@quonfig/cli 0.3.0 → 0.5.0

package/oclif.manifest.json

@@ -292,12 +292,16 @@
           "required": true
         }
       },
-      "description": "Create a new feature flag, config value, or other item.\n\nUse --type to specify the kind of item:\n  boolean-flag  On/off feature flag (sendToClientSdk defaults to true; best for gradual rollouts)\n  string        A string configuration value\n  int           An integer configuration value\n  double        A floating-point configuration value\n  string-list   A comma-separated list of strings\n  json          An arbitrary JSON blob\n  boolean       A plain boolean (not a feature flag)\n  duration      An ISO 8601 duration string, e.g. PT30S, PT5M, PT1H30M (SDK returns milliseconds)\n  log_level     A dynamic log level (value must be one of TRACE/DEBUG/INFO/WARN/ERROR/FATAL)\n\nThis sets the global default value. Override per-environment with:\n  qfg set-default my.flag --environment production --value true\n\nFor a percentage rollout (gradual rollout / A/B test / canary deploy), use:\n  qfg set-rollout my.flag --environment production --true-percent 20\n\nOr edit the JSON config file directly for complex targeting rules:\n  qfg config-schema          # full operator reference + examples\n  qfg pull --dir ./config    # clone workspace, then edit JSON and git push\n\nLog levels:\n  qfg create log-level.my-app --type log_level --value WARN\n  # Log-level keys must start with \"log-level.\".\n  # For per-logger targeting, create ONE log-level config per service and add\n  # rules on the \"quonfig-sdk-logging.key\" context property (e.g.\n  # PROP_STARTS_WITH_ONE_OF MyPackage.) rather than one config per logger.\n\nWhen this flag has done its job, mark readyForCleanup: true in the UI and run `qfg cleanup list` to retire it.",
+      "description": "Create a new feature flag, config value, or other item.\n\nUse --type to specify the kind of item:\n  boolean-flag  On/off feature flag (sendToClientSdk defaults to true; best for gradual rollouts)\n  string        A string configuration value\n  int           An integer configuration value\n  double        A floating-point configuration value\n  string-list   A comma-separated list of strings\n  json          An arbitrary JSON blob\n  boolean       A plain boolean (not a feature flag)\n  duration      An ISO 8601 duration string, e.g. PT30S, PT5M, PT1H30M (SDK returns milliseconds)\n  log_level     A dynamic log level (value must be one of TRACE/DEBUG/INFO/WARN/ERROR/FATAL)\n\nSecrets (--secret) are encrypted client-side and are STRING-ONLY: --secret\nimplies --type string, so you can leave --type off. To store a JSON secret, store the JSON as a string secret and\nJSON.parse it in your app. The CLI never prints a secret's plaintext: it shows\na redacted fingerprint like [encrypted *****3fa9c, 51 chars, ends …a1b2].\n\nKeep the value out of argv / shell history / agent transcripts with:\n  --value-stdin             read the value from stdin\n  --value-from-env=VAR      read the value from a local env var, now\nThese are different from --env-var, which stores NO value: it tells the SDK to\nread the value from that env var at runtime.\n\nThis sets the global default value. Override per-environment with:\n  qfg set-default my.flag --environment production --value true\n\nFor a percentage rollout (gradual rollout / A/B test / canary deploy), use:\n  qfg set-rollout my.flag --environment production --true-percent 20\n\nOr edit the JSON config file directly for complex targeting rules:\n  qfg config-schema          # full operator reference + examples\n  qfg pull --dir ./config    # clone workspace, then edit JSON and git push\n\nLog levels:\n  qfg create log-level.my-app --type log_level --value WARN\n  # Log-level keys must start with \"log-level.\".\n  # For per-logger targeting, create ONE log-level config per service and add\n  # rules on the \"quonfig-sdk-logging.key\" context property (e.g.\n  # PROP_STARTS_WITH_ONE_OF MyPackage.) rather than one config per logger.\n\nWhen this flag has done its job, mark readyForCleanup: true in the UI and run `qfg cleanup list` to retire it.",
       "examples": [
         "<%= config.bin %> <%= command.id %> my.new.flag --type boolean-flag",
         "<%= config.bin %> <%= command.id %> my.new.flag --type boolean-flag --value=true",
         "<%= config.bin %> <%= command.id %> my.new.string --type string --value=\"hello world\"",
-        "<%= config.bin %> <%= command.id %> my.new.string --type string --value=\"hello world\" --secret",
+        "# Create a secret without the value ever appearing in argv (--secret implies --type string):",
+        "pbpaste | <%= config.bin %> <%= command.id %> stripe.api-key --secret --value-stdin",
+        "<%= config.bin %> <%= command.id %> stripe.api-key --secret --value-from-env STRIPE_API_KEY",
+        "# A JSON secret is a string secret holding JSON (JSON.parse it in your app):",
+        "<%= config.bin %> <%= command.id %> gcp.service-account --secret --value-stdin < sa.json",
         "<%= config.bin %> <%= command.id %> my.new.string --type string --env-var=MY_ENV_VAR_NAME",
         "<%= config.bin %> <%= command.id %> my.new.string --type json --value=\"{\\\"key\\\": \\\"value\\\"}\"",
         "<%= config.bin %> <%= command.id %> my.timeout --type duration --value PT90S",
@@ -363,15 +367,15 @@
           "type": "boolean"
         },
         "env-var": {
-          "description": "environment variable to get value from",
+          "description": "store no value: the SDK reads it from this env var at RUNTIME. To read a value from a local env var NOW, use --value-from-env",
           "name": "env-var",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
         "type": {
+          "description": "kind of item to create (required, except with --secret, which implies string)",
           "name": "type",
-          "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
           "options": [
@@ -388,15 +392,29 @@
           "type": "option"
         },
         "value": {
-          "description": "default value for your new item",
+          "description": "default value for your new item (for secrets prefer --value-stdin / --value-from-env)",
           "name": "value",
           "required": false,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
+        "value-from-env": {
+          "description": "read the value to store from this LOCAL env var now (keeps it out of argv/shell history). Not the same as --env-var",
+          "name": "value-from-env",
+          "hasDynamicHelp": false,
+          "helpValue": "VAR",
+          "multiple": false,
+          "type": "option"
+        },
+        "value-stdin": {
+          "description": "read the value to store from stdin (one trailing newline is stripped). Keeps it out of argv",
+          "name": "value-stdin",
+          "allowNo": false,
+          "type": "boolean"
+        },
         "secret": {
-          "description": "encrypt the value of this item",
+          "description": "encrypt the value of this item (string-only; the CLI never prints the plaintext)",
           "name": "secret",
           "allowNo": false,
           "type": "boolean"
@@ -663,10 +681,12 @@
           "name": "name"
         }
       },
-      "description": "Get the value of a config/feature-flag/etc.",
+      "description": "Get the value of a config/feature-flag/etc.\n\nSecrets (encrypted) and confidential values print REDACTED by default, as a\nfingerprint plus length (and the last 4 characters for values of 12+ chars):\n  [encrypted *****3fa9c, 51 chars, ends …a1b2]\nThe fingerprint is the same one SDK telemetry and the Quonfig UI show, so you\ncan confirm a rotation landed without printing the secret. Pass --reveal to\nprint the plaintext. To inject secrets into a process, prefer `qfg run`.",
       "examples": [
         "<%= config.bin %> <%= command.id %> my.config.name",
-        "<%= config.bin %> <%= command.id %> my.config.name --environment=production"
+        "<%= config.bin %> <%= command.id %> my.config.name --environment=production",
+        "<%= config.bin %> <%= command.id %> stripe.api-key --environment=production            # redacted fingerprint",
+        "<%= config.bin %> <%= command.id %> stripe.api-key --environment=production --reveal   # plaintext"
       ],
       "flags": {
         "json": {
@@ -725,6 +745,12 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "reveal": {
+          "description": "print the plaintext of a secret/confidential value (it is redacted by default)",
+          "name": "reveal",
+          "allowNo": false,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
@@ -2308,12 +2334,16 @@
           "name": "name"
         }
       },
-      "description": "Set the fallback value for a flag or config in one environment.\n\nThe fallback is the unconditional rule at the end of the environment's rule\nlist: what users receive when no targeting rule matches. Targeting rules and\npercentage rollouts above it are kept, and the command tells you how many.\nIf the environment has no rules of its own yet, they are copied from the\nflag's default rules first, so inherited targeting is kept too.\n\nTo turn a flag on or off for EVERYONE, including users matched by targeting\nrules, add --replace-targeting. This deletes the environment's targeting\nrules (they stay in git history).\n\nTo set a percentage rollout (gradual rollout / A/B test / canary deploy) instead:\n  qfg set-rollout my.flag --environment production --true-percent 20\n\nTo see all current values and rules for a flag:\n  qfg info my.flag\n\nTo target specific organizations or users, write rules on their KEY\n(organization.key, user.key), not a slug or email; find a key from a name with:\n  qfg contexts search organization formhealth",
+      "description": "Set the fallback value for a flag or config in one environment.\n\nThe fallback is the unconditional rule at the end of the environment's rule\nlist: what users receive when no targeting rule matches. Targeting rules and\npercentage rollouts above it are kept, and the command tells you how many.\nIf the environment has no rules of its own yet, they are copied from the\nflag's default rules first, so inherited targeting is kept too.\n\nTo turn a flag on or off for EVERYONE, including users matched by targeting\nrules, add --replace-targeting. This deletes the environment's targeting\nrules (they stay in git history).\n\nTo set a percentage rollout (gradual rollout / A/B test / canary deploy) instead:\n  qfg set-rollout my.flag --environment production --true-percent 20\n\nSecrets (--secret, or any config whose value is already encrypted) are\nSTRING-ONLY. To store a JSON secret, make it a string secret holding the JSON\nand JSON.parse it in your app. The CLI never prints a secret's plaintext; it\nshows a redacted fingerprint like [encrypted *****3fa9c, 51 chars, ends …a1b2].\nRotate a secret without the value entering argv / shell history:\n  pbpaste | qfg set-default stripe.api-key --environment production --secret --value-stdin --confirm\n  qfg set-default stripe.api-key --environment production --secret --value-from-env STRIPE_API_KEY --confirm\n(--env-var is different: it stores NO value and tells the SDK to read one from\nthat env var at runtime.)\n\nTo see all current values and rules for a flag:\n  qfg info my.flag\n\nTo target specific organizations or users, write rules on their KEY\n(organization.key, user.key), not a slug or email; find a key from a name with:\n  qfg contexts search organization formhealth",
       "examples": [
         "<%= config.bin %> <%= command.id %> my.flag.name                                          # prompts for value and env",
         "<%= config.bin %> <%= command.id %> my.flag.name --value=true --environment=staging",
         "<%= config.bin %> <%= command.id %> my.flag.name --value=false --environment=production --replace-targeting   # kill-switch: off for everyone",
-        "<%= config.bin %> <%= command.id %> my.flag.name --value=true --secret",
+        "# Rotate a secret without the value entering argv:",
+        "pbpaste | <%= config.bin %> <%= command.id %> my.secret --environment=production --secret --value-stdin --confirm",
+        "<%= config.bin %> <%= command.id %> my.secret --environment=production --secret --value-from-env=MY_SECRET --confirm",
+        "# Write the [Default] rules (inherited by every environment without its own):",
+        "<%= config.bin %> <%= command.id %> my.secret --environment=\"[Default]\" --secret --value-from-env=MY_SECRET --confirm",
         "<%= config.bin %> <%= command.id %> my.config.name --env-var=MY_ENV_VAR_NAME --environment=production",
         "# For a percentage rollout, use set-rollout instead:",
         "<%= config.bin %> set-rollout my.flag.name --environment production --true-percent 20",
@@ -2378,14 +2408,14 @@
           "type": "boolean"
         },
         "env-var": {
-          "description": "environment variable to use as default value",
+          "description": "store no value: the SDK reads it from this env var at RUNTIME. To read a value from a local env var NOW, use --value-from-env",
           "name": "env-var",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
         "environment": {
-          "description": "environment to change",
+          "description": "environment to change, e.g. production. Use \"[Default]\" for the default rules that every environment without its own rules inherits",
           "name": "environment",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -2398,12 +2428,26 @@
           "type": "boolean"
         },
         "value": {
-          "description": "new default value",
+          "description": "new default value (for secrets prefer --value-stdin / --value-from-env)",
           "name": "value",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
+        "value-from-env": {
+          "description": "read the value to store from this LOCAL env var now (keeps it out of argv/shell history). Not the same as --env-var",
+          "name": "value-from-env",
+          "hasDynamicHelp": false,
+          "helpValue": "VAR",
+          "multiple": false,
+          "type": "option"
+        },
+        "value-stdin": {
+          "description": "read the value to store from stdin (one trailing newline is stripped). Keeps it out of argv",
+          "name": "value-stdin",
+          "allowNo": false,
+          "type": "boolean"
+        },
         "confirm": {
           "description": "confirm without prompt",
           "name": "confirm",
@@ -2411,7 +2455,7 @@
           "type": "boolean"
         },
         "secret": {
-          "description": "encrypt the value of this item",
+          "description": "encrypt the value of this item (string-only; the CLI never prints the plaintext)",
           "name": "secret",
           "allowNo": false,
           "type": "boolean"
@@ -2816,18 +2860,17 @@
         "workspace.js"
       ]
     },
-    "activity:deleted": {
+    "cleanup:list": {
       "aliases": [],
       "args": {},
-      "description": "List configs that were deleted from the workspace and have not been restored.\n\nUseful for \"did somebody delete X?\" — pair with `qfg activity restore NAME`\nto undelete a tombstoned config.",
+      "description": "List feature flags marked readyForCleanup=true, with eval volume per window.\n\nColumns:\n  KEY         the flag key\n  TYPE        the flag's valueType (bool, string, int, etc.)\n  EVALS_24H   evals counted in today's bucket (latest day)\n  EVALS_2D    evals in the last 2 calendar days\n  EVALS_7D    evals in the last 7 calendar days\n  EVALS_30D   evals in the last 30 calendar days\n  LAST_EVAL   most recent calendar day with any evals (UTC), blank if none\n  CLASS       quiet (zero evals in last 2 days) or active\n\nDefault sort: quiet first, oldest LAST_EVAL at top.\n\nPass --json for the structured object (rows[]). Each row carries the columns\nabove plus the raw eval counts your agent can reason about itself.\n\nOnce you've picked a candidate, run `qfg cleanup status <key>` for the\ndrill-in, or `qfg cleanup remove <key>` to hand the removal to your coding agent\nwith the Quonfig agent skill.",
       "examples": [
         "<%= config.bin %> <%= command.id %>",
         "<%= config.bin %> <%= command.id %> --json"
       ],
       "flags": {
         "json": {
-          "description": "Format output as json.",
-          "helpGroup": "GLOBAL",
+          "description": "Return structured rows for agent consumption",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
@@ -2878,7 +2921,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "activity:deleted",
+      "id": "cleanup:list",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -2888,18 +2931,23 @@
       "relativePath": [
         "dist",
         "commands",
-        "activity",
-        "deleted.js"
+        "cleanup",
+        "list.js"
       ]
     },
-    "activity:feed": {
+    "cleanup:remove": {
       "aliases": [],
-      "args": {},
-      "description": "Recent activity across the workspace, newest first.\n\nEach entry shows who changed which config, the action (created/updated/deleted/restored),\nand the human-readable audit message produced by the server. The server already\ntranslates JSON diffs into messages — this command does not re-translate.",
+      "args": {
+        "name": {
+          "description": "config/feature-flag/etc. name",
+          "name": "name"
+        }
+      },
+      "description": "Write a cleanup payload for a ready-for-cleanup flag and hand off to the Quonfig agent skill.\n\nModeled on `qfg migrate my-code` — this command never edits source files\nitself. It validates that the flag is marked readyForCleanup=true, refuses to\nproceed if there are still evals_2d > 0 (use --force to override), writes\n`.qf/cleanup/<key>.json` describing the flag's current rule shape +\ntelemetry, and prints how to have your coding agent remove the call sites with\nthe quonfig agent skill (its references/retire-a-flag.md), which asks the\nengineer which value should \"win\" and applies the inlining. Install the skill\nwith `qfg agent install-skill` or `claude plugin install quonfig@quonfig`.\n\nThe payload deliberately does NOT suggest a winning value; that's the\nengineer's call. Run `qfg cleanup status <key>` first if you want to inspect\ntelemetry before retiring.",
       "examples": [
-        "<%= config.bin %> <%= command.id %>",
-        "<%= config.bin %> <%= command.id %> --limit 5",
-        "<%= config.bin %> <%= command.id %> --json"
+        "<%= config.bin %> <%= command.id %> my.flag.key",
+        "<%= config.bin %> <%= command.id %> my.flag.key --force",
+        "<%= config.bin %> <%= command.id %> my.flag.key --json"
       ],
       "flags": {
         "json": {
@@ -2952,18 +3000,16 @@
           "multiple": false,
           "type": "option"
         },
-        "limit": {
-          "description": "Maximum number of feed entries (1-100)",
-          "name": "limit",
-          "default": 30,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
+        "force": {
+          "description": "Skip the evals_2d > 0 safety gate (useful when telemetry is delayed but you know the flag is dead)",
+          "name": "force",
+          "allowNo": false,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "activity:feed",
+      "id": "cleanup:remove",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -2973,11 +3019,11 @@
       "relativePath": [
         "dist",
         "commands",
-        "activity",
-        "feed.js"
+        "cleanup",
+        "remove.js"
       ]
     },
-    "activity:history": {
+    "cleanup:status": {
       "aliases": [],
       "args": {
         "name": {
@@ -2985,15 +3031,14 @@
           "name": "name"
         }
       },
-      "description": "Per-config audit trail for a flag, config, log-level, segment, or schema.\n\nResolves NAME against the workspace metadata (no need to specify type) and\nreturns the full commit history for that file with audit messages translated\nby the server. Restored entries are rendered distinctly so a recovery doesn't\nlook like a fresh create.",
+      "description": "Drill into one ready-for-cleanup flag — show telemetry across all environments and the current rule shape.\n\nUse this after `qfg cleanup list` to inspect a specific flag before handing\nremoval off to the Quonfig agent skill. The eval counts come from\nanalytics.configSparklines (the same backing data the per-flag sparklines on\nthe flag detail page use), summed into 24h/2d/7d/30d windows so you can decide\nwhether it's safe to retire.\n\nPass --json for the structured object including the full rule shape per\nenvironment — the agent skill consumes this directly.",
       "examples": [
-        "<%= config.bin %> <%= command.id %> my.flag",
-        "<%= config.bin %> <%= command.id %> request.timeout --json"
+        "<%= config.bin %> <%= command.id %> my.flag.key",
+        "<%= config.bin %> <%= command.id %> my.flag.key --json"
       ],
       "flags": {
         "json": {
-          "description": "Format output as json.",
-          "helpGroup": "GLOBAL",
+          "description": "Return structured object for agent consumption",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
@@ -3044,7 +3089,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "activity:history",
+      "id": "cleanup:status",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -3054,11 +3099,11 @@
       "relativePath": [
         "dist",
         "commands",
-        "activity",
-        "history.js"
+        "cleanup",
+        "status.js"
       ]
     },
-    "activity:restore": {
+    "cleanup:verify": {
       "aliases": [],
       "args": {
         "name": {
@@ -3066,15 +3111,16 @@
           "name": "name"
         }
       },
-      "description": "Undelete a config that was previously removed.\n\nLooks up the most recent deletion for the key (so you see who deleted it and when),\nthen asks for confirmation before re-creating the file from the prior content.\nSchemas cannot be restored — use git history instead.",
+      "description": "Confirm zero evals for a flag in the trailing N days (default 7). Exits 0 if safe to delete, non-zero otherwise.\n\nRead-only gate intended for chaining with `qfg delete` after a cleanup PR\nhas merged and the SDK has redeployed:\n\n  qfg cleanup verify my.flag.key && qfg delete my.flag.key\n\nThe trailing window is stricter than the `qfg cleanup remove` 2-day gate on\npurpose — `remove` only writes a payload describing the flag, but `delete`\npermanently removes the flag definition, so we want a longer quiet period\nbefore chaining. Bump --days N if you want a more conservative window.",
       "examples": [
-        "<%= config.bin %> <%= command.id %> my.flag --yes",
-        "<%= config.bin %> <%= command.id %> request.timeout --type config --yes"
+        "<%= config.bin %> <%= command.id %> my.flag.key",
+        "<%= config.bin %> <%= command.id %> my.flag.key --days 14",
+        "<%= config.bin %> <%= command.id %> my.flag.key --json",
+        "<%= config.bin %> <%= command.id %> my.flag.key && <%= config.bin %> delete my.flag.key"
       ],
       "flags": {
         "json": {
-          "description": "Format output as json.",
-          "helpGroup": "GLOBAL",
+          "description": "Return structured object for agent consumption",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
@@ -3122,32 +3168,18 @@
           "multiple": false,
           "type": "option"
         },
-        "type": {
-          "description": "Config type. Optional — inferred from history when omitted.",
-          "name": "type",
-          "required": false,
+        "days": {
+          "description": "Number of trailing calendar days that must have zero evals",
+          "name": "days",
+          "default": 7,
           "hasDynamicHelp": false,
           "multiple": false,
-          "options": [
-            "feature_flag",
-            "config",
-            "log_level",
-            "segment",
-            "flag",
-            "log-level"
-          ],
           "type": "option"
-        },
-        "yes": {
-          "description": "Skip the confirmation prompt",
-          "name": "yes",
-          "allowNo": false,
-          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "activity:restore",
+      "id": "cleanup:verify",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -3157,19 +3189,17 @@
       "relativePath": [
         "dist",
         "commands",
-        "activity",
-        "restore.js"
+        "cleanup",
+        "verify.js"
       ]
     },
-    "agent:install-skill": {
+    "activity:deleted": {
       "aliases": [],
       "args": {},
-      "description": "Install the Quonfig agent skill into this repo so coding agents use Quonfig correctly.\n\nWrites .claude/skills/quonfig/ (SKILL.md + references/) — the same files as\n`claude plugin install quonfig@quonfig` from github.com/quonfig/skills, embedded\nin this qfg build (no network). Claude Code picks the skill up automatically;\nfor Codex, Cursor and other agents that read AGENTS.md, add --add-pointer.\n\nSafe to re-run: files still as qfg wrote them are upgraded in place, files you\nedited are left alone (the command fails and lists them) unless you pass --force.\n\nThis skill is for APPLICATION repos (SDK + qfg + MCP usage). A workspace repo\ncreated by `qfg init` has its own AGENTS.md/CLAUDE.md for editing config JSON.",
+      "description": "List configs that were deleted from the workspace and have not been restored.\n\nUseful for \"did somebody delete X?\" — pair with `qfg activity restore NAME`\nto undelete a tombstoned config.",
       "examples": [
         "<%= config.bin %> <%= command.id %>",
-        "<%= config.bin %> <%= command.id %> --add-pointer",
-        "<%= config.bin %> <%= command.id %> --dir .agents/skills",
-        "<%= config.bin %> <%= command.id %> --force"
+        "<%= config.bin %> <%= command.id %> --json"
       ],
       "flags": {
         "json": {
@@ -3201,30 +3231,31 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "add-pointer": {
-          "description": "Also append a one-line pointer to the skill in ./AGENTS.md (created if missing)",
-          "name": "add-pointer",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "dir": {
-          "description": "Skills directory to install into, relative to the current directory",
-          "name": "dir",
-          "default": ".claude/skills",
+        "workspace": {
+          "char": "w",
+          "description": "Workspace slug to use (overrides QUONFIG_WORKSPACE env var and saved default)",
+          "helpGroup": "GLOBAL",
+          "name": "workspace",
+          "required": false,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "force": {
-          "description": "Overwrite skill files you have edited locally",
-          "name": "force",
-          "allowNo": false,
-          "type": "boolean"
+        "profile": {
+          "char": "p",
+          "description": "Deprecated: use --workspace instead",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "profile",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "agent:install-skill",
+      "id": "activity:deleted",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -3234,21 +3265,23 @@
       "relativePath": [
         "dist",
         "commands",
-        "agent",
-        "install-skill.js"
+        "activity",
+        "deleted.js"
       ]
     },
-    "cleanup:list": {
+    "activity:feed": {
       "aliases": [],
       "args": {},
-      "description": "List feature flags marked readyForCleanup=true, with eval volume per window.\n\nColumns:\n  KEY         the flag key\n  TYPE        the flag's valueType (bool, string, int, etc.)\n  EVALS_24H   evals counted in today's bucket (latest day)\n  EVALS_2D    evals in the last 2 calendar days\n  EVALS_7D    evals in the last 7 calendar days\n  EVALS_30D   evals in the last 30 calendar days\n  LAST_EVAL   most recent calendar day with any evals (UTC), blank if none\n  CLASS       quiet (zero evals in last 2 days) or active\n\nDefault sort: quiet first, oldest LAST_EVAL at top.\n\nPass --json for the structured object (rows[]). Each row carries the columns\nabove plus the raw eval counts your agent can reason about itself.\n\nOnce you've picked a candidate, run `qfg cleanup status <key>` for the\ndrill-in, or `qfg cleanup remove <key>` to hand the removal to your coding agent\nwith the Quonfig agent skill.",
+      "description": "Recent activity across the workspace, newest first.\n\nEach entry shows who changed which config, the action (created/updated/deleted/restored),\nand the human-readable audit message produced by the server. The server already\ntranslates JSON diffs into messages — this command does not re-translate.",
       "examples": [
         "<%= config.bin %> <%= command.id %>",
+        "<%= config.bin %> <%= command.id %> --limit 5",
         "<%= config.bin %> <%= command.id %> --json"
       ],
       "flags": {
         "json": {
-          "description": "Return structured rows for agent consumption",
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
@@ -3295,11 +3328,19 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "limit": {
+          "description": "Maximum number of feed entries (1-100)",
+          "name": "limit",
+          "default": 30,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "cleanup:list",
+      "id": "activity:feed",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -3309,11 +3350,11 @@
       "relativePath": [
         "dist",
         "commands",
-        "cleanup",
-        "list.js"
+        "activity",
+        "feed.js"
       ]
     },
-    "cleanup:remove": {
+    "activity:history": {
       "aliases": [],
       "args": {
         "name": {
@@ -3321,11 +3362,10 @@
           "name": "name"
         }
       },
-      "description": "Write a cleanup payload for a ready-for-cleanup flag and hand off to the Quonfig agent skill.\n\nModeled on `qfg migrate my-code` — this command never edits source files\nitself. It validates that the flag is marked readyForCleanup=true, refuses to\nproceed if there are still evals_2d > 0 (use --force to override), writes\n`.qf/cleanup/<key>.json` describing the flag's current rule shape +\ntelemetry, and prints how to have your coding agent remove the call sites with\nthe quonfig agent skill (its references/retire-a-flag.md), which asks the\nengineer which value should \"win\" and applies the inlining. Install the skill\nwith `qfg agent install-skill` or `claude plugin install quonfig@quonfig`.\n\nThe payload deliberately does NOT suggest a winning value; that's the\nengineer's call. Run `qfg cleanup status <key>` first if you want to inspect\ntelemetry before retiring.",
+      "description": "Per-config audit trail for a flag, config, log-level, segment, or schema.\n\nResolves NAME against the workspace metadata (no need to specify type) and\nreturns the full commit history for that file with audit messages translated\nby the server. Restored entries are rendered distinctly so a recovery doesn't\nlook like a fresh create.",
       "examples": [
-        "<%= config.bin %> <%= command.id %> my.flag.key",
-        "<%= config.bin %> <%= command.id %> my.flag.key --force",
-        "<%= config.bin %> <%= command.id %> my.flag.key --json"
+        "<%= config.bin %> <%= command.id %> my.flag",
+        "<%= config.bin %> <%= command.id %> request.timeout --json"
       ],
       "flags": {
         "json": {
@@ -3377,17 +3417,11 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
-        },
-        "force": {
-          "description": "Skip the evals_2d > 0 safety gate (useful when telemetry is delayed but you know the flag is dead)",
-          "name": "force",
-          "allowNo": false,
-          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "cleanup:remove",
+      "id": "activity:history",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -3397,11 +3431,11 @@
       "relativePath": [
         "dist",
         "commands",
-        "cleanup",
-        "remove.js"
+        "activity",
+        "history.js"
       ]
     },
-    "cleanup:status": {
+    "activity:restore": {
       "aliases": [],
       "args": {
         "name": {
@@ -3409,14 +3443,15 @@
           "name": "name"
         }
       },
-      "description": "Drill into one ready-for-cleanup flag — show telemetry across all environments and the current rule shape.\n\nUse this after `qfg cleanup list` to inspect a specific flag before handing\nremoval off to the Quonfig agent skill. The eval counts come from\nanalytics.configSparklines (the same backing data the per-flag sparklines on\nthe flag detail page use), summed into 24h/2d/7d/30d windows so you can decide\nwhether it's safe to retire.\n\nPass --json for the structured object including the full rule shape per\nenvironment — the agent skill consumes this directly.",
+      "description": "Undelete a config that was previously removed.\n\nLooks up the most recent deletion for the key (so you see who deleted it and when),\nthen asks for confirmation before re-creating the file from the prior content.\nSchemas cannot be restored — use git history instead.",
       "examples": [
-        "<%= config.bin %> <%= command.id %> my.flag.key",
-        "<%= config.bin %> <%= command.id %> my.flag.key --json"
+        "<%= config.bin %> <%= command.id %> my.flag --yes",
+        "<%= config.bin %> <%= command.id %> request.timeout --type config --yes"
       ],
       "flags": {
         "json": {
-          "description": "Return structured object for agent consumption",
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
@@ -3463,11 +3498,33 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "type": {
+          "description": "Config type. Optional — inferred from history when omitted.",
+          "name": "type",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "feature_flag",
+            "config",
+            "log_level",
+            "segment",
+            "flag",
+            "log-level"
+          ],
+          "type": "option"
+        },
+        "yes": {
+          "description": "Skip the confirmation prompt",
+          "name": "yes",
+          "allowNo": false,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "cleanup:status",
+      "id": "activity:restore",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -3477,28 +3534,34 @@
       "relativePath": [
         "dist",
         "commands",
-        "cleanup",
-        "status.js"
+        "activity",
+        "restore.js"
       ]
     },
-    "cleanup:verify": {
+    "contexts:search": {
       "aliases": [],
       "args": {
-        "name": {
-          "description": "config/feature-flag/etc. name",
-          "name": "name"
+        "contextType": {
+          "description": "Context type to search, e.g. organization or user (the part before \".key\" in a rule)",
+          "name": "contextType",
+          "required": true
+        },
+        "query": {
+          "description": "Case-insensitive text matched against each context key and its reported properties (e.g. a name)",
+          "name": "query",
+          "required": true
         }
       },
-      "description": "Confirm zero evals for a flag in the trailing N days (default 7). Exits 0 if safe to delete, non-zero otherwise.\n\nRead-only gate intended for chaining with `qfg delete` after a cleanup PR\nhas merged and the SDK has redeployed:\n\n  qfg cleanup verify my.flag.key && qfg delete my.flag.key\n\nThe trailing window is stricter than the `qfg cleanup remove` 2-day gate on\npurpose — `remove` only writes a payload describing the flag, but `delete`\npermanently removes the flag definition, so we want a longer quiet period\nbefore chaining. Bump --days N if you want a more conservative window.",
+      "description": "Find a context's key from a name, to target it in a rule.\n\nTargeting rules should match a context by its KEY (<contextType>.key, e.g.\norganization.key or user.key), not by a slug, email or name. This searches the\ncontexts your SDKs have reported through telemetry, matching the query against\neach context's key and properties, and prints each match's key, its name and\nits email (blank when the context reported none), most recently seen first.\n\nOnly contexts your SDKs have reported are searchable. If nothing matches, the key\nis unknown: get it from whoever owns that customer rather than targeting a slug\nor email instead.\n\nPass a key as the query to see its name and email.\n\n--json prints {contexts: [{key, name, email?}]}: name is null when the context\nreported no name, and email is present only when it reported one.",
       "examples": [
-        "<%= config.bin %> <%= command.id %> my.flag.key",
-        "<%= config.bin %> <%= command.id %> my.flag.key --days 14",
-        "<%= config.bin %> <%= command.id %> my.flag.key --json",
-        "<%= config.bin %> <%= command.id %> my.flag.key && <%= config.bin %> delete my.flag.key"
+        "<%= config.bin %> <%= command.id %> organization formhealth",
+        "<%= config.bin %> <%= command.id %> user barry@example.com --environment production",
+        "<%= config.bin %> <%= command.id %> organization formhealth --json"
       ],
       "flags": {
         "json": {
-          "description": "Return structured object for agent consumption",
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
@@ -3546,10 +3609,17 @@
           "multiple": false,
           "type": "option"
         },
-        "days": {
-          "description": "Number of trailing calendar days that must have zero evals",
-          "name": "days",
-          "default": 7,
+        "environment": {
+          "description": "Only contexts reported from this environment (default: every environment)",
+          "name": "environment",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "limit": {
+          "description": "Maximum number of matches (1-100)",
+          "name": "limit",
+          "default": 20,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -3557,7 +3627,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "cleanup:verify",
+      "id": "contexts:search",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -3567,29 +3637,19 @@
       "relativePath": [
         "dist",
         "commands",
-        "cleanup",
-        "verify.js"
+        "contexts",
+        "search.js"
       ]
     },
-    "contexts:search": {
+    "agent:install-skill": {
       "aliases": [],
-      "args": {
-        "contextType": {
-          "description": "Context type to search, e.g. organization or user (the part before \".key\" in a rule)",
-          "name": "contextType",
-          "required": true
-        },
-        "query": {
-          "description": "Case-insensitive text matched against each context key and its reported properties (e.g. a name)",
-          "name": "query",
-          "required": true
-        }
-      },
-      "description": "Find a context's key from a name, to target it in a rule.\n\nTargeting rules should match a context by its KEY (<contextType>.key, e.g.\norganization.key or user.key), not by a slug, email or name. This searches the\ncontexts your SDKs have reported through telemetry, matching the query against\neach context's key and properties, and prints each match's key, its name and\nits email (blank when the context reported none), most recently seen first.\n\nOnly contexts your SDKs have reported are searchable. If nothing matches, the key\nis unknown: get it from whoever owns that customer rather than targeting a slug\nor email instead.\n\nPass a key as the query to see its name and email.\n\n--json prints {contexts: [{key, name, email?}]}: name is null when the context\nreported no name, and email is present only when it reported one.",
+      "args": {},
+      "description": "Install the Quonfig agent skill into this repo so coding agents use Quonfig correctly.\n\nWrites .claude/skills/quonfig/ (SKILL.md + references/) — the same files as\n`claude plugin install quonfig@quonfig` from github.com/quonfig/skills, embedded\nin this qfg build (no network). Claude Code picks the skill up automatically;\nfor Codex, Cursor and other agents that read AGENTS.md, add --add-pointer.\n\nSafe to re-run: files still as qfg wrote them are upgraded in place, files you\nedited are left alone (the command fails and lists them) unless you pass --force.\n\nThis skill is for APPLICATION repos (SDK + qfg + MCP usage). A workspace repo\ncreated by `qfg init` has its own AGENTS.md/CLAUDE.md for editing config JSON.",
       "examples": [
-        "<%= config.bin %> <%= command.id %> organization formhealth",
-        "<%= config.bin %> <%= command.id %> user barry@example.com --environment production",
-        "<%= config.bin %> <%= command.id %> organization formhealth --json"
+        "<%= config.bin %> <%= command.id %>",
+        "<%= config.bin %> <%= command.id %> --add-pointer",
+        "<%= config.bin %> <%= command.id %> --dir .agents/skills",
+        "<%= config.bin %> <%= command.id %> --force"
       ],
       "flags": {
         "json": {
@@ -3621,46 +3681,30 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "workspace": {
-          "char": "w",
-          "description": "Workspace slug to use (overrides QUONFIG_WORKSPACE env var and saved default)",
-          "helpGroup": "GLOBAL",
-          "name": "workspace",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "profile": {
-          "char": "p",
-          "description": "Deprecated: use --workspace instead",
-          "helpGroup": "GLOBAL",
-          "hidden": true,
-          "name": "profile",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
+        "add-pointer": {
+          "description": "Also append a one-line pointer to the skill in ./AGENTS.md (created if missing)",
+          "name": "add-pointer",
+          "allowNo": false,
+          "type": "boolean"
         },
-        "environment": {
-          "description": "Only contexts reported from this environment (default: every environment)",
-          "name": "environment",
+        "dir": {
+          "description": "Skills directory to install into, relative to the current directory",
+          "name": "dir",
+          "default": ".claude/skills",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "limit": {
-          "description": "Maximum number of matches (1-100)",
-          "name": "limit",
-          "default": 20,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
+        "force": {
+          "description": "Overwrite skill files you have edited locally",
+          "name": "force",
+          "allowNo": false,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "contexts:search",
+      "id": "agent:install-skill",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -3670,8 +3714,8 @@
       "relativePath": [
         "dist",
         "commands",
-        "contexts",
-        "search.js"
+        "agent",
+        "install-skill.js"
       ]
     },
     "migrate:doctor": {
@@ -4383,5 +4427,5 @@
       ]
     }
   },
-  "version": "0.3.0"
+  "version": "0.5.0"
 }