@quonfig/cli 0.4.0 → 0.6.0

package/oclif.manifest.json

@@ -292,12 +292,16 @@
           "required": true
         }
       },
-      "description": "Create a new feature flag, config value, or other item.\n\nUse --type to specify the kind of item:\n  boolean-flag  On/off feature flag (sendToClientSdk defaults to true; best for gradual rollouts)\n  string        A string configuration value\n  int           An integer configuration value\n  double        A floating-point configuration value\n  string-list   A comma-separated list of strings\n  json          An arbitrary JSON blob\n  boolean       A plain boolean (not a feature flag)\n  duration      An ISO 8601 duration string, e.g. PT30S, PT5M, PT1H30M (SDK returns milliseconds)\n  log_level     A dynamic log level (value must be one of TRACE/DEBUG/INFO/WARN/ERROR/FATAL)\n\nThis sets the global default value. Override per-environment with:\n  qfg set-default my.flag --environment production --value true\n\nFor a percentage rollout (gradual rollout / A/B test / canary deploy), use:\n  qfg set-rollout my.flag --environment production --true-percent 20\n\nOr edit the JSON config file directly for complex targeting rules:\n  qfg config-schema          # full operator reference + examples\n  qfg pull --dir ./config    # clone workspace, then edit JSON and git push\n\nLog levels:\n  qfg create log-level.my-app --type log_level --value WARN\n  # Log-level keys must start with \"log-level.\".\n  # For per-logger targeting, create ONE log-level config per service and add\n  # rules on the \"quonfig-sdk-logging.key\" context property (e.g.\n  # PROP_STARTS_WITH_ONE_OF MyPackage.) rather than one config per logger.\n\nWhen this flag has done its job, mark readyForCleanup: true in the UI and run `qfg cleanup list` to retire it.",
+      "description": "Create a new feature flag, config value, or other item.\n\nUse --type to specify the kind of item:\n  boolean-flag  On/off feature flag (sendToClientSdk defaults to true; best for gradual rollouts)\n  string        A string configuration value\n  int           An integer configuration value\n  double        A floating-point configuration value\n  string-list   A comma-separated list of strings\n  json          An arbitrary JSON blob\n  boolean       A plain boolean (not a feature flag)\n  duration      An ISO 8601 duration string, e.g. PT30S, PT5M, PT1H30M (SDK returns milliseconds)\n  log_level     A dynamic log level (value must be one of TRACE/DEBUG/INFO/WARN/ERROR/FATAL)\n\nSecrets (--secret) are encrypted client-side and are STRING-ONLY: --secret\nimplies --type string, so you can leave --type off. To store a JSON secret, store the JSON as a string secret and\nJSON.parse it in your app. The CLI never prints a secret's plaintext: it shows\na redacted fingerprint like [encrypted *****3fa9c, 51 chars, ends …a1b2].\n\nKeep the value out of argv / shell history / agent transcripts with:\n  --value-stdin             read the value from stdin\n  --value-from-env=VAR      read the value from a local env var, now\nThese are different from --env-var, which stores NO value: it tells the SDK to\nread the value from that env var at runtime.\n\nThis sets the global default value. Override per-environment with:\n  qfg set-default my.flag --environment production --value true\n\nFor a percentage rollout (gradual rollout / A/B test / canary deploy), use:\n  qfg set-rollout my.flag --environment production --true-percent 20\n\nOr edit the JSON config file directly for complex targeting rules:\n  qfg config-schema          # full operator reference + examples\n  qfg pull --dir ./config    # clone workspace, then edit JSON and git push\n\nLog levels:\n  qfg create log-level.my-app --type log_level --value WARN\n  # Log-level keys must start with \"log-level.\".\n  # For per-logger targeting, create ONE log-level config per service and add\n  # rules on the \"quonfig-sdk-logging.key\" context property (e.g.\n  # PROP_STARTS_WITH_ONE_OF MyPackage.) rather than one config per logger.\n\nWhen this flag has done its job, mark readyForCleanup: true in the UI and run `qfg cleanup list` to retire it.",
       "examples": [
         "<%= config.bin %> <%= command.id %> my.new.flag --type boolean-flag",
         "<%= config.bin %> <%= command.id %> my.new.flag --type boolean-flag --value=true",
         "<%= config.bin %> <%= command.id %> my.new.string --type string --value=\"hello world\"",
-        "<%= config.bin %> <%= command.id %> my.new.string --type string --value=\"hello world\" --secret",
+        "# Create a secret without the value ever appearing in argv (--secret implies --type string):",
+        "pbpaste | <%= config.bin %> <%= command.id %> stripe.api-key --secret --value-stdin",
+        "<%= config.bin %> <%= command.id %> stripe.api-key --secret --value-from-env STRIPE_API_KEY",
+        "# A JSON secret is a string secret holding JSON (JSON.parse it in your app):",
+        "<%= config.bin %> <%= command.id %> gcp.service-account --secret --value-stdin < sa.json",
         "<%= config.bin %> <%= command.id %> my.new.string --type string --env-var=MY_ENV_VAR_NAME",
         "<%= config.bin %> <%= command.id %> my.new.string --type json --value=\"{\\\"key\\\": \\\"value\\\"}\"",
         "<%= config.bin %> <%= command.id %> my.timeout --type duration --value PT90S",
@@ -363,15 +367,15 @@
           "type": "boolean"
         },
         "env-var": {
-          "description": "environment variable to get value from",
+          "description": "store no value: the SDK reads it from this env var at RUNTIME. To read a value from a local env var NOW, use --value-from-env",
           "name": "env-var",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
         "type": {
+          "description": "kind of item to create (required, except with --secret, which implies string)",
           "name": "type",
-          "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
           "options": [
@@ -388,15 +392,29 @@
           "type": "option"
         },
         "value": {
-          "description": "default value for your new item",
+          "description": "default value for your new item (for secrets prefer --value-stdin / --value-from-env)",
           "name": "value",
           "required": false,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
+        "value-from-env": {
+          "description": "read the value to store from this LOCAL env var now (keeps it out of argv/shell history). Not the same as --env-var",
+          "name": "value-from-env",
+          "hasDynamicHelp": false,
+          "helpValue": "VAR",
+          "multiple": false,
+          "type": "option"
+        },
+        "value-stdin": {
+          "description": "read the value to store from stdin (one trailing newline is stripped). Keeps it out of argv",
+          "name": "value-stdin",
+          "allowNo": false,
+          "type": "boolean"
+        },
         "secret": {
-          "description": "encrypt the value of this item",
+          "description": "encrypt the value of this item (string-only; the CLI never prints the plaintext)",
           "name": "secret",
           "allowNo": false,
           "type": "boolean"
@@ -512,6 +530,83 @@
         "delete.js"
       ]
     },
+    "environments": {
+      "aliases": [
+        "envs"
+      ],
+      "args": {},
+      "description": "List the environments in your workspace.\n\nUse these names with --environment (set-default, set-rollout, get, run, ...).\n\"[Default]\" is not an environment: it names the default rules that every\nenvironment without rules of its own inherits. Protected environments may\nrequire extra permissions to change.",
+      "examples": [
+        "<%= config.bin %> <%= command.id %>",
+        "<%= config.bin %> <%= command.id %> --json"
+      ],
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "interactive": {
+          "description": "Force interactive mode",
+          "helpGroup": "GLOBAL",
+          "name": "interactive",
+          "allowNo": true,
+          "type": "boolean"
+        },
+        "no-color": {
+          "description": "Do not colorize output",
+          "env": "NO_COLOR",
+          "helpGroup": "GLOBAL",
+          "name": "no-color",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "verbose": {
+          "description": "Verbose output",
+          "helpGroup": "GLOBAL",
+          "name": "verbose",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "workspace": {
+          "char": "w",
+          "description": "Workspace slug to use (overrides QUONFIG_WORKSPACE env var and saved default)",
+          "helpGroup": "GLOBAL",
+          "name": "workspace",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "char": "p",
+          "description": "Deprecated: use --workspace instead",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "profile",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "environments",
+      "pluginAlias": "@quonfig/cli",
+      "pluginName": "@quonfig/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "environments.js"
+      ]
+    },
     "generate-new-hex-key": {
       "aliases": [],
       "args": {},
@@ -663,10 +758,12 @@
           "name": "name"
         }
       },
-      "description": "Get the value of a config/feature-flag/etc.",
+      "description": "Get the value of a config/feature-flag/etc.\n\nSecrets (encrypted) and confidential values print REDACTED by default, as a\nfingerprint plus length (and the last 4 characters for values of 12+ chars):\n  [encrypted *****3fa9c, 51 chars, ends …a1b2]\nThe fingerprint is the same one SDK telemetry and the Quonfig UI show, so you\ncan confirm a rotation landed without printing the secret. Pass --reveal to\nprint the plaintext. To inject secrets into a process, prefer `qfg run`.",
       "examples": [
         "<%= config.bin %> <%= command.id %> my.config.name",
-        "<%= config.bin %> <%= command.id %> my.config.name --environment=production"
+        "<%= config.bin %> <%= command.id %> my.config.name --environment=production",
+        "<%= config.bin %> <%= command.id %> stripe.api-key --environment=production            # redacted fingerprint",
+        "<%= config.bin %> <%= command.id %> stripe.api-key --environment=production --reveal   # plaintext"
       ],
       "flags": {
         "json": {
@@ -725,6 +822,12 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "reveal": {
+          "description": "print the plaintext of a secret/confidential value (it is redacted by default)",
+          "name": "reveal",
+          "allowNo": false,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
@@ -2308,12 +2411,16 @@
           "name": "name"
         }
       },
-      "description": "Set the fallback value for a flag or config in one environment.\n\nThe fallback is the unconditional rule at the end of the environment's rule\nlist: what users receive when no targeting rule matches. Targeting rules and\npercentage rollouts above it are kept, and the command tells you how many.\nIf the environment has no rules of its own yet, they are copied from the\nflag's default rules first, so inherited targeting is kept too.\n\nTo turn a flag on or off for EVERYONE, including users matched by targeting\nrules, add --replace-targeting. This deletes the environment's targeting\nrules (they stay in git history).\n\nTo set a percentage rollout (gradual rollout / A/B test / canary deploy) instead:\n  qfg set-rollout my.flag --environment production --true-percent 20\n\nTo see all current values and rules for a flag:\n  qfg info my.flag\n\nTo target specific organizations or users, write rules on their KEY\n(organization.key, user.key), not a slug or email; find a key from a name with:\n  qfg contexts search organization formhealth",
+      "description": "Set the fallback value for a flag or config in one environment.\n\nThe fallback is the unconditional rule at the end of the environment's rule\nlist: what users receive when no targeting rule matches. Targeting rules and\npercentage rollouts above it are kept, and the command tells you how many.\nIf the environment has no rules of its own yet, they are copied from the\nflag's default rules first, so inherited targeting is kept too.\n\nTo turn a flag on or off for EVERYONE, including users matched by targeting\nrules, add --replace-targeting. This deletes the environment's targeting\nrules (they stay in git history).\n\nTo set a percentage rollout (gradual rollout / A/B test / canary deploy) instead:\n  qfg set-rollout my.flag --environment production --true-percent 20\n\nSecrets (--secret, or any config whose value is already encrypted) are\nSTRING-ONLY. To store a JSON secret, make it a string secret holding the JSON\nand JSON.parse it in your app. The CLI never prints a secret's plaintext; it\nshows a redacted fingerprint like [encrypted *****3fa9c, 51 chars, ends …a1b2].\nRotate a secret without the value entering argv / shell history:\n  pbpaste | qfg set-default stripe.api-key --environment production --secret --value-stdin --confirm\n  qfg set-default stripe.api-key --environment production --secret --value-from-env STRIPE_API_KEY --confirm\n(--env-var is different: it stores NO value and tells the SDK to read one from\nthat env var at runtime.)\n\nTo see all current values and rules for a flag:\n  qfg info my.flag\n\nTo target specific organizations or users, write rules on their KEY\n(organization.key, user.key), not a slug or email; find a key from a name with:\n  qfg contexts search organization formhealth",
       "examples": [
         "<%= config.bin %> <%= command.id %> my.flag.name                                          # prompts for value and env",
         "<%= config.bin %> <%= command.id %> my.flag.name --value=true --environment=staging",
         "<%= config.bin %> <%= command.id %> my.flag.name --value=false --environment=production --replace-targeting   # kill-switch: off for everyone",
-        "<%= config.bin %> <%= command.id %> my.flag.name --value=true --secret",
+        "# Rotate a secret without the value entering argv:",
+        "pbpaste | <%= config.bin %> <%= command.id %> my.secret --environment=production --secret --value-stdin --confirm",
+        "<%= config.bin %> <%= command.id %> my.secret --environment=production --secret --value-from-env=MY_SECRET --confirm",
+        "# Write the [Default] rules (inherited by every environment without its own):",
+        "<%= config.bin %> <%= command.id %> my.secret --environment=\"[Default]\" --secret --value-from-env=MY_SECRET --confirm",
         "<%= config.bin %> <%= command.id %> my.config.name --env-var=MY_ENV_VAR_NAME --environment=production",
         "# For a percentage rollout, use set-rollout instead:",
         "<%= config.bin %> set-rollout my.flag.name --environment production --true-percent 20",
@@ -2372,20 +2479,20 @@
           "type": "option"
         },
         "confidential": {
-          "description": "mark the value as confidential",
+          "description": "mark the value as confidential. Auto-detected when the key already holds a confidential value; pass --no-confidential to store it in the clear",
           "name": "confidential",
-          "allowNo": false,
+          "allowNo": true,
           "type": "boolean"
         },
         "env-var": {
-          "description": "environment variable to use as default value",
+          "description": "store no value: the SDK reads it from this env var at RUNTIME. To read a value from a local env var NOW, use --value-from-env",
           "name": "env-var",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
         "environment": {
-          "description": "environment to change",
+          "description": "environment to change, e.g. production. Use \"[Default]\" for the default rules that every environment without its own rules inherits",
           "name": "environment",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -2398,12 +2505,26 @@
           "type": "boolean"
         },
         "value": {
-          "description": "new default value",
+          "description": "new default value (for secrets prefer --value-stdin / --value-from-env)",
           "name": "value",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
+        "value-from-env": {
+          "description": "read the value to store from this LOCAL env var now (keeps it out of argv/shell history). Not the same as --env-var",
+          "name": "value-from-env",
+          "hasDynamicHelp": false,
+          "helpValue": "VAR",
+          "multiple": false,
+          "type": "option"
+        },
+        "value-stdin": {
+          "description": "read the value to store from stdin (one trailing newline is stripped). Keeps it out of argv",
+          "name": "value-stdin",
+          "allowNo": false,
+          "type": "boolean"
+        },
         "confirm": {
           "description": "confirm without prompt",
           "name": "confirm",
@@ -2411,7 +2532,7 @@
           "type": "boolean"
         },
         "secret": {
-          "description": "encrypt the value of this item",
+          "description": "encrypt the value of this item (string-only; the CLI never prints the plaintext)",
           "name": "secret",
           "allowNo": false,
           "type": "boolean"
@@ -3238,17 +3359,30 @@
         "install-skill.js"
       ]
     },
-    "cleanup:list": {
+    "contexts:search": {
       "aliases": [],
-      "args": {},
-      "description": "List feature flags marked readyForCleanup=true, with eval volume per window.\n\nColumns:\n  KEY         the flag key\n  TYPE        the flag's valueType (bool, string, int, etc.)\n  EVALS_24H   evals counted in today's bucket (latest day)\n  EVALS_2D    evals in the last 2 calendar days\n  EVALS_7D    evals in the last 7 calendar days\n  EVALS_30D   evals in the last 30 calendar days\n  LAST_EVAL   most recent calendar day with any evals (UTC), blank if none\n  CLASS       quiet (zero evals in last 2 days) or active\n\nDefault sort: quiet first, oldest LAST_EVAL at top.\n\nPass --json for the structured object (rows[]). Each row carries the columns\nabove plus the raw eval counts your agent can reason about itself.\n\nOnce you've picked a candidate, run `qfg cleanup status <key>` for the\ndrill-in, or `qfg cleanup remove <key>` to hand the removal to your coding agent\nwith the Quonfig agent skill.",
+      "args": {
+        "contextType": {
+          "description": "Context type to search, e.g. organization or user (the part before \".key\" in a rule)",
+          "name": "contextType",
+          "required": true
+        },
+        "query": {
+          "description": "Case-insensitive text matched against each context key and its reported properties (e.g. a name)",
+          "name": "query",
+          "required": true
+        }
+      },
+      "description": "Find a context's key from a name, to target it in a rule.\n\nTargeting rules should match a context by its KEY (<contextType>.key, e.g.\norganization.key or user.key), not by a slug, email or name. This searches the\ncontexts your SDKs have reported through telemetry, matching the query against\neach context's key and properties, and prints each match's key, its name and\nits email (blank when the context reported none), most recently seen first.\n\nOnly contexts your SDKs have reported are searchable. If nothing matches, the key\nis unknown: get it from whoever owns that customer rather than targeting a slug\nor email instead.\n\nPass a key as the query to see its name and email.\n\n--json prints {contexts: [{key, name, email?}]}: name is null when the context\nreported no name, and email is present only when it reported one.",
       "examples": [
-        "<%= config.bin %> <%= command.id %>",
-        "<%= config.bin %> <%= command.id %> --json"
+        "<%= config.bin %> <%= command.id %> organization formhealth",
+        "<%= config.bin %> <%= command.id %> user barry@example.com --environment production",
+        "<%= config.bin %> <%= command.id %> organization formhealth --json"
       ],
       "flags": {
         "json": {
-          "description": "Return structured rows for agent consumption",
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
@@ -3295,11 +3429,26 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "environment": {
+          "description": "Only contexts reported from this environment (default: every environment)",
+          "name": "environment",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "limit": {
+          "description": "Maximum number of matches (1-100)",
+          "name": "limit",
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "cleanup:list",
+      "id": "contexts:search",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -3309,28 +3458,21 @@
       "relativePath": [
         "dist",
         "commands",
-        "cleanup",
-        "list.js"
+        "contexts",
+        "search.js"
       ]
     },
-    "cleanup:remove": {
+    "cleanup:list": {
       "aliases": [],
-      "args": {
-        "name": {
-          "description": "config/feature-flag/etc. name",
-          "name": "name"
-        }
-      },
-      "description": "Write a cleanup payload for a ready-for-cleanup flag and hand off to the Quonfig agent skill.\n\nModeled on `qfg migrate my-code` — this command never edits source files\nitself. It validates that the flag is marked readyForCleanup=true, refuses to\nproceed if there are still evals_2d > 0 (use --force to override), writes\n`.qf/cleanup/<key>.json` describing the flag's current rule shape +\ntelemetry, and prints how to have your coding agent remove the call sites with\nthe quonfig agent skill (its references/retire-a-flag.md), which asks the\nengineer which value should \"win\" and applies the inlining. Install the skill\nwith `qfg agent install-skill` or `claude plugin install quonfig@quonfig`.\n\nThe payload deliberately does NOT suggest a winning value; that's the\nengineer's call. Run `qfg cleanup status <key>` first if you want to inspect\ntelemetry before retiring.",
+      "args": {},
+      "description": "List feature flags marked readyForCleanup=true, with eval volume per window.\n\nColumns:\n  KEY         the flag key\n  TYPE        the flag's valueType (bool, string, int, etc.)\n  EVALS_24H   evals counted in today's bucket (latest day)\n  EVALS_2D    evals in the last 2 calendar days\n  EVALS_7D    evals in the last 7 calendar days\n  EVALS_30D   evals in the last 30 calendar days\n  LAST_EVAL   most recent calendar day with any evals (UTC), blank if none\n  CLASS       quiet (zero evals in last 2 days) or active\n\nDefault sort: quiet first, oldest LAST_EVAL at top.\n\nPass --json for the structured object (rows[]). Each row carries the columns\nabove plus the raw eval counts your agent can reason about itself.\n\nOnce you've picked a candidate, run `qfg cleanup status <key>` for the\ndrill-in, or `qfg cleanup remove <key>` to hand the removal to your coding agent\nwith the Quonfig agent skill.",
       "examples": [
-        "<%= config.bin %> <%= command.id %> my.flag.key",
-        "<%= config.bin %> <%= command.id %> my.flag.key --force",
-        "<%= config.bin %> <%= command.id %> my.flag.key --json"
+        "<%= config.bin %> <%= command.id %>",
+        "<%= config.bin %> <%= command.id %> --json"
       ],
       "flags": {
         "json": {
-          "description": "Format output as json.",
-          "helpGroup": "GLOBAL",
+          "description": "Return structured rows for agent consumption",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
@@ -3377,17 +3519,11 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
-        },
-        "force": {
-          "description": "Skip the evals_2d > 0 safety gate (useful when telemetry is delayed but you know the flag is dead)",
-          "name": "force",
-          "allowNo": false,
-          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "cleanup:remove",
+      "id": "cleanup:list",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -3398,10 +3534,10 @@
         "dist",
         "commands",
         "cleanup",
-        "remove.js"
+        "list.js"
       ]
     },
-    "cleanup:status": {
+    "cleanup:remove": {
       "aliases": [],
       "args": {
         "name": {
@@ -3409,14 +3545,16 @@
           "name": "name"
         }
       },
-      "description": "Drill into one ready-for-cleanup flag — show telemetry across all environments and the current rule shape.\n\nUse this after `qfg cleanup list` to inspect a specific flag before handing\nremoval off to the Quonfig agent skill. The eval counts come from\nanalytics.configSparklines (the same backing data the per-flag sparklines on\nthe flag detail page use), summed into 24h/2d/7d/30d windows so you can decide\nwhether it's safe to retire.\n\nPass --json for the structured object including the full rule shape per\nenvironment — the agent skill consumes this directly.",
+      "description": "Write a cleanup payload for a ready-for-cleanup flag and hand off to the Quonfig agent skill.\n\nModeled on `qfg migrate my-code` — this command never edits source files\nitself. It validates that the flag is marked readyForCleanup=true, refuses to\nproceed if there are still evals_2d > 0 (use --force to override), writes\n`.qf/cleanup/<key>.json` describing the flag's current rule shape +\ntelemetry, and prints how to have your coding agent remove the call sites with\nthe quonfig agent skill (its references/retire-a-flag.md), which asks the\nengineer which value should \"win\" and applies the inlining. Install the skill\nwith `qfg agent install-skill` or `claude plugin install quonfig@quonfig`.\n\nThe payload deliberately does NOT suggest a winning value; that's the\nengineer's call. Run `qfg cleanup status <key>` first if you want to inspect\ntelemetry before retiring.",
       "examples": [
         "<%= config.bin %> <%= command.id %> my.flag.key",
+        "<%= config.bin %> <%= command.id %> my.flag.key --force",
         "<%= config.bin %> <%= command.id %> my.flag.key --json"
       ],
       "flags": {
         "json": {
-          "description": "Return structured object for agent consumption",
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
@@ -3463,11 +3601,17 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "force": {
+          "description": "Skip the evals_2d > 0 safety gate (useful when telemetry is delayed but you know the flag is dead)",
+          "name": "force",
+          "allowNo": false,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "cleanup:status",
+      "id": "cleanup:remove",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -3478,10 +3622,10 @@
         "dist",
         "commands",
         "cleanup",
-        "status.js"
+        "remove.js"
       ]
     },
-    "cleanup:verify": {
+    "cleanup:status": {
       "aliases": [],
       "args": {
         "name": {
@@ -3489,12 +3633,10 @@
           "name": "name"
         }
       },
-      "description": "Confirm zero evals for a flag in the trailing N days (default 7). Exits 0 if safe to delete, non-zero otherwise.\n\nRead-only gate intended for chaining with `qfg delete` after a cleanup PR\nhas merged and the SDK has redeployed:\n\n  qfg cleanup verify my.flag.key && qfg delete my.flag.key\n\nThe trailing window is stricter than the `qfg cleanup remove` 2-day gate on\npurpose — `remove` only writes a payload describing the flag, but `delete`\npermanently removes the flag definition, so we want a longer quiet period\nbefore chaining. Bump --days N if you want a more conservative window.",
+      "description": "Drill into one ready-for-cleanup flag — show telemetry across all environments and the current rule shape.\n\nUse this after `qfg cleanup list` to inspect a specific flag before handing\nremoval off to the Quonfig agent skill. The eval counts come from\nanalytics.configSparklines (the same backing data the per-flag sparklines on\nthe flag detail page use), summed into 24h/2d/7d/30d windows so you can decide\nwhether it's safe to retire.\n\nPass --json for the structured object including the full rule shape per\nenvironment — the agent skill consumes this directly.",
       "examples": [
         "<%= config.bin %> <%= command.id %> my.flag.key",
-        "<%= config.bin %> <%= command.id %> my.flag.key --days 14",
-        "<%= config.bin %> <%= command.id %> my.flag.key --json",
-        "<%= config.bin %> <%= command.id %> my.flag.key && <%= config.bin %> delete my.flag.key"
+        "<%= config.bin %> <%= command.id %> my.flag.key --json"
       ],
       "flags": {
         "json": {
@@ -3545,19 +3687,11 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
-        },
-        "days": {
-          "description": "Number of trailing calendar days that must have zero evals",
-          "name": "days",
-          "default": 7,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "cleanup:verify",
+      "id": "cleanup:status",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -3568,33 +3702,27 @@
         "dist",
         "commands",
         "cleanup",
-        "verify.js"
+        "status.js"
       ]
     },
-    "contexts:search": {
+    "cleanup:verify": {
       "aliases": [],
       "args": {
-        "contextType": {
-          "description": "Context type to search, e.g. organization or user (the part before \".key\" in a rule)",
-          "name": "contextType",
-          "required": true
-        },
-        "query": {
-          "description": "Case-insensitive text matched against each context key and its reported properties (e.g. a name)",
-          "name": "query",
-          "required": true
+        "name": {
+          "description": "config/feature-flag/etc. name",
+          "name": "name"
         }
       },
-      "description": "Find a context's key from a name, to target it in a rule.\n\nTargeting rules should match a context by its KEY (<contextType>.key, e.g.\norganization.key or user.key), not by a slug, email or name. This searches the\ncontexts your SDKs have reported through telemetry, matching the query against\neach context's key and properties, and prints each match's key, its name and\nits email (blank when the context reported none), most recently seen first.\n\nOnly contexts your SDKs have reported are searchable. If nothing matches, the key\nis unknown: get it from whoever owns that customer rather than targeting a slug\nor email instead.\n\nPass a key as the query to see its name and email.\n\n--json prints {contexts: [{key, name, email?}]}: name is null when the context\nreported no name, and email is present only when it reported one.",
+      "description": "Confirm zero evals for a flag in the trailing N days (default 7). Exits 0 if safe to delete, non-zero otherwise.\n\nRead-only gate intended for chaining with `qfg delete` after a cleanup PR\nhas merged and the SDK has redeployed:\n\n  qfg cleanup verify my.flag.key && qfg delete my.flag.key\n\nThe trailing window is stricter than the `qfg cleanup remove` 2-day gate on\npurpose — `remove` only writes a payload describing the flag, but `delete`\npermanently removes the flag definition, so we want a longer quiet period\nbefore chaining. Bump --days N if you want a more conservative window.",
       "examples": [
-        "<%= config.bin %> <%= command.id %> organization formhealth",
-        "<%= config.bin %> <%= command.id %> user barry@example.com --environment production",
-        "<%= config.bin %> <%= command.id %> organization formhealth --json"
+        "<%= config.bin %> <%= command.id %> my.flag.key",
+        "<%= config.bin %> <%= command.id %> my.flag.key --days 14",
+        "<%= config.bin %> <%= command.id %> my.flag.key --json",
+        "<%= config.bin %> <%= command.id %> my.flag.key && <%= config.bin %> delete my.flag.key"
       ],
       "flags": {
         "json": {
-          "description": "Format output as json.",
-          "helpGroup": "GLOBAL",
+          "description": "Return structured object for agent consumption",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
@@ -3642,17 +3770,10 @@
           "multiple": false,
           "type": "option"
         },
-        "environment": {
-          "description": "Only contexts reported from this environment (default: every environment)",
-          "name": "environment",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "limit": {
-          "description": "Maximum number of matches (1-100)",
-          "name": "limit",
-          "default": 20,
+        "days": {
+          "description": "Number of trailing calendar days that must have zero evals",
+          "name": "days",
+          "default": 7,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -3660,7 +3781,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "contexts:search",
+      "id": "cleanup:verify",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -3670,8 +3791,8 @@
       "relativePath": [
         "dist",
         "commands",
-        "contexts",
-        "search.js"
+        "cleanup",
+        "verify.js"
       ]
     },
     "migrate:doctor": {
@@ -4383,5 +4504,5 @@
       ]
     }
   },
-  "version": "0.4.0"
+  "version": "0.6.0"
 }