closeyourit-cli

closeyourit (alias cyi) is the command-line interface for CloseYourIt. Authenticate with your user token and manage projects, error monitoring, ingest tokens, tickets and performance metrics straight from your terminal — handy for CI pipelines and SDK setup.

Install

npm install -g @bussolabs/closeyourit-cli
# or run without installing
npx @bussolabs/closeyourit-cli --help

Getting started

closeyourit login        # device flow: opens your browser, enter the shown code
closeyourit whoami       # confirm who you are and which org/token is active
closeyourit projects list

login uses the OAuth 2.0 device authorization grant: it prints a short user code and a verification URL (and opens it in your browser), then polls until you approve. The resulting token, account and organization are stored locally.

Headless / CI / agents

Set CLOSEYOURIT_TOKEN to a user token (cyi_u_…) to authenticate non-interactively, without the device-flow login. It overrides the stored config token. Ideal for a service account token driving an agent or CI job:

CLOSEYOURIT_TOKEN=cyi_u_… CLOSEYOURIT_API_URL=https://www.closeyour.it \
  closeyourit secrets bundle -p KEY -e development

Commands

| Command | Description | | --- | --- | | login [--api-url <url>] | Authenticate via device flow, store the token. | | logout | Clear the locally stored token and identity. | | whoami | Show account, organization, token prefix and permissions. | | projects list [--page] | List visible projects. | | projects show <id\|key> | Show one project. | | projects create <name> --key <key> [--group <id\|name>] [--color] [--description] [--roadmap-enabled] [--quick-bug-report-enabled] | Create a project (optionally inside a group). | | projects update --project <id\|key> [--name] [--key] [--color] [--description] [--group] [--roadmap-enabled] [--quick-bug-report-enabled] | Update a project (only the passed fields change). | | projects link-server --project <id\|key> --host-id <id> --environment-id <id> | Link a server host to a declared project environment (uptime). | | projects unlink-server <link-id> --project <id\|key> --confirm | Unlink a server host from the project. | | projects settings show --project <id\|key> | Show a project's settings (log/analytics retention + feature flags). | | projects settings update --project <id\|key> [--logs-retention-days] [--analytics-retention-days] [--roadmap-enabled] [--quick-bug-report-enabled] [--analytics-enabled] | Update a project's settings (only the passed fields change). | | projects github --project <id\|key> | Show a project's GitHub integration (repo link + tag→release binding rules). | | projects github-connect --project <id\|key> --repository <owner/name> | Connect a project to a repository visible to the organization's GitHub App. | | projects github-map [--connected-only] | List every visible CloseYourIt project and its connected GitHub repository; automatically fetches all pages. | | projects github-update --project <id\|key> [--default-branch] [--production-environment-id] [--staging-environment-id] [--sync-enabled] [--tag-binding-enabled] [--autoclose-on-merge] | Update a project's GitHub binding rules (only the passed fields change). | | groups list [--page] | List groups (macro-projects) in your org. | | groups create <name> [--color] [--roadmap-enabled] | Create a group (container of related projects, e.g. "DriverOne"). | | groups update <id\|name> [--name] [--color] [--roadmap-enabled] | Update a group (rename, recolor, toggle roadmap). | | roles list\|show <id\|name> | List roles / show a role with its permission keys. | | roles create <name> [--permission <key>…] [--color] | Create an RBAC role (bundle of permission keys). | | roles update <id\|name> [--name] [--permission <key>…] [--color] | Update a role (permissions REPLACE the set). | | roles delete <id\|name> | Delete a role. | | teams list\|show <id\|name> | List teams / show a team (roles, scope, members). | | teams create <name> [--role <id\|name>…] [--group <id\|name>…] [--project <id\|key>…] [--member <email\|id>…] [--color] | Create a team with roles + group/project scope + members. | | teams update <id\|name> [--name] [--role…] [--group…] [--project…] [--member…] | Update a team (each dimension REPLACES its set). | | teams add-member\|remove-member <team> <email\|id> | Add/remove one person, keeping the others. | | teams delete <id\|name> | Delete a team. | | members list [--page] | List org members (resolve email → account id). | | members set-access <membership-id> [--group <id\|name>…] [--project <id\|key>…] [--role-id <id\|name>…] [--override <key=allow\|deny\|inherit>…] | Set a member's scope, direct roles and permission overrides. | | members update <membership-id> [--name] [--email] [--handle] | Update a member's profile (requires members.edit). | | members remove <membership-id> --confirm | Remove a member from the org (requires members.manage). | | invitations create <email> [--role customer\|member\|admin] | Invite a person; prints the acceptance link (once). | | invitations list [--page] | List invitations. | | invitations revoke <id> | Revoke a pending invitation. | | org update [--name] [--slug] [--projects-view cards\|table] [--logs-retention-days] [--analytics-retention-days] | Update the organization (requires organization.manage). | | platforms create <code> --label <label> [--color] [--position] [--active] [--supports-uptime] | Create a platform (a device/system your projects run on). | | platforms update <id\|code> [--code] [--label] [--color] [--position] [--active] [--supports-uptime] | Update a platform. | | errors list --project <id\|key> [--status] [--page] | List error groups. | | errors show <id> --project <id\|key> | Show one error group. | | errors resolve\|reopen\|mute\|unmute <id> --project <id\|key> | Triage an error group. | | tokens list --project <id\|key> | List ingest tokens. | | tokens create --project <id\|key> --name <name> --environment-id <id> | Create a token (secret shown once). | | tokens provision --project <id\|key> --name <name> --environment-id <code\|id> --to-project <id\|key> --to-environment-id <code\|id> --secret-name <NAME> | Generate and deliver a token without revealing its value. GitHub sync is enabled by default; use --no-sync-github for vault-only delivery. | | tokens provisions show <id> --project <id\|key> | Show secret-free provisioning status. | | tokens provisions retry <id> --project <id\|key> | Retry GitHub sync without regenerating or revealing the token. | | tokens rotate <id> --project <id\|key> | Rotate a token (new secret shown once). | | tokens revoke <id> --project <id\|key> | Revoke a token. | | secrets assets list --project <id\|key> | List encrypted secret-file metadata (never contents). | | secrets assets upload --project <id\|key> --name <name> --file <path> [--environment] | Encrypt and upload .p8, .p12, keystore or service-account JSON. | | secrets assets download <id> --project <id\|key> --output <path> [--version] [--force] | Decrypt to an explicit 0600 file; refuses overwrite by default. | | secrets assets versions\|rollback\|archive\|purge … | Manage immutable versions, restore, archive or owner-only permanent purge. | | secrets assets shared-list\|shared-upload\|delegate\|undelegate … | Manage one organization-level ciphertext and delegate it to authorized projects. | | tickets list --project <id\|key> [--page] | List tickets. | | tickets show <id> --project <id\|key> | Show one ticket. | | tickets create --project <id\|key> --title <t> [--kind] [--step-*] [--description] [--status-id] [--priority-id] | Create a ticket. | | tickets statuses | List the org ticket statuses (id, code, label) — the id feeds create --status-id. | | tickets priorities | List the org ticket priorities (id, code, label) — the id feeds create --priority-id. | | tickets reject <id> --project <id\|key> --reason <text> | Reject the review: back to work, the reason becomes a comment. | | tickets approve <id> --project <id\|key> | Approve the review: move to the first done status. | | tickets links <id> --project <id\|key> | List the ticket-to-ticket links (duplicate/related) involving a ticket. | | tickets unlink <id> <link-id> --project <id\|key> --confirm | Remove a ticket-to-ticket link (requires tickets.edit). | | tickets reviewer <id> --project <id\|key> --reviewer-id <account-id> | Set the reviewer of a ticket (requires tickets.assign). | | tickets unreviewer <id> --project <id\|key> | Remove the reviewer of a ticket. | | tickets watch\|unwatch <id> --project <id\|key> | Watch / stop watching a ticket (its notifications). | | tickets branch <id\|code> --project <id\|key> | Create a GitHub branch from a ticket (name prefixed with the ticket code). | | tickets pr <id\|code> --project <id\|key> | Open a GitHub pull request from a ticket (head = the ticket branch). | | ideas delete <id> --project <id\|key> --confirm | Delete an idea (author always allowed; others need ideas.delete). | | ideas archive\|unarchive <id> --project <id\|key> | Archive an idea (open → archived) / reopen it. | | ideas case-update <idea-id> <case-id> --project <id\|key> [--title] [--description] | Update a case (example) of an idea. | | ideas case-delete <idea-id> <case-id> --project <id\|key> --confirm | Delete a case from an open idea. | | metrics list --project <id\|key> [--kind] [--page] | List metric groups. | | metrics show <id> --project <id\|key> | Show one metric group. | | logs list [--project <id\|key>] [--level] [--trace-id] [--environment] [--page] | List structured log entries. Cross-app: omit --project for the full visible stream. | | logs show <id> | Show a single log entry (attributes, trace id, correlation). | | logs link <id> --to <Errors::Group:uuid\|Ticketing::Ticket:uuid> | Manually link a log entry to an error group or ticket. | | logs unlink <id> <link-id> --confirm | Remove a manual log link. | | kb list [--project <id\|key>] [--kind] [--per] [--page] | List knowledge pages. Cross-project: omit --project for every visible project. | | kb search <query…> [--project <id\|key>] [--kind] [--per] [--page] | Search knowledge pages (semantic when available, title ILIKE fallback). | | kb show <id> | Show one knowledge page: metadata header + raw markdown body. | | kb create --project <id\|key> --title <t> [--kind note\|decision\|guide] (--body <md> \| --body-file <path>) | Create a knowledge page. | | kb update <id> [--title] [--kind] [--body \| --body-file] | Update a page (unpassed fields keep their current value). | | kb delete <id> --confirm | Delete a knowledge page (irreversible). | | kb ask <question…> | Ask a question; the AI answers from the knowledge base and cites the pages it used. | | servers list [--status] [--page] | List the monitored servers (fleet snapshot: status, cpu/mem/disk, last seen). | | servers show <id> | Show a monitored server (latest snapshot + machine details). | | servers rename <id> --name <name> | Rename a server (display name only). | | servers pause\|resume <id> | Pause (no staleness/alerts) / resume a server. | | servers revoke <id> --confirm | Revoke a server: its agent gets 403 and stops (reversible with unrevoke). | | servers unrevoke <id> | Restore a revoked server. | | servers delete <id> --confirm | Delete a server and all its metrics. | | servers tokens list | List the fleet enrollment tokens. | | servers tokens create <name> | Create an enrollment token (secret shown once). | | servers tokens revoke <id> --confirm | Revoke an enrollment token. | | agents list [--kind claude\|shell] [--page] | List the automation agents in your org. | | agents show <id> | Show one automation agent. | | agents create --name --slug --run --schedule [--kind] [--timeout] [--model] [--permission-mode] [--allowed-tool…] [--on-failure] [--project <id\|key>…] [--group <id\|name>…] [--catch-up] [--no-enabled] | Create an agent (executed by closeyourit-automator). | | agents update <id> [--name] [--slug] [--kind] [--run] [--schedule] [--timeout] [--model] [--permission-mode] [--allowed-tool…] [--on-failure] [--enabled\|--no-enabled] [--catch-up\|--no-catch-up] | Update an agent (only the passed fields change). | | agents assign <id> [--project <id\|key>…] [--group <id\|name>…] | Assign the agent to projects/groups (replaces targets). | | agents delete <id> --confirm | Delete an agent and its run history. | | agents runs list <agent-id> [--page] | List an agent's run history. | | agents runs show <agent-id> <run-id> | Show a single run (with output). | | agents tokens list [--page] | List the org automator tokens (cyi_a_). | | agents tokens create <name> | Create an org automator token (secret shown only once). | | agents tokens revoke <id> --confirm | Revoke an org automator token. | | service-accounts list [--page] | List the service accounts (AI members, CLI-only) in your org. | | service-accounts create --name [--handle] [--project <id\|key>…] [--group <id\|name>…] [--role <id\|name>…] [--grant-secrets] [--secret-environment <code>…] | Create a service account (optionally granting read+write secrets, limited to environment codes). | | service-accounts delete <id> --confirm | Delete a service account (revokes tokens + removes access; secrets audit kept). | | service-accounts tokens create <account-id> <name> | Mint a CLI token (cyi_u_) for a service account (secret shown only once). | | service-accounts tokens revoke <account-id> <token-id> --confirm | Revoke a service account token. | | monitors create --project <id\|key> --url <url> [--environment] [--http-method] [--interval-seconds] [--expected-status] [--timeout-seconds] [--expected-body-keyword] [--ssl-expiry-warn-days] [--group-id] | Create an uptime monitor (one per environment). | | monitors update <id> --project <id\|key> [--url] [--http-method] [--interval-seconds] [--expected-status] [--timeout-seconds] [--expected-body-keyword] [--ssl-expiry-warn-days] [--group-id] | Update an uptime monitor. | | monitors publish\|unpublish <id> --project <id\|key> | Publish / unpublish the monitor's public status page. | | monitors announcements show <id> --project <id\|key> | Show the status-page announcement banner. | | monitors announcements set <id> --project <id\|key> [--level info\|maintenance\|warning] [--message] [--starts-at] [--ends-at] [--active] | Upsert the status-page announcement banner. | | monitors announcements clear <id> --project <id\|key> --confirm | Remove the announcement banner. | | monitors incidents delete <id> <incident-id> --project <id\|key> --confirm | Delete an uptime incident. | | monitors incidents group <id> --project <id\|key> --incident <id>… --phase <phase> [--body] | Unify incidents and post the first narration step. | | monitors incidents ungroup <id> <incident-id> --project <id\|key> [--keep <window-id>] | Dissolve an incident grouping. | | monitors incidents update-add <id> <incident-id> --project <id\|key> --phase <phase> [--body] | Add a timeline step to a narrated incident. | | monitors incidents update-delete <id> <incident-id> <update-id> --project <id\|key> --confirm | Delete a timeline step from an incident. | | uptime-groups list [--page] | List uptime monitor groups in your org. | | uptime-groups show <id> | Show an uptime monitor group. | | uptime-groups create --name <name> [--color] [--icon] [--description] | Create an uptime monitor group (org-level container). | | uptime-groups update <id> [--name] [--color] [--icon] [--description] | Update an uptime monitor group. | | uptime-groups delete <id> --confirm | Delete an uptime monitor group. | | uptime-groups publish\|unpublish <id> | Publish / unpublish the group's public status page. | | cron-monitors list [--status] [--project <id\|key>] [--page] | List cron / heartbeat monitors across visible projects. | | cron-monitors show <id> | Show a cron / heartbeat monitor. | | analytics show --project <id\|key> [--range 24h\|7d\|30d\|1y] [--environment] | Show the web analytics snapshot (traffic, top pages, goals). | | analytics share --project <id\|key> [--password] | Publish a public shareable analytics link. | | analytics unshare --project <id\|key> --confirm | Revoke the public analytics link. | | analytics goals list --project <id\|key> | List a project's conversion goals. | | analytics goals create --project <id\|key> --kind pageview_path\|custom_event --display-name <name> [--event-name] [--path-pattern] | Create a conversion goal. | | analytics goals delete <id> --project <id\|key> --confirm | Delete a conversion goal. | | releases list --project <id\|key> [--page] | List a project's releases (tracked from CI). | | alerts channels list | List the external alert channels (webhook / Telegram). | | alerts channels create <name> --kind telegram\|webhook … | Create a channel (--bot-token/--chat-id or --url/--secret). | | alerts channels delete <id> --confirm | Delete a channel. | | alerts notifications list [--page] | List your in-app alert notifications. | | alerts notifications read <id> | Mark a notification as read. | | alerts notifications read-all | Mark all your unread notifications as read. | | alerts notifications delete <id> --confirm | Delete one of your notifications. | | alerts preferences show | Show your personal alert preferences (per org). | | alerts preferences update [--in-app-enabled] [--email-enabled] [--errors-enabled] [--uptime-enabled] [--tickets-enabled] [--chat-enabled] [--servers-enabled] [--min-level] [--quiet-hours-enabled] [--quiet-hours-start] [--quiet-hours-end] [--quiet-hours-tz] | Update your personal alert preferences (send only the fields to change). | | todos list [--page] | List your own todo lists. | | todos show <id> | Show one of your todo lists. | | todos create --name <name> [--color] | Create a todo list. | | todos update <id> [--name] [--color] | Update a todo list (rename or recolor). | | todos delete <id> --confirm | Delete a todo list. | | todos reorder --list <id>… | Reorder your todo lists (pass --list once per id, in order). | | todos shares <list-id> | List the members a todo list is shared with. | | todos share <list-id> [--account <id>…] | Set who a todo list is shared with (omit --account to unshare all). | | todos complete\|uncomplete <list-id> <item-id> | Mark a todo item done / reopen it. | | todos shared [--page] | List todo lists shared with you (read-only). | | todos shared-show <id> | Show a todo list shared with you (read-only). | | todos items list <list-id> [--page] | List the items of a todo list. | | todos items add <list-id> --title <title> [--ticket] [--position] | Add an item to a todo list. | | todos items update <list-id> <item-id> [--title] [--ticket] [--position] | Update a todo item. | | todos items delete <list-id> <item-id> --confirm | Delete a todo item. |

Every command accepts --json for machine-readable output and --help for usage details. --project accepts either a project UUID or its key (matched case-insensitively).

Configuration

The CLI stores its state in:

~/.config/closeyourit/config.json   (mode 0600)

It holds the backend URL, your token and a cached copy of your account/organization. Use logout to clear it locally; revoke the token on the server at /account/cli/tokens.

Environment variables

| Variable | Purpose | Default | | --- | --- | --- | | CLOSEYOURIT_TOKEN | User token (cyi_u_…) for headless/CI/agent use; overrides the stored config token. | — | | CLOSEYOURIT_API_URL | Default backend base URL (overridden by a persisted --api-url). | https://www.closeyour.it | | CLOSEYOURIT_CONFIG_DIR | Directory holding config.json. | ~/.config/closeyourit |

Development

Toolchain is pinned with mise (mise.toml): Node 24 + pnpm.

mise install
mise exec -- pnpm install
mise exec -- pnpm build      # tsc -> dist/
mise exec -- pnpm test       # vitest (fetch mocked)
./bin/run.js --help          # run the built CLI

The machine-readable command surface lives in opencli.json (OpenCLI).