bt-cli 0.4.72__tar.gz → 0.4.73__tar.gz

{bt_cli-0.4.72 → bt_cli-0.4.73}/CLAUDE.md

@@ -1,6 +1,6 @@
 # BT-CLI
 
-BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.72**
+BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.73**
 
 ## Setup
 
@@ -83,6 +83,7 @@ PASSWORD=$(bt pws quick checkout -s server -a admin --raw)
 - PWS assets: Must create via workgroup endpoint
 - ECM integration: PWS system name must match PRA jump item name
 - **`-o json` is pure JSON on stdout — in every product.** All human status/progress banners *and interactive prompts* go to **stderr** (`core/output.py` `err_console`; `typer.confirm`/`typer.prompt` are called with `err=True`), so `... -o json | jq` and `json.load(stdin)` are safe even for `quick` workflow commands that narrate their steps. Enforced by static guards in `tests/core/test_json_stdout_purity.py` — when adding a command, use `print_success`/`print_warning`/`print_info` or `err_console.print` for anything that isn't the command's data. Consequence: piping *table* output to a file drops the narration (it's on stderr) — that's intended. PRA API 4xx `errors` objects are surfaced field-by-field, not collapsed to "Validation Failed".
+- **`bt tree` / `bt find` are derived from the live Typer app** (`core/command_tree.py` walks the Click tree) — **never hardcode a command list**. They used to be hand-maintained literals and silently drifted to 278-of-460 commands missing (all of `bt pws sessions`/`audit`, the whole `bt pf` product) before 0.4.73. `tests/core/test_command_tree.py` fails if any registered command is undiscoverable. New commands need no tree/find edit; help text comes from the docstring's first line.
 - **PRA tunnel create gates fields by `tunnel_type`**: tcp→`--ports`, mssql→`--username`/`--database`, k8s→`--url`/`--ca-cert`. **psql/mysql are created BARE** — the public Config API has no write path for their username/database (POST rejects, PATCH no-ops, PUT 405s) though GET shows them; CLI warns + ignores those flags. Set in `/login` UI.
 - **PRA `export jump-items` defaults to a REAL export** (all types: shell/rdp/vnc/web/tunnel, full type-specific columns) that round-trips through `import jump-items`; `--sample` gives the blank template. `bt pra jump-items web create` exists.
 - **PRA vault `associate -t protocol_tunnel` is MSSQL-only** (live-verified): server rejects psql/mysql/tcp/k8s with "Only SQL Server Tunnels are allowed" — use tag/criteria association for those. **TCP `--ports` needs listen;destination *pairs*** (even count; odd → 400 "number of parameters is invalid"). Jumpoint listing is `bt pra jumpoints list` (plural).

{bt_cli-0.4.72 → bt_cli-0.4.73}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: bt-cli
-Version: 0.4.72
+Version: 0.4.73
 Summary: BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM
 Author-email: Dave Grendysz <dgrendysz@beyondtrust.com>
 License: MIT

{bt_cli-0.4.72 → bt_cli-0.4.73}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bt-cli"
-version = "0.4.72"
+version = "0.4.73"
 description = "BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM"
 readme = "README.md"
 requires-python = ">=3.9"

{bt_cli-0.4.72 → bt_cli-0.4.73}/src/bt_cli/__init__.py

@@ -1,3 +1,3 @@
 """BeyondTrust Unified Admin CLI."""
 
-__version__ = "0.4.72"
+__version__ = "0.4.73"

{bt_cli-0.4.72 → bt_cli-0.4.73}/src/bt_cli/cli.py

@@ -263,9 +263,10 @@ def find_command(
         bt find secret        # Find secret-related commands
         bt find jump          # Find jump-related commands
     """
+    from rich.markup import escape
     from rich.table import Table
 
-    # Build command registry
+    # Built from the live command tree, so it can never drift from reality
     commands = _get_all_commands()
 
     # Search
@@ -276,7 +277,7 @@ def find_command(
             matches.append((cmd_path, cmd_help))
 
     if not matches:
-        console.print(f"[yellow]No commands found matching '{term}'[/yellow]")
+        console.print(f"[yellow]No commands found matching '{escape(term)}'[/yellow]")
         console.print("\nTry: bt tree  # Show all commands")
         return
 
@@ -286,374 +287,123 @@ def find_command(
 
     for cmd_path, cmd_help in sorted(matches):
         # Truncate help text
-        short_help = cmd_help[:60] + "..." if len(cmd_help) > 60 else cmd_help
-        table.add_row(cmd_path, short_help)
+        short = cmd_help[:60] + "..." if len(cmd_help) > 60 else cmd_help
+        table.add_row(escape(cmd_path), escape(short))
 
     console.print(table)
     console.print(f"\n[dim]{len(matches)} command(s) found[/dim]")
 
 
+def _chunk_verbs(names: list[str], width: int = 58) -> list[str]:
+    """Pack subcommand names into pipe-joined lines of at most `width` chars."""
+    rows: list[str] = []
+    current = ""
+    for name in names:
+        candidate = f"{current}|{name}" if current else name
+        if current and len(candidate) > width:
+            rows.append(current)
+            current = name
+        else:
+            current = candidate
+    if current:
+        rows.append(current)
+    return rows
+
+
+def _render_tree_node(node, group, full: bool, top_level: bool = False) -> None:
+    """Recursively add a Click group's children to a Rich tree node.
+
+    Groups whose children are all leaves collapse onto a single line
+    ("accounts list|get|create|delete") to keep the full tree readable;
+    --full expands every command onto its own line with its help text.
+    """
+    from rich.markup import escape
+
+    from .core import command_tree as ct
+
+    for name, sub in ct.children(group):
+        style = "bold yellow" if top_level else "green"
+        label = f"[{style}]{escape(name)}[/{style}]"
+        help_text = ct.short_help(sub)
+
+        if not ct.is_group(sub):
+            if help_text:
+                label += f" - [dim]{escape(help_text)}[/dim]"
+            node.add(label)
+            continue
+
+        kids = ct.children(sub)
+        if kids and not ct.has_subgroups(sub) and not full and not top_level:
+            # Compact: collapse the group's verbs onto as few lines as possible.
+            # Chunked by hand because Rich would character-wrap "a|b|c" mid-word.
+            rows = _chunk_verbs([n for n, _ in kids])
+            if len(rows) == 1:
+                node.add(f"{label} {escape(rows[0])}")
+            else:
+                child = node.add(label)
+                for row in rows:
+                    child.add(escape(row))
+            continue
+
+        if help_text:
+            label += f" - [dim]{escape(help_text)}[/dim]"
+        _render_tree_node(node.add(label), sub, full)
+
+
 @app.command("tree")
 def tree_command(
-    product: Optional[str] = typer.Argument(None, help="Filter by product: pws, pra, entitle, epmw"),
+    path: Optional[list[str]] = typer.Argument(
+        None, help="Filter to a command path, e.g. 'pws' or 'pws sessions'"
+    ),
+    full: bool = typer.Option(
+        False, "--full", "-f", help="Expand every command on its own line with help text"
+    ),
 ) -> None:
     """Show command hierarchy tree.
 
-    Displays the full command tree for navigation.
+    Built by introspecting the live command tree, so it always reflects
+    every registered command.
 
     Examples:
-        bt tree           # Show all commands
-        bt tree pws       # Show only PWS commands
-        bt tree pra       # Show only PRA commands
+        bt tree                  # Show all commands
+        bt tree pws              # Show only PWS commands
+        bt tree pws sessions     # Drill into a subcommand group
+        bt tree pws --full       # One line per command, with help text
     """
+    from rich.markup import escape
     from rich.tree import Tree
 
-    if product:
-        product = product.lower()
-        if product not in ["pws", "pra", "entitle", "epmw", "epml", "secrets", "pf", "quick", "configure"]:
-            console.print(f"[red]Unknown product: {product}[/red]")
-            console.print("Available: pws, pra, entitle, epmw, epml, secrets, pf, quick, configure")
-            raise typer.Exit(1)
-
-    tree = Tree("[bold cyan]bt[/bold cyan]")
-
-    # Top-level commands
-    if not product:
-        tree.add("[green]version[/green] - Show version")
-        tree.add("[green]whoami[/green] - Test all connections")
-        tree.add("[green]find[/green] <term> - Search commands")
-        tree.add("[green]tree[/green] - Show this tree")
-        tree.add("[green]skills[/green] - Install Claude Code skills")
-        tree.add("[green]configure[/green] - Configure products")
-
-    # PWS
-    if not product or product == "pws":
-        pws = tree.add("[bold yellow]pws[/bold yellow] - Password Safe")
-        pws.add("[green]auth[/green] test")
-        pws.add("[green]search[/green] <query> - Search across all entities")
-
-        systems = pws.add("[green]systems[/green] list|get|create|update|delete")
-        accounts = pws.add("[green]accounts[/green] list|get|create|update|delete|rotate")
-        pws.add("[green]functional[/green] list|get|create|update|delete")
-        pws.add("[green]assets[/green] list|search|get|create|update|delete")
-        pws.add("[green]credentials[/green] checkout|checkin")
-        pws.add("[green]platforms[/green] list|get")
-        pws.add("[green]workgroups[/green] list|get")
-
-        secrets = pws.add("[green]secrets[/green]")
-        secrets.add("safes list|get|create|delete")
-        secrets.add("folders list|get|create|delete")
-        secrets.add("secrets list|get|create|create-text|create-file|delete")
-
-        pws.add("[green]quick[/green] checkout|onboard|offboard")
-
-    # PRA
-    if not product or product == "pra":
-        pra = tree.add("[bold yellow]pra[/bold yellow] - Privileged Remote Access")
-        pra.add("[green]auth[/green] test")
-        pra.add("[green]jumpoint[/green] list|get")
-        pra.add("[green]jump-groups[/green] list|get|create")
-
-        ji = pra.add("[green]jump-items[/green]")
-        ji.add("shell list|get|create|update|delete")
-        ji.add("rdp list|get|create|delete")
-
-        vault = pra.add("[green]vault[/green]")
-        vault.add("accounts list|get|create|delete|checkout|checkin|get-user-data|get-public-key")
-        vault.add("groups list|get")
-
-        pra.add("[green]users[/green] list|get|update|delete|group-policies|provision")
-        pra.add("[green]teams[/green] list|get")
-        pol = pra.add("[green]policies[/green]")
-        pol.add("jump list|get")
-        pol.add("session list")
-        pol.add("group list|get|create|update|delete|copy|provision")
-        pol.add("  + jumpoints|members|jump-groups|vault-accounts|")
-        pol.add("    vault-account-groups|teams (list|add|remove)")
-
-        pra.add("[green]quick[/green] shell-jump|rdp-jump|change-group-policy-update")
-
-    # Entitle
-    if not product or product == "entitle":
-        ent = tree.add("[bold yellow]entitle[/bold yellow] - Just-in-Time Access")
-        ent.add("[green]auth[/green] test")
-        ent.add("[green]integrations[/green] list|get")
-        ent.add("[green]resources[/green] list|get|create-virtual|delete")
-        ent.add("[green]roles[/green] list|get")
-        ent.add("[green]bundles[/green] list|get|create|delete")
-        ent.add("[green]workflows[/green] list|get")
-        ent.add("[green]users[/green] list|get")
-        ent.add("[green]permissions[/green] list|revoke")
-        ent.add("[green]policies[/green] list|get")
-        ent.add("[green]accounts[/green] list")
-        ent.add("[green]agents[/green] list|get|status")
-
-    # EPMW
-    if not product or product == "epmw":
-        epmw = tree.add("[bold yellow]epmw[/bold yellow] - EPM Windows")
-        epmw.add("[green]auth[/green] test")
-        epmw.add("[green]computers[/green] list|get|archive")
-        epmw.add("[green]groups[/green] list|get")
-        epmw.add("[green]policies[/green] list|get")
-        epmw.add("[green]requests[/green] list|get|approve|deny")
-        epmw.add("[green]quick[/green] approve-all")
-
-    # EPML
-    if not product or product == "epml":
-        epml = tree.add("[bold yellow]epml[/bold yellow] - EPM Linux")
-        epml.add("[green]auth[/green] test|status")
-        epml.add("[green]settings[/green] list|get")
-        epml.add("[green]users[/green] list|get")
-        epml.add("[green]hosts[/green] list|features")
-        epml.add("[green]license[/green] get")
-        epml.add("[green]siems[/green] list")
-        audit = epml.add("[green]audit[/green]")
-        audit.add("sessions list|categories")
-        epml.add("[green]client-pkg[/green] list|status|link")
-        epml.add("[green]external-apis[/green] list|get")
-        epml.add("[green]iolog[/green] list")
-        rbp = epml.add("[green]rbp[/green] - Role-Based Policy")
-        rbp.add("cmdgrps list|create|delete  + commands list|add|clear|replace")
-        rbp.add("hostgrps list|create|delete + hosts list|add|clear|replace")
-        rbp.add("usergrps list|create|create-multiple|delete + users list|add|clear|replace")
-        rbp.add("tmdategrps list|create|delete + tmdates list|add|clear|replace")
-        rbp.add("roles list|create|delete|duplicate")
-        rbp.add("  + cmdgrps|hostgrps|usergrps|tmdategrps list|add|remove")
-        rbp.add("entitlement run [--raw]")
-        rbp.add("policy export|import|revert|versions|diff|snapshot|delete-all")
-        rbp.add("tests suites list|get|create|update|delete")
-        rbp.add("  + tests add|update|delete  + run --suite <id>")
-        rbp.add("tx status|begin|commit|rollback|abort")
-        epml.add("[green]quick[/green] tests-then-deploy")
-
-    # Secrets API
-    if not product or product == "secrets":
-        secrets = tree.add("[bold yellow]secrets[/bold yellow] - BeyondTrust Secrets API")
-        secrets.add("[green]auth[/green] test|status")
-        secrets.add("[green]folders[/green] list|get|create|delete")
-        secrets.add("[green]static[/green] list|get|create|update|delete")
-        secrets.add("[green]dynamic[/green] list|get|generate|create|delete")
-        secrets.add("[green]leases[/green] list|get|revoke")
-        secrets.add("[green]integrations[/green] list|get|create|update|delete")
-
-    # Quick
-    if not product or product == "quick":
-        quick = tree.add("[bold yellow]quick[/bold yellow] - Cross-product workflows")
-        quick.add("[green]pasm-onboard[/green] - Onboard to PWS + PRA")
-        quick.add("[green]pasm-offboard[/green] - Remove from PWS + PRA")
-        quick.add("[green]pasm-search[/green] - Search across PWS + PRA")
+    from .core import command_tree as ct
+
+    root = ct.get_root_command()
+    parts = [p.lower() for p in (path or [])]
+
+    node_cmd = ct.resolve(root, parts)
+    if node_cmd is None:
+        console.print(f"[red]Unknown command path: {escape(' '.join(parts))}[/red]")
+        available = ", ".join(n for n, _ in ct.children(root))
+        console.print(f"Available: {escape(available)}")
+        raise typer.Exit(1)
+
+    label = "[bold cyan]" + " ".join(["bt"] + parts) + "[/bold cyan]"
+    if not ct.is_group(node_cmd):
+        help_text = ct.short_help(node_cmd)
+        console.print(f"{label}" + (f" - [dim]{escape(help_text)}[/dim]" if help_text else ""))
+        return
 
+    tree = Tree(label)
+    _render_tree_node(tree, node_cmd, full, top_level=not parts)
     console.print(tree)
 
+    total = sum(1 for _ in ct.walk(node_cmd))
+    console.print(f"\n[dim]{total} command(s)[/dim]")
+
 
 def _get_all_commands() -> list[tuple[str, str]]:
-    """Build list of all commands with their help text."""
-    commands = [
-        ("bt version", "Show version information"),
-        ("bt whoami", "Test all configured products and show connection info"),
-        ("bt find <term>", "Search for commands by name or description"),
-        ("bt tree", "Show command hierarchy tree"),
-        ("bt skills", "Install Claude Code skills"),
-        ("bt configure", "Configure bt-cli settings"),
-        # PWS
-        ("bt pws auth test", "Test Password Safe connection"),
-        ("bt pws search <query>", "Search across all PWS entities"),
-        ("bt pws systems list", "List managed systems"),
-        ("bt pws systems get", "Get a managed system"),
-        ("bt pws systems create", "Create a managed system"),
-        ("bt pws systems update", "Update a managed system"),
-        ("bt pws systems delete", "Delete a managed system"),
-        ("bt pws accounts list", "List managed accounts"),
-        ("bt pws accounts get", "Get a managed account"),
-        ("bt pws accounts create", "Create a managed account"),
-        ("bt pws accounts update", "Update a managed account"),
-        ("bt pws accounts delete", "Delete a managed account"),
-        ("bt pws accounts rotate", "Rotate account password"),
-        ("bt pws functional list", "List functional accounts (for auto-management)"),
-        ("bt pws functional get", "Get a functional account"),
-        ("bt pws functional create", "Create a functional account"),
-        ("bt pws functional update", "Update a functional account"),
-        ("bt pws functional delete", "Delete a functional account"),
-        ("bt pws assets list", "List assets"),
-        ("bt pws assets search", "Search assets"),
-        ("bt pws assets get", "Get an asset"),
-        ("bt pws assets create", "Create an asset"),
-        ("bt pws assets update", "Update an asset"),
-        ("bt pws assets delete", "Delete an asset"),
-        ("bt pws credentials checkout", "Check out account credentials"),
-        ("bt pws credentials checkin", "Check in account credentials"),
-        ("bt pws secrets safes list", "List Secrets Safe safes"),
-        ("bt pws secrets folders list", "List Secrets Safe folders"),
-        ("bt pws secrets secrets list", "List secrets"),
-        ("bt pws secrets secrets create", "Create a secret"),
-        ("bt pws secrets secrets create-text", "Create a text secret (supports --file)"),
-        ("bt pws secrets secrets create-file", "Create a file secret"),
-        ("bt pws quick checkout", "Quick checkout workflow"),
-        ("bt pws quick onboard", "Quick onboard system + account"),
-        ("bt pws quick offboard", "Quick offboard system"),
-        # PRA
-        ("bt pra auth test", "Test PRA connection"),
-        ("bt pra jumpoint list", "List jumpoints"),
-        ("bt pra jump-groups list", "List jump groups"),
-        ("bt pra jump-groups create", "Create a jump group"),
-        ("bt pra jump-items shell list", "List shell jump items"),
-        ("bt pra jump-items shell create", "Create a shell jump item"),
-        ("bt pra jump-items shell update", "Update a shell jump item"),
-        ("bt pra jump-items shell delete", "Delete a shell jump item"),
-        ("bt pra jump-items rdp list", "List RDP jump items"),
-        ("bt pra jump-items rdp create", "Create an RDP jump item"),
-        ("bt pra vault accounts list", "List vault accounts"),
-        ("bt pra vault accounts get", "Get a vault account"),
-        ("bt pra vault accounts create", "Create a vault account"),
-        ("bt pra vault accounts checkout", "Checkout vault credentials"),
-        ("bt pra vault accounts get-user-data", "Generate EC2 user-data for SSH CA"),
-        ("bt pra vault accounts get-public-key", "Get SSH CA public key"),
-        ("bt pra users list", "List PRA users"),
-        ("bt pra users update", "Update a user (--unlock to clear failed_logins)"),
-        ("bt pra users group-policies", "Show GPs a user is a member of"),
-        ("bt pra users provision -u <id>", "Recompute permissions for a user"),
-        ("bt pra policies group list", "List Group Policies"),
-        ("bt pra policies group create --name X", "Create a Group Policy"),
-        ("bt pra policies group copy <id> --name Y", "Duplicate a Group Policy"),
-        ("bt pra policies group members list <id>", "List members of a GP"),
-        ("bt pra policies group jump-groups add <id>", "Attach a Jump Group to a GP"),
-        ("bt pra policies group vault-accounts add <id>", "Attach a Vault Account to a GP"),
-        ("bt pra policies group teams add <id>", "Attach a Team to a GP"),
-        ("bt pra quick change-group-policy-update", "Interactive: toggle a user's GP memberships"),
-        # Entitle
-        ("bt entitle auth test", "Test Entitle connection"),
-        ("bt entitle integrations list", "List integrations"),
-        ("bt entitle resources list", "List resources"),
-        ("bt entitle resources create-virtual", "Create a virtual resource"),
-        ("bt entitle roles list", "List roles"),
-        ("bt entitle bundles list", "List bundles"),
-        ("bt entitle workflows list", "List workflows"),
-        ("bt entitle users list", "List users"),
-        ("bt entitle permissions list", "List permissions"),
-        ("bt entitle permissions revoke", "Revoke a permission"),
-        ("bt entitle agents list", "List agents"),
-        ("bt entitle agents status", "Show agent status summary"),
-        # EPMW
-        ("bt epmw auth test", "Test EPM Windows connection"),
-        ("bt epmw computers list", "List managed computers"),
-        ("bt epmw computers archive", "Archive a computer"),
-        ("bt epmw groups list", "List computer groups"),
-        ("bt epmw policies list", "List policies"),
-        ("bt epmw requests list", "List elevation requests"),
-        ("bt epmw requests approve", "Approve an elevation request"),
-        ("bt epmw requests deny", "Deny an elevation request"),
-        ("bt epmw quick approve-all", "Approve all pending requests"),
-        # EPML
-        ("bt epml auth test", "Test EPM Linux connection"),
-        ("bt epml auth status", "Show EPM Linux configuration status"),
-        ("bt epml settings list", "List site-level settings"),
-        ("bt epml settings get", "Get a single setting by key"),
-        ("bt epml users list", "List EPM Linux users"),
-        ("bt epml users get", "Get a user by ID"),
-        ("bt epml hosts list", "List PMUL hosts"),
-        ("bt epml hosts features", "Show feature flags per PMUL host"),
-        ("bt epml license get", "Get the EPM Linux license"),
-        ("bt epml siems list", "List SIEM forwarders"),
-        ("bt epml audit sessions list", "List audit session records"),
-        ("bt epml audit sessions categories", "List audit session categories"),
-        ("bt epml client-pkg list", "List built client installer packages"),
-        ("bt epml client-pkg status", "Client package build status"),
-        ("bt epml client-pkg link", "Get presigned download URL for a package"),
-        ("bt epml external-apis list", "List external API integrations"),
-        ("bt epml external-apis get", "Get an external API by ID"),
-        ("bt epml iolog list", "List iolog files for a host"),
-        # EPML RBP
-        ("bt epml rbp cmdgrps list", "List RBP command groups"),
-        ("bt epml rbp cmdgrps create", "Create an RBP command group"),
-        ("bt epml rbp cmdgrps delete", "Delete RBP command groups"),
-        ("bt epml rbp cmdgrps commands list", "List commands within a cmdgrp"),
-        ("bt epml rbp cmdgrps commands add", "Add commands to a cmdgrp"),
-        ("bt epml rbp cmdgrps commands clear", "Clear ALL commands in a cmdgrp"),
-        ("bt epml rbp cmdgrps commands replace", "Replace cmdgrp's full command list"),
-        ("bt epml rbp hostgrps list", "List RBP host groups"),
-        ("bt epml rbp hostgrps create", "Create an RBP host group"),
-        ("bt epml rbp hostgrps delete", "Delete RBP host groups"),
-        ("bt epml rbp hostgrps hosts list", "List hosts within a hostgrp"),
-        ("bt epml rbp hostgrps hosts add", "Add hosts to a hostgrp"),
-        ("bt epml rbp hostgrps hosts clear", "Clear ALL hosts in a hostgrp"),
-        ("bt epml rbp hostgrps hosts replace", "Replace hostgrp's full host list"),
-        ("bt epml rbp usergrps list", "List RBP user groups"),
-        ("bt epml rbp usergrps create", "Create an RBP user group"),
-        ("bt epml rbp usergrps create-multiple", "Bulk-create user groups from a JSON file"),
-        ("bt epml rbp usergrps delete", "Delete RBP user groups"),
-        ("bt epml rbp usergrps users list", "List users within a usergrp"),
-        ("bt epml rbp usergrps users add", "Add users to a usergrp"),
-        ("bt epml rbp usergrps users clear", "Clear ALL users in a usergrp"),
-        ("bt epml rbp usergrps users replace", "Replace usergrp's full user list"),
-        ("bt epml rbp tmdategrps list", "List RBP time/date groups"),
-        ("bt epml rbp tmdategrps create", "Create an RBP time/date group"),
-        ("bt epml rbp tmdategrps delete", "Delete RBP time/date groups"),
-        ("bt epml rbp tmdategrps tmdates list", "List time/date entries in a group"),
-        ("bt epml rbp tmdategrps tmdates add", "Add time/date entries"),
-        ("bt epml rbp tmdategrps tmdates clear", "Clear ALL time/dates in a group"),
-        ("bt epml rbp tmdategrps tmdates replace", "Replace the group's full tmdate list"),
-        ("bt epml rbp roles list", "List RBP roles"),
-        ("bt epml rbp roles create", "Create an RBP role"),
-        ("bt epml rbp roles delete", "Delete RBP roles"),
-        ("bt epml rbp roles duplicate", "Duplicate an RBP role"),
-        ("bt epml rbp roles cmdgrps list/add/remove", "Manage cmdgrps on a role"),
-        ("bt epml rbp roles hostgrps list/add/remove", "Manage hostgrps on a role"),
-        ("bt epml rbp roles usergrps list/add/remove", "Manage usergrps on a role"),
-        ("bt epml rbp roles tmdategrps list/add/remove", "Manage tmdategrps on a role"),
-        ("bt epml rbp entitlement run", "Run the entitlement report"),
-        ("bt epml rbp policy export", "Export the full RBP DB"),
-        ("bt epml rbp policy import", "Import an RBP DB serialization"),
-        ("bt epml rbp policy revert", "Revert policy to last committed state"),
-        ("bt epml rbp policy versions", "List RBP policy versions"),
-        ("bt epml rbp policy diff", "Diff current draft against a prior version"),
-        ("bt epml rbp policy snapshot", "Get full current RBP snapshot"),
-        ("bt epml rbp policy delete-all", "Delete the entire RBP DB (destructive)"),
-        ("bt epml rbp tx status", "Show RBP transaction state"),
-        ("bt epml rbp tx begin", "Begin an RBP transaction"),
-        ("bt epml rbp tx commit", "Commit the RBP transaction"),
-        ("bt epml rbp tx rollback", "Rollback the RBP transaction"),
-        ("bt epml rbp tx abort", "Abort the RBP transaction"),
-        ("bt epml rbp tests suites list", "List RBP test suites"),
-        ("bt epml rbp tests suites get", "Get a test suite (with tests)"),
-        ("bt epml rbp tests suites create", "Create a test suite"),
-        ("bt epml rbp tests suites update", "Update a test suite"),
-        ("bt epml rbp tests suites delete", "Delete a test suite"),
-        ("bt epml rbp tests tests add", "Add a test to a suite"),
-        ("bt epml rbp tests tests update", "Update a test"),
-        ("bt epml rbp tests tests delete", "Delete a test"),
-        ("bt epml rbp tests run", "Run a test suite, exit non-zero on failure"),
-        ("bt epml quick tests-then-deploy", "Run tests, commit or rollback the open RBP transaction"),
-        # Secrets API
-        ("bt secrets auth test", "Test BeyondTrust Secrets API connection"),
-        ("bt secrets auth status", "Show Secrets API configuration status"),
-        ("bt secrets folders list", "List folders (server-side filter)"),
-        ("bt secrets folders get", "Get folder metadata"),
-        ("bt secrets folders create", "Create a folder"),
-        ("bt secrets folders delete", "Delete a folder"),
-        ("bt secrets static list", "List static secrets"),
-        ("bt secrets static get", "Get a static secret value"),
-        ("bt secrets static create", "Create a static secret"),
-        ("bt secrets static update", "Update a static secret (bumps version)"),
-        ("bt secrets static delete", "Delete a static secret"),
-        ("bt secrets dynamic list", "List dynamic-secret configs"),
-        ("bt secrets dynamic get", "Get a dynamic-secret config"),
-        ("bt secrets dynamic generate", "Mint a fresh dynamic credential (e.g. AWS STS)"),
-        ("bt secrets dynamic create", "Create a dynamic-secret config"),
-        ("bt secrets dynamic delete", "Delete a dynamic-secret config"),
-        ("bt secrets leases list", "List active leases for a dynamic secret"),
-        ("bt secrets leases get", "Get lease details by id"),
-        ("bt secrets leases revoke", "Revoke a lease (scope-gated; lab returns 403)"),
-        ("bt secrets integrations list", "List integrations"),
-        ("bt secrets integrations get", "Get an integration"),
-        ("bt secrets integrations create", "Create an integration"),
-        ("bt secrets integrations update", "Update an integration (PUT or --partial PATCH)"),
-        ("bt secrets integrations delete", "Delete an integration"),
-        # Quick
-        ("bt quick pasm-onboard", "Onboard host to PWS + PRA (Total PASM)"),
-        ("bt quick pasm-offboard", "Offboard host from PWS + PRA"),
-        ("bt quick pasm-search", "Search across PWS + PRA"),
-    ]
-    return commands
+    """List every command with its help text, read from the live command tree."""
+    from .core import command_tree as ct
+
+    return list(ct.walk(ct.get_root_command()))
 
 
 @app.command("skills")

bt_cli-0.4.73/src/bt_cli/core/command_tree.py

@@ -0,0 +1,82 @@
+"""Introspection over the live Typer command tree.
+
+`bt tree` and `bt find` used to be hand-maintained lists that silently drifted
+from the real command surface every time a command was added. Everything here
+walks the actual command objects instead, so the two can never disagree again.
+
+Deliberately does NOT ``import click``. Typer >= 0.26 vendors click as the
+private ``typer._click`` and no longer declares a click dependency, so a
+top-level import fails outright on a stock install; and its ``TyperGroup``
+subclasses ``Command`` rather than a ``Group``, so ``isinstance(cmd, Group)``
+is wrong there too. Duck-typing on ``.commands`` is correct on every typer
+version the project supports (>=0.12).
+"""
+
+from typing import Any, Iterator, Optional
+
+
+def get_root_command() -> Any:
+    """Return the root command object for the `bt` app."""
+    from typer.main import get_command
+
+    from ..cli import app
+
+    return get_command(app)
+
+
+def is_group(cmd: Any) -> bool:
+    """True if the command has subcommands (a group, in any typer version)."""
+    commands = getattr(cmd, "commands", None)
+    return commands is not None and hasattr(commands, "items")
+
+
+def short_help(cmd: Any) -> str:
+    """First meaningful line of a command's help text."""
+    text = getattr(cmd, "short_help", None) or getattr(cmd, "help", None) or ""
+    for line in text.splitlines():
+        line = line.strip()
+        if line:
+            return line
+    return ""
+
+
+def children(group: Any) -> list[tuple[str, Any]]:
+    """Visible child commands of a group, sorted by name."""
+    return [
+        (name, cmd)
+        for name, cmd in sorted(group.commands.items())
+        if not getattr(cmd, "hidden", False)
+    ]
+
+
+def has_subgroups(group: Any) -> bool:
+    return any(is_group(cmd) for _, cmd in children(group))
+
+
+def walk(cmd: Any, path: Optional[list[str]] = None) -> Iterator[tuple[str, str]]:
+    """Yield (full command path, short help) for every leaf command, depth-first.
+
+    A group that can be invoked on its own (``invoke_without_command``) is
+    yielded as a runnable command in addition to being recursed into.
+    """
+    path = path or ["bt"]
+    if is_group(cmd):
+        if getattr(cmd, "invoke_without_command", False):
+            yield " ".join(path), short_help(cmd)
+        for name, sub in children(cmd):
+            yield from walk(sub, path + [name])
+    else:
+        yield " ".join(path), short_help(cmd)
+
+
+def resolve(root: Any, parts: list[str]) -> Optional[Any]:
+    """Follow a command path (e.g. ["pws", "sessions"]) from the root."""
+    cmd = root
+    for part in parts:
+        if not is_group(cmd):
+            return None
+        sub = cmd.commands.get(part)
+        if sub is None or getattr(sub, "hidden", False):
+            return None
+        cmd = sub
+    return cmd