quoxcli 0.0.0-stage → 0.2.0

package/lib/commands/onboard.js

@@ -0,0 +1,328 @@
+/**
+ * `quox onboard <host>`: guided, idempotent, resumable tenant-onboarding
+ * wizard.
+ *
+ * This is NET-NEW GLUE over verbs that already exist (dev doctor, org create,
+ * plan roadmap create, engagement create/target/verify/gripe-target/schedule,
+ * vault list). It does NOT reimplement any of their logic: every REST call
+ * goes through ctx.client + resolveEndpoint, exactly as the individual verbs
+ * do. The wizard's only job is to run the mechanical steps in the right order,
+ * skip anything already done, and STOP cleanly at the two human-auth gates
+ * (dev-enable + profile-verify, and the GitHub PAT) with the exact copy-paste
+ * command the operator must run before re-running the wizard.
+ *
+ * Design rules baked in here:
+ *   - Idempotent: every step CHECKs before it acts, so a second run creates no
+ *     duplicates and simply resumes at the first incomplete step.
+ *   - Honest gates: a gated step is never reported as done. It prints a WAITING
+ *     banner and the wizard returns (exit 0, since a gate is a pause, not an error).
+ *   - Secret-free: the GitHub PAT is instruct-and-stop in v1. The token never
+ *     enters this process; the operator adds it with `quox vault create
+ *     --credentials-stdin` and re-runs.
+ */
+
+import { resolveEndpoint } from '../api/endpoints.js';
+import { line as glyphLine, printEvent } from '../core/quoxglyph.js';
+
+// ── status line markers ────────────────────────────────────────────────────
+// One line per step. [ok] already there, [+] created/changed, [wait] a human
+// gate blocks progress. Kept as plain console.log (not the chalk helpers) so
+// the markers are trivially assertable in tests and scannable in a wall of
+// tool output.
+function ok(msg) { console.log(`  [ok] ${msg}`); }
+function created(msg) { console.log(`  [+] ${msg}`); }
+function waiting(msg) { console.log(`  [wait] needs you: ${msg}`); }
+
+// ── small pure helpers (exported for unit tests) ───────────────────────────
+
+/** Slug for a display name: lowercase, non-alphanumeric collapsed to '-'. */
+export function slugify(name) {
+  return String(name || '')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    || 'tenant';
+}
+
+/**
+ * Infer an engagement target type from its value.
+ *   - an ipv4 or ipv4/cidr        -> 'cidr'
+ *   - a scheme://... or host:port -> 'url'
+ *   - a bare hostname             -> 'domain'
+ * Default for a bare IP is 'cidr' (the engagement scope model treats a single
+ * host as a /32 cidr target).
+ */
+export function inferTargetType(value) {
+  const v = String(value || '').trim();
+  // ipv4 with optional /nn suffix
+  if (/^\d{1,3}(\.\d{1,3}){3}(\/\d{1,2})?$/.test(v)) return 'cidr';
+  // explicit scheme, or a host:port pair
+  if (/:\/\//.test(v) || /^[^\s/]+:\d+$/.test(v)) return 'url';
+  return 'domain';
+}
+
+/** curl install command for a host that is not yet a fleet-enrolled dev server. */
+export function buildOnboardInstallCommand(collectorBase, host) {
+  const base = String(collectorBase || '').replace(/\/+$/, '');
+  return `curl -sSL ${base}/install | sudo bash -s -- --host-id ${host}`;
+}
+
+// ── the wizard ──────────────────────────────────────────────────────────────
+
+/**
+ * Run the onboarding orchestration. Returns { status: 'COMPLETE' | 'WAITING' }.
+ * Exported so it can be unit-tested directly with an injected fake client, and
+ * so a caller can branch on the outcome.
+ */
+export async function runOnboard(host, options, ctx) {
+  const { client, auth, config } = ctx;
+  auth.requireAuth();
+
+  const name = options.name;
+  const targetValue = options.target || host;
+  const envTier = options.environmentTier || 'dev';
+  const cron = options.scheduleCron || '0 2 * * 3';
+  const tool = options.tool || 'vuln_scan';
+  const slug = slugify(name);
+
+  printEvent(glyphLine('quox', `onboarding ${host}`));
+
+  // ── Step 1: AGENT + DEV-ENABLE gate ──────────────────────────────────────
+  // Read real registry state; never infer readiness from an enable having
+  // returned 200. Not enrolled -> install. Enrolled but not dev-enabled or not
+  // profile_verified -> the enable/seam-key gate.
+  const orgIdForDev = auth.getOrgId(ctx.program?.opts?.().org);
+  const serversEp = resolveEndpoint('v1.dev.servers.list');
+  const serversResp = await client.get(serversEp.path, {
+    service: serversEp.service,
+    query: orgIdForDev ? { org_id: orgIdForDev } : {},
+  });
+  const servers = Array.isArray(serversResp?.servers) ? serversResp.servers : [];
+  const server = servers.find((s) => s.host_id === host);
+
+  if (!server) {
+    const collectorBase = config?.getServiceUrl ? config.getServiceUrl('collector') : '<collector-url>';
+    waiting(`${host} is not a fleet-enrolled dev server. Install the agent, then re-run:`);
+    console.log(`      ${buildOnboardInstallCommand(collectorBase, host)}`);
+    return stop(host);
+  }
+
+  const enabledCaps = Array.isArray(server.enabled_capabilities) ? server.enabled_capabilities : [];
+  if (!server.profile_verified || enabledCaps.length === 0) {
+    const why = !server.profile_verified ? 'profile not verified' : 'no capabilities enabled';
+    waiting(`${host} is enrolled but not ready (${why}). Run (as an owner/admin):`);
+    console.log(`      quox dev enable ${host}`);
+    console.log('      profile_verified needs the seam key plus an agent restart.');
+    console.log(`      Confirm with: quox dev doctor ${host}`);
+    return stop(host);
+  }
+  ok(`${host} is a dev-enabled, profile-verified dev server`);
+
+  // ── Step 2: ORG ──────────────────────────────────────────────────────────
+  const orgsEp = resolveEndpoint('orgs.list');
+  const orgsResp = await client.get(orgsEp.path, { service: orgsEp.service });
+  const orgs = orgsResp?.orgs || orgsResp?.organizations || orgsResp || [];
+  let org = (Array.isArray(orgs) ? orgs : []).find(
+    (o) => o.name === name || o.slug === slug || o.id === name,
+  );
+  let orgId;
+  if (org) {
+    orgId = org.id;
+    ok(`org "${name}" exists (${orgId})`);
+  } else {
+    const createEp = resolveEndpoint('orgs.create');
+    const createResp = await client.post(createEp.path, {
+      service: createEp.service,
+      body: { name, slug },
+    });
+    org = createResp?.organization || createResp?.org || createResp;
+    orgId = org.id;
+    created(`org "${name}" (${orgId})`);
+  }
+
+  // ── Step 3: ROADMAP ───────────────────────────────────────────────────────
+  const roadmapId = slug;
+  const roadmapsEp = resolveEndpoint('quoxplan.roadmaps.list');
+  const roadmapsResp = await client.get(roadmapsEp.path, { service: roadmapsEp.service });
+  const roadmaps = roadmapsResp?.roadmaps || [];
+  const existingRoadmap = roadmaps.find((r) => r.id === roadmapId || r.org_id === orgId);
+  if (existingRoadmap) {
+    ok(`roadmap "${existingRoadmap.id}" exists for this tenant`);
+  } else {
+    const rmCreateEp = resolveEndpoint('quoxplan.roadmaps.create');
+    await client.post(rmCreateEp.path, {
+      service: rmCreateEp.service,
+      body: { org_id: orgId, id: roadmapId, name: `${name} delivery`, actor: 'quox-cli' },
+    });
+    created(`roadmap "${roadmapId}" for org ${orgId}`);
+  }
+
+  // ── Step 4: ENGAGEMENT ────────────────────────────────────────────────────
+  const engagementName = `${name} security`;
+  const engListEp = resolveEndpoint('engagement.list');
+  const engListResp = await client.get(engListEp.path, { service: engListEp.service });
+  const engagements = engListResp?.engagements || [];
+  let engagement = engagements.find((e) => e.name === engagementName);
+  let engagementId;
+  if (engagement) {
+    engagementId = engagement.id;
+    ok(`engagement "${engagementName}" exists (${engagementId})`);
+  } else {
+    const engCreateEp = resolveEndpoint('engagement.create');
+    const engResp = await client.post(engCreateEp.path, {
+      service: engCreateEp.service,
+      body: { name: engagementName, environment_tier: envTier, risk_ceiling: 'safe_active' },
+    });
+    engagement = engResp.engagement;
+    engagementId = engagement.id;
+    created(`engagement "${engagementName}" (${engagementId})`);
+  }
+
+  // ── Step 5: TARGET ────────────────────────────────────────────────────────
+  const engGetEp = resolveEndpoint('engagement.get', { id: engagementId });
+  const engDetail = await client.get(engGetEp.path, { service: engGetEp.service });
+  const currentEngagement = engDetail?.engagement || engagement;
+  const targets = Array.isArray(engDetail?.targets) ? engDetail.targets : [];
+  let target = targets.find((t) => t.value === targetValue);
+  let targetVerified = false;
+
+  if (!target) {
+    const type = inferTargetType(targetValue);
+    const addEp = resolveEndpoint('engagement.target.create', { id: engagementId });
+    const addResp = await client.post(addEp.path, {
+      service: addEp.service,
+      body: { type, value: targetValue, verification_method: 'quoxagent_install' },
+    });
+    target = addResp.target;
+    created(`target ${targetValue} (${type}) added`);
+    const verEp = resolveEndpoint('engagement.target.verify', { id: engagementId, targetId: target.id });
+    const verResp = await client.post(verEp.path, { service: verEp.service, body: {} });
+    targetVerified = verResp?.target?.verification_status === 'verified';
+    if (targetVerified) created(`target ${targetValue} verified`);
+    else waiting(`target ${targetValue} did not verify (status: ${verResp?.target?.verification_status || 'unknown'})`);
+  } else if (target.verification_status === 'verified') {
+    targetVerified = true;
+    ok(`target ${targetValue} already verified`);
+  } else {
+    const verEp = resolveEndpoint('engagement.target.verify', { id: engagementId, targetId: target.id });
+    const verResp = await client.post(verEp.path, { service: verEp.service, body: {} });
+    targetVerified = verResp?.target?.verification_status === 'verified';
+    if (targetVerified) created(`target ${targetValue} verified`);
+    else waiting(`target ${targetValue} did not verify (status: ${verResp?.target?.verification_status || 'unknown'})`);
+  }
+
+  // ── Step 6: GITHUB PAT gate ───────────────────────────────────────────────
+  // The repo is only meaningful if a customer GitHub connector token exists to
+  // file into it. Check the org vault for a github credential; if absent, STOP
+  // with the exact instruct-and-stop command (secret via --credentials-stdin,
+  // NEVER argv), and do NOT touch gripe target or schedule.
+  const repo = options.repo;
+  if (repo) {
+    const vaultEp = resolveEndpoint('vault.list', { orgId });
+    const vaultResp = await client.get(vaultEp.path, {
+      service: vaultEp.service,
+      query: { type: 'github' },
+    });
+    const creds = vaultResp?.credentials || vaultResp || [];
+    const githubCred = (Array.isArray(creds) ? creds : []).find((c) => c.integration_type === 'github');
+    if (!githubCred) {
+      waiting(`no GitHub connector credential in org ${orgId}. Add the fine-grained PAT, then re-run:`);
+      console.log(`      printf '%s' '<PAT>' | quox vault create --org ${orgId} --type github --label "${name} github" --credentials-stdin`);
+      console.log(`      (the JSON on stdin is {"token":"<PAT>"}; scope the PAT to ${repo} with Issues read/write)`);
+      return stop(host, { orgId, roadmapId, engagementId, targetValue, targetVerified });
+    }
+    ok(`GitHub connector credential present in org ${orgId}`);
+
+    // ── Step 7: GRIPE TARGET ────────────────────────────────────────────────
+    const wantRepo = repo;
+    const wantConnector = orgId;
+    if (currentEngagement.gripe_repo === wantRepo && currentEngagement.gripe_connector_org_id === wantConnector) {
+      ok(`gripe target already ${wantRepo} via org ${wantConnector}`);
+    } else {
+      const gtEp = resolveEndpoint('engagement.gripe_target.set', { id: engagementId });
+      await client.patch(gtEp.path, {
+        service: gtEp.service,
+        body: { gripe_repo: wantRepo, gripe_connector_org_id: wantConnector },
+      });
+      created(`gripe target -> ${wantRepo} via org ${wantConnector}`);
+    }
+  } else {
+    ok('no --repo given; skipping GitHub connector and gripe target');
+  }
+
+  // ── Step 8: SCHEDULE ──────────────────────────────────────────────────────
+  const schedListEp = resolveEndpoint('engagement.schedule.list', { id: engagementId });
+  const schedResp = await client.get(schedListEp.path, { service: schedListEp.service });
+  const schedules = Array.isArray(schedResp?.schedules) ? schedResp.schedules : [];
+  let schedule = schedules.find((s) => s.target_value === targetValue && s.tool === tool);
+  if (schedule) {
+    ok(`schedule for ${tool} on ${targetValue} exists (next: ${schedule.next_run_at || 'n/a'})`);
+  } else {
+    const schedCreateEp = resolveEndpoint('engagement.schedule.create', { id: engagementId });
+    const createResp = await client.post(schedCreateEp.path, {
+      service: schedCreateEp.service,
+      body: { target_value: targetValue, tool, schedule_kind: 'cron', cron_expression: cron },
+    });
+    schedule = createResp.schedule;
+    created(`schedule ${tool} on ${targetValue} @ "${cron}" (next: ${schedule?.next_run_at || 'n/a'})`);
+  }
+
+  // ── Step 9: SUMMARY ───────────────────────────────────────────────────────
+  // Every human gate that could stop the wizard has already returned by here,
+  // so the only thing left that can hold onboarding open is an unverified
+  // target (verification is best-effort and can legitimately not land yet).
+  const complete = targetVerified;
+  printSummary({
+    status: complete ? 'COMPLETE' : 'WAITING',
+    host,
+    orgId,
+    roadmapId,
+    engagementId,
+    targetValue,
+    targetVerified,
+    gripeRepo: repo || null,
+    schedule: schedule ? { cron, next: schedule.next_run_at } : null,
+    remainingGate: targetVerified ? null : 'target not verified',
+  });
+  return { status: complete ? 'COMPLETE' : 'WAITING' };
+}
+
+/** Shared gate-stop: print the WAITING banner + resume hint, return WAITING. */
+function stop(host, partial) {
+  console.log('');
+  console.log('  ===== WAITING on a human gate =====');
+  console.log(`  Do the step above, then re-run: quox onboard ${host} ... to continue.`);
+  if (partial) {
+    console.log(`  Progress so far: org ${partial.orgId}, roadmap ${partial.roadmapId}, engagement ${partial.engagementId}, target ${partial.targetValue} (verified: ${partial.targetVerified}).`);
+  }
+  return { status: 'WAITING' };
+}
+
+function printSummary(s) {
+  console.log('');
+  console.log(`  ===== onboarding ${s.status} =====`);
+  console.log(`  host:        ${s.host}`);
+  console.log(`  org:         ${s.orgId}`);
+  console.log(`  roadmap:     ${s.roadmapId}`);
+  console.log(`  engagement:  ${s.engagementId}`);
+  console.log(`  target:      ${s.targetValue} (verified: ${s.targetVerified})`);
+  console.log(`  gripe repo:  ${s.gripeRepo || '(none)'}`);
+  if (s.schedule) console.log(`  schedule:    "${s.schedule.cron}" (next: ${s.schedule.next || 'n/a'})`);
+  if (s.remainingGate) console.log(`  remaining:   ${s.remainingGate}`);
+}
+
+export function registerOnboardCommands(program, ctx) {
+  program
+    .command('onboard <host>')
+    .description('Guided, idempotent, resumable wizard to onboard a customer site as a governed Quox tenant')
+    .requiredOption('--name <customerName>', 'the org display name')
+    .option('--repo <owner/name>', 'the customer GitHub repo for auto-filed security issues')
+    .option('--target <hostOrIp>', 'the scan target (defaults to <host>)')
+    .option('--environment-tier <tier>', 'dev | staging | production', 'dev')
+    .option('--schedule-cron <expr>', 'cron cadence for the recurring scan', '0 2 * * 3')
+    .option('--tool <name>', 'capability tool to schedule', 'vuln_scan')
+    .option('--yes', 'run non-interactively: do every automatable step and print gate instructions without pausing')
+    .action(async (host, options) => {
+      await runOnboard(host, options, ctx);
+    });
+}

package/lib/commands/open.js

@@ -0,0 +1,56 @@
+/**
+ * quox open — Resolve quox:// URIs
+ *
+ * Opens a quox:// URI in the dashboard (browser) or prints the
+ * equivalent CLI command.
+ *
+ * CLI-3f (Stream CLI Phase 3)
+ */
+
+import chalk from 'chalk';
+import { resolveQuoxUri } from '../core/deeplinks.js';
+import { execFile } from 'node:child_process';
+import { emitCliEvent } from '../core/aee.js';
+
+function openBrowser(url) {
+  const cmd = process.platform === 'darwin' ? 'open'
+    : process.platform === 'win32' ? 'cmd'
+    : 'xdg-open';
+  const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+  execFile(cmd, args, () => {});
+}
+
+export function registerOpenCommand(program, ctx) {
+  const { config, client } = ctx;
+
+  program
+    .command('open')
+    .description('Open a quox:// URI in the dashboard or show CLI equivalent')
+    .argument('<uri>', 'quox:// URI (e.g., quox://fleet/docker01)')
+    .option('--cli', 'show CLI command instead of opening browser')
+    .action(async (uri, opts) => {
+      const baseUrl = config.getBaseUrl();
+      const resolved = resolveQuoxUri(uri, baseUrl);
+
+      if (!resolved) {
+        console.error(chalk.red(`Invalid URI: ${uri}`));
+        console.error(chalk.dim('Format: quox://<type>/<id> (e.g., quox://fleet/docker01)'));
+        process.exitCode = 2;
+        return;
+      }
+
+      if (opts.cli) {
+        console.log(resolved.cliCommand);
+      } else {
+        console.log(chalk.dim(`Opening ${resolved.dashboardUrl}`));
+        openBrowser(resolved.dashboardUrl);
+        console.log(chalk.dim(`CLI equivalent: ${resolved.cliCommand}`));
+      }
+
+      emitCliEvent(client, {
+        command: 'open',
+        intent: 'quox.cli.open',
+        payload: { uri, type: resolved.type, id: resolved.id },
+      });
+    });
+}

package/lib/commands/org.js

@@ -0,0 +1,266 @@
+/**
+ * Organization commands: CRUD, switch, members, divisions, audit
+ */
+
+import { QuoxError } from '../core/errors.js';
+import { formatOutput, formatDetail, printSuccess } from '../core/output.js';
+import { resolveOrgId } from './helpers.js';
+import { resolveEndpoint } from '../api/endpoints.js';
+
+export function registerOrgCommands(program, ctx) {
+  const { client, auth, config } = ctx;
+
+  const org = program
+    .command('org')
+    .description('Manage organizations');
+
+  org
+    .command('list')
+    .description('List organizations')
+    .action(async () => {
+      auth.requireAuth();
+      const data = await client.get(resolveEndpoint('orgs.list').path, { service: resolveEndpoint('orgs.list').service });
+      formatOutput({
+        columns: ['id', 'name', 'slug', 'plan', 'created_at'],
+        headers: ['ID', 'Name', 'Slug', 'Plan', 'Created'],
+        rows: data.orgs || data.organizations || data,
+      }, { format: program.opts().output });
+    });
+
+  org
+    .command('get')
+    .description('Get organization details')
+    .argument('<orgId>', 'organization ID')
+    .action(async (orgId) => {
+      auth.requireAuth();
+      const data = await client.get(resolveEndpoint('orgs.get', { orgId }).path, { service: resolveEndpoint('orgs.get', { orgId }).service });
+      const org = data.organization || data.org || data;
+      formatDetail(org, {
+        format: program.opts().output,
+        title: org.name || data.name,
+      });
+    });
+
+  org
+    .command('create')
+    .description('Create a new organization')
+    .requiredOption('--name <name>', 'organization name')
+    .option('--slug <slug>', 'URL-friendly slug')
+    .option('--description <desc>', 'organization description')
+    .action(async (options) => {
+      auth.requireAuth();
+      const data = await client.post(resolveEndpoint('orgs.create').path, {
+        service: resolveEndpoint('orgs.create').service,
+        body: {
+          name: options.name,
+          slug: options.slug,
+          description: options.description,
+        },
+      });
+      const created = data.organization || data.org;
+      printSuccess(`Created organization: ${options.name}${created?.slug ? ` (${created.slug})` : ''}`);
+    });
+
+  org
+    .command('update')
+    .description('Update an organization')
+    .argument('<orgId>', 'organization ID')
+    .option('--name <name>', 'new name')
+    .option('--description <desc>', 'new description')
+    .action(async (orgId, options) => {
+      auth.requireAuth();
+      const body = {};
+      if (options.name) body.name = options.name;
+      if (options.description) body.description = options.description;
+      await client.patch(resolveEndpoint('orgs.update', { orgId }).path, { service: resolveEndpoint('orgs.update', { orgId }).service, body });
+      printSuccess(`Organization updated.`);
+    });
+
+  org
+    .command('delete')
+    .description('Delete an organization')
+    .argument('<orgId>', 'organization ID')
+    .action(async (orgId) => {
+      auth.requireAuth();
+      await client.delete(resolveEndpoint('orgs.delete', { orgId }).path, { service: resolveEndpoint('orgs.delete', { orgId }).service });
+      printSuccess('Organization deleted.');
+    });
+
+  org
+    .command('switch')
+    .description('Switch active organization context')
+    .argument('<orgId>', 'organization ID or slug')
+    .action(async (orgId) => {
+      auth.requireAuth();
+      // The server matches memberships by org ID only. Accept a slug (or exact name) by
+      // resolving it against the caller's org list first; a 26-char ULID passes through.
+      let targetId = orgId;
+      if (!/^[0-9A-HJKMNP-TV-Z]{26}$/i.test(orgId)) {
+        const list = await client.get(resolveEndpoint('orgs.list').path, { service: resolveEndpoint('orgs.list').service });
+        const orgs = Array.isArray(list) ? list : (list?.organizations || list?.orgs || list?.data || []);
+        const hit = orgs.find((o) => o.slug === orgId) || orgs.find((o) => String(o.name || '').toLowerCase() === orgId.toLowerCase());
+        if (!hit) throw new QuoxError(`No organisation with slug or name '${orgId}'. Run \`quox org list\` and pass its ID.`, 1);
+        targetId = hit.id;
+      }
+      // Call switch-org endpoint
+      const data = await client.post(resolveEndpoint('auth.switch-org').path, {
+        service: resolveEndpoint('auth.switch-org').service,
+        body: { org_id: targetId },
+      });
+
+      // Update stored auth
+      const authData = config.getAuth();
+      if (data.org) {
+        authData.org_id = data.org.id;
+        authData.org_name = data.org.name;
+        authData.org_slug = data.org.slug;
+        authData.org_role = data.role;
+      }
+      if (data.access_token) authData.access_token = data.access_token;
+      config.setAuth(authData);
+
+      printSuccess(`Switched to ${data.org?.name || orgId}`);
+    });
+
+  // Members subcommands
+  const members = org
+    .command('members')
+    .description('Manage organization members');
+
+  members
+    .command('list')
+    .description('List organization members')
+    .action(async () => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const data = await client.get(resolveEndpoint('members.list', { orgId }).path, { service: resolveEndpoint('members.list', { orgId }).service });
+      formatOutput({
+        // fleet #392: member rows key on id, not user_id.
+        columns: ['id', 'email', 'display_name', 'role', 'status', 'joined_at'],
+        headers: ['User ID', 'Email', 'Name', 'Role', 'Status', 'Joined'],
+        rows: data.members || data,
+      }, { format: program.opts().output });
+    });
+
+  members
+    .command('add')
+    .description('Invite a member to the organization')
+    .requiredOption('--email <email>', 'email to invite')
+    .option('--role <role>', 'role: owner, admin, builder, viewer', 'viewer')
+    .action(async (options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      await client.post(resolveEndpoint('members.create', { orgId }).path, {
+        service: resolveEndpoint('members.create', { orgId }).service,
+        body: { email: options.email, role: options.role },
+      });
+      printSuccess(`Invited ${options.email} as ${options.role}.`);
+    });
+
+  members
+    .command('update')
+    .description('Update a member role')
+    .argument('<userId>', 'user ID')
+    .requiredOption('--role <role>', 'new role')
+    .action(async (userId, options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      await client.patch(resolveEndpoint('members.update', { orgId, userId }).path, {
+        service: resolveEndpoint('members.update', { orgId, userId }).service,
+        body: { role: options.role },
+      });
+      printSuccess(`Member role updated to ${options.role}.`);
+    });
+
+  members
+    .command('remove')
+    .description('Remove a member from the organization')
+    .argument('<userId>', 'user ID')
+    .action(async (userId) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      await client.delete(resolveEndpoint('members.delete', { orgId, userId }).path, { service: resolveEndpoint('members.delete', { orgId, userId }).service });
+      printSuccess('Member removed.');
+    });
+
+  // Divisions subcommands
+  const divisions = org
+    .command('divisions')
+    .description('Manage divisions within the organization');
+
+  divisions
+    .command('list')
+    .description('List divisions')
+    .action(async () => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const data = await client.get(resolveEndpoint('divisions.list', { orgId }).path, { service: resolveEndpoint('divisions.list', { orgId }).service });
+      formatOutput({
+        columns: ['id', 'name', 'description', 'created_at'],
+        headers: ['ID', 'Name', 'Description', 'Created'],
+        rows: data.divisions || data,
+      }, { format: program.opts().output });
+    });
+
+  divisions
+    .command('create')
+    .description('Create a division')
+    .requiredOption('--name <name>', 'division name')
+    .option('--description <desc>', 'description')
+    .action(async (options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      await client.post(resolveEndpoint('divisions.create', { orgId }).path, {
+        service: resolveEndpoint('divisions.create', { orgId }).service,
+        body: { name: options.name, description: options.description },
+      });
+      printSuccess(`Division "${options.name}" created.`);
+    });
+
+  divisions
+    .command('update')
+    .description('Update a division')
+    .argument('<divId>', 'division ID')
+    .option('--name <name>', 'new name')
+    .option('--description <desc>', 'new description')
+    .action(async (divId, options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const body = {};
+      if (options.name) body.name = options.name;
+      if (options.description) body.description = options.description;
+      await client.patch(resolveEndpoint('divisions.update', { orgId, divId }).path, { service: resolveEndpoint('divisions.update', { orgId, divId }).service, body });
+      printSuccess('Division updated.');
+    });
+
+  divisions
+    .command('delete')
+    .description('Delete a division')
+    .argument('<divId>', 'division ID')
+    .action(async (divId) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      await client.delete(resolveEndpoint('divisions.delete', { orgId, divId }).path, { service: resolveEndpoint('divisions.delete', { orgId, divId }).service });
+      printSuccess('Division deleted.');
+    });
+
+  // Audit subcommand
+  org
+    .command('audit')
+    .description('View organization audit log')
+    .option('--action <action>', 'filter by action type')
+    .option('--limit <n>', 'max results', '50')
+    .action(async (options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const query = { limit: options.limit };
+      if (options.action) query.action = options.action;
+      const data = await client.get(resolveEndpoint('audit.list', { orgId }).path, { service: resolveEndpoint('audit.list', { orgId }).service, query });
+      formatOutput({
+        // fleet #392: audit_events uses created_at/actor_email/metadata.
+        columns: ['created_at', 'actor_email', 'action', 'metadata'],
+        headers: ['Time', 'User', 'Action', 'Detail'],
+        rows: data.events || data.entries || data,
+      }, { format: program.opts().output });
+    });
+}