# Changelog

Changes to `@sr-connect/cli`, newest first.

## 0.4.0 (2026-10-20)

### Added

- `local-workspace status` lists the scripts, test payloads and README that were modified, added or removed in a clone since the last clone or push. It reads only the directory and `workspace.json`, so it needs no credentials and makes no request. With `--remote` it also reads the workspace's script list and reports the scripts changed, deleted or added there since the last clone or push.
- `local-workspace clone --dry-run` lists what a clone would create, overwrite, move aside, remove and keep, and changes no file.
- `--explain` on every verb has an `Answers:` line naming the top-level keys of the document it prints, such as `connections` for `connector list` and `eventListenerId` and `scriptId` for `event-listener create`. For `app list` and `app get` it also gives the paths the listener, event type and API connection IDs sit at, under each app's `connectionType`.
- `environment-parameter create --explain` and `update --explain` show an example body for TEXT, BOOLEAN, NUMBER and SINGLE_CHOICE parameters.
- `team list-members` lists the members of a team with their roles. A member's ID is the one a workspace or connector reports as its owner.
- `script get-job` reads a workspace bundle job or a `local-workspace push --async` job by its ID, and with `--wait` waits until it succeeds or fails.
- `connector list --app-id` and `--connection-type-id` list only the connectors for that app or connection type. The table has a BASE_URL column.
- `environment-parameter list --omit-values` reads the parameters without their values.
- `local-workspace push --overwrite-remote` and `script update --overwrite-remote` write over scripts changed in the workspace since they were read. `script update --input` accepts `expectedContentHash`.

### Changed

- `readme get` and `readme update` without `-e`, and with no environment variable, clone or session default to supply one, use the workspace's default environment and name it on stderr.
- `log list-console-logs`, `log list-http-logs` and `log get-large-log-message` accept `--team` with an invocation ID instead of `-w`, and find the workspace from the invocation. An explicit `-w` still wins, and an invocation the team does not have is exit 4 `INVOCATION_NOT_FOUND`.
- `environment-parameter list` shows a masked TEXT value as `[REDACTED]`, like a password, and adds a `VALUE_SET` column. `--raw` output is unchanged.
- `environment-parameter update --input` accepts a parameter copied from `list`: `type`, `id`, `valueSet`, `children` and a choice's `id` are accepted when they match what is stored and are left out of the request. A different `type` is refused with a message saying the type cannot change, and so is a row from `list --omit-values` that says a value is set but carries none, which would clear the value.
- `local-workspace push` warns on stderr about every script it is about to create, and separately about scripts recorded in `workspace.json` that were deleted or renamed in the workspace since the clone, which the push would bring back. The push still goes ahead.
- `local-workspace clone --force` on an existing clone moves a script that was deleted in the workspace since the last clone out of `scripts/` into `removed-scripts/<time>/`, so the next push does not recreate it. The clone's document lists these under `movedToBackup`.
- A rate limit pauses every request in the run until its `Retry-After` has passed, rather than each request backing off alone, and a `local-workspace clone` read that runs out of retries gets one more try after the pause.
- `workspace get` without `--team` names the team it found the workspace in, in the detail view and, under `--agent`, on stderr.
- A 409 that is not about the workspace lock has the error code `CONFLICT` instead of `API_ERROR`.
- A `script create` or `update` that times out while bundling no longer says nothing was saved. It says the script may have been saved and to check `script list` before retrying.
- `local-workspace push` stops with exit 1 `SCRIPT_CONTENT_CHANGED`, naming the scripts, when a script it would send changed in the workspace since the last clone or push. It checks before uploading anything. `clone` and `push` record each script's content hash in `workspace.json` for this, so a clone made by an earlier version is checked only after its next clone or push.
- A push refused that way, or an `--async` push that failed for a transient reason, keeps its upload for 15 minutes. The next push of the same files applies it instead of uploading them again and asking for a new upload grant.
- `script update` run inside a clone sends the content hash the clone recorded for the script, so a change made in the workspace since is refused with exit 1 `SCRIPT_CONTENT_CHANGED` instead of being overwritten.
- `event-listener create`, `event-listener update` and `scheduled-trigger create` with `--script-name` wait for the workspace bundle the new script starts, which now runs in the background and can take several minutes. They then report its TypeScript diagnostics, or the reason it failed, as before. `--no-wait` returns at once with the job ID and a warning that the script cannot be triggered until the job finishes.
- `workspace get` without `--team` reads the workspace by its ID in one request instead of searching every team, and `workspace update` finds a workspace it is moving the same way. `workspace get` shows the team ID and the owner, and `workspace list` shows the owner.
- `event-listener-test-payload list` without `--event-listener-id` lists the test payloads of every event listener in the environment instead of asking for one. `local-workspace clone` reads them in one request instead of one per event listener.
- An error code the API sends, such as `WORKSPACE_NAME_TAKEN` or `SCRIPT_CONTENT_CHANGED`, is the code the CLI reports, with a hint for those two. The exit code still follows the HTTP status.
- The interactive connector picker asks the API for the connectors of the app already chosen.
- `script list` and `script get` show when a script was last modified.
- A `local-workspace push --async` that stops waiting after 16 minutes names the `script get-job` command that keeps waiting.
- `app get` marks an event type the vendor no longer delivers, which the catalogue reports as `hidden`, with a `note` reading `no longer delivered`. The interactive event type picker leaves such types out; an existing event listener keeps its type.

### Fixed

- `script create`, `event-listener-test-payload create`, `package add`, `feedback post` and `feedback post-crash-report` treat a success response without an `id` as an error, with a hint to read the resource back before creating it again.
- The README says the same thing about exit codes everywhere: an empty list is exit 0, and exit 4 is a single resource that does not exist.

## 0.3.0 (2026-10-09)

### Added

- This changelog ships in the package, next to the README, which points to it.

### Changed

- `--required true`, `--disabled=true` and `update --required false` say the flag is a switch and takes no value, and name the opposite switch where the verb has one. A switch given as another option's value (`--description --required`) is left alone, since commander reads it as that value.
- `--explain` marks a body key carried by a switch with `(switch)`.
- A malformed ID carries a hint naming the command that lists real ones.
- `script trigger --test-payload-id` answering 404 says an event listener's own ID is not a test payload ID.
- A network error on a write says the change may have landed and to read it back before sending it again. A refused connection, an unresolved host or a port `fetch()` will not dial leaves that out.
- A destructive verb run inside a clone with nobody to ask names the `workspace.json` values to pass.
- A lock held by your own browser tab says to save and close the workspace in the web app first, with `--force` second. `workspace-lock release` refused for that reason says so too.
- `local-workspace push --explain` documents the report's shape and how a new test-payload file becomes a payload.
- `environment-parameter update --explain` says the flags path carries every omitted field forward, the key included.
- The local-sync note for a clone of another environment names the environment the change went to, by name where the run already knows it.

### Fixed

- An agent with no terminal no longer shares one session record with every other such agent on the machine. `/dev/null` on stdin is not taken for a terminal.
- A run with no terminal and no `SR_CONNECT_CLI_SESSION_ID` keeps no session record. A lock it takes is not stored, and the warning names `--lock-id` and `SR_CONNECT_CLI_LOCK_ID` to carry it. A refusal from your own earlier lock says to pass the lock ID it printed. When a shell with an identity cannot write its session record, the same warning says the write failed rather than pointing at `SR_CONNECT_CLI_SESSION_ID`.
- `local-workspace push` with nothing to send reports `scripts.sent: []`, like a push that sent something.

## 0.2.0 (2026-10-01)

### Added

- `egress-firewall` group (alias `ef`) for the team's allowlist of outbound destinations: `list`, `add-connector`, `add-fetch-destination` and `check-api-connections`. Approving, rejecting and removing entries stays in the web app.
- `egress-firewall check-api-connections` reports, for every API connection in an environment, whether the firewall lets its connector through, with `--blocked-only` to trim the rows.
- `api-connection create` and a connector switch on `api-connection update` add the connector to the firewall unless told not to. `--request-approval` and `--skip-allowlist` choose what happens, and a warning follows a write whose connector is blocked.
- `team get` shows the team's egress firewall allowance under `connections`.
- `add-fetch-destination` refuses a blank host, a wildcard and a scheme other than http and https before sending, and warns when a non-ASCII host name is stored in its `xn--` form.

### Changed

- A `503` is now resent on reads only. On a write the change may already have landed, so the CLI stops and its hint says to read the resource back before running the command again.

### Fixed

- `api-connection update` refuses `--request-approval` and `--skip-allowlist` when nothing in the run would apply them, instead of dropping them without a word.
- The hint for an unknown SFTP credential ID on `temp-remote-workspace delete` names the three real causes.

## 0.1.4 (2026-09-20)

### Changed

- The README and the instance prompt describe a base URL instance as a dedicated instance managed by the ScriptRunner Connect team, not a self-hosted server.

## 0.1.3 (2026-09-18)

### Added

- `workspace check-package-versions` compares every package in a workspace with what the npm registry publishes, one row per package, with `--outdated-only` to trim the rows.

### Changed

- `event-listener update` sends an update with no fields, from flags, `--input {}` or an interactive run that keeps every answer. That is the only way to make an environment with no URL path of its own generate one.

### Fixed

- Prerelease versions now sort by SemVer's rules, so `1.1.0-beta.10` ranks above `1.1.0-beta.9`.
- `workspace check-package-versions` no longer reports everything as up to date when the registry answered nothing.
- An `event-listener update --input` body of `null` or `[]` no longer announces an empty update before being refused.

## 0.1.2 (2026-09-17)

### Changed

- Hints and printed commands say `sr-connect` when that is what runs this copy, and `npx @sr-connect/cli` everywhere else.

### Fixed

- On Windows, a global install under a custom npm prefix is recognised as global, so the update notice offers `npm install -g`.

## 0.1.1 (2026-09-17)

### Added

- `cli check-updates` asks the npm registry for a newer version now, ignoring the stored answer and `--no-update-check`.

### Changed

- `local-workspace clone` types every parameter in `ev-params.ts` as possibly absent, required ones included, since a required parameter can still be unset. A `Required: yes` line in the comment keeps the requiredness visible.
- `auth login` confirms with a green `✔ Logged in` line.
- `--explain` on a destructive verb says that the session record and a clone's `workspace.json` answer its scope flags only on a terminal.

## 0.1.0 (2026-09-14)

First release. A CLI for the ScriptRunner Connect API that asks for what it needs on a terminal and never asks under `--agent`.

- Verbs for teams, workspaces, environments, scripts, event listeners and their test payloads, event queues, scheduled triggers, API connections, connectors and sharing, parameters, packages, releases, the workspace README, workspace locks, temporary remote workspaces and logs.
- `--raw` prints one JSON document per run, and errors as a JSON envelope with fixed exit codes.
- `--explain` on every verb prints what it takes and what it answers, with no credentials and no request.
- Session defaults per terminal and instance, and workspace locks taken and renewed for you.
- `local-workspace clone` and `push` work on a workspace as a local TypeScript project, and commands run inside a clone take their scope from it and keep it current.
- `script trigger --stream-logs` streams console output while the script runs.
- Credentials in the operating system's secure store, an update notice, a crash report offered after an unexpected failure, and `feedback post`.