jira-ai 0.6.12 → 0.9.0

package/dist/cli.js

@@ -30,7 +30,7 @@ import { checkForUpdate, formatUpdateMessage, checkForUpdateSync } from './lib/u
 import { CliError } from './types/errors.js';
 import { CommandError } from './lib/errors.js';
 import { ui } from './lib/ui.js';
-import { CreateTaskSchema, AddCommentSchema, UpdateDescriptionSchema, ConfluenceAddCommentSchema, RunJqlSchema, GetPersonWorklogSchema, GetIssueStatisticsSchema, validateOptions, IssueKeySchema, ProjectKeySchema, TimeframeSchema } from './lib/validation.js';
+import { CreateTaskSchema, UpdateDescriptionSchema, ConfluenceAddCommentSchema, RunJqlSchema, GetPersonWorklogSchema, GetIssueStatisticsSchema, validateOptions, IssueKeySchema, ProjectKeySchema, TimeframeSchema } from './lib/validation.js';
 import { realpathSync } from 'fs';
 // Create CLI program
 const program = new Command();
@@ -94,78 +94,34 @@ program
     .command('logout')
     .description('Logout from all organizations')
     .action(() => authCommand({ logout: true }));
-// Organization commands
-const org = program
-    .command('organization')
-    .alias('org')
-    .description('Manage Jira organization profiles');
-org
-    .command('list')
-    .description('List all saved Jira organization profiles, showing their aliases and associated host URLs.')
-    .action(() => listOrganizations());
-org
-    .command('use <alias>')
-    .description('Switch the active Jira organization profile to the one specified by the alias.')
-    .action((alias) => useOrganizationCommand(alias));
-org
-    .command('remove <alias>')
-    .description('Delete the saved credentials and profile for the specified organization alias.')
-    .action((alias) => removeOrganizationCommand(alias));
-org
-    .command('add <alias>')
-    .description('Interactive prompt to add a new Jira organization profile with the given alias.')
-    .action((alias) => authCommand({ alias }));
-// Me command
-program
-    .command('me')
-    .description('Show profile details for the currently authenticated user, including Jira host, display name, email, account ID, status, and time zone.')
-    .action(withPermission('me', meCommand));
-// Projects command
-program
-    .command('projects')
-    .description('List all accessible Jira projects showing their key, name, ID, type, and project lead.')
-    .action(withPermission('projects', projectsCommand));
-// List colleagues command
-program
-    .command('list-colleagues [project-key]')
-    .description('Search and list users within the organization or a specific project (if project-key is provided). Returns display name, email, and account ID.')
-    .action(withPermission('list-colleagues', listColleaguesCommand, {
-    validateArgs: (args) => {
-        if (args[0]) {
-            validateOptions(ProjectKeySchema, args[0]);
-        }
-    }
-}));
-// Task with details command
-program
-    .command('task-with-details <task-id>')
-    .description('Retrieve comprehensive issue data including key, summary, status (name, category), assignee, reporter, creation/update dates, due date, labels, parent/subtasks, description, and comments. Use --include-detailed-history to fetch a chronological log of all changes including field updates and status transitions.')
+// =============================================================================
+// ISSUE COMMANDS
+// =============================================================================
+const issue = program
+    .command('issue')
+    .description('Manage Jira issues');
+issue
+    .command('get <issue-id>')
+    .description('Retrieve comprehensive issue data including key, summary, status, assignee, reporter, dates, labels, description, and comments.')
     .option('--include-detailed-history', 'Include the full history of task actions')
     .option('--history-limit <number>', 'Number of history entries to show (default: 50)', '50')
     .option('--history-offset <number>', 'Number of history entries to skip (default: 0)', '0')
-    .action(withPermission('task-with-details', taskWithDetailsCommand, {
+    .action(withPermission('issue.get', taskWithDetailsCommand, {
     validateArgs: (args) => validateOptions(IssueKeySchema, args[0])
 }));
-// Project statuses command
-program
-    .command('project-statuses <project-id>')
-    .description('Fetch all available workflow statuses for a given project. Returns status name, ID, category (To Do, In Progress, Done), and description.')
-    .action(withPermission('project-statuses', projectStatusesCommand, {
-    validateArgs: (args) => validateOptions(ProjectKeySchema, args[0])
-}));
-// List issue types command
-program
-    .command('list-issue-types <project-key>')
-    .description('List all issue types (Standard and Subtask) available for a project, providing their name, ID, hierarchy level, and description.')
-    .action(withPermission('list-issue-types', listIssueTypesCommand, {
-    validateArgs: (args) => validateOptions(ProjectKeySchema, args[0])
-}));
-// Run JQL command
-program
-    .command('run-jql <jql-query>')
-    .description('Execute a Jira Query Language (JQL) search. Returns a list of issues with their key, summary, status, assignee, and priority. Supports limiting results via --limit (default 50).')
+issue
+    .command('create')
+    .description('Create a new Jira issue with specified title, project key, and issue type.')
+    .requiredOption('--title <title>', 'Issue title/summary')
+    .requiredOption('--project <project>', 'Project key (e.g., PROJ)')
+    .requiredOption('--issue-type <type>', 'Issue type (e.g., Task, Epic, Subtask)')
+    .option('--parent <key>', 'Parent issue key (required for subtasks)')
+    .action(withPermission('issue.create', createTaskCommand, { schema: CreateTaskSchema }));
+issue
+    .command('search <jql-query>')
+    .description('Execute a JQL search query. Returns issues with key, summary, status, assignee, and priority.')
     .option('-l, --limit <number>', 'Maximum number of results (default: 50)', '50')
-    .action(withPermission('run-jql', runJqlCommand, {
+    .action(withPermission('issue.search', runJqlCommand, {
     schema: RunJqlSchema,
     validateArgs: (args) => {
         if (typeof args[0] !== 'string' || args[0].trim() === '') {
@@ -173,27 +129,51 @@ program
         }
     }
 }));
-// Update description command
-program
-    .command('update-description <task-id>')
-    .description('Update a Jira task\'s description using content from a local Markdown file. Requires the task ID and a valid file path.')
+issue
+    .command('transition <issue-id> <to-status>')
+    .description('Change the status of a Jira issue. The <to-status> can be either the status name or ID.')
+    .action(withPermission('issue.transition', transitionCommand, {
+    validateArgs: (args) => validateOptions(IssueKeySchema, args[0])
+}));
+issue
+    .command('update <issue-id>')
+    .description('Update a Jira issue\'s description using content from a local Markdown file.')
     .requiredOption('--from-file <path>', 'Path to Markdown file')
-    .action(withPermission('update-description', updateDescriptionCommand, {
+    .action(withPermission('issue.update', updateDescriptionCommand, {
     schema: UpdateDescriptionSchema,
     validateArgs: (args) => validateOptions(IssueKeySchema, args[0])
 }));
-// Add comment command
-program
-    .command('add-comment')
-    .description('Add a new comment to a Jira issue using content from a local Markdown file. Requires the issue key and a valid file path.')
-    .requiredOption('--file-path <path>', 'Path to Markdown file')
-    .requiredOption('--issue-key <key>', 'Jira issue key (e.g., PS-123)')
-    .action(withPermission('add-comment', addCommentCommand, { schema: AddCommentSchema }));
-// Add label command
-program
-    .command('add-label-to-issue <task-id> <labels>')
-    .description('Add one or more labels (comma-separated) to a specific Jira issue.')
-    .action(withPermission('add-label-to-issue', addLabelCommand, {
+issue
+    .command('comment <issue-id>')
+    .description('Add a new comment to a Jira issue using content from a local Markdown file.')
+    .requiredOption('--from-file <path>', 'Path to Markdown file')
+    .action(withPermission('issue.comment', (issueKey, options) => {
+    return addCommentCommand({ filePath: options.fromFile, issueKey });
+}, {
+    schema: UpdateDescriptionSchema,
+    validateArgs: (args) => validateOptions(IssueKeySchema, args[0])
+}));
+issue
+    .command('stats <issue-ids>')
+    .description('Calculate time-based metrics for one or more issues (comma-separated). Shows time logged, estimates, and status breakdown.')
+    .option('--full-breakdown', 'Display each status in its own column')
+    .action(withPermission('issue.stats', getIssueStatisticsCommand, {
+    schema: GetIssueStatisticsSchema
+}));
+issue
+    .command('assign <issue-id> <account-id>')
+    .description('Assign or reassign a Jira issue to a user. Use "null" as account-id to unassign.')
+    .action(withPermission('issue.assign', issueAssignCommand, {
+    validateArgs: (args) => validateOptions(IssueKeySchema, args[0])
+}));
+// Issue label subcommands
+const issueLabel = issue
+    .command('label')
+    .description('Manage issue labels');
+issueLabel
+    .command('add <issue-id> <labels>')
+    .description('Add one or more labels (comma-separated) to a Jira issue.')
+    .action(withPermission('issue.label.add', addLabelCommand, {
     validateArgs: (args) => {
         validateOptions(IssueKeySchema, args[0]);
         if (typeof args[1] !== 'string' || args[1].trim() === '') {
@@ -201,11 +181,10 @@ program
         }
     }
 }));
-// Delete label command
-program
-    .command('delete-label-from-issue <task-id> <labels>')
-    .description('Remove one or more labels (comma-separated) from a specific Jira issue.')
-    .action(withPermission('delete-label-from-issue', deleteLabelCommand, {
+issueLabel
+    .command('remove <issue-id> <labels>')
+    .description('Remove one or more labels (comma-separated) from a Jira issue.')
+    .action(withPermission('issue.label.remove', deleteLabelCommand, {
     validateArgs: (args) => {
         validateOptions(IssueKeySchema, args[0]);
         if (typeof args[1] !== 'string' || args[1].trim() === '') {
@@ -213,83 +192,114 @@ program
         }
     }
 }));
-// Create task command
-program
-    .command('create-task')
-    .description('Create a new Jira issue with specified title, project key, and issue type. Optional --parent key for subtasks. Returns the key of the newly created issue.')
-    .requiredOption('--title <title>', 'Issue title/summary')
-    .requiredOption('--project <project>', 'Project key (e.g., PROJ)')
-    .requiredOption('--issue-type <type>', 'Issue type (e.g., Task, Epic, Subtask)')
-    .option('--parent <key>', 'Parent issue key (required for subtasks)')
-    .action(withPermission('create-task', createTaskCommand, { schema: CreateTaskSchema }));
-// Transition command
-program
-    .command('transition <task-id> <to-status>')
-    .description('Change the status of a Jira task. The <to-status> can be either the status name or ID.')
-    .action(withPermission('transition', transitionCommand, {
-    validateArgs: (args) => validateOptions(IssueKeySchema, args[0])
+// =============================================================================
+// PROJECT COMMANDS
+// =============================================================================
+const project = program
+    .command('project')
+    .description('Manage Jira projects');
+project
+    .command('list')
+    .description('List all accessible Jira projects showing their key, name, ID, type, and project lead.')
+    .action(withPermission('project.list', projectsCommand));
+project
+    .command('statuses <project-key>')
+    .description('Fetch all available workflow statuses for a project (To Do, In Progress, Done).')
+    .action(withPermission('project.statuses', projectStatusesCommand, {
+    validateArgs: (args) => validateOptions(ProjectKeySchema, args[0])
 }));
-// Issue commands
-const issue = program
-    .command('issue')
-    .description('Manage Jira issues');
-issue
-    .command('assign <task-id> <account-id>')
-    .description('Assign or reassign a Jira issue to a specific user using their Account ID. Use "null" as account-id to unassign.')
-    .action(withPermission('issue', issueAssignCommand, {
-    validateArgs: (args) => validateOptions(IssueKeySchema, args[0])
+project
+    .command('types <project-key>')
+    .description('List all issue types (Standard and Subtask) available for a project.')
+    .action(withPermission('project.types', listIssueTypesCommand, {
+    validateArgs: (args) => validateOptions(ProjectKeySchema, args[0])
 }));
-// Get issue statistics command
-program
-    .command('get-issue-statistics <task-ids>')
-    .description('Calculate and display time-based metrics for one or more issues (comma-separated). Returns a table containing key, summary, total time logged, original estimate, and a detailed breakdown of duration spent in each status.')
-    .option('--full-breakdown', 'Display each status in its own column')
-    .action(withPermission('get-issue-statistics', getIssueStatisticsCommand, {
-    schema: GetIssueStatisticsSchema
+// =============================================================================
+// USER COMMANDS
+// =============================================================================
+const user = program
+    .command('user')
+    .description('User information and worklogs');
+user
+    .command('me')
+    .description('Show profile details for the currently authenticated user.')
+    .action(withPermission('user.me', meCommand));
+user
+    .command('search [project-key]')
+    .description('Search and list users within the organization or a specific project.')
+    .action(withPermission('user.search', listColleaguesCommand, {
+    validateArgs: (args) => {
+        if (args[0]) {
+            validateOptions(ProjectKeySchema, args[0]);
+        }
+    }
 }));
-// Get person worklog command
-program
-    .command('get-person-worklog <person> <timeframe>')
-    .description('Retrieve worklogs for a specific user over a timeframe (e.g., \'7d\', \'2w\'). Returns a list of entries with date, issue key, summary, time spent, and comments. Supports --group-by-issue.')
+user
+    .command('worklog <person> <timeframe>')
+    .description('Retrieve worklogs for a user over a timeframe (e.g., "7d", "2w").')
     .option('--group-by-issue', 'Group the output by issue')
-    .action(withPermission('get-person-worklog', getPersonWorklogCommand, {
+    .action(withPermission('user.worklog', getPersonWorklogCommand, {
     schema: GetPersonWorklogSchema,
     validateArgs: (args) => {
         validateOptions(TimeframeSchema, args[1]);
     }
 }));
-// Confluence commands
+// =============================================================================
+// ORGANIZATION COMMANDS
+// =============================================================================
+const org = program
+    .command('org')
+    .alias('organization')
+    .description('Manage Jira organization profiles');
+org
+    .command('list')
+    .description('List all saved Jira organization profiles.')
+    .action(() => listOrganizations());
+org
+    .command('use <alias>')
+    .description('Switch the active Jira organization profile.')
+    .action((alias) => useOrganizationCommand(alias));
+org
+    .command('remove <alias>')
+    .description('Delete credentials for the specified organization.')
+    .action((alias) => removeOrganizationCommand(alias));
+org
+    .command('add <alias>')
+    .description('Add a new Jira organization profile.')
+    .action((alias) => authCommand({ alias }));
+// =============================================================================
+// CONFLUENCE COMMANDS
+// =============================================================================
 const confl = program
     .command('confl')
+    .alias('confluence')
     .description('Interact with Confluence pages and content');
 confl
-    .command('get-page <url>')
+    .command('get <url>')
     .description('Download and display Confluence page content and comments from a given URL.')
-    .action(withPermission('confl', confluenceGetPageCommand, { skipValidation: false }));
+    .action(withPermission('confl.get', confluenceGetPageCommand, { skipValidation: false }));
 confl
     .command('spaces')
     .description('List all allowed Confluence spaces.')
-    .action(withPermission('confl', confluenceListSpacesCommand, { skipValidation: false }));
+    .action(withPermission('confl.spaces', confluenceListSpacesCommand, { skipValidation: false }));
 confl
     .command('pages <space-key>')
     .description('Display a hierarchical tree view of pages within a specific space.')
-    .action(withPermission('confl', confluenceGetSpacePagesHierarchyCommand, { skipValidation: false }));
+    .action(withPermission('confl.pages', confluenceGetSpacePagesHierarchyCommand, { skipValidation: false }));
 confl
-    .command('create-page <space> <title> [parent-page]')
-    .description('Create a new Confluence page')
-    .action(withPermission('confl', confluenceCreatePageCommand, { skipValidation: false }));
+    .command('create <space> <title> [parent-page]')
+    .description('Create a new Confluence page.')
+    .action(withPermission('confl.create', confluenceCreatePageCommand, { skipValidation: false }));
 confl
-    .command('add-comment')
-    .argument('<url>', 'The full URL of the Confluence page.')
-    .description('Add a new comment to a Confluence page using content from a local Markdown file.')
+    .command('comment <url>')
+    .description('Add a comment to a Confluence page using content from a Markdown file.')
     .option('-f, --from-file <path>', 'Path to the markdown file containing the comment content.')
-    .action(withPermission('confl', confluenceAddCommentCommand, { schema: ConfluenceAddCommentSchema }));
+    .action(withPermission('confl.comment', confluenceAddCommentCommand, { schema: ConfluenceAddCommentSchema }));
 confl
-    .command('update-description')
-    .argument('<url>', 'The full URL of the Confluence page.')
-    .description('Update the content of an existing Confluence page using a Markdown file.')
+    .command('update <url>')
+    .description('Update the content of a Confluence page using a Markdown file.')
     .option('-f, --from-file <path>', 'Path to the markdown file containing the new content.')
-    .action(withPermission('confl', confluenceUpdateDescriptionCommand, { schema: UpdateDescriptionSchema }));
+    .action(withPermission('confl.update', confluenceUpdateDescriptionCommand, { schema: UpdateDescriptionSchema }));
 // About command (always allowed)
 program
     .command('about')
@@ -298,7 +308,7 @@ program
 // Settings command
 program
     .command('settings')
-    .description('View, validate, or apply configuration settings. Use `settings` to view active config, `--validate <file>` to check a YAML file, or `--apply <file>` to update `~/.jira-ai/settings.yaml`.')
+    .description('View, validate, or apply configuration settings.')
     .option('--apply <path>', 'Validate and apply settings from a YAML file')
     .option('--validate <path>', 'Perform schema and deep validation of a settings YAML file')
     .option('--reset', 'Revert settings to default')
@@ -308,32 +318,44 @@ Examples:
   $ jira-ai settings --validate my-settings.yaml
   $ jira-ai settings --apply my-settings.yaml
   $ jira-ai settings --reset
-  
-  Settings File Structure:
-    defaults:
+
+Settings File Structure:
+  defaults:
+    allowed-jira-projects:
+      - all                     # Allow all projects
+    allowed-commands:
+      - all                     # Allow all commands
+    allowed-confluence-spaces:
+      - all                     # Allow all Confluence spaces
+
+  organizations:
+    work:
       allowed-jira-projects:
-        - all                   # Allow all projects
+        - PROJ                  # Allow specific project
+        - key: PM               # Project-specific config
+          commands:
+            - issue.get         # Only allow reading issues
+          filters:
+            participated:
+              was_assignee: true
       allowed-commands:
-        - all                   # Allow all commands globally
+        - issue                 # All issue commands
+        - project.list          # Only project list
+        - user.me               # Only user me
       allowed-confluence-spaces:
-        - all                   # Allow all Confluence spaces
+        - DOCS
+
+Command Groups (use in allowed-commands):
+  issue       - get, create, search, transition, update, comment, stats, assign, label
+  project     - list, statuses, types
+  user        - me, search, worklog
+  org         - list, use, add, remove
+  confl       - get, spaces, pages, create, comment, update
 
-    organizations:
-      work:
-        allowed-jira-projects:
-          - PROJ                # Allow specific project by key
-          - key: PM             # Project-specific configuration
-            commands:           # Limit commands for this project
-              - task-with-details
-            filters:
-              participated:     # Filter by user participation
-                was_assignee: true
-                was_reporter: true
-        allowed-commands:
-          - me
-          - projects
-        allowed-confluence-spaces:
-          - SPACE1              # Allow specific Confluence space
+Examples:
+  - "issue"           → allows all issue subcommands
+  - "issue.get"       → allows only issue get
+  - "issue.label"     → allows issue label add and remove
 `)
     .action((options) => settingsCommand(options));
 /**
@@ -341,9 +363,10 @@ Examples:
  */
 export function configureCommandVisibility(program) {
     const isAuthorized = hasCredentials();
+    const alwaysVisibleCommands = ['auth', 'about', 'settings'];
     if (!isAuthorized) {
         program.commands.forEach(cmd => {
-            if (cmd.name() !== 'auth' && cmd.name() !== 'about') {
+            if (!alwaysVisibleCommands.includes(cmd.name())) {
                 cmd._hidden = true;
             }
         });
@@ -351,8 +374,9 @@ export function configureCommandVisibility(program) {
     }
     else {
         program.commands.forEach(cmd => {
-            // auth and about are always visible
-            if (cmd.name() !== 'auth' && cmd.name() !== 'about') {
+            if (!alwaysVisibleCommands.includes(cmd.name())) {
+                // For hierarchical commands, check if the group is allowed
+                // e.g., 'issue' command group is allowed if 'issue' or any 'issue.*' is allowed
                 if (!isCommandAllowed(cmd.name())) {
                     cmd._hidden = true;
                 }

package/dist/lib/settings.js

@@ -6,27 +6,44 @@ import chalk from 'chalk';
 import { CliError } from '../types/errors.js';
 import { SettingsSchema } from './validation.js';
 import { getCurrentOrganizationAlias } from './auth-storage.js';
+// Mapping from old flat command names to new hierarchical paths
+export const LEGACY_COMMAND_MAP = {
+    'me': 'user.me',
+    'projects': 'project.list',
+    'task-with-details': 'issue.get',
+    'project-statuses': 'project.statuses',
+    'list-issue-types': 'project.types',
+    'list-colleagues': 'user.search',
+    'run-jql': 'issue.search',
+    'update-description': 'issue.update',
+    'add-comment': 'issue.comment',
+    'add-label-to-issue': 'issue.label.add',
+    'delete-label-from-issue': 'issue.label.remove',
+    'create-task': 'issue.create',
+    'transition': 'issue.transition',
+    'get-issue-statistics': 'issue.stats',
+    'get-person-worklog': 'user.worklog',
+    'organization': 'org',
+    'confluence': 'confl',
+    // Already hierarchical, keep as-is
+    'issue': 'issue',
+    'org': 'org',
+    'confl': 'confl'
+};
+/**
+ * Migrate legacy command names to new hierarchical format
+ */
+export function migrateCommandNames(commands) {
+    return commands.map(cmd => LEGACY_COMMAND_MAP[cmd] || cmd);
+}
 export const DEFAULT_ORG_SETTINGS = {
     'allowed-jira-projects': ['all'],
     'allowed-commands': [
-        'me',
-        'projects',
-        'task-with-details',
-        'run-jql',
-        'list-issue-types',
-        'project-statuses',
-        'create-task',
-        'list-colleagues',
-        'add-comment',
-        'add-label-to-issue',
-        'delete-label-from-issue',
-        'get-issue-statistics',
-        'get-person-worklog',
-        'organization',
-        'transition',
-        'update-description',
-        'confluence',
-        'issue'
+        'issue', // All issue commands (get, create, search, transition, update, comment, stats, assign, label)
+        'project', // All project commands (list, statuses, types)
+        'user', // All user commands (me, search, worklog)
+        'org', // Organization management
+        'confl' // Confluence commands
     ],
     'allowed-confluence-spaces': ['all']
 };
@@ -41,6 +58,8 @@ export function getSettingsPath() {
 }
 export function migrateSettings(settings) {
     // Migration logic: if old structure exists, move it to defaults
+    // Note: We keep command names as-is in storage (don't migrate them here)
+    // Command name migration happens at runtime in isCommandAllowed()
     if (settings.projects || settings.commands) {
         const migratedDefaults = {
             'allowed-jira-projects': settings.projects || DEFAULT_ORG_SETTINGS['allowed-jira-projects'],
@@ -149,6 +168,24 @@ export function isProjectAllowed(projectKey, orgAlias) {
     });
     return isAllowed;
 }
+/**
+ * Check if a command matches any allowed command using hierarchical matching.
+ * e.g., if 'issue' is allowed, then 'issue.get', 'issue.label.add' are all allowed.
+ * If 'issue.label' is allowed, then 'issue.label.add' and 'issue.label.remove' are allowed.
+ */
+function matchesHierarchicalCommand(commandPath, allowedCommands) {
+    // Check for 'all' permission
+    if (allowedCommands.includes('all'))
+        return true;
+    // Check hierarchical permissions (most specific to least specific)
+    const parts = commandPath.split('.');
+    for (let i = parts.length; i > 0; i--) {
+        const checkPath = parts.slice(0, i).join('.');
+        if (allowedCommands.includes(checkPath))
+            return true;
+    }
+    return false;
+}
 export function isCommandAllowed(commandName, projectKey, orgAlias) {
     // about, auth, and settings are always allowed
     if (['about', 'auth', 'settings'].includes(commandName)) {
@@ -157,31 +194,38 @@ export function isCommandAllowed(commandName, projectKey, orgAlias) {
     const settings = getEffectiveSettings(orgAlias);
     if (!settings)
         return false;
+    // Normalize the command name being checked (convert legacy to new format)
+    const normalizedCommandName = LEGACY_COMMAND_MAP[commandName] || commandName;
+    // Migrate legacy command names in settings to new format for checking
+    const migratedAllowedCommands = migrateCommandNames(settings['allowed-commands']);
     if (projectKey) {
         let project = settings['allowed-jira-projects'].find(p => typeof p !== 'string' && p.key === projectKey);
         if (!project) {
             project = settings['allowed-jira-projects'].find(p => typeof p === 'string' && (p === 'all' || p === projectKey));
         }
         if (project && typeof project !== 'string' && project.commands) {
-            return project.commands.includes(commandName);
+            const migratedProjectCommands = migrateCommandNames(project.commands);
+            return matchesHierarchicalCommand(normalizedCommandName, migratedProjectCommands);
         }
     }
     else {
         // For visibility/global check: allowed if in global list OR in any project-specific list
-        const allowedGlobally = settings['allowed-commands'].includes('all') || settings['allowed-commands'].includes(commandName);
-        if (allowedGlobally) {
+        if (matchesHierarchicalCommand(normalizedCommandName, migratedAllowedCommands)) {
             return true;
         }
-        const allowedInAnyProject = settings['allowed-jira-projects'].some(p => typeof p !== 'string' && p.commands && p.commands.includes(commandName));
+        const allowedInAnyProject = settings['allowed-jira-projects'].some(p => {
+            if (typeof p !== 'string' && p.commands) {
+                const migratedProjectCommands = migrateCommandNames(p.commands);
+                return matchesHierarchicalCommand(normalizedCommandName, migratedProjectCommands);
+            }
+            return false;
+        });
         if (allowedInAnyProject) {
             return true;
         }
         return false;
     }
-    if (settings['allowed-commands'].includes('all')) {
-        return true;
-    }
-    return settings['allowed-commands'].includes(commandName);
+    return matchesHierarchicalCommand(normalizedCommandName, migratedAllowedCommands);
 }
 export function isConfluenceSpaceAllowed(spaceKey, orgAlias) {
     const settings = getEffectiveSettings(orgAlias);

package/dist/lib/validation.js

@@ -87,9 +87,22 @@ export const ProjectFiltersSchema = z.object({
     }).optional(),
     jql: z.string().optional(),
 });
+/**
+ * Schema for hierarchical command names (e.g., "issue", "issue.get", "issue.label.add")
+ * Also accepts 'all' for allowing all commands
+ */
+export const HierarchicalCommandSchema = z.string().regex(/^(all|[a-z]+(\.[a-z]+)*)$/, 'Command must be "all" or lowercase dot-separated (e.g., "issue", "issue.get", "issue.label.add")');
+// Default allowed commands using hierarchical structure
+const DEFAULT_ALLOWED_COMMANDS = [
+    'issue', // All issue commands
+    'project', // All project commands
+    'user', // All user commands
+    'org', // Organization management
+    'confl' // Confluence commands
+];
 export const ProjectConfigSchema = z.object({
     key: z.string().trim().min(1),
-    commands: z.array(z.string()).optional(),
+    commands: z.array(z.string()).optional(), // Can be legacy or hierarchical
     filters: ProjectFiltersSchema.optional(),
 });
 export const ProjectSettingSchema = z.union([
@@ -98,7 +111,7 @@ export const ProjectSettingSchema = z.union([
 ]);
 export const OrganizationSettingsSchema = z.object({
     'allowed-jira-projects': z.array(ProjectSettingSchema).nullish().transform(val => val || ['all']),
-    'allowed-commands': z.array(z.string()).nullish().transform(val => val || ['me', 'projects', 'task-with-details', 'run-jql', 'list-issue-types', 'project-statuses', 'create-task', 'list-colleagues', 'add-comment', 'add-label-to-issue', 'delete-label-from-issue', 'get-issue-statistics', 'get-person-worklog', 'organization', 'transition', 'update-description', 'confluence']),
+    'allowed-commands': z.array(z.string()).nullish().transform(val => val || DEFAULT_ALLOWED_COMMANDS),
     'allowed-confluence-spaces': z.array(z.string()).nullish().transform(val => val || ['all']),
 });
 export const SettingsSchema = z.object({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jira-ai",
-  "version": "0.6.12",
+  "version": "0.9.0",
   "description": "AI friendly Jira CLI to save context",
   "type": "module",
   "main": "dist/cli.js",