failproofai 1.0.12-beta.2 → 1.0.12

package/.next/standalone/fp-cloud-cli/fp_cli/commands/account_cmds.py

@@ -0,0 +1,171 @@
+"""Additive account, billing and integration commands."""
+
+from __future__ import annotations
+
+from typing import List, Optional
+
+import typer
+
+from .. import _click_compat as click, client as api, permissions
+from .._context import GLOBALS_EPILOG, require_auth
+from . import _cloud, _write
+
+
+def request(ctx, method, path, body=None, params=None):
+    if method != "GET":
+        _write.confirm(ctx.obj, f"{method} {path}", assume_yes=False, destructive=method == "DELETE")
+    result = api.cloud_request(require_auth(ctx.obj), method, path, body=body, params=params)
+    if method != "GET":
+        _write.record_action("cloud_resource_changed", resource=path.split("/")[2], success=True, destructive=method == "DELETE")
+    _cloud.emit(ctx.obj, result, "Cloud", view=path, method=method, body=body, params=params)
+
+
+def roles_list(ctx: typer.Context) -> None:
+    """List named permission sets. Needs users:read."""
+    request(ctx, "GET", "/api/permission-sets")
+
+
+def roles_show(ctx: typer.Context, name: str = typer.Argument(...)) -> None:
+    """Show one permission set by name."""
+    request(ctx, "GET", f"/api/permission-sets/{name}")
+
+
+def grants(values):
+    if not values:
+        return []
+    try:
+        return permissions.parse_permission_tokens(values)
+    except permissions.PermissionTokenError as exc:
+        raise click.UsageError(str(exc)) from exc
+
+
+def roles_create(ctx: typer.Context, name: str = typer.Option(..., "--name"),
+                 permission: Optional[List[str]] = typer.Option(None, "--permission", "--add"),
+                 description: Optional[str] = typer.Option(None, "--description"),
+                 file: Optional[str] = typer.Option(None, "--file")) -> None:
+    """Create a custom permission set. Needs settings:write."""
+    if not 1 <= len(name.strip()) <= 64:
+        raise click.UsageError("Role name must be 1–64 characters")
+    body = _write.read_body(ctx.obj, file, {"permissions": grants(permission) if permission is not None else None, "description": description})
+    body["name"] = name.strip()
+    body.setdefault("permissions", [])
+    if not isinstance(body["permissions"], list):
+        raise click.UsageError("permissions must be an array")
+    body["permissions"] = grants(body["permissions"])
+    request(ctx, "POST", "/api/permission-sets", body)
+
+
+def roles_update(ctx: typer.Context, name: str = typer.Argument(...),
+                 permission: Optional[List[str]] = typer.Option(None, "--permission", help="Full replacement grants."),
+                 add: Optional[List[str]] = typer.Option(None, "--add"),
+                 remove: Optional[List[str]] = typer.Option(None, "--remove"),
+                 description: Optional[str] = typer.Option(None, "--description"),
+                 file: Optional[str] = typer.Option(None, "--file")) -> None:
+    """Update a custom set; affected members receive the new grants."""
+    if permission is not None and (add or remove):
+        raise click.UsageError("Use --permission or --add/--remove, not both")
+    added, removed = grants(add or []), grants(remove or [])
+    body = _write.read_body(ctx.obj, file, {"permissions": grants(permission) if permission is not None else None, "description": description})
+    if file and (add or remove):
+        raise click.UsageError("Use --file or discrete flags")
+    if not body and not added and not removed:
+        raise click.UsageError("Pass --permission, --add, --remove, --description or --file")
+    current = api.cloud_request(require_auth(ctx.obj), "GET", f"/api/permission-sets/{name}")
+    if current.get("is_builtin"):
+        raise click.UsageError("Builtin permission sets are immutable")
+    body.setdefault("permissions", list(dict.fromkeys([v for v in current.get("permissions", []) if v not in removed] + added)))
+    body["permissions"] = grants(body["permissions"])
+    body.setdefault("description", current.get("description"))
+    request(ctx, "PUT", f"/api/permission-sets/{name}", body)
+
+
+def roles_delete(ctx: typer.Context, name: str = typer.Argument(...)) -> None:
+    """Delete a custom permission set; members keep materialized permissions."""
+    request(ctx, "DELETE", f"/api/permission-sets/{name}")
+
+
+def plan(ctx: typer.Context) -> None:
+    """Show current offers and team-trial state."""
+    if ctx.invoked_subcommand:
+        return
+    _cloud.session_only(ctx.obj, "plan")
+    cctx = require_auth(ctx.obj)
+    data = {"offers": api.cloud_request(cctx, "GET", "/api/offers/me"),
+            "team_trial": api.cloud_request(cctx, "GET", "/api/team-trial/me")}
+    _cloud.emit(ctx.obj, data, "Plan")
+
+
+def claim(ctx: typer.Context, offer: str = typer.Argument(...)) -> None:
+    """Claim a named offer."""
+    _cloud.session_only(ctx.obj, "plan claim")
+    request(ctx, "POST", "/api/offers/claim", {"offer_key": offer})
+
+
+def otel_status(ctx: typer.Context) -> None:
+    """Show Cloud OTEL ingest status."""
+    request(ctx, "GET", "/api/otel/status")
+
+
+def otel_enable(ctx: typer.Context) -> None:
+    """Enable OTEL ingestion for the Cloud org."""
+    request(ctx, "PUT", "/api/settings/otel.ingest_enabled", {"value": True})
+
+
+def otel_disable(ctx: typer.Context) -> None:
+    """Disable OTEL ingestion for the Cloud org."""
+    request(ctx, "PUT", "/api/settings/otel.ingest_enabled", {"value": False})
+
+
+def slack_status(ctx: typer.Context) -> None:
+    """Show Slack connection status (session only)."""
+    _cloud.session_only(ctx.obj, "slack status")
+    request(ctx, "GET", "/api/integrations/slack")
+
+
+def slack_disconnect(ctx: typer.Context) -> None:
+    """Disconnect Slack (session only)."""
+    _cloud.session_only(ctx.obj, "slack disconnect")
+    request(ctx, "DELETE", "/api/integrations/slack")
+
+
+def context_list(ctx: typer.Context) -> None:
+    """List model context-window overrides."""
+    request(ctx, "GET", "/api/settings/model-context-windows")
+
+
+def context_set(ctx: typer.Context, model: str = typer.Argument(...),
+                tokens: int = typer.Argument(...)) -> None:
+    """Set an override; zero means unknown."""
+    if not 1 <= len(model.strip()) <= 256 or not 0 <= tokens <= 1_000_000:
+        raise click.UsageError("Model must be 1–256 characters; tokens must be 0–1000000")
+    request(ctx, "PUT", "/api/settings/model-context-windows", {"model_id": model.strip(), "context_window": tokens})
+
+
+def context_delete(ctx: typer.Context, model: str = typer.Argument(...)) -> None:
+    """Remove a model override."""
+    if not model.strip():
+        raise click.UsageError("Model cannot be empty")
+    request(ctx, "DELETE", "/api/settings/model-context-windows", params={"model": model})
+
+
+def register_context_windows(settings_app):
+    group = typer.Typer(no_args_is_help=True, context_settings={"help_option_names": ["-h", "--help"]})
+    for name, fn in (("list", context_list), ("set", context_set), ("delete", context_delete)):
+        group.command(name, epilog=GLOBALS_EPILOG)(fn)
+    settings_app.add_typer(group, name="context-windows")
+
+
+def register(app):
+    for name, help_text, commands in (
+        ("roles", "Manage permission sets.", (("list", roles_list), ("show", roles_show), ("create", roles_create), ("update", roles_update), ("delete", roles_delete))),
+        ("otel", "Control Cloud OTEL ingest.", (("status", otel_status), ("enable", otel_enable), ("disable", otel_disable))),
+        ("slack", "Manage the Slack integration (session only).", (("status", slack_status), ("disconnect", slack_disconnect))),
+    ):
+        group = typer.Typer(no_args_is_help=True, help=help_text, context_settings={"help_option_names": ["-h", "--help"]})
+        for command, fn in commands:
+            group.command(command, epilog=GLOBALS_EPILOG)(fn)
+        app.add_typer(group, name=name)
+    group = typer.Typer(invoke_without_command=True, context_settings={"help_option_names": ["-h", "--help"]})
+    group.callback(epilog=GLOBALS_EPILOG)(plan)
+    group.command("claim", epilog=GLOBALS_EPILOG)(claim)
+    app.add_typer(group, name="plan")

package/.next/standalone/fp-cloud-cli/fp_cli/commands/agent_cmds.py

@@ -21,10 +21,10 @@ import typer
 
 from .. import _click_compat as click  # the Click Typer is running; see _click_compat
 from .. import client as api
-from .. import output
+from .. import cloud_output, output
 from .._context import GLOBALS_EPILOG, AppState, deny_in_key_mode, require_auth
-from ..errors import NotFoundError
-from . import _write
+from ..errors import FpCliError, NetworkError, NotFoundError
+from . import _cloud, _write
 
 # The assistant has NO server route at all: `/agent/chat` and `/agent/health` are
 # implemented by the dashboard itself, and the conversation routes are per-human
@@ -279,6 +279,7 @@ def agent_ask(
     chat: Optional[str] = typer.Option(None, "--chat", help="Continue this chat — its short id from `agent chats` (a prefix) or full id. Omit to start a NEW chat (its id is printed)."),
     model: Optional[str] = typer.Option(None, "--model", help="Model to use (see `agent models`)."),
     page_context: Optional[str] = typer.Option(None, "--page-context", help="Optional context string to ground the answer."),
+    approve: bool = typer.Option(False, "--approve", help="Explicitly approve requested writes. Without this, scripts/--json decline."),
 ) -> None:
     """Ask the assistant a question — every ask is saved to a chat.
 
@@ -301,7 +302,7 @@ def agent_ask(
     * `fp agent ask "summarize p95 latency" --model claude-opus-4-7`
     """
     state: AppState = ctx.obj
-    deny_in_key_mode(state, "agent", _KEY_MODE_REASON)
+    _cloud.session_only(state, "agent ask")
     if not message:
         message = sys.stdin.read().strip() if not sys.stdin.isatty() else typer.prompt("question", err=True)
     if not message:
@@ -323,11 +324,49 @@ def agent_ask(
     ]
     thread.append({"role": "user", "content": {"text": message}})
 
+    artifacts = []
+
+    def on_artifact(block):
+        rendered = run_artifact(cctx, block)
+        artifacts.append(rendered)
+        if not state.json:
+            render_artifact(rendered)
+
+    def on_ask_user(event):
+        decision = "reject"
+        if event.get("kind") == "approval":
+            if approve:
+                decision = "approve"
+            elif not state.json and sys.stdin.isatty():
+                output.info(str(event.get("question", "Approve this write?")))
+                if event.get("details"):
+                    output.info(str(event["details"]))
+                if typer.confirm("Approve this change", default=False, err=True):
+                    decision = "approve"
+        answer = {"callId": event["callId"], "decision": decision}
+        try:
+            api.cloud_request(cctx, "POST", "/api/agent/answer", body=answer)
+        except FpCliError as exc:
+            # Unwind the stream and Rich status before the central error renderer
+            # prints one line. Preserve the transport's exit code and request id.
+            reason = (
+                "cannot reach FailproofAI Cloud" if isinstance(exc, NetworkError)
+                else " ".join(exc.message.split()).rstrip(".")
+            )
+            exc.message = (
+                f"Assistant approval answer failed: {reason}; delivery unconfirmed."
+            )
+            exc.hint = None
+            raise exc from None
+        if decision == "reject" and not state.json:
+            output.hint("Declined assistant request; no write approved.")
+
     # The reply streams server-side (an LLM turn + tool calls can take many seconds); show a
     # themed spinner on stderr so the CLI doesn't look hung. No-op under --json / non-TTY.
     with output.thinking("thinking…", enabled=not state.json):
         result = api.agent_chat_oneshot(
-            cctx, messages=thread, conversation_id=full_chat_id, page_context=page_context, model=model
+            cctx, messages=thread, conversation_id=full_chat_id, page_context=page_context, model=model,
+            on_ask_user=on_ask_user, on_artifact=on_artifact,
         )
 
     chat_id = full_chat_id
@@ -337,7 +376,10 @@ def agent_ask(
             # create-with-empty-title then a follow-up rename PATCH.
             chat_id = (api.create_conversation(cctx, title=_title_from_question(message)) or {}).get("id")
         if chat_id:
-            full = thread + [{"role": "assistant", "content": {"text": result.get("answer", "")}}]
+            content = {"text": result.get("answer", "")}
+            if artifacts:
+                content["artifacts"] = [{k: v for k, v in a.items() if k != "result"} for a in artifacts]
+            full = thread + [{"role": "assistant", "content": content}]
             api.replace_messages(cctx, chat_id, full)
             if full_chat_id is not None and not prior:
                 # Continuing a chat that had no messages yet → title it from this first question
@@ -350,7 +392,7 @@ def agent_ask(
         mode="continue" if chat else "new",
     )
     if state.json:
-        output.emit_json({**result, "chat_id": chat_id})
+        output.emit_json({**result, "chat_id": chat_id, **({"artifacts": artifacts} if artifacts else {})})
     else:
         for tool in result.get("tools", []):
             output.agent_tool_used(tool)
@@ -404,4 +446,35 @@ def register(app: typer.Typer) -> None:
     agent.command("show", epilog=GLOBALS_EPILOG)(agent_show)
     agent.command("rename", epilog=GLOBALS_EPILOG)(agent_rename)
     agent.command("delete", epilog=GLOBALS_EPILOG)(agent_delete)
+    agent.command("brief", epilog=GLOBALS_EPILOG)(agent_brief)
     app.add_typer(agent, name="agent")
+
+
+def run_artifact(cctx, block):
+    """Only execute through queries:run; never follow arbitrary URLs or actions."""
+    rendered = dict(block)
+    sql = block.get("sql")
+    if sql:
+        import re
+        if not isinstance(sql, str) or not re.match(r"^\s*(select|with)\b", sql, re.I):
+            raise click.UsageError("Assistant artifact SQL must be SELECT or WITH")
+        rendered["result"] = api.cloud_request(cctx, "POST", "/api/queries/run", body={"sql": sql, "params": []})
+    return rendered
+
+
+def render_artifact(block):
+    cloud_output.artifact(block)
+
+
+def agent_brief(ctx: typer.Context, range: str = typer.Option("24h", "--range")) -> None:
+    """Print the agent-curated home brief (24h or 7d). Session only."""
+    _cloud.session_only(ctx.obj, "agent brief")
+    if range not in ("24h", "7d"):
+        raise click.UsageError("--range must be 24h or 7d")
+    cctx = require_auth(ctx.obj)
+    data = api.cloud_request(cctx, "POST", "/api/agent/home-brief", body={"range": range})
+    blocks = [run_artifact(cctx, block) for block in data.get("blocks", [])]
+    if ctx.obj.json:
+        output.emit_json({**data, "blocks": blocks})
+    else:
+        cloud_output.brief({**data, "blocks": blocks})

package/.next/standalone/fp-cloud-cli/fp_cli/commands/alerts_cmds.py

@@ -442,4 +442,27 @@ def register(app: typer.Typer) -> None:
     alerts_app.command("update", epilog=GLOBALS_EPILOG)(alerts_update)
     alerts_app.command("delete", epilog=GLOBALS_EPILOG)(alerts_delete)
     alerts_app.command("test", epilog=GLOBALS_EPILOG)(alerts_test)
+    alerts_app.command("recipients", epilog=GLOBALS_EPILOG)(alerts_recipients)
+    alerts_app.command("issues", epilog=GLOBALS_EPILOG)(alerts_issues)
     app.add_typer(alerts_app, name="alerts")
+
+
+def alerts_recipients(ctx: typer.Context) -> None:
+    """List available alert recipients."""
+    from .account_cmds import request
+    request(ctx, "GET", "/api/alerts/recipients")
+
+
+def alerts_issues(ctx: typer.Context, alert_id: str = typer.Argument(...),
+                 create: bool = typer.Option(False, "--create"),
+                 title: Optional[str] = typer.Option(None, "--title"),
+                 summary: Optional[str] = typer.Option(None, "--summary"),
+                 file: Optional[str] = typer.Option(None, "--file")) -> None:
+    """List alert issues, or --create one with --title/--summary or --file."""
+    from .account_cmds import request
+    if not create and any(v is not None for v in (title, summary, file)):
+        raise click.UsageError("Pass --create to use issue body flags")
+    body = _write.read_body(ctx.obj, file, {"title": title, "summary": summary}) if create else None
+    if create and (not isinstance(body.get("title"), str) or not body["title"].strip()):
+        raise click.UsageError("Creating an issue needs --title or a title in --file")
+    request(ctx, "POST" if create else "GET", f"/api/alerts/{alert_id}/issues", body)

package/.next/standalone/fp-cloud-cli/fp_cli/commands/audits_cmds.py

@@ -1051,4 +1051,6 @@ def register(app: typer.Typer) -> None:
     audits_app.command("resolve", epilog=GLOBALS_EPILOG)(findings_resolve)
     audits_app.command("reopen", epilog=GLOBALS_EPILOG)(findings_reopen)
     audits_app.command("assign", epilog=GLOBALS_EPILOG)(findings_assign)
+    from . import contracts_cmds
+    contracts_cmds.register(audits_app)
     app.add_typer(audits_app, name="audits")

package/.next/standalone/fp-cloud-cli/fp_cli/commands/contracts_cmds.py

@@ -0,0 +1,67 @@
+"""Org-wide agent contracts, alongside scheduled audits."""
+
+from __future__ import annotations
+
+from typing import Optional
+
+import typer
+
+from .. import _click_compat as click, client as api
+from .._context import GLOBALS_EPILOG, require_auth
+from . import _write
+from .account_cmds import request
+
+PATH = "/api/audits/contracts"
+
+
+def list_contracts(ctx: typer.Context) -> None:
+    """List agent contracts."""
+    request(ctx, "GET", PATH)
+
+
+def show(ctx: typer.Context, id: str = typer.Argument(...)) -> None:
+    """Show one contract, including its Markdown."""
+    request(ctx, "GET", f"{PATH}/{id}")
+
+
+def validate(body):
+    if set(body) - {"agent_id", "body", "enabled"}:
+        raise click.UsageError("Contracts accept agent_id, body and enabled")
+    if not isinstance(body.get("agent_id"), str) or not body["agent_id"].strip():
+        raise click.UsageError("Contract needs an agent_id from your telemetry")
+    if not isinstance(body.get("body"), str) or not body["body"].strip() or len(body["body"]) > 5000 or "\0" in body["body"]:
+        raise click.UsageError("Contract body must be 1–5000 characters without NUL")
+    if "enabled" in body and not isinstance(body["enabled"], bool):
+        raise click.UsageError("Contract enabled must be boolean")
+
+
+def create(ctx: typer.Context, agent_id: Optional[str] = typer.Option(None, "--agent-id"),
+           body: Optional[str] = typer.Option(None, "--body", help="Markdown or @file."),
+           file: Optional[str] = typer.Option(None, "--file", help="Contract API body JSON.")) -> None:
+    """Write an agent contract."""
+    data = _write.read_body(ctx.obj, file, {"agent_id": agent_id, "body": _write.read_text_arg(body[1:]) if body and body.startswith("@") else body})
+    validate(data)
+    request(ctx, "POST", PATH, data)
+
+
+def update(ctx: typer.Context, id: str = typer.Argument(...),
+           agent_id: Optional[str] = typer.Option(None, "--agent-id"),
+           body: Optional[str] = typer.Option(None, "--body"),
+           enabled: Optional[bool] = typer.Option(None, "--enabled/--disabled"),
+           file: Optional[str] = typer.Option(None, "--file")) -> None:
+    """Update selected fields, preserving the rest."""
+    changes = _write.read_body(ctx.obj, file, {"agent_id": agent_id, "body": _write.read_text_arg(body[1:]) if body and body.startswith("@") else body, "enabled": enabled})
+    if not changes:
+        raise click.UsageError("Pass --agent-id, --body, --enabled/--disabled or --file")
+    current = api.cloud_request(require_auth(ctx.obj), "GET", f"{PATH}/{id}")
+    data = {k: current[k] for k in ("agent_id", "body", "enabled") if k in current}
+    data.update(changes)
+    validate(data)
+    request(ctx, "PUT", f"{PATH}/{id}", data)
+
+
+def register(audits_app):
+    group = typer.Typer(no_args_is_help=True, context_settings={"help_option_names": ["-h", "--help"]})
+    for name, fn in (("list", list_contracts), ("show", show), ("create", create), ("update", update)):
+        group.command(name, epilog=GLOBALS_EPILOG)(fn)
+    audits_app.add_typer(group, name="contracts")

package/.next/standalone/fp-cloud-cli/fp_cli/commands/dashboards_cmds.py

@@ -0,0 +1,159 @@
+"""Org dashboards and their saved-query tiles."""
+
+from __future__ import annotations
+
+from typing import Optional
+
+import typer
+
+from .. import _click_compat as click, client as api
+from .._context import GLOBALS_EPILOG, require_auth, validate_choice
+from . import _cloud, _write
+
+CHARTS = ("line", "area", "bar", "stacked_bar", "pie", "kpi", "table")
+TILE_FIELDS = ("query_id", "title", "chart_type", "chart_config", "param_bindings", "pos_x", "pos_y", "pos_w", "pos_h")
+
+
+def request(ctx, method, path, body=None):
+    if method != "GET":
+        _write.confirm(ctx.obj, f"{method} {path}", assume_yes=False, destructive=method == "DELETE")
+    data = api.cloud_request(require_auth(ctx.obj), method, path, body=body)
+    if method != "GET":
+        _write.record_action("dashboard_changed", resource="dashboard", success=True, destructive=method == "DELETE")
+    _cloud.emit(ctx.obj, data, "Dashboards", view=path, method=method, body=body)
+
+
+def list_dashboards(ctx: typer.Context) -> None:
+    """List org dashboards."""
+    request(ctx, "GET", "/api/dashboards")
+
+
+def show(ctx: typer.Context, id: str = typer.Argument(...)) -> None:
+    """Show a dashboard and its tiles."""
+    request(ctx, "GET", f"/api/dashboards/{id}")
+
+
+def create(ctx: typer.Context, name: str = typer.Option(..., "--name"),
+           description: str = typer.Option("", "--description"),
+           file: Optional[str] = typer.Option(None, "--file", help="Dashboard definition JSON.")) -> None:
+    """Create a dashboard (no tiles yet)."""
+    if not name.strip():
+        raise click.UsageError("--name cannot be empty")
+    definition = _write.read_body(ctx.obj, file) if file else {}
+    request(ctx, "POST", "/api/dashboards", {"name": name, "description": description, "definition": definition})
+
+
+def update(ctx: typer.Context, id: str = typer.Argument(...),
+           name: Optional[str] = typer.Option(None, "--name"),
+           description: Optional[str] = typer.Option(None, "--description"),
+           file: Optional[str] = typer.Option(None, "--file", help="Replacement dashboard definition JSON.")) -> None:
+    """Update selected fields, preserving the others."""
+    if name is None and description is None and file is None:
+        raise click.UsageError("Pass --name, --description or --file")
+    if name is not None and not name.strip():
+        raise click.UsageError("--name cannot be empty")
+    definition = _write.read_body(ctx.obj, file) if file else None
+    current = api.cloud_request(require_auth(ctx.obj), "GET", f"/api/dashboards/{id}")
+    # Show returns {dashboard, tiles}; older deployments return the row itself.
+    current = current.get("dashboard", current)
+    body = {k: current.get(k, {} if k == "definition" else "") for k in ("name", "description", "definition")}
+    body.update({k: v for k, v in {"name": name, "description": description, "definition": definition}.items() if v is not None})
+    request(ctx, "PUT", f"/api/dashboards/{id}", body)
+
+
+def delete(ctx: typer.Context, id: str = typer.Argument(...)) -> None:
+    """Delete a dashboard (saved queries are retained)."""
+    request(ctx, "DELETE", f"/api/dashboards/{id}")
+
+
+def tiles(ctx: typer.Context, id: str = typer.Argument(..., metavar="DASHBOARD_ID")) -> None:
+    """Manage tiles: `fp dashboards tiles ID list|add|update|remove|layout`."""
+    ctx.meta["dashboard_id"] = id
+
+
+def tile_path(ctx):
+    return f"/api/dashboards/{ctx.meta['dashboard_id']}/tiles"
+
+
+def tile_list(ctx: typer.Context) -> None:
+    """List tiles."""
+    request(ctx, "GET", tile_path(ctx))
+
+
+def tile_add(ctx: typer.Context, query: str = typer.Option(..., "--query"),
+             chart: str = typer.Option(..., "--chart"), title: str = typer.Option("", "--title"),
+             file: Optional[str] = typer.Option(None, "--file", help="Tile config/geometry JSON.")) -> None:
+    """Add a saved-query tile."""
+    validate_choice(chart, CHARTS, flag="--chart")
+    body = {"query_id": query, "title": title, "chart_type": chart, "chart_config": {},
+            "param_bindings": {}, "pos_x": 0, "pos_y": 0, "pos_w": 6, "pos_h": 4}
+    if file:
+        body.update(_write.read_body(ctx.obj, file))
+    validate_tile(body)
+    request(ctx, "POST", tile_path(ctx), body)
+
+
+def validate_tile(body):
+    if set(body) - set(TILE_FIELDS):
+        raise click.UsageError("Unknown tile fields")
+    validate_choice(body.get("chart_type"), CHARTS, flag="--chart")
+    if not body.get("query_id") or not body.get("chart_type"):
+        raise click.UsageError("Tile needs query_id and chart_type")
+    for key in ("pos_x", "pos_y", "pos_w", "pos_h"):
+        value = body.get(key)
+        if isinstance(value, bool) or not isinstance(value, int) or value < (1 if key in ("pos_w", "pos_h") else 0):
+            raise click.UsageError("Tile position must be non-negative with positive size")
+    for key in ("chart_config", "param_bindings"):
+        if not isinstance(body.get(key), dict):
+            raise click.UsageError(f"{key} must be a JSON object")
+
+
+def tile_update(ctx: typer.Context, tile: str = typer.Argument(...),
+                query: Optional[str] = typer.Option(None, "--query"),
+                chart: Optional[str] = typer.Option(None, "--chart"),
+                title: Optional[str] = typer.Option(None, "--title"),
+                file: Optional[str] = typer.Option(None, "--file")) -> None:
+    """Update a tile, preserving unmentioned config and geometry."""
+    body = _write.read_body(ctx.obj, file, {"query_id": query, "chart_type": chart, "title": title})
+    if not body:
+        raise click.UsageError("Pass --query, --chart, --title or --file")
+    data = api.cloud_request(require_auth(ctx.obj), "GET", tile_path(ctx))
+    matches = [r for r in _cloud.rows(data, "tiles") if str(r.get("id")) == tile]
+    if len(matches) != 1:
+        from ..errors import NotFoundError
+        raise NotFoundError(f"no tile {tile}; run `fp dashboards tiles {ctx.meta['dashboard_id']} list`")
+    merged = {k: matches[0][k] for k in TILE_FIELDS}
+    merged.update(body)
+    validate_tile(merged)
+    request(ctx, "PUT", f"{tile_path(ctx)}/{tile}", merged)
+
+
+def tile_remove(ctx: typer.Context, tile: str = typer.Argument(...)) -> None:
+    """Remove a tile."""
+    request(ctx, "DELETE", f"{tile_path(ctx)}/{tile}")
+
+
+def tile_layout(ctx: typer.Context, file: str = typer.Option(..., "--file")) -> None:
+    """Apply geometry JSON: {tiles: [{id,pos_x,pos_y,pos_w,pos_h}]}."""
+    body = _write.read_body(ctx.obj, file)
+    if not isinstance(body.get("tiles"), list):
+        raise click.UsageError("Layout must contain a tiles array")
+    for row in body["tiles"]:
+        if not isinstance(row, dict) or not row.get("id"):
+            raise click.UsageError("Layout tiles need ids")
+        if set(row) != {"id", "pos_x", "pos_y", "pos_w", "pos_h"}:
+            raise click.UsageError("Layout tiles must contain id,pos_x,pos_y,pos_w,pos_h")
+        validate_tile({**{k: v for k, v in row.items() if k != "id"}, "query_id": "layout", "chart_type": "table", "chart_config": {}, "param_bindings": {}, "title": ""})
+    request(ctx, "PUT", f"{tile_path(ctx)}/layout", body)
+
+
+def register(app: typer.Typer) -> None:
+    group = typer.Typer(no_args_is_help=True, help="Manage org dashboards and tiles.", context_settings={"help_option_names": ["-h", "--help"]})
+    for name, fn in (("list", list_dashboards), ("show", show), ("create", create), ("update", update), ("delete", delete)):
+        group.command(name, epilog=GLOBALS_EPILOG)(fn)
+    tile_group = typer.Typer(no_args_is_help=True, context_settings={"help_option_names": ["-h", "--help"]})
+    tile_group.callback()(tiles)
+    for name, fn in (("list", tile_list), ("add", tile_add), ("update", tile_update), ("remove", tile_remove), ("layout", tile_layout)):
+        tile_group.command(name, epilog=GLOBALS_EPILOG)(fn)
+    group.add_typer(tile_group, name="tiles")
+    app.add_typer(group, name="dashboards")