argocd-axi 0.1.5 → 0.1.7

package/README.md

@@ -48,8 +48,8 @@ argocd-axi turns that into small, definitive answers:
   the raw text is one `--full` away.
 - **Opt-in writes.** `apps sync <app>` previews the per-resource diff and
   makes no change unless `--confirm` is passed. It never prunes unless
-  `--prune` is explicit, and execution is limited to configured writable
-  contexts. Other writes remain refused.
+  `--prune` is explicit. Resource actions and automated-sync changes also
+  preview by default and execute only on configured writable contexts.
 - **Safe output.** Secret data, passwords, tokens and sensitive-looking Helm
   parameters are redacted and counted. No flag reveals them.
 - **Never hangs.** Nothing streams or follows; waits are bounded; no prompt can
@@ -121,14 +121,20 @@ and every other command that prints or changes a credential.
 
 Pick one; you do not need both.
 
-- **Session hook (recommended).** `argocd-axi setup hooks` installs a
-  SessionStart hook for Claude Code, Codex and OpenCode. The hook runs
-  `argocd-axi-ctx`, which is local only: current context, server, CLI version
-  and the cached server version. It makes no network call, triggers no SSO
-  refresh and reads no credential, so a dead context can never hang a session
-  start. It needs a persistent install (`npm install -g argocd-axi`); run from
-  an npx cache, it answers `REFUSED` because the hook would point at a
-  temporary path.
+- **Session hook (recommended).** `argocd-axi setup hooks` installs
+  SessionStart hooks for Claude Code, Codex and OpenCode, plus a Claude Code
+  SessionEnd hook. The start hook runs `argocd-axi-ctx`, which is local only:
+  current context, server, CLI version and the cached server version. It makes
+  no network call, triggers no SSO refresh and reads no credential, so a dead
+  context can never hang a session start. The end hook records only argocd-axi
+  command names, their counts and the most-used `--context` value for that
+  working directory; it does not save arguments or other values. The session
+  log is limited to 100 directories and stored with `0600` permissions. Run
+  `argocd-axi context` to view the current directory's last session, or
+  `argocd-axi setup status` / `argocd-axi setup uninstall` to inspect or remove
+  the Claude Code SessionEnd hook. Hooks need a persistent install
+  (`npm install -g argocd-axi`); run from an npx cache, installation is refused
+  because hooks would point at a temporary path.
 - **Skill.** `npx skills add Dematom1/argocd-axi --skill argocd-axi`
   installs [`skills/argocd-axi/SKILL.md`](skills/argocd-axi/SKILL.md), which
   is generated from the CLI's own help and loads when a task is about Argo CD.
@@ -146,15 +152,18 @@ argocd-axi apps view <app> [--full]
 argocd-axi apps resources <app> [--problems | --orphaned]
 argocd-axi apps diff <app> [--revision <rev>] [--full]
 argocd-axi apps sync <app> [--confirm] [--prune] [--timeout <s>] --context <c>
+argocd-axi apps auto-sync <app> <on|off> [--confirm] --context <c>
 argocd-axi apps history <app> [--limit <n>]
 argocd-axi apps manifests <app> [--source git|live] [--revision <rev>] [--kind <k>] [--full]
 argocd-axi apps logs <app> [--kind <k> --name <n>] [--tail 100] [--since 15m] [--filter <s>] [--full] [-p]
 argocd-axi apps wait <app> [--sync --health --operation] [--timeout 120]
 argocd-axi apps actions <app> [--kind <k>]
+argocd-axi apps actions run <app> <action> --kind <k> --name <resource> [--confirm] --context <c>
 argocd-axi projects | projects view <p> | projects windows <p>
 argocd-axi appsets | appsets view <name> | appsets generate <file>
 argocd-axi repos | clusters
-argocd-axi setup hooks
+argocd-axi context [end]
+argocd-axi setup hooks | status | uninstall
 argocd-axi update [--check]
 ```
 
@@ -219,7 +228,7 @@ specific app.
   local-file and delete flags whatever a command passes, gives argocd no
   stdin, and enforces a timeout and an output cap. Tests fail if a new
   operation becomes reachable without updating the registry.
-- **Opt-in Application writes.** Sync, rollback, refresh and terminate-op require an explicit context, preview and `--confirm`; execution is limited by `writable-contexts` and Argo CD RBAC. Other writes and credential commands answer `REFUSED`.
+- **Opt-in Application writes.** Sync, rollback, refresh, terminate-op, resource actions and automated-sync changes require an explicit context, preview and `--confirm`; execution is limited by `writable-contexts` and Argo CD RBAC. Other writes and credential commands answer `REFUSED`.
 - **Redaction.** Kubernetes Secret `data`, `stringData` and their
   last-applied annotation, values under sensitive-looking keys, and env-var or
   Helm-parameter pairs with sensitive-looking names are replaced with
@@ -231,9 +240,11 @@ specific app.
 - **Writable contexts.** argocd-axi's own config file,
   `~/.config/argocd-axi/config` (or `$XDG_CONFIG_HOME/argocd-axi/config`),
   holds the allowlist of contexts where Application writes may execute.
-  It defaults to none. To allow writes on a context, a human runs
-  `argocd-axi ctx writable add <context>` in a terminal and confirms the exact
-  context name. Use `argocd-axi ctx writable remove <context>` to revoke access.
+  It defaults to none. To allow writes, a human runs
+  `argocd-axi ctx writable add` in a terminal to select a configured context,
+  or passes `<context>` directly; either path requires an explicit y/yes
+  confirmation. Non-interactive runs are refused. Use
+  `argocd-axi ctx writable remove <context>` to revoke access.
 
 - **Version cache.** The server version is checked at most once every 12
   hours per context and server, and cached in `~/.cache/argocd-axi/`

package/dist/src/cli.js

@@ -10,6 +10,7 @@ import { homeCommand } from "./commands/home.js";
 import { clustersCommand, reposCommand } from "./commands/inventory.js";
 import { projectsCommand } from "./commands/projects.js";
 import { setupCommand } from "./commands/setup.js";
+import { contextCommand } from "./commands/context.js";
 import { DESCRIPTION, TOP_HELP } from "./help.js";
 import { NATIVE_NOUNS, REFUSALS } from "./registry.js";
 import { renderBlocks, renderHelp } from "./toon.js";
@@ -55,6 +56,7 @@ export const COMMANDS = Object.assign(Object.create(null), {
     repos: reposCommand,
     clusters: clustersCommand,
     setup: setupCommand,
+    context: contextCommand,
     ...Object.fromEntries(TOP_LEVEL_REFUSALS.map((key) => [key, refusalCommand(key)])),
 });
 export async function main(argv = process.argv.slice(2)) {

package/dist/src/commands/apps.js

@@ -1,8 +1,9 @@
 import { AxiError } from "axi-sdk-js";
+import { setTimeout as delay } from "node:timers/promises";
 import { parseAllDocuments, stringify } from "yaml";
 import { argocdJson, runArgocd } from "../argocd.js";
 import { loadConfig } from "../config.js";
-import { evaluateWriteGate } from "../gate.js";
+import { attributionArgs, evaluateWriteGate } from "../gate.js";
 import { CONTEXT_FLAG, getBool, getInt, getList, getString, parseArgs, parseDurationSeconds, validateName, } from "../args.js";
 import { CODES, axiError, mapArgocdFailure, validationError, } from "../errors.js";
 import { appName, appSources, attentionReasonPreview, attentionReasons, autoSyncSummary, destinationSummary, displayNames, formatAge, healthStatus, isOperationRunning, isResourceProblem, isUnhealthy, needsAttention, shortRevision, sortApps, syncRevision, syncStatus, plural, truncate, } from "../model.js";
@@ -1149,9 +1150,7 @@ export const APPS_ACTIONS_SPEC = {
         "argocd-axi apps actions guestbook",
         "argocd-axi apps actions guestbook --kind Rollout",
     ],
-    notes: [
-        "Running an action is planned for a later write tier; this command only lists them",
-    ],
+    notes: ["List actions before running one with `apps actions run`"],
 };
 function pick(record, key) {
     const found = Object.keys(record).find((k) => k.toLowerCase() === key);
@@ -1159,7 +1158,7 @@ function pick(record, key) {
 }
 export async function appsActions(args) {
     if (args[0] === "run")
-        refuseActionRun();
+        return appsActionRun(args.slice(1));
     const parsed = parseArgs(APPS_ACTIONS_SPEC, args);
     const name = validateName("app", parsed.positionals[0]);
     const argv = [name, "-o", "json"];
@@ -1185,10 +1184,126 @@ export async function appsActions(args) {
     }));
     return finish([encodeObject({ count: plural(rows.length, "action"), actions: rows })], undefined);
 }
-function refuseActionRun() {
-    throw axiError("running resource actions is planned for the write tier, behind preview-by-default and the writable-contexts allowlist; not in v1 (see ROADMAP.md)", CODES.REFUSED, [
-        "A human can run one with the raw CLI: `argocd app actions run <app> <action> --kind <kind>`",
-    ]);
+const APPS_ACTION_RUN_SPEC = {
+    path: "apps actions run",
+    summary: "Preview and optionally run one action on one resource",
+    positionals: [
+        APP_ARG,
+        { name: "action", required: true, description: "Listed resource action" },
+    ],
+    flags: [
+        {
+            name: "--kind",
+            kind: "value",
+            valueName: "kind",
+            description: "Resource kind",
+        },
+        {
+            name: "--name",
+            kind: "value",
+            valueName: "resource",
+            description: "Resource name",
+        },
+        {
+            name: "--group",
+            kind: "value",
+            valueName: "group",
+            description: "Resource API group when needed to disambiguate",
+        },
+        {
+            name: "--namespace",
+            kind: "value",
+            valueName: "namespace",
+            description: "Resource namespace when needed to disambiguate",
+        },
+        { name: "--confirm", kind: "bool", description: "Execute after preview" },
+        {
+            name: "--timeout",
+            kind: "value",
+            valueName: "s",
+            description: "Maximum wait in seconds (default 120)",
+        },
+        CONTEXT_FLAG,
+    ],
+    examples: [
+        "argocd-axi apps actions run guestbook restart --kind Deployment --name guestbook --context staging",
+    ],
+};
+async function appsActionRun(args) {
+    const parsed = parseArgs(APPS_ACTION_RUN_SPEC, args);
+    const appNameArg = validateName("app", parsed.positionals[0]);
+    const action = validateName("action", parsed.positionals[1]);
+    const kind = getString(parsed, "--kind");
+    const resourceName = getString(parsed, "--name");
+    const group = getString(parsed, "--group");
+    const namespace = getString(parsed, "--namespace");
+    const timeout = getInt(parsed, "--timeout", WRITE_TIMEOUT);
+    if (!kind || !resourceName)
+        throw validationError("apps actions run needs --kind and --name");
+    const context = getString(parsed, "--context"), confirm = getBool(parsed, "--confirm");
+    const gate = evaluateWriteGate({
+        command: "apps actions run",
+        context,
+        execute: confirm,
+        executeFlag: "--confirm",
+    }, loadConfig().config);
+    const options = { context: gate.context };
+    const app = await getApp(appNameArg, options);
+    const resources = (app.status?.resources ?? []).filter((r) => r.kind === kind &&
+        r.name === resourceName &&
+        (group === undefined || r.group === group) &&
+        (namespace === undefined || r.namespace === namespace));
+    const resource = resources[0];
+    if (!resource)
+        throw axiError(`REFUSED: ${kind}/${resourceName} is not managed by ${appNameArg}`, CODES.REFUSED);
+    if (resources.length > 1)
+        throw axiError(`REFUSED: ${kind}/${resourceName} is ambiguous; candidates: ${resources
+            .map((r) => `${r.group ?? "core"}/${r.kind} ${r.namespace ?? "_cluster"}/${r.name}`)
+            .join(", ")}. Specify --group and/or --namespace`, CODES.REFUSED);
+    const actions = await argocdJson("app actions list", [appNameArg, "--kind", kind, "-o", "json"], options);
+    const matchingActions = actions.filter((entry) => String(pick(entry, "name") ?? "") === resourceName &&
+        String(pick(entry, "group") ?? "") === (resource.group ?? "") &&
+        String(pick(entry, "kind") ?? "") === kind &&
+        String(pick(entry, "action") ?? "") === action);
+    const namespacedActions = matchingActions.filter((entry) => pick(entry, "namespace") !== undefined);
+    const unnamespacedAction = matchingActions.length === 1 ? matchingActions[0] : undefined;
+    const actionAvailable = namespacedActions.length
+        ? namespacedActions.some((entry) => pick(entry, "namespace") === resource.namespace &&
+            pick(entry, "disabled") !== true)
+        : unnamespacedAction !== undefined &&
+            pick(unnamespacedAction, "disabled") !== true;
+    if (!actionAvailable)
+        throw axiError(`REFUSED: action ${action} is unavailable for ${kind}/${resourceName}`, CODES.REFUSED);
+    const blocks = [
+        encodeObject({ action, app: appNameArg, kind, resource: resourceName }),
+    ];
+    if (!confirm)
+        return finish(blocks, undefined, [
+            "No changes made; add --confirm to run the action",
+            ...(gate.mode === "preview" ? gate.help : []),
+        ]);
+    await checkWritePermission(`action/${resource.group ?? ""}/${kind}/${action}`, app, appNameArg, options);
+    await runApplicationWrite("app actions run", [
+        appNameArg,
+        action,
+        "--kind",
+        kind,
+        "--resource-name",
+        resourceName,
+        ...(resource.group ? ["--group", resource.group] : []),
+        ...(resource.namespace ? ["--namespace", resource.namespace] : []),
+        ...attributionArgs(),
+    ], options, appNameArg);
+    const current = await waitForAppState(appNameArg, timeout, options, (fresh) => fresh.status?.resources?.some((r) => r.group === resource.group &&
+        r.kind === resource.kind &&
+        r.namespace === resource.namespace &&
+        r.name === resource.name &&
+        r.health?.status === "Healthy") ?? false);
+    const state = current.status?.resources?.find((r) => r.group === resource.group &&
+        r.kind === resource.kind &&
+        r.namespace === resource.namespace &&
+        r.name === resource.name)?.health?.status ?? "unknown";
+    return finish([...blocks, encodeObject({ result: "submitted", state })], undefined);
 }
 // ---------------------------------------------------------------- app writes
 function writeSpec(path, summary, positionals) {
@@ -1249,6 +1364,15 @@ function writeOutcome(phase, timedOut, completed) {
         return "waiting";
     return phase ?? "unknown";
 }
+async function waitForAppState(name, timeout, options, settled) {
+    const deadline = Date.now() + timeout * 1000;
+    let app = await getApp(name, options);
+    while (!settled(app) && Date.now() < deadline) {
+        await delay(Math.min(1000, Math.max(0, deadline - Date.now())));
+        app = await getApp(name, options);
+    }
+    return app;
+}
 async function waitForWrite(name, timeout, options) {
     try {
         const result = await runArgocd("app wait", [name, "--operation", "--timeout", String(timeout)], { ...options, allowFailure: true, timeoutMs: (timeout + 10) * 1000 });
@@ -1412,6 +1536,61 @@ const SUBCOMMANDS = {
     refresh: { spec: APPS_REFRESH_SPEC, run: appsRefresh },
     "terminate-op": { spec: APPS_TERMINATE_SPEC, run: appsTerminateOp },
 };
+const APPS_AUTO_SYNC_SPEC = {
+    path: "apps auto-sync",
+    summary: "Preview and optionally enable or disable automated sync",
+    positionals: [
+        APP_ARG,
+        { name: "mode", required: true, description: "on or off" },
+    ],
+    flags: [
+        { name: "--confirm", kind: "bool", description: "Execute after preview" },
+        {
+            name: "--timeout",
+            kind: "value",
+            valueName: "s",
+            description: "Maximum wait in seconds (default 120)",
+        },
+        CONTEXT_FLAG,
+    ],
+    examples: ["argocd-axi apps auto-sync guestbook on --context staging"],
+};
+async function appsAutoSync(args) {
+    const parsed = parseArgs(APPS_AUTO_SYNC_SPEC, args);
+    const name = validateName("app", parsed.positionals[0]);
+    const mode = parsed.positionals[1];
+    if (mode !== "on" && mode !== "off")
+        throw validationError("mode must be on or off");
+    const context = getString(parsed, "--context"), confirm = getBool(parsed, "--confirm"), timeout = getInt(parsed, "--timeout", WRITE_TIMEOUT);
+    const gate = evaluateWriteGate({
+        command: "apps auto-sync",
+        context,
+        execute: confirm,
+        executeFlag: "--confirm",
+    }, loadConfig().config);
+    const options = { context: gate.context }, app = await getApp(name, options);
+    const current = autoSyncSummary(app), blocks = [encodeObject({ autoSync: name, current, target: mode })];
+    if (!confirm)
+        return finish(blocks, undefined, [
+            "No changes made; add --confirm to change automated sync",
+            ...(gate.mode === "preview" ? gate.help : []),
+        ]);
+    await checkWritePermission("update", app, name, options);
+    await runApplicationWrite("app set", [
+        name,
+        "--sync-policy",
+        mode === "on" ? "automated" : "none",
+        ...attributionArgs(),
+    ], options, name);
+    const observed = await waitForAppState(name, timeout, options, (fresh) => mode === "on"
+        ? autoSyncSummary(fresh).startsWith("automated")
+        : autoSyncSummary(fresh) === "manual");
+    return finish([
+        ...blocks,
+        encodeObject({ result: "submitted", state: autoSyncSummary(observed) }),
+    ], undefined);
+}
+SUBCOMMANDS["auto-sync"] = { spec: APPS_AUTO_SYNC_SPEC, run: appsAutoSync };
 export const APPS_SPECS = [
     APPS_LIST_SPEC,
     ...Object.values(SUBCOMMANDS).map((s) => s.spec),

package/dist/src/commands/context.js

@@ -0,0 +1,83 @@
+import { realpathSync } from "node:fs";
+import { parseArgs } from "../args.js";
+import { CODES, axiError } from "../errors.js";
+import { encodeObject } from "../toon.js";
+import { finish } from "./common.js";
+import { lastSession, recordSession, sessionText, summarizeTranscript, } from "../sessionlog.js";
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function directory(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return path;
+    }
+}
+function display(summary) {
+    return summary ? sessionText(summary) : undefined;
+}
+const CONTEXT_SPEC = {
+    path: "context",
+    summary: "Show or record session memory",
+    positionals: [{ name: "action", required: false, description: "end" }],
+    flags: [],
+    examples: ["argocd-axi context", "argocd-axi context end"],
+};
+export async function contextCommand(args) {
+    const parsed = parseArgs(CONTEXT_SPEC, args);
+    const sub = parsed.positionals[0];
+    if (sub !== undefined && sub !== "end") {
+        throw axiError("unknown context action", CODES.VALIDATION_ERROR, [
+            "Run `argocd-axi context` or `argocd-axi context end`",
+        ]);
+    }
+    if (sub !== "end") {
+        const summary = display(lastSession(directory(process.cwd())));
+        return finish([encodeObject({ last_session: summary })], undefined);
+    }
+    if (process.stdin.isTTY)
+        throw axiError("context end reads a SessionEnd hook payload on stdin", CODES.VALIDATION_ERROR, ["It runs from the hook installed by `argocd-axi setup hooks`"]);
+    let payload;
+    try {
+        payload = JSON.parse(await new Promise((resolve, reject) => {
+            let text = "";
+            process.stdin.setEncoding("utf8");
+            process.stdin.on("data", (chunk) => (text += chunk));
+            process.stdin.on("end", () => resolve(text));
+            process.stdin.on("error", reject);
+        }));
+    }
+    catch {
+        return finish([encodeObject({ recorded: "nothing - stdin is not a hook payload" })], undefined);
+    }
+    if (!isRecord(payload) || typeof payload.transcript_path !== "string")
+        return finish([encodeObject({ recorded: "nothing - payload has no transcript_path" })], undefined);
+    let summary;
+    try {
+        summary = await summarizeTranscript(payload.transcript_path);
+    }
+    catch {
+        return finish([encodeObject({ recorded: "nothing - transcript could not be read" })], undefined);
+    }
+    if (!summary)
+        return finish([
+            encodeObject({
+                recorded: "nothing - no argocd-axi commands this session",
+            }),
+        ], undefined);
+    const cwd = typeof payload.cwd === "string" ? payload.cwd : process.cwd();
+    try {
+        if (!(await recordSession(directory(cwd), summary)))
+            return finish([encodeObject({ recorded: "nothing - session log is busy" })], undefined);
+    }
+    catch {
+        return finish([
+            encodeObject({
+                recorded: "nothing - session log could not be written",
+            }),
+        ], undefined);
+    }
+    return finish([encodeObject({ recorded: sessionText(summary) })], undefined);
+}

package/dist/src/commands/ctx.js

@@ -150,12 +150,15 @@ const WRITABLE_ADD_SPEC = {
     positionals: [
         {
             name: "context",
-            required: true,
+            required: false,
             description: "Configured Argo CD context",
         },
     ],
     flags: [],
-    examples: ["argocd-axi ctx writable add staging"],
+    examples: [
+        "argocd-axi ctx writable add",
+        "argocd-axi ctx writable add staging",
+    ],
 };
 const WRITABLE_REMOVE_SPEC = {
     path: "ctx writable remove",
@@ -177,44 +180,92 @@ const WRITABLE_LIST_SPEC = {
     flags: [],
     examples: ["argocd-axi ctx writable list"],
 };
+export async function readConfirmation(input, output, prompt) {
+    const rl = createInterface({ input, output });
+    const closed = new Promise((resolve) => rl.once("close", () => resolve("")));
+    try {
+        return await Promise.race([rl.question(prompt), closed]);
+    }
+    finally {
+        rl.close();
+    }
+}
+export async function confirmWritableContext(name, server, input, output) {
+    const answer = await readConfirmation(input, output, `Allow argocd-axi to sync, rollback, refresh, and terminate operations on context ${name} (${server})? [y/N] `);
+    return /^y(?:es)?$/i.test(answer.trim());
+}
+export async function contextDetails(contexts, lookup = async (name) => (await argocdJson("account get-user-info", ["-o", "json"], { context: name, timeoutMs: 1_500 })).username) {
+    const result = [];
+    for (let offset = 0; offset < contexts.length; offset += 3) {
+        const batch = await Promise.all(contexts.slice(offset, offset + 3).map(async (context) => ({
+            ...context,
+            username: (await lookup(context.name).catch(() => undefined)) ?? "unknown",
+        })));
+        result.push(...batch);
+    }
+    return result;
+}
+export function addWritableContextIfConfirmed(name, confirmed) {
+    return confirmed ? addWritableContext(name) : false;
+}
+export async function chooseContext(contexts, writable, input, output) {
+    output.write(contexts
+        .map((context, index) => `${index + 1}. ${context.name} - ${context.server} - ${context.username}${writable.includes(context.name) ? " (already writable)" : ""}`)
+        .join("\n") + "\n");
+    const selected = await readConfirmation(input, output, "Select a context by number: ");
+    const index = Number(selected);
+    const context = Number.isInteger(index) && index >= 1 ? contexts[index - 1] : undefined;
+    if (!context)
+        throw axiError("invalid context selection; no changes made", CODES.REFUSED);
+    return context.name;
+}
 async function writableAdd(args) {
     const parsed = parseArgs(WRITABLE_ADD_SPEC, args);
-    const name = validateContextName(parsed.positionals[0]);
+    if (!process.stdin.isTTY || !process.stdout.isTTY)
+        throw axiError("writable context changes require an interactive terminal; run this command in a terminal", CODES.REFUSED);
     const listing = await listContexts();
     if (listing.notInstalled)
         throw listing.notInstalled;
     if (listing.unavailable) {
         throw axiError(`cannot list Argo CD contexts: ${listing.unavailable}`, CODES.NO_CONTEXT, LOGIN_HELP);
     }
-    const match = listing.contexts.find((context) => context.name === name);
+    const writable = loadConfig().config.writableContexts;
+    let name = parsed.positionals[0]
+        ? validateContextName(parsed.positionals[0])
+        : undefined;
+    let username;
+    if (name === undefined) {
+        if (listing.contexts.length === 0)
+            throw axiError("no configured Argo CD contexts to select", CODES.NO_CONTEXT);
+        const details = await contextDetails(listing.contexts);
+        name = await chooseContext(details, writable, process.stdin, process.stdout);
+        username = details.find((context) => context.name === name)?.username;
+    }
+    const selectedName = name;
+    const match = listing.contexts.find((context) => context.name === selectedName);
     if (!match)
         throw axiError(`Argo CD context ${name} is not configured`, CODES.CONTEXT_NOT_FOUND);
-    if (loadConfig().config.writableContexts.includes(name))
+    if (writable.includes(selectedName))
         return finish([
             encodeObject({
-                writableContext: `${name} is already writable (no change)`,
+                writableContext: `${selectedName} is already writable (no change)`,
+            }),
+        ], undefined);
+    username ??= (await argocdJson("account get-user-info", ["-o", "json"], { context: selectedName })).username;
+    process.stdout.write(`Context: ${selectedName}\nServer: ${match.server}\nUser: ${username ?? "unknown"}\n`);
+    const confirmed = await confirmWritableContext(selectedName, match.server, process.stdin, process.stdout);
+    const changed = addWritableContextIfConfirmed(selectedName, confirmed);
+    if (!confirmed)
+        return finish([
+            encodeObject({
+                writableContext: `${selectedName} remains read-only (no change)`,
             }),
         ], undefined);
-    if (!process.stdin.isTTY || !process.stdout.isTTY)
-        throw axiError("writable context changes require an interactive terminal", CODES.REFUSED);
-    const info = await argocdJson("account get-user-info", ["-o", "json"], { context: name });
-    process.stdout.write(`Context: ${name}\nServer: ${match.server}\nUser: ${info.username ?? "unknown"}\nType ${name} to allow writes: `);
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    let answer;
-    try {
-        answer = await rl.question("");
-    }
-    finally {
-        rl.close();
-    }
-    if (answer !== name)
-        throw axiError("confirmation did not match; no changes made", CODES.REFUSED);
-    const changed = addWritableContext(name);
     return finish([
         encodeObject({
             writableContext: changed
-                ? `added ${name}`
-                : `${name} is already writable (no change)`,
+                ? `added ${selectedName}`
+                : `${selectedName} is already writable (no change)`,
         }),
     ], undefined);
 }

package/dist/src/commands/setup.js

@@ -6,14 +6,16 @@ import { parseArgs, renderCommandHelp } from "../args.js";
 import { CODES, axiError, validationError } from "../errors.js";
 import { encodeObject } from "../toon.js";
 import { finish } from "./common.js";
+import { installSessionEndHook, sessionEndHookStatus, uninstallSessionEndHook, } from "../session-hook.js";
 export const SETUP_HOOKS_SPEC = {
     path: "setup hooks",
-    summary: "Install or repair SessionStart hooks for Claude Code, Codex and OpenCode",
+    summary: "Install, inspect or remove agent session hooks",
     positionals: [],
     flags: [],
     examples: ["argocd-axi setup hooks"],
     notes: [
         "The hook runs `argocd-axi-ctx`, which is local only: current context, server and CLI version, with no network call, no SSO refresh and no credential read",
+        "SessionEnd records command names, counts and the most-used --context value only; setup status and setup uninstall inspect or remove that Claude Code hook",
         "Intended for global installs; repeated runs are no-ops",
     ],
 };
@@ -29,16 +31,31 @@ function ctxEntrypoint() {
         : join(here, "..", "..", "bin", "argocd-axi-ctx.ts");
 }
 export async function setupCommand(args) {
-    if (args[0] !== "hooks") {
+    const action = args[0];
+    if (action !== "hooks" && action !== "status" && action !== "uninstall") {
         if (args.includes("--help"))
             return renderCommandHelp(SETUP_HOOKS_SPEC);
         throw validationError("unknown setup action", [
-            "Run `argocd-axi setup hooks`",
+            "Run `argocd-axi setup hooks`, `argocd-axi setup status` or `argocd-axi setup uninstall`",
         ]);
     }
     if (args.includes("--help"))
         return renderCommandHelp(SETUP_HOOKS_SPEC);
     parseArgs(SETUP_HOOKS_SPEC, args.slice(1));
+    if (action === "status")
+        return finish([
+            encodeObject({
+                sessionEnd: sessionEndHookStatus() ? "installed" : "not installed",
+            }),
+        ], undefined);
+    if (action === "uninstall")
+        return finish([
+            encodeObject({
+                sessionEnd: uninstallSessionEndHook()
+                    ? "removed"
+                    : "not installed (no-op)",
+            }),
+        ], undefined);
     // An npx (or pnpm dlx, bunx) run lives in a cache that later sessions may
     // not have on PATH or may have evicted, so a hook pointing at it would
     // silently stop working. Require a persistent install instead.
@@ -56,6 +73,12 @@ export async function setupCommand(args) {
         distEntrypoints: ["dist/bin/argocd-axi-ctx.js"],
         onError: (message) => errors.push(message),
     });
+    try {
+        installSessionEndHook();
+    }
+    catch (error) {
+        errors.push(error instanceof Error ? error.message : String(error));
+    }
     if (errors.length > 0) {
         throw axiError(`hook installation reported problems: ${errors.join("; ")}`, CODES.UPSTREAM_ERROR, ["Re-run `argocd-axi setup hooks` after fixing the paths above"]);
     }

package/dist/src/help.js

@@ -4,6 +4,8 @@ export const DESCRIPTION = "Argo CD for agents: read operations plus opt-in writ
 export const COMMAND_LINES = [
     "(no command): live overview - context, server, user, apps needing attention with the reason, running operations",
     "ctx [--context <c>]: current context, server and CLI version, local only (what the session hook prints)",
+    "context: last session's argocd-axi command summary for this directory",
+    "context end: record the current Claude Code session summary (SessionEnd hook)",
     "ctx use <context>: switch the argocd CLI's current context (local config only)",
     "auth guide [--context <c>]: offline human login and agent token setup instructions",
     "whoami: user, issuer and groups of the current credential",
@@ -16,15 +18,17 @@ export const COMMAND_LINES = [
     "apps rollback <app> <history-id> [--confirm] [--timeout <s>]: preview revision, then optionally roll back",
     "apps refresh <app> [--hard] [--confirm]: preview, then optionally refresh one app",
     "apps terminate-op <app> [--confirm] [--timeout <s>]: preview, then optionally stop a running operation",
+    "apps auto-sync <app> <on|off> [--confirm]: preview, then optionally change automated sync",
+    "apps actions run <app> <action> --kind <kind> --name <resource> [--confirm]: preview, then optionally run one listed resource action",
     "apps history <app>: deployments, newest first",
     "apps manifests <app> [--source git|live] [--kind <k>] [--full]: rendered manifests, Secret data redacted",
     "apps logs <app> [--kind --name --tail --since --filter -p]: recent pod logs, never follows",
     "apps wait <app> [--sync --health --operation] [--timeout <s>]: bounded wait, returns the state either way",
-    "apps actions <app>: resource actions available (listing only)",
+    "apps actions <app>: list available resource actions",
     "projects | projects view <p> | projects windows <p>: projects, their rules, and whether sync is allowed now",
     "appsets | appsets view <name> | appsets generate <file>: ApplicationSets and what a spec would generate",
     "repos | clusters: repositories and destination clusters with connection status",
-    "setup hooks: install the SessionStart hook (runs the offline ctx view)",
+    "setup hooks | status | uninstall: manage the Claude Code SessionEnd memory hook; setup hooks also installs SessionStart hooks",
 ];
 export const TOP_HELP = `${renderBlocks([
     "usage: argocd-axi <command> [args] [flags]",
@@ -42,7 +46,7 @@ export const TOP_HELP = `${renderBlocks([
         "argocd-axi apps diff payments-api",
     ]),
     renderHelpBlock("notes", [
-        "Read-only except opt-in writes on writable contexts: apps sync, rollback, refresh and terminate-op require --confirm; sync never prunes unless --prune is given",
+        "Writes on writable contexts require --confirm: apps sync, rollback, refresh, terminate-op, auto-sync and actions run; sync never prunes unless --prune is given",
         "Output is TOON on stdout, errors included; exit 0 = success (an unhealthy app is data, not an error), 1 = error, 2 = usage",
         "Secret-looking values are redacted and counted; no flag reveals them",
         "Uses your existing argocd CLI session or ARGOCD_AUTH_TOKEN; never logs in, never reads the argocd config file",

package/dist/src/registry.js

@@ -50,6 +50,18 @@ export const OPERATIONS = {
         network: true,
         timeoutMs: READ_TIMEOUT_MS,
     },
+    "app actions run": {
+        argv: ["app", "actions", "run"],
+        tier: "write",
+        network: true,
+        timeoutMs: READ_TIMEOUT_MS,
+    },
+    "app set": {
+        argv: ["app", "set"],
+        tier: "write",
+        network: true,
+        timeoutMs: READ_TIMEOUT_MS,
+    },
     "app resources": {
         argv: ["app", "resources"],
         tier: "read",
@@ -190,20 +202,11 @@ export const FORBIDDEN_ARGS = [
     "--port-forward",
     "--prompts-enabled",
 ];
-const PLANNED = "planned for the write tier, behind preview-by-default and the writable-contexts allowlist; not in v1 (see ROADMAP.md)";
 /**
  * Writes the design names for the next tier (decision A2): known verbs that
  * answer REFUSED with the raw argocd route a human can take today.
  */
-export const PLANNED_WRITES = {
-    "apps action": {
-        reason: `running resource actions is ${PLANNED}`,
-        help: [
-            "List available actions with `argocd-axi apps actions <app>`",
-            "A human can run one with the raw CLI: `argocd app actions run <app> <action> --kind <kind>`",
-        ],
-    },
-};
+export const PLANNED_WRITES = {};
 const HUMAN_ONLY = "A human runs this with the raw argocd CLI";
 /**
  * Known verbs that argocd-axi never wraps (design decisions S7 and A2), each

package/dist/src/session-hook.js

@@ -0,0 +1,117 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { homedir } from "node:os";
+import { join } from "node:path";
+const path = () => join(process.env.CLAUDE_CONFIG_DIR || join(homedir(), ".claude"), "settings.json");
+const command = "argocd-axi context end";
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function settings() {
+    const file = path();
+    if (!existsSync(file))
+        return {};
+    const value = JSON.parse(readFileSync(file, "utf8"));
+    if (!isRecord(value))
+        throw new Error(`${file} is not a JSON object`);
+    return value;
+}
+function writeSettings(value) {
+    const file = path();
+    mkdirSync(join(file, ".."), { recursive: true });
+    const mode = existsSync(file) ? statSync(file).mode & 0o777 : 0o600;
+    const temporary = `${file}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode });
+        chmodSync(temporary, mode);
+        renameSync(temporary, file);
+    }
+    catch (error) {
+        try {
+            unlinkSync(temporary);
+        }
+        catch {
+            /* No temporary file to remove. */
+        }
+        throw error;
+    }
+}
+export function installSessionEndHook() {
+    const value = settings();
+    const hooks = isRecord(value.hooks) ? value.hooks : {};
+    value.hooks = hooks;
+    const groups = Array.isArray(hooks.SessionEnd) ? hooks.SessionEnd : [];
+    const next = [];
+    let installed = false;
+    for (const group of groups) {
+        if (!isRecord(group) || !Array.isArray(group.hooks)) {
+            next.push(group);
+            continue;
+        }
+        const kept = group.hooks.filter((entry) => {
+            const ours = isRecord(entry) &&
+                (entry.command === command ||
+                    (typeof entry.command === "string" &&
+                        entry.command.endsWith("/argocd-axi context end")));
+            if (ours && !installed) {
+                installed = true;
+                return false;
+            }
+            return !ours;
+        });
+        if (kept.length)
+            next.push({ ...group, hooks: kept });
+    }
+    next.push({
+        matcher: "",
+        hooks: [{ type: "command", command, timeout: 30 }],
+    });
+    hooks.SessionEnd = next;
+    writeSettings(value);
+}
+export function sessionEndHookStatus() {
+    try {
+        const hooks = settings().hooks;
+        const groups = isRecord(hooks) ? hooks.SessionEnd : undefined;
+        return (Array.isArray(groups) &&
+            groups.some((group) => isRecord(group) &&
+                Array.isArray(group.hooks) &&
+                group.hooks.some((entry) => isRecord(entry) &&
+                    (entry.command === command ||
+                        (typeof entry.command === "string" &&
+                            entry.command.endsWith("/argocd-axi context end"))))));
+    }
+    catch {
+        return false;
+    }
+}
+export function uninstallSessionEndHook() {
+    const value = settings();
+    const hooks = value.hooks;
+    if (!isRecord(hooks) || !Array.isArray(hooks.SessionEnd))
+        return false;
+    let removed = false;
+    const next = hooks.SessionEnd.flatMap((group) => {
+        if (!isRecord(group) || !Array.isArray(group.hooks))
+            return [group];
+        const entries = group.hooks.filter((entry) => {
+            const ours = isRecord(entry) &&
+                (entry.command === command ||
+                    (typeof entry.command === "string" &&
+                        entry.command.endsWith("/argocd-axi context end")));
+            removed ||= ours;
+            return !ours;
+        });
+        return entries.length ? [{ ...group, hooks: entries }] : [];
+    });
+    if (!removed)
+        return false;
+    if (next.length)
+        hooks.SessionEnd = next;
+    else
+        delete hooks.SessionEnd;
+    if (Object.keys(hooks).length === 0)
+        delete value.hooks;
+    writeSettings(value);
+    return true;
+}

package/dist/src/sessionlog.js

@@ -0,0 +1,347 @@
+import { chmodSync, closeSync, createReadStream, mkdirSync, openSync, readdirSync, readFileSync, renameSync, rmdirSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { dirname, join } from "node:path";
+import { createInterface } from "node:readline";
+import { configPath } from "./config.js";
+const MAX_DIRECTORIES = 100;
+const LOCK_WAIT_MS = 2_000;
+const STALE_LOCK_MS = 30_000;
+const MAX_TRANSCRIPT_BYTES = 256 * 1024 * 1024;
+const TOOL = "argocd-axi";
+const COMMANDS = new Set([
+    "apps",
+    "projects",
+    "appsets",
+    "repos",
+    "clusters",
+    "ctx",
+    "auth",
+    "whoami",
+    "can-i",
+    "setup",
+    "context",
+]);
+const CONTEXTS = new Set([
+    "apps",
+    "projects",
+    "appsets",
+    "repos",
+    "clusters",
+    "ctx",
+    "auth",
+    "whoami",
+    "can-i",
+]);
+/** Split shell words without retaining anything in the persisted result. */
+function words(command) {
+    const result = [];
+    let token = "";
+    let quote = "";
+    let started = false;
+    const end = () => {
+        if (started)
+            result.push(token);
+        token = "";
+        started = false;
+    };
+    for (let i = 0; i < command.length; i++) {
+        const c = command[i];
+        if (quote) {
+            if (c === quote)
+                quote = "";
+            else if (c === "\\" && quote === '"' && i + 1 < command.length)
+                token += command[++i];
+            else
+                token += c;
+        }
+        else if (c === "'" || c === '"') {
+            quote = c;
+            started = true;
+        }
+        else if (c === "\\" && i + 1 < command.length) {
+            token += command[++i];
+            started = true;
+        }
+        else if (/\s|[;|&()`]/.test(c))
+            end();
+        else {
+            token += c;
+            started = true;
+        }
+    }
+    end();
+    return result;
+}
+function commandParts(line) {
+    const parts = [];
+    let quote = "";
+    let start = 0;
+    for (let i = 0; i < line.length; i++) {
+        const c = line[i];
+        if (quote) {
+            if (c === "\\" && quote === '"')
+                i++;
+            else if (c === quote)
+                quote = "";
+        }
+        else if (c === "\\")
+            i++;
+        else if (c === "'" || c === '"')
+            quote = c;
+        else if (/[;|&\n]/.test(c)) {
+            parts.push(line.slice(start, i));
+            start = i + 1;
+        }
+    }
+    parts.push(line.slice(start));
+    return parts;
+}
+function commandCalls(line) {
+    const calls = [];
+    for (const part of commandParts(line)) {
+        const args = words(part);
+        const index = args.findIndex((word) => word.split("/").pop()?.replace(/\.js$/, "") === TOOL);
+        if (index < 0)
+            continue;
+        const argsAfter = args.slice(index + 1);
+        const command = argsAfter.find((arg) => !arg.startsWith("-"));
+        if (!command || !COMMANDS.has(command))
+            continue;
+        const contextArg = argsAfter.findIndex((arg) => arg === "--context");
+        const contextValue = contextArg >= 0
+            ? argsAfter[contextArg + 1]
+            : argsAfter.find((arg) => arg.startsWith("--context="))?.slice(10);
+        calls.push({
+            command,
+            ...(contextValue && CONTEXTS.has(command.split(" ")[0])
+                ? { context: contextValue }
+                : {}),
+        });
+    }
+    return calls;
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function* toolCommands(value) {
+    if (Array.isArray(value)) {
+        for (const item of value)
+            yield* toolCommands(item);
+        return;
+    }
+    if (!isRecord(value))
+        return;
+    if (value.type === "tool_use") {
+        if (isRecord(value.input) && typeof value.input.command === "string")
+            yield value.input.command;
+        return;
+    }
+    for (const key of ["message", "content"])
+        if (key in value)
+            yield* toolCommands(value[key]);
+}
+export async function summarizeTranscript(path) {
+    if (statSync(path).size > MAX_TRANSCRIPT_BYTES)
+        return undefined;
+    const counts = {};
+    const contexts = [];
+    const lines = createInterface({
+        input: createReadStream(path, { encoding: "utf8" }),
+        crlfDelay: Infinity,
+    });
+    for await (const line of lines) {
+        if (!line.includes(TOOL))
+            continue;
+        let entry;
+        try {
+            entry = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        for (const commandLine of toolCommands(entry))
+            for (const call of commandCalls(commandLine)) {
+                counts[call.command] = (counts[call.command] ?? 0) + 1;
+                if (call.context)
+                    contexts.push(call.context);
+            }
+    }
+    if (Object.keys(counts).length === 0)
+        return undefined;
+    const contextCounts = new Map();
+    for (const context of contexts)
+        contextCounts.set(context, (contextCounts.get(context) ?? 0) + 1);
+    const context = [...contextCounts].sort((a, b) => b[1] - a[1])[0]?.[0];
+    return { commands: counts, ...(context ? { context } : {}) };
+}
+const sessionsPath = () => join(dirname(configPath()), "sessions.json");
+function isSessionSummary(value) {
+    return (isRecord(value) &&
+        isRecord(value.commands) &&
+        Object.entries(value.commands).every(([name, count]) => COMMANDS.has(name) &&
+            typeof count === "number" &&
+            Number.isSafeInteger(count) &&
+            count > 0) &&
+        (value.context === undefined ||
+            (typeof value.context === "string" && !/[\r\n]/.test(value.context))));
+}
+function readSessions() {
+    try {
+        const parsed = JSON.parse(readFileSync(sessionsPath(), "utf8"));
+        if (isRecord(parsed) && isRecord(parsed.directories))
+            return Object.fromEntries(Object.entries(parsed.directories).filter((entry) => isSessionSummary(entry[1])));
+    }
+    catch {
+        /* Missing or corrupt memory is optional. */
+    }
+    return {};
+}
+function processAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return errorCode(error) !== "ESRCH";
+    }
+}
+function lockPid(token) {
+    const pid = Number(token.trim().split(/\s+/, 1)[0]);
+    return Number.isSafeInteger(pid) && pid > 0 ? pid : undefined;
+}
+function errorCode(error) {
+    return error &&
+        typeof error === "object" &&
+        "code" in error &&
+        typeof error.code === "string"
+        ? error.code
+        : undefined;
+}
+async function acquireLock(path) {
+    const lockPath = `${path}.lock`;
+    const deadline = Date.now() + LOCK_WAIT_MS;
+    while (Date.now() < deadline) {
+        try {
+            mkdirSync(lockPath, 0o700);
+            const ownerPath = join(lockPath, `owner-${randomUUID()}`);
+            const token = `${process.pid} ${randomUUID()}\n`;
+            let fd;
+            try {
+                fd = openSync(ownerPath, "wx", 0o600);
+            }
+            catch {
+                rmdirSync(lockPath);
+                return undefined;
+            }
+            try {
+                writeFileSync(fd, token);
+                return { fd, path: ownerPath, token };
+            }
+            catch {
+                closeSync(fd);
+                try {
+                    unlinkSync(ownerPath);
+                    rmdirSync(lockPath);
+                }
+                catch {
+                    /* The lock may already be gone. */
+                }
+                return undefined;
+            }
+        }
+        catch (error) {
+            if (errorCode(error) !== "EEXIST")
+                return undefined;
+            if (reclaimStaleLock(lockPath))
+                continue;
+            await new Promise((resolve) => setTimeout(resolve, 25));
+        }
+    }
+    return undefined;
+}
+function reclaimStaleLock(lockPath) {
+    try {
+        const owners = readdirSync(lockPath);
+        if (owners.length === 0) {
+            if (Date.now() - statSync(lockPath).mtimeMs <= STALE_LOCK_MS)
+                return false;
+            rmdirSync(lockPath);
+            return true;
+        }
+        for (const ownerFile of owners) {
+            const ownerPath = join(lockPath, ownerFile);
+            const info = statSync(ownerPath);
+            const owner = readFileSync(ownerPath, "utf8");
+            const pid = lockPid(owner);
+            if (Date.now() - info.mtimeMs <= STALE_LOCK_MS ||
+                pid === undefined ||
+                processAlive(pid) ||
+                readFileSync(ownerPath, "utf8") !== owner)
+                continue;
+            unlinkSync(ownerPath);
+            rmdirSync(lockPath);
+            return true;
+        }
+    }
+    catch {
+        return false;
+    }
+    return false;
+}
+export function releaseSessionLock(lock) {
+    closeSync(lock.fd);
+    try {
+        if (readFileSync(lock.path, "utf8") === lock.token) {
+            unlinkSync(lock.path);
+            rmdirSync(dirname(lock.path));
+        }
+    }
+    catch {
+        /* A successor owns the lock, or it is already gone. */
+    }
+}
+export async function recordSession(directory, summary) {
+    const path = sessionsPath();
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const lock = await acquireLock(path);
+    if (lock === undefined)
+        return false;
+    try {
+        const directories = readSessions();
+        delete directories[directory];
+        directories[directory] = summary;
+        for (const old of Object.keys(directories).slice(0, Math.max(0, Object.keys(directories).length - MAX_DIRECTORIES)))
+            delete directories[old];
+        const temporary = `${path}.${randomUUID()}.tmp`;
+        try {
+            writeFileSync(temporary, `${JSON.stringify({ directories }, null, 2)}\n`, {
+                mode: 0o600,
+            });
+            chmodSync(temporary, 0o600);
+            renameSync(temporary, path);
+        }
+        catch (error) {
+            try {
+                unlinkSync(temporary);
+            }
+            catch {
+                /* No temporary file to remove. */
+            }
+            throw error;
+        }
+        return true;
+    }
+    finally {
+        releaseSessionLock(lock);
+    }
+}
+export function lastSession(directory) {
+    return readSessions()[directory];
+}
+export function sessionText(summary) {
+    const commands = Object.entries(summary.commands)
+        .sort((a, b) => b[1] - a[1])
+        .map(([name, count]) => `${name} ${count}`)
+        .join("; ");
+    return `${commands}${summary.context ? ` - context ${JSON.stringify(summary.context)}` : ""}`;
+}

package/dist/src/skill.js

@@ -33,7 +33,7 @@ For anything argocd-axi does not cover, the raw \`argocd\` CLI is the fallback.
 
 ## Setup
 
-Run \`npx -y argocd-axi auth guide\` for offline instructions. A human operator logs in interactively with \`argocd login <server> --sso --grpc-web\`; agents and CI use \`ARGOCD_SERVER\` and \`ARGOCD_AUTH_TOKEN\` from a scoped account token. The user owns login; argocd-axi never logs in. Verify access with \`npx -y argocd-axi whoami\`. To enable writes on a context, a human runs \`argocd-axi ctx writable add <context>\` in a terminal and confirms the context name.
+Run \`npx -y argocd-axi auth guide\` for offline instructions. A human operator logs in interactively with \`argocd login <server> --sso --grpc-web\`; agents and CI use \`ARGOCD_SERVER\` and \`ARGOCD_AUTH_TOKEN\` from a scoped account token. The user owns login; argocd-axi never logs in. Verify access with \`npx -y argocd-axi whoami\`. See the README's writable-context instructions before enabling writes.
 
 ## Workflow
 

package/dist/src/version.js

@@ -1,3 +1,3 @@
 // Leaf module: node builtins only, so the bin fast path can answer
 // `--version` without loading the command graph.
-export const VERSION = "0.1.5"; // x-release-please-version
+export const VERSION = "0.1.7"; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "argocd-axi",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Agent-ergonomic Argo CD CLI with opt-in writes - AXI-compliant argocd wrapper with token-efficient TOON output",
   "type": "module",
   "license": "MIT",

package/skills/argocd-axi/SKILL.md

@@ -20,7 +20,7 @@ For anything argocd-axi does not cover, the raw `argocd` CLI is the fallback.
 
 ## Setup
 
-Run `npx -y argocd-axi auth guide` for offline instructions. A human operator logs in interactively with `argocd login <server> --sso --grpc-web`; agents and CI use `ARGOCD_SERVER` and `ARGOCD_AUTH_TOKEN` from a scoped account token. The user owns login; argocd-axi never logs in. Verify access with `npx -y argocd-axi whoami`. To enable writes on a context, a human runs `argocd-axi ctx writable add <context>` in a terminal and confirms the context name.
+Run `npx -y argocd-axi auth guide` for offline instructions. A human operator logs in interactively with `argocd login <server> --sso --grpc-web`; agents and CI use `ARGOCD_SERVER` and `ARGOCD_AUTH_TOKEN` from a scoped account token. The user owns login; argocd-axi never logs in. Verify access with `npx -y argocd-axi whoami`. See the README's writable-context instructions before enabling writes.
 
 ## Workflow
 
@@ -34,9 +34,11 @@ Run `npx -y argocd-axi auth guide` for offline instructions. A human operator lo
 ## Commands
 
 ```
-commands[23]:
+commands[27]:
   (no command): live overview - context, server, user, apps needing attention with the reason, running operations
   ctx [--context <c>]: current context, server and CLI version, local only (what the session hook prints)
+  context: last session's argocd-axi command summary for this directory
+  context end: record the current Claude Code session summary (SessionEnd hook)
   ctx use <context>: switch the argocd CLI's current context (local config only)
   auth guide [--context <c>]: offline human login and agent token setup instructions
   whoami: user, issuer and groups of the current credential
@@ -49,15 +51,17 @@ commands[23]:
   apps rollback <app> <history-id> [--confirm] [--timeout <s>]: preview revision, then optionally roll back
   apps refresh <app> [--hard] [--confirm]: preview, then optionally refresh one app
   apps terminate-op <app> [--confirm] [--timeout <s>]: preview, then optionally stop a running operation
+  apps auto-sync <app> <on|off> [--confirm]: preview, then optionally change automated sync
+  apps actions run <app> <action> --kind <kind> --name <resource> [--confirm]: preview, then optionally run one listed resource action
   apps history <app>: deployments, newest first
   apps manifests <app> [--source git|live] [--kind <k>] [--full]: rendered manifests, Secret data redacted
   apps logs <app> [--kind --name --tail --since --filter -p]: recent pod logs, never follows
   apps wait <app> [--sync --health --operation] [--timeout <s>]: bounded wait, returns the state either way
-  apps actions <app>: resource actions available (listing only)
+  apps actions <app>: list available resource actions
   projects | projects view <p> | projects windows <p>: projects, their rules, and whether sync is allowed now
   appsets | appsets view <name> | appsets generate <file>: ApplicationSets and what a spec would generate
   repos | clusters: repositories and destination clusters with connection status
-  setup hooks: install the SessionStart hook (runs the offline ctx view)
+  setup hooks | status | uninstall: manage the Claude Code SessionEnd memory hook; setup hooks also installs SessionStart hooks
 ```
 
 Run `npx -y argocd-axi --help` for global flags, or `npx -y argocd-axi <command> --help` for per-command usage.