netbox-super-cli 1.2.0__tar.gz → 1.3.0__tar.gz

netbox_super_cli-1.3.0/.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+
+updates:
+  # Keep GitHub Actions pinned to commit SHAs maintainable: when an upstream
+  # action ships a new release, Dependabot opens a PR bumping the SHA and
+  # updates the trailing `# vX.Y.Z` comment to the new semver. `directory: "/"`
+  # monitors every workflow under .github/workflows/. Actions left on a
+  # floating tag by design (e.g. pypa/gh-action-pypi-publish@release/v1) are
+  # not bumped because they have no SHA to advance.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "ci"

{netbox_super_cli-1.2.0 → netbox_super_cli-1.3.0}/.github/workflows/bench.yml

@@ -6,12 +6,15 @@ on:
     branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   startup-time:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v4
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v7
       - name: Install
         run: uv sync --all-extras --dev
       - name: Benchmark

{netbox_super_cli-1.2.0 → netbox_super_cli-1.3.0}/.github/workflows/claude.yml

@@ -10,6 +10,18 @@ on:
   pull_request_review:
     types: [submitted]
 
+# Least-privilege default for the whole workflow; the single `claude` job
+# below re-declares the same scopes explicitly. The action only reads PRs
+# and issues here (no auto-commit/comment requested), so write scopes are
+# intentionally withheld — id-token: write is the sole write, required for
+# the action's OIDC handshake.
+permissions:
+  contents: read
+  pull-requests: read
+  issues: read
+  id-token: write
+  actions: read # Required for Claude to read CI results on PRs
+
 jobs:
   claude:
     # Only trusted authors (repo owner/members/collaborators) can invoke the
@@ -29,7 +41,7 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 1
 

{netbox_super_cli-1.2.0 → netbox_super_cli-1.3.0}/.github/workflows/docs.yml

@@ -26,9 +26,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
       - name: Install Python
@@ -52,4 +52,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

{netbox_super_cli-1.2.0 → netbox_super_cli-1.3.0}/.github/workflows/e2e.yml

@@ -15,13 +15,27 @@ on:
       - '.github/workflows/e2e.yml'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   e2e:
+    name: e2e (${{ matrix.netbox-version }})
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        # Latest patch of each supported NetBox minor. A regression on one
+        # version surfaces as a per-dimension failure rather than a sweeping red.
+        netbox-version:
+          - v4.5.10
+          - v4.6.3
+    env:
+      NETBOX_IMAGE: netboxcommunity/netbox:${{ matrix.netbox-version }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v3
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v7
       - name: Sync deps
         run: uv sync --frozen
       - name: Start NetBox

{netbox_super_cli-1.2.0 → netbox_super_cli-1.3.0}/.github/workflows/lint.yml

@@ -5,13 +5,16 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
       - name: Install Python
@@ -28,9 +31,9 @@ jobs:
   docs-reference-fresh:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
       - name: Install Python
@@ -43,9 +46,9 @@ jobs:
   agents-md-fresh:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
       - name: Install Python

{netbox_super_cli-1.2.0 → netbox_super_cli-1.3.0}/.github/workflows/release.yml

@@ -39,7 +39,7 @@ jobs:
     # prerequisites).
     steps:
       - name: Checkout (full history for changelog notes)
-        uses: actions/checkout@v4
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1
         with:
           fetch-depth: 0
 
@@ -51,7 +51,7 @@ jobs:
           # main. Tags pushed from a topic branch (or any unmerged commit)
           # would otherwise publish from un-reviewed code. This guard rejects
           # any tag whose commit is not reachable from origin/main.
-          # actions/checkout@v4 with fetch-depth: 0 fetches the tag's full
+          # actions/checkout@v5 with fetch-depth: 0 fetches the tag's full
           # history but does not populate origin/main as a ref locally; we
           # fetch it explicitly here.
           git fetch origin main
@@ -62,7 +62,7 @@ jobs:
           echo "Tag $GITHUB_REF_NAME ($GITHUB_SHA) is on main."
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # v7.6.0
         with:
           enable-cache: true
 

netbox_super_cli-1.3.0/.github/workflows/skill-convention-review.yml

@@ -0,0 +1,48 @@
+name: skill-convention-review
+
+# Quarterly reminder to re-check the four per-platform Skill-install conventions
+# hard-coded in nsc/cli/skill_commands.py `_RESOLVERS`. Opens a tracking issue so
+# a maintainer re-reads each canonical source and updates code+docs on drift.
+
+on:
+  schedule:
+    # 09:00 UTC on the 1st of Feb/May/Aug/Nov.
+    - cron: "0 9 1 2,5,8,11 *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  open-tracking-issue:
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - name: Open quarterly convention re-check issue
+        run: |
+          gh issue create \
+            --repo "${{ github.repository }}" \
+            --title "Quarterly: re-check Skill install conventions" \
+            --body "$(cat <<'EOF'
+          Quarterly re-check of the four per-platform Skill-install conventions
+          hard-coded in `nsc/cli/skill_commands.py` `_RESOLVERS`. Re-read each
+          canonical source below and confirm the documented user-scoped path is
+          still current.
+
+          - [ ] **claude-code** — https://code.claude.com/docs/en/skills
+          - [ ] **codex** — https://developers.openai.com/codex/skills
+          - [ ] **gemini** — https://geminicli.com/docs/cli/skills/
+          - [ ] **copilot** — https://docs.github.com/en/copilot/how-tos/copilot-cli/customize-copilot/add-skills
+
+          If any convention drifted, update all of:
+
+          - `nsc/cli/skill_commands.py` (the relevant `_resolve_*` resolver)
+          - `docs/guides/using-with-ai-agents.md` (per-target path table)
+          - `skills/netbox-super-cli/SKILL.md` (if it lists per-target paths)
+          - `CHANGELOG.md` (note the change under the unreleased section)
+
+          Close this issue once all four are confirmed (and any drift is shipped).
+          EOF
+          )"

{netbox_super_cli-1.2.0 → netbox_super_cli-1.3.0}/.github/workflows/test.yml

@@ -5,6 +5,9 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}
@@ -14,9 +17,9 @@ jobs:
         os: [ubuntu-latest, macos-latest]
         python: ["3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
       - name: Install Python

{netbox_super_cli-1.2.0 → netbox_super_cli-1.3.0}/.pre-commit-config.yaml

@@ -24,6 +24,7 @@ repos:
         # plus type stubs for any third-party packages used in scripts/.
         additional_dependencies:
           - pydantic>=2.7
+          - click>=8.1
           - typer>=0.12
           - rich>=13.7
           - httpx>=0.27

{netbox_super_cli-1.2.0 → netbox_super_cli-1.3.0}/AGENTS.md

@@ -21,6 +21,7 @@ This is the contributor guide for AI agents (and humans!) modifying this repo. T
 - `nsc/cache/` — disk cache for generated command-models.
 - `nsc/auth/` — login verification helpers (pre-flight probes, token rotate).
 - `nsc/aliases/` — curated alias resolver (`ls`, `get`, `rm`, `search`). Framework-free.
+- `nsc/completion/` — dynamic shell-completion: framework-free providers + cheap on-disk cache probe + Typer `shell_complete` callbacks.
 - `nsc/skill/` — bundle-path helper for the portable `SKILL.md` shipped in the wheel.
 - `nsc/schemas/bundled/` — versioned NetBox OpenAPI snapshots, fallback when offline.
 

{netbox_super_cli-1.2.0 → netbox_super_cli-1.3.0}/CHANGELOG.md

@@ -2,6 +2,94 @@
 
 All notable changes to netbox-super-cli are tracked here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) loosely. From v1.0.0 onward, releases follow [Semantic Versioning](https://semver.org/) and the version in `pyproject.toml` matches the git tag. Pre-1.0 milestones (Phase 1-5) were pinned by tag while `pyproject.toml` stayed at `0.0.1`.
 
+## v1.3.0 — 2026-06-25
+
+Minor release. A batch of user-facing features — singular alias forms, parallel
+bulk writes, dynamic shell completion, and a strict `audit_redaction: full`
+mode — plus a round of state-directory, workflow, and supply-chain hardening.
+
+### Added
+
+- **Singular alias forms** ([#6]). `nsc ls device` now resolves like
+  `nsc ls devices` for a curated set of nine resources: `device`, `prefix`,
+  `tenant`, `vlan`, `site`, `rack`, `interface`, `cable`, and `tag`. A
+  non-curated singular that does not resolve suggests the plural
+  (e.g. "Did you mean `devices`?") rather than guessing.
+- **`--workers N` on bulk writes** ([#3]). Bulk write commands
+  (`create --ndjson`, `update --ndjson`, …) accept `--workers N` to run up to N
+  concurrent in-flight requests (default `1`, max `32`). Per-record
+  `--on-error` semantics are preserved, and the audit log stays one well-formed
+  line per record (writes are thread-safe). With `--on-error stop`, the bound
+  applies to *new* submissions — in-flight requests (up to N) are allowed to
+  complete.
+- **Dynamic shell completion** ([#2]). Completion now reads the cached schema to
+  complete dynamic values: `nsc ls dev<TAB>` →
+  `devices device-roles device-types`; `nsc --profile <TAB>` → profile names;
+  `nsc <tag> <resource> list --status <TAB>` → enum values. This complements the
+  existing static `--install-completion` stubs.
+- **`audit_redaction: full` config mode** ([#5]). A new strict redaction mode
+  redacts ALL request/response bodies, leaving only
+  `{method, url, status_code, timestamp, profile}` per audit line. The `url` is
+  sanitized — the query string and any `user:pass@` credentials are stripped.
+  The default stays `safe`.
+
+### Changed
+
+- **Faster command-tree registration / startup**. The static command-option
+  specs (global read flags and write flags) are now built once at import and
+  shared across all commands instead of being rebuilt per command, recovering a
+  startup-time regression introduced when `--workers` was added.
+- **`~/.nsc` state root hardened to `0700`** ([#90]). Defense-in-depth on the
+  state directory itself; config and audit files were already `0600` and
+  `logs/` already `0700`.
+- **CI runners on Node.js 24** ([#9]). Bumped `actions/checkout` to v5,
+  `astral-sh/setup-uv` to v7, and `deploy-pages` to v5.
+- **Least-privilege workflow permissions** ([#12]). Every GitHub Actions
+  workflow now declares an explicit least-privilege `permissions:` block.
+- **Release workflow actions pinned to commit SHAs** ([#16]). `release.yml`
+  pins `checkout` and `setup-uv` to commit SHAs (the PyPA publish action stays
+  on its floating tag per PyPA guidance); added `.github/dependabot.yml`
+  (github-actions ecosystem, weekly).
+- **E2E CI matrix over NetBox v4.5 and v4.6** ([#4]). The end-to-end job now
+  runs against both NetBox lines (`fail-fast: false`, per-version labels).
+- **`nsc skill install` now supports Gemini and Copilot CLI** ([#7]). Their
+  user-scoped Skill paths (`~/.gemini/skills/`, `~/.copilot/skills/`) are now
+  confirmed and documented, so `--target gemini` / `--target copilot` resolve to
+  a real install path instead of printing manual instructions. A quarterly CI
+  job opens a tracking issue to re-check the four per-platform conventions.
+
+[#6]: https://github.com/thomaschristory/netbox-super-cli/issues/6
+[#3]: https://github.com/thomaschristory/netbox-super-cli/issues/3
+[#2]: https://github.com/thomaschristory/netbox-super-cli/issues/2
+[#5]: https://github.com/thomaschristory/netbox-super-cli/issues/5
+[#7]: https://github.com/thomaschristory/netbox-super-cli/issues/7
+[#90]: https://github.com/thomaschristory/netbox-super-cli/issues/90
+[#9]: https://github.com/thomaschristory/netbox-super-cli/issues/9
+[#12]: https://github.com/thomaschristory/netbox-super-cli/issues/12
+[#16]: https://github.com/thomaschristory/netbox-super-cli/issues/16
+[#4]: https://github.com/thomaschristory/netbox-super-cli/issues/4
+
+## v1.2.1 — 2026-06-25
+
+Patch release. Fixes foreign-key handling in the interactive TUI.
+
+### Fixed
+
+- **TUI foreign-key fields show names and a chooser, not raw IDs** ([#97]).
+  In the bulk-edit, single-edit and detail screens, FK fields (device `role`,
+  `site`, `tenant`, `device_type`, …) now render their human-readable
+  `display`/`name` in the confirmation diff and present a searchable
+  record-picker dropdown of valid related objects, instead of showing the
+  numeric id and requiring a raw id to be typed. The outgoing `PATCH` still
+  carries the id, so the wire format is unchanged. FK detection is now keyed on
+  the record's nested object rather than the widget kind, because NetBox's
+  writable schema types FK fields as `oneOf[integer, brief]` (no primitive
+  type), which previously fell through to a free-text widget. When a relation's
+  target resource has no list endpoint, the field gracefully falls back to
+  raw-id entry with a hint rather than an inert chooser button.
+
+[#97]: https://github.com/thomaschristory/netbox-super-cli/issues/97
+
 ## v1.2.0 — 2026-06-24
 
 Minor release. Adds an **interactive terminal UI** — a keyboard-driven, fully

{netbox_super_cli-1.2.0 → netbox_super_cli-1.3.0}/CLAUDE.md

@@ -14,6 +14,7 @@ This is the contributor guide for AI agents (and humans!) modifying this repo. T
 - `nsc/cache/` — disk cache for generated command-models.
 - `nsc/auth/` — login verification helpers (pre-flight probes, token rotate).
 - `nsc/aliases/` — curated alias resolver (`ls`, `get`, `rm`, `search`). Framework-free.
+- `nsc/completion/` — dynamic shell-completion: framework-free providers + cheap on-disk cache probe + Typer `shell_complete` callbacks.
 - `nsc/skill/` — bundle-path helper for the portable `SKILL.md` shipped in the wheel.
 - `nsc/schemas/bundled/` — versioned NetBox OpenAPI snapshots, fallback when offline.
 

{netbox_super_cli-1.2.0 → netbox_super_cli-1.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: netbox-super-cli
-Version: 1.2.0
+Version: 1.3.0
 Summary: Dynamic NetBox CLI generated from the live OpenAPI schema.
 Project-URL: Homepage, https://github.com/thomaschristory/netbox-super-cli
 Project-URL: Issues, https://github.com/thomaschristory/netbox-super-cli/issues
@@ -103,6 +103,10 @@ uv run nsc dcim devices create -f device.yaml --apply
 uv run nsc dcim devices create -f devices.yaml --apply
 uv run nsc dcim devices create -f devices.yaml --no-bulk --on-error continue --apply
 
+# Speed up a loop-mode bulk write with concurrent requests (default 1, max 32).
+# Per-record --on-error semantics hold; the audit log stays one line per record.
+uv run nsc dcim devices create -f devices.ndjson --workers 8 --apply
+
 # NDJSON / JSONL — one record per line; parse failures abort the whole batch
 # before any wire request fires (`type: input_error`, exit 4, `details.bad_lines`).
 uv run nsc dcim devices create -f devices.ndjson --apply
@@ -137,7 +141,26 @@ Stdin is sniffed from the first 512 bytes (first non-whitespace byte plus a one-
 - HTTP headers in the `SENSITIVE_HEADERS` set (e.g. `Authorization`, `X-API-Key`) — replaced with `"<redacted>"`.
 - Request-body fields whose OpenAPI definition has `format: password` OR whose name (case-insensitive) is one of: `password`, `secret`, `token`, `api_key`, `apikey`, `private_key`, `passphrase`, `client_secret`. Nested fields and arrays of objects are walked recursively.
 
-The wire body sent to NetBox is **not** redacted — only the audit log. A failed write still records the redacted body; redaction is irreversible. Treat `audit.jsonl` like a verbose application log: gate it behind your home-directory permissions and rotate / archive accordingly. A "redact everything" mode is on the post-v1.0 roadmap.
+The wire body sent to NetBox is **not** redacted — only the audit log. A failed write still records the redacted body; redaction is irreversible. Treat `audit.jsonl` like a verbose application log: gate it behind your home-directory permissions and rotate / archive accordingly.
+
+For a stricter posture, set `audit_redaction: full` in `~/.nsc/config.yaml` (the default is `safe`, the field-level redaction described above). In `full` mode every audit line keeps only `{method, url, status_code, timestamp, profile}` — all request and response bodies are dropped, and the `url` is sanitized (query string and any `user:pass@` credentials stripped).
+
+## Curated aliases
+
+`nsc ls`, `nsc get`, `nsc rm`, and `nsc search` are short verbs over the dynamic
+command tree.
+
+```sh
+nsc ls devices                 # list a resource by plural name
+nsc ls device                  # singular also works (curated set, see below)
+nsc get devices 7              # one record by id or name
+nsc rm devices 7 --apply       # delete (dry-run by default)
+nsc search "rack-42"           # /api/search/ on NetBox 4.5+
+```
+
+Singular forms resolve for a curated set of nine resources: `device`, `prefix`,
+`tenant`, `vlan`, `site`, `rack`, `interface`, `cable`, and `tag`. Any other
+singular that does not resolve suggests its plural ("Did you mean `devices`?").
 
 ## Output and errors
 
@@ -183,7 +206,16 @@ nsc --install-completion         # auto-detects $SHELL
 nsc --show-completion            # prints the script instead of installing
 ```
 
-Typer supports `bash`, `zsh`, `fish`, and `pwsh`. Completion of dynamic values (resource names, profile names, filter keys) is on the post-1.0 roadmap.
+Typer supports `bash`, `zsh`, `fish`, and `pwsh`.
+
+Completion of dynamic values reads the cached schema and complements the static
+stubs above:
+
+```sh
+nsc ls dev<TAB>                               # devices device-roles device-types
+nsc --profile <TAB>                           # configured profile names
+nsc dcim devices list --status <TAB>          # enum values for the field
+```
 
 ## Bundled Skill for AI agents
 

{netbox_super_cli-1.2.0 → netbox_super_cli-1.3.0}/README.md

@@ -74,6 +74,10 @@ uv run nsc dcim devices create -f device.yaml --apply
 uv run nsc dcim devices create -f devices.yaml --apply
 uv run nsc dcim devices create -f devices.yaml --no-bulk --on-error continue --apply
 
+# Speed up a loop-mode bulk write with concurrent requests (default 1, max 32).
+# Per-record --on-error semantics hold; the audit log stays one line per record.
+uv run nsc dcim devices create -f devices.ndjson --workers 8 --apply
+
 # NDJSON / JSONL — one record per line; parse failures abort the whole batch
 # before any wire request fires (`type: input_error`, exit 4, `details.bad_lines`).
 uv run nsc dcim devices create -f devices.ndjson --apply
@@ -108,7 +112,26 @@ Stdin is sniffed from the first 512 bytes (first non-whitespace byte plus a one-
 - HTTP headers in the `SENSITIVE_HEADERS` set (e.g. `Authorization`, `X-API-Key`) — replaced with `"<redacted>"`.
 - Request-body fields whose OpenAPI definition has `format: password` OR whose name (case-insensitive) is one of: `password`, `secret`, `token`, `api_key`, `apikey`, `private_key`, `passphrase`, `client_secret`. Nested fields and arrays of objects are walked recursively.
 
-The wire body sent to NetBox is **not** redacted — only the audit log. A failed write still records the redacted body; redaction is irreversible. Treat `audit.jsonl` like a verbose application log: gate it behind your home-directory permissions and rotate / archive accordingly. A "redact everything" mode is on the post-v1.0 roadmap.
+The wire body sent to NetBox is **not** redacted — only the audit log. A failed write still records the redacted body; redaction is irreversible. Treat `audit.jsonl` like a verbose application log: gate it behind your home-directory permissions and rotate / archive accordingly.
+
+For a stricter posture, set `audit_redaction: full` in `~/.nsc/config.yaml` (the default is `safe`, the field-level redaction described above). In `full` mode every audit line keeps only `{method, url, status_code, timestamp, profile}` — all request and response bodies are dropped, and the `url` is sanitized (query string and any `user:pass@` credentials stripped).
+
+## Curated aliases
+
+`nsc ls`, `nsc get`, `nsc rm`, and `nsc search` are short verbs over the dynamic
+command tree.
+
+```sh
+nsc ls devices                 # list a resource by plural name
+nsc ls device                  # singular also works (curated set, see below)
+nsc get devices 7              # one record by id or name
+nsc rm devices 7 --apply       # delete (dry-run by default)
+nsc search "rack-42"           # /api/search/ on NetBox 4.5+
+```
+
+Singular forms resolve for a curated set of nine resources: `device`, `prefix`,
+`tenant`, `vlan`, `site`, `rack`, `interface`, `cable`, and `tag`. Any other
+singular that does not resolve suggests its plural ("Did you mean `devices`?").
 
 ## Output and errors
 
@@ -154,7 +177,16 @@ nsc --install-completion         # auto-detects $SHELL
 nsc --show-completion            # prints the script instead of installing
 ```
 
-Typer supports `bash`, `zsh`, `fish`, and `pwsh`. Completion of dynamic values (resource names, profile names, filter keys) is on the post-1.0 roadmap.
+Typer supports `bash`, `zsh`, `fish`, and `pwsh`.
+
+Completion of dynamic values reads the cached schema and complements the static
+stubs above:
+
+```sh
+nsc ls dev<TAB>                               # devices device-roles device-types
+nsc --profile <TAB>                           # configured profile names
+nsc dcim devices list --status <TAB>          # enum values for the field
+```
 
 ## Bundled Skill for AI agents
 

{netbox_super_cli-1.2.0 → netbox_super_cli-1.3.0}/docs/architecture/caching.md

@@ -70,3 +70,12 @@ nsc cache prune --apply              # actually delete
 nsc cache prune --max-age 30 --apply
 nsc cache prune --output json        # structured envelope
 ```
+
+## Shell completion reads the cache
+
+Dynamic shell completion (`nsc/completion/`) is backed by this same on-disk
+cache. At TAB time the completion providers probe the cached command-model for
+the active profile (`<profile>/<schema-hash>.json`) — never the network — so
+resource-name, profile, and enum suggestions are cheap. A missing or corrupt
+cache degrades to no suggestions rather than blocking the prompt; the cache is
+populated by the first real command (or `nsc login --fetch-schema`).

{netbox_super_cli-1.2.0 → netbox_super_cli-1.3.0}/docs/architecture/http-client.md

@@ -22,6 +22,17 @@
 - Pagination helper that follows `next` URLs (used by `--all`).
 - Audit log appender at `~/.nsc/logs/audit.jsonl` — written for writes
   always, and for any request when `--debug` is set.
+
+## Concurrency (`--workers N`)
+
+Bulk write commands accept `--workers N` (default 1, max 32) to keep up to N
+requests in flight. Concurrency is **thread-based**: a `ThreadPoolExecutor`
+fans the per-record loop out over the single sync `httpx.Client` — there is no
+async path. Per-record `--on-error` semantics are preserved regardless of
+worker count. Audit appends are serialized by a module-level lock
+(`_APPEND_LOCK` in `nsc/http/audit.py`) wrapped around the whole
+open/write/close, so concurrent workers can never interleave a partial line —
+each record is one well-formed JSON line.
 - A "last request" snapshot at `~/.nsc/logs/last-request.json`
   (overwritten every call, regardless of `--debug`) — handy for triage.
 
@@ -55,9 +66,26 @@ Each line of `audit.jsonl` is a JSON object with:
 - `duration_ms`, `attempt_n`, `final_attempt`, `error_kind`
 - `dry_run`, `preflight_blocked`, `record_indices`, `applied`, `explain`
 
+## Redaction modes
+
+Redaction is applied when each entry is serialized (`nsc/http/audit.py`), so a
+failed retry never unredacts. The `defaults.audit_redaction` config setting
+selects the mode:
+
+- `safe` (default) — the full audit shape above, with sensitive headers and
+  `sensitive_paths` body fields masked to `"<redacted>"` and bodies over 256 KB
+  truncated.
+- `full` — compliance escalation that drops every body, header, and query
+  string entirely. Each line keeps exactly five keys —
+  `{method, url, status_code, timestamp, profile}` — and `url` is sanitized to
+  scheme + host[:port] + path so neither query params nor `user:pass@` userinfo
+  can leak through the one remaining string field.
+
 The audit file is append-only and rotates to `audit.jsonl.1` at 10 MB; it is
 created owner-only (`0600`) inside a `0700` logs directory, and failed writes do
-NOT unredact. See
+NOT unredact. The state root (`~/.nsc`) and its subdirectories are clamped to
+`0700` via a shared `ensure_private_dir()` (`nsc/config/settings.py`) used by
+both the config writer and the audit-dir code. See
 [Writes and safety](../guides/writes-and-safety.md) for the full redaction
 contract.
 

{netbox_super_cli-1.2.0 → netbox_super_cli-1.3.0}/docs/architecture/overview.md

@@ -17,6 +17,7 @@ nsc/
 ├── cache/           # On-disk cache for generated CommandModels
 ├── auth/            # Login verification helpers (verify probe, token rotate)
 ├── aliases/         # Curated alias resolver (ls/get/rm/search)
+├── completion/      # Dynamic shell-completion: providers + cache probe + Typer callbacks
 ├── skill/           # Bundle-path helper for the portable SKILL.md
 └── schemas/bundled/ # Versioned NetBox OpenAPI snapshots (offline fallback)
 ```

{netbox_super_cli-1.2.0 → netbox_super_cli-1.3.0}/docs/contributing/development.md

@@ -41,6 +41,23 @@ just docs-build    # build the site, fail on broken links / missing nav
 underlying issue and create a new commit. If `ruff format` modifies a file
 during the hook, re-`git add` and re-commit.
 
+## CI
+
+GitHub Actions mirrors the local `just` targets, plus an end-to-end suite:
+
+- **E2E is multi-version.** The e2e workflow runs a matrix over NetBox **4.5
+  and 4.6** (latest patch of each minor) with `fail-fast: false`, so a
+  regression on one version surfaces as a per-dimension failure rather than a
+  sweeping red.
+- **Runners are on Node.js 24** — the JS-based actions are pinned to their
+  Node-24 majors (`actions/checkout@v5`, `astral-sh/setup-uv@v7`,
+  `actions/deploy-pages@v5`).
+- **Least-privilege permissions.** Every workflow declares an explicit
+  top-level `permissions:` block; the release workflow additionally SHA-pins
+  its actions (the PyPA publish action excepted).
+- **Dependabot** watches the `github-actions` ecosystem on a weekly schedule
+  (`.github/dependabot.yml`) so action pins stay current.
+
 ## Where the design lives
 
 - `docs/superpowers/specs/` — design specs (gitignored; local-only).

{netbox_super_cli-1.2.0 → netbox_super_cli-1.3.0}/docs/getting-started/concepts.md

@@ -49,6 +49,12 @@ endpoints — without per-plugin code in `nsc`**.
 
 A short curated alias layer sits on top: `nsc ls`, `nsc get`, `nsc rm`, `nsc search`.
 
+For the curated resources — `device`, `prefix`, `tenant`, `vlan`, `site`,
+`rack`, `interface`, `cable`, `tag` — the singular works identically to the
+plural: `nsc ls device` is the same as `nsc ls devices` (likewise for `get` and
+`rm` where supported). A non-curated singular that doesn't resolve suggests the
+plural instead ("Did you mean `devices`?").
+
 ## Dry-run / apply
 
 Writes default to dry-run. The CLI shows the resolved request and exits 0

{netbox_super_cli-1.2.0 → netbox_super_cli-1.3.0}/docs/getting-started/first-run.md

@@ -74,6 +74,7 @@ nsc dcim devices list                       # default page (page_size=50)
 nsc dcim devices list --all                 # paginate to completion
 nsc dcim devices get 7                      # get by id
 nsc ls devices                              # alias — matches devices.list
+nsc ls device                               # singular works too for curated resources
 nsc dcim devices list --output json --all   # canonical machine-readable form
 ```
 

{netbox_super_cli-1.2.0 → netbox_super_cli-1.3.0}/docs/getting-started/install.md

@@ -50,8 +50,16 @@ nsc --install-completion=pwsh
 
 Restart your shell, then verify with `nsc <TAB><TAB>`.
 
-> Dynamic completion (resource names, profile names, filter keys) is on the
-> post-1.0 roadmap.
+### Dynamic completion
+
+Once completion is installed, TAB expands real values from the cached schema —
+no network call at TAB time:
+
+```sh
+nsc ls dev<TAB>                  # → devices device-roles device-types
+nsc --profile <TAB>             # → profile names from ~/.nsc/config.yaml
+nsc dcim devices list --status <TAB>   # → schema enum values for that filter
+```
 
 ## Requirements