argocd-axi 0.1.5 → 0.1.6

package/README.md

@@ -48,8 +48,8 @@ argocd-axi turns that into small, definitive answers:
   the raw text is one `--full` away.
 - **Opt-in writes.** `apps sync <app>` previews the per-resource diff and
   makes no change unless `--confirm` is passed. It never prunes unless
-  `--prune` is explicit, and execution is limited to configured writable
-  contexts. Other writes remain refused.
+  `--prune` is explicit. Resource actions and automated-sync changes also
+  preview by default and execute only on configured writable contexts.
 - **Safe output.** Secret data, passwords, tokens and sensitive-looking Helm
   parameters are redacted and counted. No flag reveals them.
 - **Never hangs.** Nothing streams or follows; waits are bounded; no prompt can
@@ -146,11 +146,13 @@ argocd-axi apps view <app> [--full]
 argocd-axi apps resources <app> [--problems | --orphaned]
 argocd-axi apps diff <app> [--revision <rev>] [--full]
 argocd-axi apps sync <app> [--confirm] [--prune] [--timeout <s>] --context <c>
+argocd-axi apps auto-sync <app> <on|off> [--confirm] --context <c>
 argocd-axi apps history <app> [--limit <n>]
 argocd-axi apps manifests <app> [--source git|live] [--revision <rev>] [--kind <k>] [--full]
 argocd-axi apps logs <app> [--kind <k> --name <n>] [--tail 100] [--since 15m] [--filter <s>] [--full] [-p]
 argocd-axi apps wait <app> [--sync --health --operation] [--timeout 120]
 argocd-axi apps actions <app> [--kind <k>]
+argocd-axi apps actions run <app> <action> --kind <k> --name <resource> [--confirm] --context <c>
 argocd-axi projects | projects view <p> | projects windows <p>
 argocd-axi appsets | appsets view <name> | appsets generate <file>
 argocd-axi repos | clusters
@@ -219,7 +221,7 @@ specific app.
   local-file and delete flags whatever a command passes, gives argocd no
   stdin, and enforces a timeout and an output cap. Tests fail if a new
   operation becomes reachable without updating the registry.
-- **Opt-in Application writes.** Sync, rollback, refresh and terminate-op require an explicit context, preview and `--confirm`; execution is limited by `writable-contexts` and Argo CD RBAC. Other writes and credential commands answer `REFUSED`.
+- **Opt-in Application writes.** Sync, rollback, refresh, terminate-op, resource actions and automated-sync changes require an explicit context, preview and `--confirm`; execution is limited by `writable-contexts` and Argo CD RBAC. Other writes and credential commands answer `REFUSED`.
 - **Redaction.** Kubernetes Secret `data`, `stringData` and their
   last-applied annotation, values under sensitive-looking keys, and env-var or
   Helm-parameter pairs with sensitive-looking names are replaced with
@@ -231,9 +233,11 @@ specific app.
 - **Writable contexts.** argocd-axi's own config file,
   `~/.config/argocd-axi/config` (or `$XDG_CONFIG_HOME/argocd-axi/config`),
   holds the allowlist of contexts where Application writes may execute.
-  It defaults to none. To allow writes on a context, a human runs
-  `argocd-axi ctx writable add <context>` in a terminal and confirms the exact
-  context name. Use `argocd-axi ctx writable remove <context>` to revoke access.
+  It defaults to none. To allow writes, a human runs
+  `argocd-axi ctx writable add` in a terminal to select a configured context,
+  or passes `<context>` directly; either path requires an explicit y/yes
+  confirmation. Non-interactive runs are refused. Use
+  `argocd-axi ctx writable remove <context>` to revoke access.
 
 - **Version cache.** The server version is checked at most once every 12
   hours per context and server, and cached in `~/.cache/argocd-axi/`

package/dist/src/commands/apps.js

@@ -1,8 +1,9 @@
 import { AxiError } from "axi-sdk-js";
+import { setTimeout as delay } from "node:timers/promises";
 import { parseAllDocuments, stringify } from "yaml";
 import { argocdJson, runArgocd } from "../argocd.js";
 import { loadConfig } from "../config.js";
-import { evaluateWriteGate } from "../gate.js";
+import { attributionArgs, evaluateWriteGate } from "../gate.js";
 import { CONTEXT_FLAG, getBool, getInt, getList, getString, parseArgs, parseDurationSeconds, validateName, } from "../args.js";
 import { CODES, axiError, mapArgocdFailure, validationError, } from "../errors.js";
 import { appName, appSources, attentionReasonPreview, attentionReasons, autoSyncSummary, destinationSummary, displayNames, formatAge, healthStatus, isOperationRunning, isResourceProblem, isUnhealthy, needsAttention, shortRevision, sortApps, syncRevision, syncStatus, plural, truncate, } from "../model.js";
@@ -1149,9 +1150,7 @@ export const APPS_ACTIONS_SPEC = {
         "argocd-axi apps actions guestbook",
         "argocd-axi apps actions guestbook --kind Rollout",
     ],
-    notes: [
-        "Running an action is planned for a later write tier; this command only lists them",
-    ],
+    notes: ["List actions before running one with `apps actions run`"],
 };
 function pick(record, key) {
     const found = Object.keys(record).find((k) => k.toLowerCase() === key);
@@ -1159,7 +1158,7 @@ function pick(record, key) {
 }
 export async function appsActions(args) {
     if (args[0] === "run")
-        refuseActionRun();
+        return appsActionRun(args.slice(1));
     const parsed = parseArgs(APPS_ACTIONS_SPEC, args);
     const name = validateName("app", parsed.positionals[0]);
     const argv = [name, "-o", "json"];
@@ -1185,10 +1184,126 @@ export async function appsActions(args) {
     }));
     return finish([encodeObject({ count: plural(rows.length, "action"), actions: rows })], undefined);
 }
-function refuseActionRun() {
-    throw axiError("running resource actions is planned for the write tier, behind preview-by-default and the writable-contexts allowlist; not in v1 (see ROADMAP.md)", CODES.REFUSED, [
-        "A human can run one with the raw CLI: `argocd app actions run <app> <action> --kind <kind>`",
-    ]);
+const APPS_ACTION_RUN_SPEC = {
+    path: "apps actions run",
+    summary: "Preview and optionally run one action on one resource",
+    positionals: [
+        APP_ARG,
+        { name: "action", required: true, description: "Listed resource action" },
+    ],
+    flags: [
+        {
+            name: "--kind",
+            kind: "value",
+            valueName: "kind",
+            description: "Resource kind",
+        },
+        {
+            name: "--name",
+            kind: "value",
+            valueName: "resource",
+            description: "Resource name",
+        },
+        {
+            name: "--group",
+            kind: "value",
+            valueName: "group",
+            description: "Resource API group when needed to disambiguate",
+        },
+        {
+            name: "--namespace",
+            kind: "value",
+            valueName: "namespace",
+            description: "Resource namespace when needed to disambiguate",
+        },
+        { name: "--confirm", kind: "bool", description: "Execute after preview" },
+        {
+            name: "--timeout",
+            kind: "value",
+            valueName: "s",
+            description: "Maximum wait in seconds (default 120)",
+        },
+        CONTEXT_FLAG,
+    ],
+    examples: [
+        "argocd-axi apps actions run guestbook restart --kind Deployment --name guestbook --context staging",
+    ],
+};
+async function appsActionRun(args) {
+    const parsed = parseArgs(APPS_ACTION_RUN_SPEC, args);
+    const appNameArg = validateName("app", parsed.positionals[0]);
+    const action = validateName("action", parsed.positionals[1]);
+    const kind = getString(parsed, "--kind");
+    const resourceName = getString(parsed, "--name");
+    const group = getString(parsed, "--group");
+    const namespace = getString(parsed, "--namespace");
+    const timeout = getInt(parsed, "--timeout", WRITE_TIMEOUT);
+    if (!kind || !resourceName)
+        throw validationError("apps actions run needs --kind and --name");
+    const context = getString(parsed, "--context"), confirm = getBool(parsed, "--confirm");
+    const gate = evaluateWriteGate({
+        command: "apps actions run",
+        context,
+        execute: confirm,
+        executeFlag: "--confirm",
+    }, loadConfig().config);
+    const options = { context: gate.context };
+    const app = await getApp(appNameArg, options);
+    const resources = (app.status?.resources ?? []).filter((r) => r.kind === kind &&
+        r.name === resourceName &&
+        (group === undefined || r.group === group) &&
+        (namespace === undefined || r.namespace === namespace));
+    const resource = resources[0];
+    if (!resource)
+        throw axiError(`REFUSED: ${kind}/${resourceName} is not managed by ${appNameArg}`, CODES.REFUSED);
+    if (resources.length > 1)
+        throw axiError(`REFUSED: ${kind}/${resourceName} is ambiguous; candidates: ${resources
+            .map((r) => `${r.group ?? "core"}/${r.kind} ${r.namespace ?? "_cluster"}/${r.name}`)
+            .join(", ")}. Specify --group and/or --namespace`, CODES.REFUSED);
+    const actions = await argocdJson("app actions list", [appNameArg, "--kind", kind, "-o", "json"], options);
+    const matchingActions = actions.filter((entry) => String(pick(entry, "name") ?? "") === resourceName &&
+        String(pick(entry, "group") ?? "") === (resource.group ?? "") &&
+        String(pick(entry, "kind") ?? "") === kind &&
+        String(pick(entry, "action") ?? "") === action);
+    const namespacedActions = matchingActions.filter((entry) => pick(entry, "namespace") !== undefined);
+    const unnamespacedAction = matchingActions.length === 1 ? matchingActions[0] : undefined;
+    const actionAvailable = namespacedActions.length
+        ? namespacedActions.some((entry) => pick(entry, "namespace") === resource.namespace &&
+            pick(entry, "disabled") !== true)
+        : unnamespacedAction !== undefined &&
+            pick(unnamespacedAction, "disabled") !== true;
+    if (!actionAvailable)
+        throw axiError(`REFUSED: action ${action} is unavailable for ${kind}/${resourceName}`, CODES.REFUSED);
+    const blocks = [
+        encodeObject({ action, app: appNameArg, kind, resource: resourceName }),
+    ];
+    if (!confirm)
+        return finish(blocks, undefined, [
+            "No changes made; add --confirm to run the action",
+            ...(gate.mode === "preview" ? gate.help : []),
+        ]);
+    await checkWritePermission(`action/${resource.group ?? ""}/${kind}/${action}`, app, appNameArg, options);
+    await runApplicationWrite("app actions run", [
+        appNameArg,
+        action,
+        "--kind",
+        kind,
+        "--resource-name",
+        resourceName,
+        ...(resource.group ? ["--group", resource.group] : []),
+        ...(resource.namespace ? ["--namespace", resource.namespace] : []),
+        ...attributionArgs(),
+    ], options, appNameArg);
+    const current = await waitForAppState(appNameArg, timeout, options, (fresh) => fresh.status?.resources?.some((r) => r.group === resource.group &&
+        r.kind === resource.kind &&
+        r.namespace === resource.namespace &&
+        r.name === resource.name &&
+        r.health?.status === "Healthy") ?? false);
+    const state = current.status?.resources?.find((r) => r.group === resource.group &&
+        r.kind === resource.kind &&
+        r.namespace === resource.namespace &&
+        r.name === resource.name)?.health?.status ?? "unknown";
+    return finish([...blocks, encodeObject({ result: "submitted", state })], undefined);
 }
 // ---------------------------------------------------------------- app writes
 function writeSpec(path, summary, positionals) {
@@ -1249,6 +1364,15 @@ function writeOutcome(phase, timedOut, completed) {
         return "waiting";
     return phase ?? "unknown";
 }
+async function waitForAppState(name, timeout, options, settled) {
+    const deadline = Date.now() + timeout * 1000;
+    let app = await getApp(name, options);
+    while (!settled(app) && Date.now() < deadline) {
+        await delay(Math.min(1000, Math.max(0, deadline - Date.now())));
+        app = await getApp(name, options);
+    }
+    return app;
+}
 async function waitForWrite(name, timeout, options) {
     try {
         const result = await runArgocd("app wait", [name, "--operation", "--timeout", String(timeout)], { ...options, allowFailure: true, timeoutMs: (timeout + 10) * 1000 });
@@ -1412,6 +1536,61 @@ const SUBCOMMANDS = {
     refresh: { spec: APPS_REFRESH_SPEC, run: appsRefresh },
     "terminate-op": { spec: APPS_TERMINATE_SPEC, run: appsTerminateOp },
 };
+const APPS_AUTO_SYNC_SPEC = {
+    path: "apps auto-sync",
+    summary: "Preview and optionally enable or disable automated sync",
+    positionals: [
+        APP_ARG,
+        { name: "mode", required: true, description: "on or off" },
+    ],
+    flags: [
+        { name: "--confirm", kind: "bool", description: "Execute after preview" },
+        {
+            name: "--timeout",
+            kind: "value",
+            valueName: "s",
+            description: "Maximum wait in seconds (default 120)",
+        },
+        CONTEXT_FLAG,
+    ],
+    examples: ["argocd-axi apps auto-sync guestbook on --context staging"],
+};
+async function appsAutoSync(args) {
+    const parsed = parseArgs(APPS_AUTO_SYNC_SPEC, args);
+    const name = validateName("app", parsed.positionals[0]);
+    const mode = parsed.positionals[1];
+    if (mode !== "on" && mode !== "off")
+        throw validationError("mode must be on or off");
+    const context = getString(parsed, "--context"), confirm = getBool(parsed, "--confirm"), timeout = getInt(parsed, "--timeout", WRITE_TIMEOUT);
+    const gate = evaluateWriteGate({
+        command: "apps auto-sync",
+        context,
+        execute: confirm,
+        executeFlag: "--confirm",
+    }, loadConfig().config);
+    const options = { context: gate.context }, app = await getApp(name, options);
+    const current = autoSyncSummary(app), blocks = [encodeObject({ autoSync: name, current, target: mode })];
+    if (!confirm)
+        return finish(blocks, undefined, [
+            "No changes made; add --confirm to change automated sync",
+            ...(gate.mode === "preview" ? gate.help : []),
+        ]);
+    await checkWritePermission("update", app, name, options);
+    await runApplicationWrite("app set", [
+        name,
+        "--sync-policy",
+        mode === "on" ? "automated" : "none",
+        ...attributionArgs(),
+    ], options, name);
+    const observed = await waitForAppState(name, timeout, options, (fresh) => mode === "on"
+        ? autoSyncSummary(fresh).startsWith("automated")
+        : autoSyncSummary(fresh) === "manual");
+    return finish([
+        ...blocks,
+        encodeObject({ result: "submitted", state: autoSyncSummary(observed) }),
+    ], undefined);
+}
+SUBCOMMANDS["auto-sync"] = { spec: APPS_AUTO_SYNC_SPEC, run: appsAutoSync };
 export const APPS_SPECS = [
     APPS_LIST_SPEC,
     ...Object.values(SUBCOMMANDS).map((s) => s.spec),

package/dist/src/commands/ctx.js

@@ -150,12 +150,15 @@ const WRITABLE_ADD_SPEC = {
     positionals: [
         {
             name: "context",
-            required: true,
+            required: false,
             description: "Configured Argo CD context",
         },
     ],
     flags: [],
-    examples: ["argocd-axi ctx writable add staging"],
+    examples: [
+        "argocd-axi ctx writable add",
+        "argocd-axi ctx writable add staging",
+    ],
 };
 const WRITABLE_REMOVE_SPEC = {
     path: "ctx writable remove",
@@ -177,44 +180,92 @@ const WRITABLE_LIST_SPEC = {
     flags: [],
     examples: ["argocd-axi ctx writable list"],
 };
+export async function readConfirmation(input, output, prompt) {
+    const rl = createInterface({ input, output });
+    const closed = new Promise((resolve) => rl.once("close", () => resolve("")));
+    try {
+        return await Promise.race([rl.question(prompt), closed]);
+    }
+    finally {
+        rl.close();
+    }
+}
+export async function confirmWritableContext(name, server, input, output) {
+    const answer = await readConfirmation(input, output, `Allow argocd-axi to sync, rollback, refresh, and terminate operations on context ${name} (${server})? [y/N] `);
+    return /^y(?:es)?$/i.test(answer.trim());
+}
+export async function contextDetails(contexts, lookup = async (name) => (await argocdJson("account get-user-info", ["-o", "json"], { context: name, timeoutMs: 1_500 })).username) {
+    const result = [];
+    for (let offset = 0; offset < contexts.length; offset += 3) {
+        const batch = await Promise.all(contexts.slice(offset, offset + 3).map(async (context) => ({
+            ...context,
+            username: (await lookup(context.name).catch(() => undefined)) ?? "unknown",
+        })));
+        result.push(...batch);
+    }
+    return result;
+}
+export function addWritableContextIfConfirmed(name, confirmed) {
+    return confirmed ? addWritableContext(name) : false;
+}
+export async function chooseContext(contexts, writable, input, output) {
+    output.write(contexts
+        .map((context, index) => `${index + 1}. ${context.name} - ${context.server} - ${context.username}${writable.includes(context.name) ? " (already writable)" : ""}`)
+        .join("\n") + "\n");
+    const selected = await readConfirmation(input, output, "Select a context by number: ");
+    const index = Number(selected);
+    const context = Number.isInteger(index) && index >= 1 ? contexts[index - 1] : undefined;
+    if (!context)
+        throw axiError("invalid context selection; no changes made", CODES.REFUSED);
+    return context.name;
+}
 async function writableAdd(args) {
     const parsed = parseArgs(WRITABLE_ADD_SPEC, args);
-    const name = validateContextName(parsed.positionals[0]);
+    if (!process.stdin.isTTY || !process.stdout.isTTY)
+        throw axiError("writable context changes require an interactive terminal; run this command in a terminal", CODES.REFUSED);
     const listing = await listContexts();
     if (listing.notInstalled)
         throw listing.notInstalled;
     if (listing.unavailable) {
         throw axiError(`cannot list Argo CD contexts: ${listing.unavailable}`, CODES.NO_CONTEXT, LOGIN_HELP);
     }
-    const match = listing.contexts.find((context) => context.name === name);
+    const writable = loadConfig().config.writableContexts;
+    let name = parsed.positionals[0]
+        ? validateContextName(parsed.positionals[0])
+        : undefined;
+    let username;
+    if (name === undefined) {
+        if (listing.contexts.length === 0)
+            throw axiError("no configured Argo CD contexts to select", CODES.NO_CONTEXT);
+        const details = await contextDetails(listing.contexts);
+        name = await chooseContext(details, writable, process.stdin, process.stdout);
+        username = details.find((context) => context.name === name)?.username;
+    }
+    const selectedName = name;
+    const match = listing.contexts.find((context) => context.name === selectedName);
     if (!match)
         throw axiError(`Argo CD context ${name} is not configured`, CODES.CONTEXT_NOT_FOUND);
-    if (loadConfig().config.writableContexts.includes(name))
+    if (writable.includes(selectedName))
         return finish([
             encodeObject({
-                writableContext: `${name} is already writable (no change)`,
+                writableContext: `${selectedName} is already writable (no change)`,
+            }),
+        ], undefined);
+    username ??= (await argocdJson("account get-user-info", ["-o", "json"], { context: selectedName })).username;
+    process.stdout.write(`Context: ${selectedName}\nServer: ${match.server}\nUser: ${username ?? "unknown"}\n`);
+    const confirmed = await confirmWritableContext(selectedName, match.server, process.stdin, process.stdout);
+    const changed = addWritableContextIfConfirmed(selectedName, confirmed);
+    if (!confirmed)
+        return finish([
+            encodeObject({
+                writableContext: `${selectedName} remains read-only (no change)`,
             }),
         ], undefined);
-    if (!process.stdin.isTTY || !process.stdout.isTTY)
-        throw axiError("writable context changes require an interactive terminal", CODES.REFUSED);
-    const info = await argocdJson("account get-user-info", ["-o", "json"], { context: name });
-    process.stdout.write(`Context: ${name}\nServer: ${match.server}\nUser: ${info.username ?? "unknown"}\nType ${name} to allow writes: `);
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    let answer;
-    try {
-        answer = await rl.question("");
-    }
-    finally {
-        rl.close();
-    }
-    if (answer !== name)
-        throw axiError("confirmation did not match; no changes made", CODES.REFUSED);
-    const changed = addWritableContext(name);
     return finish([
         encodeObject({
             writableContext: changed
-                ? `added ${name}`
-                : `${name} is already writable (no change)`,
+                ? `added ${selectedName}`
+                : `${selectedName} is already writable (no change)`,
         }),
     ], undefined);
 }

package/dist/src/help.js

@@ -16,11 +16,13 @@ export const COMMAND_LINES = [
     "apps rollback <app> <history-id> [--confirm] [--timeout <s>]: preview revision, then optionally roll back",
     "apps refresh <app> [--hard] [--confirm]: preview, then optionally refresh one app",
     "apps terminate-op <app> [--confirm] [--timeout <s>]: preview, then optionally stop a running operation",
+    "apps auto-sync <app> <on|off> [--confirm]: preview, then optionally change automated sync",
+    "apps actions run <app> <action> --kind <kind> --name <resource> [--confirm]: preview, then optionally run one listed resource action",
     "apps history <app>: deployments, newest first",
     "apps manifests <app> [--source git|live] [--kind <k>] [--full]: rendered manifests, Secret data redacted",
     "apps logs <app> [--kind --name --tail --since --filter -p]: recent pod logs, never follows",
     "apps wait <app> [--sync --health --operation] [--timeout <s>]: bounded wait, returns the state either way",
-    "apps actions <app>: resource actions available (listing only)",
+    "apps actions <app>: list available resource actions",
     "projects | projects view <p> | projects windows <p>: projects, their rules, and whether sync is allowed now",
     "appsets | appsets view <name> | appsets generate <file>: ApplicationSets and what a spec would generate",
     "repos | clusters: repositories and destination clusters with connection status",
@@ -42,7 +44,7 @@ export const TOP_HELP = `${renderBlocks([
         "argocd-axi apps diff payments-api",
     ]),
     renderHelpBlock("notes", [
-        "Read-only except opt-in writes on writable contexts: apps sync, rollback, refresh and terminate-op require --confirm; sync never prunes unless --prune is given",
+        "Writes on writable contexts require --confirm: apps sync, rollback, refresh, terminate-op, auto-sync and actions run; sync never prunes unless --prune is given",
         "Output is TOON on stdout, errors included; exit 0 = success (an unhealthy app is data, not an error), 1 = error, 2 = usage",
         "Secret-looking values are redacted and counted; no flag reveals them",
         "Uses your existing argocd CLI session or ARGOCD_AUTH_TOKEN; never logs in, never reads the argocd config file",

package/dist/src/registry.js

@@ -50,6 +50,18 @@ export const OPERATIONS = {
         network: true,
         timeoutMs: READ_TIMEOUT_MS,
     },
+    "app actions run": {
+        argv: ["app", "actions", "run"],
+        tier: "write",
+        network: true,
+        timeoutMs: READ_TIMEOUT_MS,
+    },
+    "app set": {
+        argv: ["app", "set"],
+        tier: "write",
+        network: true,
+        timeoutMs: READ_TIMEOUT_MS,
+    },
     "app resources": {
         argv: ["app", "resources"],
         tier: "read",
@@ -190,20 +202,11 @@ export const FORBIDDEN_ARGS = [
     "--port-forward",
     "--prompts-enabled",
 ];
-const PLANNED = "planned for the write tier, behind preview-by-default and the writable-contexts allowlist; not in v1 (see ROADMAP.md)";
 /**
  * Writes the design names for the next tier (decision A2): known verbs that
  * answer REFUSED with the raw argocd route a human can take today.
  */
-export const PLANNED_WRITES = {
-    "apps action": {
-        reason: `running resource actions is ${PLANNED}`,
-        help: [
-            "List available actions with `argocd-axi apps actions <app>`",
-            "A human can run one with the raw CLI: `argocd app actions run <app> <action> --kind <kind>`",
-        ],
-    },
-};
+export const PLANNED_WRITES = {};
 const HUMAN_ONLY = "A human runs this with the raw argocd CLI";
 /**
  * Known verbs that argocd-axi never wraps (design decisions S7 and A2), each

package/dist/src/skill.js

@@ -33,7 +33,7 @@ For anything argocd-axi does not cover, the raw \`argocd\` CLI is the fallback.
 
 ## Setup
 
-Run \`npx -y argocd-axi auth guide\` for offline instructions. A human operator logs in interactively with \`argocd login <server> --sso --grpc-web\`; agents and CI use \`ARGOCD_SERVER\` and \`ARGOCD_AUTH_TOKEN\` from a scoped account token. The user owns login; argocd-axi never logs in. Verify access with \`npx -y argocd-axi whoami\`. To enable writes on a context, a human runs \`argocd-axi ctx writable add <context>\` in a terminal and confirms the context name.
+Run \`npx -y argocd-axi auth guide\` for offline instructions. A human operator logs in interactively with \`argocd login <server> --sso --grpc-web\`; agents and CI use \`ARGOCD_SERVER\` and \`ARGOCD_AUTH_TOKEN\` from a scoped account token. The user owns login; argocd-axi never logs in. Verify access with \`npx -y argocd-axi whoami\`. See the README's writable-context instructions before enabling writes.
 
 ## Workflow
 

package/dist/src/version.js

@@ -1,3 +1,3 @@
 // Leaf module: node builtins only, so the bin fast path can answer
 // `--version` without loading the command graph.
-export const VERSION = "0.1.5"; // x-release-please-version
+export const VERSION = "0.1.6"; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "argocd-axi",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Agent-ergonomic Argo CD CLI with opt-in writes - AXI-compliant argocd wrapper with token-efficient TOON output",
   "type": "module",
   "license": "MIT",

package/skills/argocd-axi/SKILL.md

@@ -20,7 +20,7 @@ For anything argocd-axi does not cover, the raw `argocd` CLI is the fallback.
 
 ## Setup
 
-Run `npx -y argocd-axi auth guide` for offline instructions. A human operator logs in interactively with `argocd login <server> --sso --grpc-web`; agents and CI use `ARGOCD_SERVER` and `ARGOCD_AUTH_TOKEN` from a scoped account token. The user owns login; argocd-axi never logs in. Verify access with `npx -y argocd-axi whoami`. To enable writes on a context, a human runs `argocd-axi ctx writable add <context>` in a terminal and confirms the context name.
+Run `npx -y argocd-axi auth guide` for offline instructions. A human operator logs in interactively with `argocd login <server> --sso --grpc-web`; agents and CI use `ARGOCD_SERVER` and `ARGOCD_AUTH_TOKEN` from a scoped account token. The user owns login; argocd-axi never logs in. Verify access with `npx -y argocd-axi whoami`. See the README's writable-context instructions before enabling writes.
 
 ## Workflow
 
@@ -34,7 +34,7 @@ Run `npx -y argocd-axi auth guide` for offline instructions. A human operator lo
 ## Commands
 
 ```
-commands[23]:
+commands[25]:
   (no command): live overview - context, server, user, apps needing attention with the reason, running operations
   ctx [--context <c>]: current context, server and CLI version, local only (what the session hook prints)
   ctx use <context>: switch the argocd CLI's current context (local config only)
@@ -49,11 +49,13 @@ commands[23]:
   apps rollback <app> <history-id> [--confirm] [--timeout <s>]: preview revision, then optionally roll back
   apps refresh <app> [--hard] [--confirm]: preview, then optionally refresh one app
   apps terminate-op <app> [--confirm] [--timeout <s>]: preview, then optionally stop a running operation
+  apps auto-sync <app> <on|off> [--confirm]: preview, then optionally change automated sync
+  apps actions run <app> <action> --kind <kind> --name <resource> [--confirm]: preview, then optionally run one listed resource action
   apps history <app>: deployments, newest first
   apps manifests <app> [--source git|live] [--kind <k>] [--full]: rendered manifests, Secret data redacted
   apps logs <app> [--kind --name --tail --since --filter -p]: recent pod logs, never follows
   apps wait <app> [--sync --health --operation] [--timeout <s>]: bounded wait, returns the state either way
-  apps actions <app>: resource actions available (listing only)
+  apps actions <app>: list available resource actions
   projects | projects view <p> | projects windows <p>: projects, their rules, and whether sync is allowed now
   appsets | appsets view <name> | appsets generate <file>: ApplicationSets and what a spec would generate
   repos | clusters: repositories and destination clusters with connection status