() {
+    try {
+      const { api, chatbotFlag } = await client(this.optsWithGlobals());
+      const id = await resolveChatbotId(api, chatbotFlag);
+      const result = await api.get(
+        `/api/v1/chatbots/${id}/prompts/active`
+      );
+      emit(result, { json: !!this.optsWithGlobals().json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  return cmd;
+}
+
+// src/commands/backtests.ts
+var import_commander6 = require("commander");
+function backtestsCommand() {
+  const cmd = new import_commander6.Command("backtests").description(
+    "Retest a candidate prompt against flagged conversations (create + poll status)"
+  );
+  cmd.command("create").description("Replay flagged conversations against a candidate prompt version").requiredOption("--name <name>", "Backtest name").requiredOption(
+    "--candidate-prompt <versionId>",
+    "Candidate prompt version id (from `openbat prompts list`)"
+  ).requiredOption(
+    "--flags <csv>",
+    "Comma-separated flag values to sample (e.g. churn_risk,billing_issue)"
+  ).option("--sample-size <n>", "How many flagged messages to replay (1-500)", "50").option("--from <iso>", "Only sample flags on/after this ISO timestamp").option("--to <iso>", "Only sample flags on/before this ISO timestamp").action(async function(opts) {
+    try {
+      const flagValues = opts.flags.split(",").map((s) => s.trim()).filter(Boolean);
+      if (flagValues.length === 0) {
+        fatal("Provide at least one flag via --flags <csv>.");
+      }
+      const { api, chatbotFlag } = await client(this.optsWithGlobals());
+      const id = await resolveChatbotId(api, chatbotFlag);
+      const result = await api.post(
+        `/api/v1/chatbots/${id}/backtests`,
+        {
+          name: opts.name,
+          candidatePromptId: opts.candidatePrompt,
+          flagValues,
+          sampleSize: Number(opts.sampleSize),
+          timeRangeStart: opts.from,
+          timeRangeEnd: opts.to
+        }
+      );
+      emit(result, { json: !!this.optsWithGlobals().json });
+      process.stderr.write("\nStarted. Poll progress with: openbat backtests status <id>\n");
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("status <backtestId>").description("Show a backtest's progress + verdict tally").action(async function(backtestId) {
+    try {
+      const { api } = await client(this.optsWithGlobals());
+      const result = await api.get(
+        `/api/v1/backtests/${encodeURIComponent(backtestId)}/status`
+      );
+      emit(result, { json: !!this.optsWithGlobals().json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  return cmd;
+}
+
+// src/commands/login.ts
+var import_commander7 = require("commander");
 var import_node_os2 = __toESM(require("os"));
 var import_node_readline = __toESM(require("readline"));
 
@@ -916,7 +1261,7 @@ async function runLoopbackServer(opts) {
 // src/commands/login.ts
 var HOSTNAME = import_node_os2.default.hostname();
 function loginCommand() {
-  return new import_commander4.Command("login").description("Sign in via browser and install an API key on this device").option("--device", "Use the device-code flow (for SSH / headless machines)").option(
+  return new import_commander7.Command("login").description("Sign in via browser and install an API key on this device").option("--device", "Use the device-code flow (for SSH / headless machines)").option(
     "--use <key>",
     "Skip the browser; install a PAT plaintext you already have"
   ).action(async function(opts) {
@@ -1106,9 +1451,9 @@ You have ${chatbots.length} chatbots. Pick one later with \`openbat use <id>\`.
 }
 
 // src/commands/logout.ts
-var import_commander5 = require("commander");
+var import_commander8 = require("commander");
 function logoutCommand() {
-  return new import_commander5.Command("logout").description("Revoke the stored API key and clear ~/.openbatrc").action(async function() {
+  return new import_commander8.Command("logout").description("Revoke the stored API key and clear ~/.openbatrc").action(async function() {
     try {
       const globals = this.optsWithGlobals();
       const cfg = await resolveConfig({
@@ -1143,7 +1488,7 @@ function logoutCommand() {
 }
 
 // src/commands/org.ts
-var import_commander6 = require("commander");
+var import_commander9 = require("commander");
 async function client2(globals) {
   const cfg = await resolveConfig({
     apiKeyFlag: globals.apiKey ?? null,
@@ -1158,7 +1503,7 @@ async function client2(globals) {
   return new ApiClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl });
 }
 function orgCommand() {
-  const cmd = new import_commander6.Command("org").description(
+  const cmd = new import_commander9.Command("org").description(
     "Manage the OpenBat tenant org (rename, members, invitations). Requires PAT."
   );
   cmd.command("list").description("List orgs the current PAT's user belongs to").action(async function() {
@@ -1266,7 +1611,7 @@ function orgCommand() {
 }
 
 // src/commands/write.ts
-var import_commander7 = require("commander");
+var import_commander10 = require("commander");
 async function client3(globals) {
   const cfg = await resolveConfig({
     apiKeyFlag: globals.apiKey ?? null,
@@ -1299,7 +1644,7 @@ function surfacePlaintext(plaintext, label) {
   );
 }
 function chatbotsCommand() {
-  const cmd = new import_commander7.Command("chatbots").description(
+  const cmd = new import_commander10.Command("chatbots").description(
     "List, create, delete chatbots in the current scope"
   );
   cmd.command("list").description("List every chatbot the credential can reach").action(async function() {
@@ -1347,7 +1692,7 @@ function chatbotsCommand() {
   return cmd;
 }
 function webhooksCommand() {
-  const cmd = new import_commander7.Command("webhooks").description("Manage webhooks for a chatbot");
+  const cmd = new import_commander10.Command("webhooks").description("Manage webhooks for a chatbot");
   cmd.command("list").action(async function() {
     try {
       const chatbotId = requireChatbotId(this);
@@ -1391,7 +1736,7 @@ function webhooksCommand() {
   return cmd;
 }
 function settingsCommand() {
-  const cmd = new import_commander7.Command("settings").description(
+  const cmd = new import_commander10.Command("settings").description(
     "Manage chatbot settings + per-chatbot keys"
   );
   const keys = cmd.command("keys").description("Manage API keys for a chatbot");
@@ -1485,7 +1830,7 @@ function settingsCommand() {
   return cmd;
 }
 function workflowsCommand() {
-  const cmd = new import_commander7.Command("workflows").description("Manage workflows");
+  const cmd = new import_commander10.Command("workflows").description("Manage workflows");
   cmd.command("list").action(async function() {
     try {
       const chatbotId = requireChatbotId(this);
@@ -1525,7 +1870,7 @@ function workflowsCommand() {
   return cmd;
 }
 function reportsCommand() {
-  const cmd = new import_commander7.Command("reports").description("Manage AI reports");
+  const cmd = new import_commander10.Command("reports").description("Manage AI reports");
   cmd.command("list").action(async function() {
     try {
       const chatbotId = requireChatbotId(this);
@@ -1563,7 +1908,7 @@ Created report. View it (org members only):
   return cmd;
 }
 function analysisCommand() {
-  const cmd = new import_commander7.Command("analysis").description("Manage analysis definitions");
+  const cmd = new import_commander10.Command("analysis").description("Manage analysis definitions");
   cmd.command("list").option("--type <t>", "intent | flag | assistant_outcome | assistant_issue").option("--pending", "Include pending suggestions").action(async function(opts) {
     try {
       const chatbotId = requireChatbotId(this);
@@ -1605,7 +1950,7 @@ function analysisCommand() {
   return cmd;
 }
 function usersCommand() {
-  const cmd = new import_commander7.Command("users").description(
+  const cmd = new import_commander10.Command("users").description(
     "List external users (chatbot customers) with health metrics"
   );
   cmd.command("list").option("--from <iso>").option("--to <iso>").option("--days <n>", "Convenience: last N days").option("--search <q>").option("--limit <n>", "Page size", "20").action(async function(opts) {
@@ -1638,7 +1983,7 @@ Total: ${result.total}
   return cmd;
 }
 function sdkCommand() {
-  const cmd = new import_commander7.Command("sdk").description(
+  const cmd = new import_commander10.Command("sdk").description(
     "Help install and verify the OpenBat SDK in a target project"
   );
   cmd.command("install-instructions").description("Print markdown the calling agent can follow").option(
@@ -1748,10 +2093,10 @@ Timed out after ${timeoutSec}s \u2014 no events yet. Confirm OPENBAT_API_KEY and
 }
 
 // src/index.ts
-var program = new import_commander8.Command();
+var program = new import_commander11.Command();
 program.name("openbat").description(
   "Query OpenBat chatbot data \u2014 conversations, sentiment, analytics, exports."
-).version("0.2.3").option("--api-key <key>", "Override the stored Read API key (footgun \u2014 leaks into shell history)").option(
+).version("0.4.0").option("--api-key <key>", "Override the stored Read API key (footgun \u2014 leaks into shell history)").option(
   "--base-url <url>",
   "Override the OpenBat API base URL (defaults to ~/.openbatrc or https://openbat.dev)"
 ).option(
@@ -1770,6 +2115,9 @@ program.addCommand(orgCommand());
 program.addCommand(chatbotCommand());
 program.addCommand(chatbotsCommand());
 program.addCommand(conversationsCommand());
+program.addCommand(reviewCommand());
+program.addCommand(promptsCommand());
+program.addCommand(backtestsCommand());
 program.addCommand(usersCommand());
 program.addCommand(settingsCommand());
 program.addCommand(webhooksCommand());

package/dist/index.mjs

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   ApiClient
-} from "./chunk-HBSCN3HV.mjs";
+} from "./chunk-RA36VFZI.mjs";
 
 // src/index.ts
-import { Command as Command8 } from "commander";
+import { Command as Command11 } from "commander";
 
 // src/commands/config.ts
 import { Command } from "commander";
@@ -255,12 +255,24 @@ function configCommand() {
   cmd.command("show").description("Show the current resolved config (key prefix only)").action(async () => {
     const cfg = await resolveConfig({});
     const keyDisplay = cfg.apiKey ? `${cfg.apiKey.slice(0, 16)}\u2026<hidden>` : "(not set)";
+    let activeChatbot = cfg.activeChatbotId ?? "(not set)";
+    if (cfg.apiKey && cfg.activeChatbotId) {
+      try {
+        const api = new ApiClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl });
+        const list = await api.get("/api/v1/chatbots");
+        const hit = (list.chatbots ?? []).find(
+          (c) => c.id === cfg.activeChatbotId
+        );
+        if (hit) activeChatbot = `${hit.name} (${hit.id})`;
+      } catch {
+      }
+    }
     emit({
       apiKey: keyDisplay,
       apiKeySource: cfg.apiKeySource,
       baseUrl: cfg.baseUrl,
       baseUrlSource: cfg.baseUrlSource,
-      activeChatbotId: cfg.activeChatbotId ?? "(not set)",
+      activeChatbot,
       activeChatbotIdSource: cfg.activeChatbotIdSource,
       configFile: configPath()
     });
@@ -315,9 +327,46 @@ async function resolveTargetChatbotId(target) {
   }
   return matches[0].id;
 }
+async function showCurrentAndOptions() {
+  const cfg = await resolveConfig({});
+  if (!cfg.apiKey) {
+    fatal("No API key configured. Run `openbat config set-key` first.");
+  }
+  const api = new ApiClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl });
+  const list = await api.get(
+    "/api/v1/chatbots"
+  );
+  const chatbots = list.chatbots ?? [];
+  if (cfg.activeChatbotId) {
+    const hit = chatbots.find((c) => c.id === cfg.activeChatbotId);
+    process.stdout.write(
+      hit ? `Active chatbot: ${hit.name} (${hit.id})
+
+` : `Active chatbot: ${cfg.activeChatbotId} (not in reachable set)
+
+`
+    );
+  } else {
+    process.stdout.write("No active chatbot set.\n\n");
+  }
+  if (chatbots.length === 0) {
+    process.stdout.write("No chatbots reachable by this key.\n");
+    return;
+  }
+  process.stdout.write("Reachable chatbots \u2014 pin one with `openbat use <id>`:\n");
+  for (const c of chatbots) {
+    const marker = c.id === cfg.activeChatbotId ? "\u25CF" : "\u25CB";
+    process.stdout.write(`  ${marker} ${c.name}   ${c.id}
+`);
+  }
+}
 function useCommand() {
-  return new Command("use").argument("<id-or-name>", "Chatbot UUID or exact name").description("Set the default chatbot for this CLI (shortcut for `config use-chatbot`)").action(async (target) => {
+  return new Command("use").argument("[id-or-name]", "Chatbot UUID or exact name (omit to show current + options)").description("Set the active chatbot for this CLI (omit the arg to see current + options)").action(async (target) => {
     try {
+      if (!target) {
+        await showCurrentAndOptions();
+        return;
+      }
       const id = await resolveTargetChatbotId(target);
       await setActiveChatbotId(id);
       process.stdout.write(`Active chatbot saved: ${id}
@@ -347,6 +396,10 @@ async function client(globals) {
   };
 }
 var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function announceScope(name, id) {
+  process.stderr.write(`\u2192 chatbot: ${name} (${id})
+`);
+}
 async function resolveChatbotId(api, chatbotFlag) {
   const list = await api.get(
     "/api/v1/chatbots"
@@ -365,6 +418,7 @@ async function resolveChatbotId(api, chatbotFlag) {
           `Chatbot ${chatbotFlag} is not reachable by this API key. Run \`openbat chatbot list\` to see what is.`
         );
       }
+      announceScope(hit.name, hit.id);
       return hit.id;
     }
     const lower = chatbotFlag.toLowerCase();
@@ -379,9 +433,13 @@ async function resolveChatbotId(api, chatbotFlag) {
         `Multiple chatbots named "${chatbotFlag}". Use the UUID instead \u2014 list them with \`openbat chatbot list\`.`
       );
     }
+    announceScope(matches[0].name, matches[0].id);
     return matches[0].id;
   }
-  if (chatbots.length === 1) return chatbots[0].id;
+  if (chatbots.length === 1) {
+    announceScope(chatbots[0].name, chatbots[0].id);
+    return chatbots[0].id;
+  }
   const lines = chatbots.map((c) => `  \u2022 ${c.name}   ${c.id}`).join("\n");
   fatal(
     `This API key targets multiple chatbots. Pick one with \`openbat use <id>\` (persistent) or \`--chatbot <id>\` (one-off):
@@ -509,9 +567,10 @@ function exportCommand() {
         `/api/v1/export/${id}?format=${format}`
       );
       if (opts.out) {
-        const { createWriteStream } = await import("fs");
-        const { Writable } = await import("stream");
-        const { Readable } = await import("stream");
+        const [{ createWriteStream }, { Writable, Readable }] = await Promise.all([
+          import("fs"),
+          import("stream")
+        ]);
         const file = createWriteStream(opts.out);
         const nodeReadable = Readable.fromWeb(
           body
@@ -546,6 +605,13 @@ function detectKind(apiKey) {
   if (apiKey.startsWith("ob_pat_")) return "pat";
   return "unknown";
 }
+function activeChatbotDisplay(activeId, chatbots) {
+  if (!activeId) {
+    return chatbots.length > 1 ? `(not pinned \u2014 ${chatbots.length} reachable; run \`openbat use <id>\`)` : "(not pinned)";
+  }
+  const hit = chatbots.find((c) => c.id === activeId);
+  return hit ? `${hit.name} (${hit.id})` : `${activeId} (not in reachable set)`;
+}
 function authCommand() {
   const cmd = new Command3("auth").description(
     "Inspect the current credential's scope and audit history"
@@ -569,6 +635,10 @@ function authCommand() {
           {
             kind,
             keyPrefix: `${cfg.apiKey.slice(0, 16)}\u2026<hidden>`,
+            activeChatbot: activeChatbotDisplay(
+              cfg.activeChatbotId,
+              chatbots.chatbots
+            ),
             orgs: orgs.orgs,
             chatbots: chatbots.chatbots
           },
@@ -582,6 +652,10 @@ function authCommand() {
           {
             kind,
             keyPrefix: `${cfg.apiKey.slice(0, 16)}\u2026<hidden>`,
+            activeChatbot: activeChatbotDisplay(
+              cfg.activeChatbotId,
+              chatbots.chatbots
+            ),
             chatbots: chatbots.chatbots
           },
           { json: !!globals.json }
@@ -594,8 +668,279 @@ function authCommand() {
   return cmd;
 }
 
-// src/commands/login.ts
+// src/commands/review.ts
 import { Command as Command4 } from "commander";
+function parseSinceToMinutes(s) {
+  const match = /^(\d+)\s*(m|h|d)?$/.exec(s.trim().toLowerCase());
+  if (!match) {
+    fatal(`Invalid --since "${s}". Use e.g. 45m, 6h, or 7d.`);
+  }
+  const n = Number(match[1]);
+  const unit = match[2] ?? "m";
+  const minutes = unit === "d" ? n * 1440 : unit === "h" ? n * 60 : n;
+  if (minutes < 1) fatal("--since must be at least 1 minute.");
+  if (minutes > 43200) fatal("--since cannot exceed 30 days (43200m / 720h / 30d).");
+  return minutes;
+}
+var arrow = (t) => t === "up" ? "\u25B2" : t === "down" ? "\u25BC" : "=";
+var pctDelta = (d) => d === null ? "(new)" : `${arrow(d >= 0 ? "up" : "down")} ${d >= 0 ? "+" : ""}${d}%`;
+var ptsDelta = (d) => `${arrow(d >= 0 ? "up" : "down")} ${d >= 0 ? "+" : ""}${d} pts`;
+function renderReview(r) {
+  const L = [];
+  const h = r.headline;
+  L.push(`OpenBat review \xB7 last ${r.window.since} \xB7 vs prior ${r.window.since}`);
+  L.push("");
+  L.push(`  Conversations  ${h.conversations.value}  ${pctDelta(h.conversations.delta_pct)}`);
+  L.push(`  Messages       ${h.messages.value}`);
+  L.push(`  Resolved       ${h.outcomes.resolved.pct}%  ${ptsDelta(h.outcomes.resolved.delta_pts)}`);
+  L.push(`  Partial        ${h.outcomes.partially_resolved.pct}%  ${ptsDelta(h.outcomes.partially_resolved.delta_pts)}`);
+  L.push(`  Failed         ${h.outcomes.failed.pct}%  ${ptsDelta(h.outcomes.failed.delta_pts)}`);
+  const sent = h.avg_sentiment.value ?? "\u2014";
+  const sentDelta = h.avg_sentiment.delta === null ? "" : `  ${arrow(h.avg_sentiment.delta >= 0 ? "up" : "down")} ${h.avg_sentiment.delta >= 0 ? "+" : ""}${h.avg_sentiment.delta}`;
+  L.push(`  Avg sentiment  ${sent}${sentDelta}`);
+  L.push(`  Flagged        ${h.flagged}`);
+  if (r.clusters.issues.length) {
+    L.push("");
+    L.push("Top issues");
+    for (const i of r.clusters.issues) {
+      const ans = i.answer_available.true + i.answer_available.false;
+      const ansStr = ans > 0 ? `  answer_available ${i.answer_available.true}/${ans}` : "";
+      L.push(
+        `  ${i.type}  ${i.count} ${arrow(i.trend)}  high ${i.severity.high} \xB7 med ${i.severity.medium} \xB7 low ${i.severity.low}${ansStr}`
+      );
+    }
+  }
+  if (r.clusters.flags.length) {
+    L.push("");
+    L.push(`Top flags      ${r.clusters.flags.map((f) => `${f.value} ${f.count} ${arrow(f.trend)}`).join(" \xB7 ")}`);
+  }
+  if (r.clusters.intents.length) {
+    L.push(`Top intents    ${r.clusters.intents.map((i) => `${i.value} ${i.count} ${arrow(i.trend)}`).join(" \xB7 ")}`);
+  }
+  const reps = [
+    ...r.clusters.issues.flatMap((i) => i.representatives),
+    ...r.clusters.failedOutcomes
+  ];
+  if (reps.length) {
+    L.push("");
+    L.push("Representative failures");
+    for (const rep of reps.slice(0, 8)) {
+      const tag = rep.type ? `[${rep.type} \xB7 ${rep.severity ?? "?"} \xB7 answer_available=${rep.answer_available ?? "?"} \xB7 source=${rep.verification_source ?? "?"}]` : `[failed outcome]`;
+      L.push(`  ${tag}`);
+      L.push(`    conv ${rep.conversationId ?? "?"} msg ${rep.messageId}`);
+      if (rep.reasoning) L.push(`    why: ${rep.reasoning}`);
+    }
+  }
+  L.push("");
+  L.push("Drill in: openbat conversations show <id>   \xB7   Fix: openbat-optimize skill");
+  return L.join("\n");
+}
+function reviewCommand() {
+  return new Command4("review").description(
+    "Daily eval digest for the active chatbot \u2014 flags, issues, outcomes + reasonings"
+  ).option(
+    "--since <duration>",
+    "Look-back window: 45m, 6h, 7d (max 30d)",
+    "24h"
+  ).action(async function(opts) {
+    try {
+      const windowMinutes = parseSinceToMinutes(opts.since);
+      const globals = this.optsWithGlobals();
+      const { api, chatbotFlag } = await client(globals);
+      const id = await resolveChatbotId(api, chatbotFlag);
+      const params = new URLSearchParams({
+        windowMinutes: String(windowMinutes)
+      });
+      const result = await api.get(
+        `/api/v1/chatbots/${id}/review?${params}`
+      );
+      if (this.optsWithGlobals().json) {
+        emit(result, { json: true });
+      } else {
+        process.stdout.write(renderReview(result) + "\n");
+      }
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+}
+
+// src/commands/prompts.ts
+import { Command as Command5 } from "commander";
+import { promises as fs2 } from "fs";
+async function waitForActive(api, chatbotId, versionId) {
+  const deadlineMs = Date.now() + 15e3;
+  let attempt = 0;
+  while (Date.now() < deadlineMs) {
+    const res = await api.get(
+      `/api/v1/chatbots/${chatbotId}/prompts/active`
+    );
+    if (res.activeVersionId === versionId) {
+      process.stderr.write(
+        `
+Confirmed live (server): active version is ${versionId}. Live SDK processes converge within their ~60s fetch-cache TTL.
+`
+      );
+      return;
+    }
+    attempt++;
+    await new Promise((r) => setTimeout(r, Math.min(500 * attempt, 2e3)));
+  }
+  process.stderr.write(
+    "\nPublished, but timed out (15s) waiting for server confirmation \u2014 the active pointer may still be propagating.\n"
+  );
+}
+function promptsCommand() {
+  const cmd = new Command5("prompts").description(
+    "Manage the live published system prompt (list / publish / activate / kill-switch)"
+  );
+  cmd.command("list").description("List system-prompt versions + live controls (active version, kill switch)").action(async function() {
+    try {
+      const { api, chatbotFlag } = await client(this.optsWithGlobals());
+      const id = await resolveChatbotId(api, chatbotFlag);
+      const result = await api.get(
+        `/api/v1/chatbots/${id}/prompts`
+      );
+      emit(result, { json: !!this.optsWithGlobals().json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("publish").description("Publish a template as the LIVE prompt (from --file or --text)").option("--file <path>", "Read the template text from a file").option("--text <text>", "Inline template text (prefer --file for long prompts)").option("--wait", "Block until the server confirms the new version is the active published prompt").action(async function(opts) {
+    try {
+      let templateText = opts.text;
+      if (opts.file) templateText = await fs2.readFile(opts.file, "utf8");
+      if (!templateText || !templateText.trim()) {
+        fatal("Provide the prompt text via --file <path> or --text <text>.");
+      }
+      const { api, chatbotFlag } = await client(this.optsWithGlobals());
+      const id = await resolveChatbotId(api, chatbotFlag);
+      const result = await api.post(
+        `/api/v1/chatbots/${id}/prompts`,
+        { templateText }
+      );
+      emit(result, { json: !!this.optsWithGlobals().json });
+      if (opts.wait && result.versionId) {
+        await waitForActive(api, id, result.versionId);
+      } else {
+        process.stderr.write(
+          "\nPublished. Live within ~60s for chatbots that fetch their prompt from OpenBat.\n"
+        );
+      }
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("activate <versionId>").description("Point the live prompt at an existing version id (roll back/forward)").action(async function(versionId) {
+    try {
+      const { api, chatbotFlag } = await client(this.optsWithGlobals());
+      const id = await resolveChatbotId(api, chatbotFlag);
+      const result = await api.post(
+        `/api/v1/chatbots/${id}/prompts/activate`,
+        { versionId }
+      );
+      emit(result, { json: !!this.optsWithGlobals().json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("kill-switch").description("Toggle the remote prompt kill switch (--on / --off)").option("--on", "Enable: SDK falls back to its hardcoded prompt").option("--off", "Disable: SDK serves the active published prompt again").action(async function(opts) {
+    try {
+      if (!!opts.on === !!opts.off) {
+        fatal("Pass exactly one of --on or --off.");
+      }
+      const enabled = !!opts.on;
+      const { api, chatbotFlag } = await client(this.optsWithGlobals());
+      const id = await resolveChatbotId(api, chatbotFlag);
+      const result = await api.post(
+        `/api/v1/chatbots/${id}/prompts/kill-switch`,
+        { enabled }
+      );
+      emit(result, { json: !!this.optsWithGlobals().json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("show <versionId>").description("Show a version's full template text (list shows only hashes)").action(async function(versionId) {
+    try {
+      const { api, chatbotFlag } = await client(this.optsWithGlobals());
+      const id = await resolveChatbotId(api, chatbotFlag);
+      const result = await api.get(
+        `/api/v1/chatbots/${id}/prompts/${versionId}`
+      );
+      emit(result, { json: !!this.optsWithGlobals().json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("active").description("Show what the server resolves to RIGHT NOW (active version, kill switch)").action(async function() {
+    try {
+      const { api, chatbotFlag } = await client(this.optsWithGlobals());
+      const id = await resolveChatbotId(api, chatbotFlag);
+      const result = await api.get(
+        `/api/v1/chatbots/${id}/prompts/active`
+      );
+      emit(result, { json: !!this.optsWithGlobals().json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  return cmd;
+}
+
+// src/commands/backtests.ts
+import { Command as Command6 } from "commander";
+function backtestsCommand() {
+  const cmd = new Command6("backtests").description(
+    "Retest a candidate prompt against flagged conversations (create + poll status)"
+  );
+  cmd.command("create").description("Replay flagged conversations against a candidate prompt version").requiredOption("--name <name>", "Backtest name").requiredOption(
+    "--candidate-prompt <versionId>",
+    "Candidate prompt version id (from `openbat prompts list`)"
+  ).requiredOption(
+    "--flags <csv>",
+    "Comma-separated flag values to sample (e.g. churn_risk,billing_issue)"
+  ).option("--sample-size <n>", "How many flagged messages to replay (1-500)", "50").option("--from <iso>", "Only sample flags on/after this ISO timestamp").option("--to <iso>", "Only sample flags on/before this ISO timestamp").action(async function(opts) {
+    try {
+      const flagValues = opts.flags.split(",").map((s) => s.trim()).filter(Boolean);
+      if (flagValues.length === 0) {
+        fatal("Provide at least one flag via --flags <csv>.");
+      }
+      const { api, chatbotFlag } = await client(this.optsWithGlobals());
+      const id = await resolveChatbotId(api, chatbotFlag);
+      const result = await api.post(
+        `/api/v1/chatbots/${id}/backtests`,
+        {
+          name: opts.name,
+          candidatePromptId: opts.candidatePrompt,
+          flagValues,
+          sampleSize: Number(opts.sampleSize),
+          timeRangeStart: opts.from,
+          timeRangeEnd: opts.to
+        }
+      );
+      emit(result, { json: !!this.optsWithGlobals().json });
+      process.stderr.write("\nStarted. Poll progress with: openbat backtests status <id>\n");
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  cmd.command("status <backtestId>").description("Show a backtest's progress + verdict tally").action(async function(backtestId) {
+    try {
+      const { api } = await client(this.optsWithGlobals());
+      const result = await api.get(
+        `/api/v1/backtests/${encodeURIComponent(backtestId)}/status`
+      );
+      emit(result, { json: !!this.optsWithGlobals().json });
+    } catch (err) {
+      fatal(err instanceof Error ? err.message : String(err));
+    }
+  });
+  return cmd;
+}
+
+// src/commands/login.ts
+import { Command as Command7 } from "commander";
 import os from "os";
 import readline from "readline";
 
@@ -738,7 +1083,7 @@ async function runLoopbackServer(opts) {
 // src/commands/login.ts
 var HOSTNAME = os.hostname();
 function loginCommand() {
-  return new Command4("login").description("Sign in via browser and install an API key on this device").option("--device", "Use the device-code flow (for SSH / headless machines)").option(
+  return new Command7("login").description("Sign in via browser and install an API key on this device").option("--device", "Use the device-code flow (for SSH / headless machines)").option(
     "--use <key>",
     "Skip the browser; install a PAT plaintext you already have"
   ).action(async function(opts) {
@@ -928,9 +1273,9 @@ You have ${chatbots.length} chatbots. Pick one later with \`openbat use <id>\`.
 }
 
 // src/commands/logout.ts
-import { Command as Command5 } from "commander";
+import { Command as Command8 } from "commander";
 function logoutCommand() {
-  return new Command5("logout").description("Revoke the stored API key and clear ~/.openbatrc").action(async function() {
+  return new Command8("logout").description("Revoke the stored API key and clear ~/.openbatrc").action(async function() {
     try {
       const globals = this.optsWithGlobals();
       const cfg = await resolveConfig({
@@ -965,7 +1310,7 @@ function logoutCommand() {
 }
 
 // src/commands/org.ts
-import { Command as Command6 } from "commander";
+import { Command as Command9 } from "commander";
 async function client2(globals) {
   const cfg = await resolveConfig({
     apiKeyFlag: globals.apiKey ?? null,
@@ -980,7 +1325,7 @@ async function client2(globals) {
   return new ApiClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl });
 }
 function orgCommand() {
-  const cmd = new Command6("org").description(
+  const cmd = new Command9("org").description(
     "Manage the OpenBat tenant org (rename, members, invitations). Requires PAT."
   );
   cmd.command("list").description("List orgs the current PAT's user belongs to").action(async function() {
@@ -1088,7 +1433,7 @@ function orgCommand() {
 }
 
 // src/commands/write.ts
-import { Command as Command7 } from "commander";
+import { Command as Command10 } from "commander";
 async function client3(globals) {
   const cfg = await resolveConfig({
     apiKeyFlag: globals.apiKey ?? null,
@@ -1121,7 +1466,7 @@ function surfacePlaintext(plaintext, label) {
   );
 }
 function chatbotsCommand() {
-  const cmd = new Command7("chatbots").description(
+  const cmd = new Command10("chatbots").description(
     "List, create, delete chatbots in the current scope"
   );
   cmd.command("list").description("List every chatbot the credential can reach").action(async function() {
@@ -1169,7 +1514,7 @@ function chatbotsCommand() {
   return cmd;
 }
 function webhooksCommand() {
-  const cmd = new Command7("webhooks").description("Manage webhooks for a chatbot");
+  const cmd = new Command10("webhooks").description("Manage webhooks for a chatbot");
   cmd.command("list").action(async function() {
     try {
       const chatbotId = requireChatbotId(this);
@@ -1213,7 +1558,7 @@ function webhooksCommand() {
   return cmd;
 }
 function settingsCommand() {
-  const cmd = new Command7("settings").description(
+  const cmd = new Command10("settings").description(
     "Manage chatbot settings + per-chatbot keys"
   );
   const keys = cmd.command("keys").description("Manage API keys for a chatbot");
@@ -1307,7 +1652,7 @@ function settingsCommand() {
   return cmd;
 }
 function workflowsCommand() {
-  const cmd = new Command7("workflows").description("Manage workflows");
+  const cmd = new Command10("workflows").description("Manage workflows");
   cmd.command("list").action(async function() {
     try {
       const chatbotId = requireChatbotId(this);
@@ -1347,7 +1692,7 @@ function workflowsCommand() {
   return cmd;
 }
 function reportsCommand() {
-  const cmd = new Command7("reports").description("Manage AI reports");
+  const cmd = new Command10("reports").description("Manage AI reports");
   cmd.command("list").action(async function() {
     try {
       const chatbotId = requireChatbotId(this);
@@ -1385,7 +1730,7 @@ Created report. View it (org members only):
   return cmd;
 }
 function analysisCommand() {
-  const cmd = new Command7("analysis").description("Manage analysis definitions");
+  const cmd = new Command10("analysis").description("Manage analysis definitions");
   cmd.command("list").option("--type <t>", "intent | flag | assistant_outcome | assistant_issue").option("--pending", "Include pending suggestions").action(async function(opts) {
     try {
       const chatbotId = requireChatbotId(this);
@@ -1427,7 +1772,7 @@ function analysisCommand() {
   return cmd;
 }
 function usersCommand() {
-  const cmd = new Command7("users").description(
+  const cmd = new Command10("users").description(
     "List external users (chatbot customers) with health metrics"
   );
   cmd.command("list").option("--from <iso>").option("--to <iso>").option("--days <n>", "Convenience: last N days").option("--search <q>").option("--limit <n>", "Page size", "20").action(async function(opts) {
@@ -1460,7 +1805,7 @@ Total: ${result.total}
   return cmd;
 }
 function sdkCommand() {
-  const cmd = new Command7("sdk").description(
+  const cmd = new Command10("sdk").description(
     "Help install and verify the OpenBat SDK in a target project"
   );
   cmd.command("install-instructions").description("Print markdown the calling agent can follow").option(
@@ -1570,10 +1915,10 @@ Timed out after ${timeoutSec}s \u2014 no events yet. Confirm OPENBAT_API_KEY and
 }
 
 // src/index.ts
-var program = new Command8();
+var program = new Command11();
 program.name("openbat").description(
   "Query OpenBat chatbot data \u2014 conversations, sentiment, analytics, exports."
-).version("0.2.3").option("--api-key <key>", "Override the stored Read API key (footgun \u2014 leaks into shell history)").option(
+).version("0.4.0").option("--api-key <key>", "Override the stored Read API key (footgun \u2014 leaks into shell history)").option(
   "--base-url <url>",
   "Override the OpenBat API base URL (defaults to ~/.openbatrc or https://openbat.dev)"
 ).option(
@@ -1592,6 +1937,9 @@ program.addCommand(orgCommand());
 program.addCommand(chatbotCommand());
 program.addCommand(chatbotsCommand());
 program.addCommand(conversationsCommand());
+program.addCommand(reviewCommand());
+program.addCommand(promptsCommand());
+program.addCommand(backtestsCommand());
 program.addCommand(usersCommand());
 program.addCommand(settingsCommand());
 program.addCommand(webhooksCommand());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openbat/cli",
-  "version": "0.2.3",
+  "version": "0.4.0",
   "description": "Command-line tool for querying OpenBat chatbot data — conversations, sentiment, analytics, exports",
   "bin": {
     "openbat": "bin/openbat"