Feat/databox v2 support

[bwiz]

Migrates the CLI to the Databox V2 API and brings every command into line with the
ingestion-api contracts, including the organization/account rename. Breaking: the CLI no longer
speaks V1 at all.

What's in it

V2 migration — all endpoints, the {data, requestId, status} envelope, 0-based pagination,
numeric resource IDs, and --account-id promoted to a global flag.

Organizations and accounts — the API now calls the parent entity the organization and the
former clients accounts, and the CLI follows:

• organization info | update | usage | timezones | countries | metadata-options, on
  /v2/organization. usage reports Accounts, and info has no account type.
• account list | get | create | update | delete, on /v2/accounts. These were the client
  commands; the client topic is gone. This matches 0.3.1, where account already meant the
  account that --account-id targets. account list works only for organizations that manage
  accounts.
• profile info/update print readable Organization and Account lines, from the user's home
  space, and cope with names the API could not resolve.
• activity-log list runs on /v2/organization/activity-log. --resource-type administration
  covers organization and account events, which upstream can't tell apart; the old values are
  rejected. details no longer carry the space id.
• connection set-permissions --[no-]shared-with-accounts (was --shared-with-clients).
• --account-id is unchanged: it targets an account in your organization.

Contract sync — ingestion-api's C# contracts are the source of truth. Every V2 route maps to
exactly one command, and every request body, query parameter and response type is derived from the
contracts rather than inferred from endpoint names. --json returns what the endpoint returned:
plain lists unwrap to an array, and responses that carry more than a list (a dataset's schema and
primary key, a drilldown's rows and schema) come through whole.

The second sync round fixed commands that could not work against the current API:

• Renamed routes: sync-frequencies → sync-frequency-options (dataset and data-source),
  dataset modification-formulas → modification-functions.
• Removed routes: dataset add-modification (use update-modification, which replaces the
  whole definition) and metric data (use metric drilldown).
• Request bodies the API rejected: dataset schema columns use id; column metadata sends
  id/conceptType/synonyms; modification filters use conditions; metric column refs are
  {id, displayName} and metric filters {logicalOperator, conditions}; dimension-values and
  drilldown send sourceId/dimensionIds.
• Output: dataset modifications crashed in table mode; several tables printed blank or
  [object Object] columns.
• New: metric lineage, --clear-dimensions, the private access level, the editor/viewer
  roles. connection set-permissions requires the sharing flag: defaulting it to false silently
  stopped sharing a connection with accounts.

Global flags — --output table|json|csv (--json stays as shorthand), --verbose (a request
trace on stderr that never has the API key in scope), --all (fetch every page, warning if the API
stops short), --no-color, and --idempotency-key on the ten routes the API makes idempotent.

Errors and exit codes — errors print the API's code, message, field and request ID. Exit codes:
0 success, 1 API error, 2 invalid input or network failure/timeout, 130 interrupted key prompt.
Input the API always rejects fails locally with exit 2 before any request: blank names, empty
record or column lists, out-of-range page sizes, non-positive IDs, unknown enum values.

End-to-end suite (test/e2e/, npm run test:e2e) — spawns the built binary against a real
API and asserts exit codes and output. Everything goes through the CLI, so the suite cannot drift
from the client it tests. This is what found the contract bugs above; none of them were visible to
the mocked unit suite, because each mock encoded the same guess as the code it tested. Every run
names its target with DATABOX_E2E_API_URL and DATABOX_E2E_API_KEY. There is no built-in
environment or key, since this repository is public, and the committed develop6 key is removed.
Production also needs DATABOX_E2E_ALLOW_PROD=1. Mutations to shared resources are recorded in a
durable undo log so an interrupted run can be unwound with npm run test:e2e:cleanup.

Review fixes — request timeouts (30s, 300s for uploads) where there were none, UUID validation
and path encoding on dataset ingestion, --access-level constrained to the values the API
accepts, the 9 missing oclif.topics entries, empty-2xx-body handling, and credential hygiene: the
config file is written 0600, the unit suite no longer writes to the developer's real
~/.config/databox-cli/config.json, and a caller-supplied header can no longer overwrite
x-api-key. From the second review round: --data-source-id is validated as a positive integer, and
dataset ingest's request body is asserted in its unit tests.

Shared helpers — parseJsonFlag, requireUuid, paginationFlags/sortFlags, the
schema-driven row and lineage renderers, and one set of contract types in src/lib/types.ts,
replacing patterns that had been copied across commands and had already drifted.

Tooling — the eslint ignore pattern lib also matched src/lib, so the shared code had never
been linted; it is anchored now and the 45 hidden errors are fixed without suppressions.

Breaking changes

• V1 is gone. Requires a Databox organization with V2 API access.
• account data-sources and account datasets are removed. They were v1 spellings of
  data-source list and dataset list against the same endpoints; use those with --account-id.
• Organization and account commands: the former account commands are under organization,
  and account now manages the accounts in your organization (the former client topic).
• Numeric resource IDs, and renamed flags (--primary-keys→--primary-key,
  --key→--integration-key, --tags→--synonyms,
  --shared-with-clients→--shared-with-accounts).
• activity-log list --resource-type: administration replaces account/client.
• The command renames and removals listed under Contract sync.
• --json output of dataset data/schema/preview-modification, metric drilldown/lineage/
  dimension-values and databoard metrics is the whole response rather than a bare array.

Full command-by-command mapping in the
CHANGELOG migration guide.

Testing

• 506 unit tests (typecheck, lint and mocha on every npm test). They include sweeps for
  malformed JSON, invalid resource IDs and empty update bodies, and a lastBody() assertion for
  every command that sends a request body.
• E2E green against production on a dedicated test account, against the released API with the
  organization/account rename: 53 passing across the organization, account, profile, activity-log,
  connection and CLI-contract suites. The only skips carry a logged reason: account management
  (the test organization doesn't manage accounts), --account-id scoping, and a connection rename
  whose original name can't be restored. The API's own ExternalTests for those areas passed too.
• Not yet covered live: account create/update/delete and an account-level user's profile. Both
  need an organization that manages accounts.
• ingestion-api fixes this work surfaced, all merged: the dataset list dataSourceId filter
  and the duplicate-dataset message (#48); GetIngestion returning less than a list row; access
  checks on dataset verification, metric drilldown, dimension values and metric PATCH, invoice
  pagination, sortOrder validation and empty-list rejection (#64); and the organization/account
  rename, with administration in the activity log and no space id in its details.

🤖 Generated with Claude Code

[AndreLei]

http://markdown-server.prod/view/d7b1bc6b-2c8b-4ae9-9222-9bd8afedc9c4

We need to address the above issues and improvements

[bwiz]

Thanks for this — the report was genuinely useful, and the blocker category it identified
(fields guessed from the endpoint name rather than read from the contract) turned out to be the
right diagnosis of the whole class of bug here.

One thing worth saying up front: the review was written before the contract-sync commits, so
B2–B5 were already fixed by the time it landed. I verified each one against the branch rather
than assuming:

• B2 (6 dead commands) — syncInterval, isVerified, {metrics:[…]} + dimensionValues,
  sharedWithClients all send the contract's field names.
• B3 (4 crashing renders) — sync-frequencies reads the bare array, column-metadata reads
  .items, modifications renders an array.
• B4 (timestamp) — gone; both commands render startedAt/finishedAt/duration/user.
• B5 (6 blank columns) — parentDataSourceId, createdAt/user, finishedAt populated; no
  phantom columns.

B1 was fixed in code but not in the docs. That's now swept: README regenerated, both skill
files, and the CHANGELOG line that still promised --key.

Everything else is addressed — warnings and all 14 suggestions:

W1	requireUuid + encodeURIComponent on dataset ingestion; examples use a real UUID
W2	--access-level constrained to the values the API accepts; specific_users was never one
W3	preview-modification actually sends --page/--page-size
W4	9 missing oclif.topics entries
W5	account datasets / account data-sources removed — v1 spellings of commands that already exist. Breaking, and called out in the CHANGELOG
W6	request timeouts (30s; 300s for uploads) and an idle timeout on ask-genie's reader
W7, S13	validation sweeps + list output-contract tests; 203 → 301 unit tests
S1, S2	empty-2xx-body guard; dataset ingest preflights array shape and the size limits
S5, S6	paginationFlags/sortFlags and parseJsonFlag, replacing 17 copies each
S8, S9, S12	showPagination edge cases, the null .join crash, exclusive on metric data, --managed-by-id 0, Errors: null
S11	config written 0600; the unit suite no longer writes the developer's real config; a caller header can no longer overwrite x-api-key; --account-id validated
S14	PR description written

Three places I deliberately did not follow the report:

1. B1's --data-source-id claim is incorrect. It says the flag was renamed to --source-id.
   It wasn't — --data-source-id is still live on dataset create, dataset list and
   metric data, while --source-id is what metric list and metric dimension-values use.
   Two different flags, not one rename; the README's references are correct, so I left them alone.
2. dataset update's empty-body guard stays exit 1. .claude/rules/commands.md specifies
   exit 1 for a well-formed command with nothing to do, and exit 2 for input validation. Happy to
   change the convention, but not in one command only.
3. S4 — added response interfaces where they prevent a real mistake, not to every call site.

S3 (--idempotency-key) is not done — it's a feature rather than a fix, so I left it out
rather than expanding the PR further. Say the word if you want it in.

Two things the review led to that were API bugs, both now merged in ingestion-api (#48):
dataset list applied the dataSourceId filter after paging (so it silently dropped matches on
other pages and reported the unfiltered total), and dataset duplicate surfaced an opaque upstream
refusal instead of explaining that API-created datasets can't be duplicated yet.

On B4 — you were right that the CLI side was only half the story. GetIngestion returned less than
a single list row because it read the ingest through the V1 contract, which has no
startedAt/finishedAt/duration/user at all, and left metrics and errors unpopulated too.
Fixed on fix/v2-ingestion-detail-fields: it now reads account-service directly, as
ListIngestions already did, and both views map through one shared helper so a detail response
can't end up thinner than a list row again.

CodeQL's js/clear-text-logging is green. The first pass at it was a rename that stopped the
heuristic matching without changing anything real; the fix that's in now separates the printable
target from the credential so the banner builder never has the key in scope, with tests that hold
independently of the scanner.

[bwiz]

Round-2 review: what it found, and what's fixed

I re-reviewed the branch as it stands after the contract re-sync (e550dcd) and the organization/account rename (3c2c1d3). Specialist passes covered correctness, security, consistency and testing, and every blocker and warning was independently re-checked. The round-1 items that were settled stayed settled.

The contract work held up. Four passes compared every route, query parameter, request body and response envelope against ingestion-api master and found no drift. That was round 1's main class of bug: request fields the API doesn't accept and response envelopes read the wrong way. All 30 commands that send a body have a unit test asserting it.

What the review did find was outside the contracts. It's fixed in five commits:

	Finding	Fix
d6e54c1	profile update --metadata "", dataset set-metadata --synonyms "" and dataset duplicate --name "" were silently dropped, or answered with a misleading error	Exit 2 with a clear message
	Header casing, optional metric list pagination, auth validate examples, connection list Shared column untested	Fixed
c0346ce	auth login's masked prompt echoed the API key in clear text next to the * (readline was still attached)	The mask path reads stdin itself. A pasted key with its Enter works in one go
	Ctrl-C or closed stdin at a y/n prompt left the promise unsettled, so Node exited 13	Ctrl-C exits 130 with Aborted., and a closed stdin counts as "no"
	--account-id, a missing key or a broken config was only checked after a delete had asked for confirmation	Checked in init(), before any prompt
	metric delete .. sent DELETE /v2/: encodeURIComponent leaves dots alone	requireMetricId rejects an empty id, . and ..
	A malformed config file printed a raw SyntaxError, and a non-JSON 2xx response did the same	Clear errors that don't quote the file's contents
ca8528e	analyze ask-genie had no timeout	30 s without response headers, 120 s of silence while streaming; exit 2. 13 unit tests, where there were none
7e69878	The rename left auth.e2e.ts and data-source.e2e.ts calling account info / account timezones, which no longer exist	They call organization now. test/e2e-commands.test.ts checks every e2e command against src/commands/ in npm test, and failed on exactly those three call sites
	dataset set-timezone / set-permissions had no e2e test	Added, and both set-timezone tests now pick a zone that actually differs
	e2e assertions that the key is never printed would print most of the key when they failed	expectNoKey()
fd587c9	Exit-code docs	README and CHANGELOG updated

A correction to my round-1 reply. I said W6 included "an idle timeout on ask-genie's reader". It didn't: only ApiClient got timeouts. Both the correctness and the security pass caught this. It's genuinely in now, in ca8528e.

Not changed, on purpose:

• --sort-order without --sort-by is only rejected by metric drilldown. The API requires the pairing only on drilldown, so adding the check elsewhere would refuse valid requests.
• Backlog:
  • Redirect handling and an https-only check for custom API URLs, as hardening. It needs a live check first.
  • Whether --output csv should neutralise spreadsheet formulas. Exact output vs. sanitised is a policy call.
  • A this.flags vs destructured flags style difference in four data-source commands. It changes no behaviour.

Verification

• npm test: 557 passing, with lint clean. Every commit passes on its own.
• e2e against production: 159 passing, 0 failing, 7 pending. Each pending test logs why it skipped, for example no --account-id to scope to, or a connection whose blank name can't be restored.
• Still missing: a live run on an organization that manages accounts. The account commands haven't run against the real API yet.

🤖 Generated with Claude Code

[AndreLei]

Round-3 review — final pass before merge

Five specialist passes (correctness, security, consistency × 2 domains, testing), with every
blocker and warning independently re-validated. Reconciled against the 24 dispositions from
rounds 1 and 2 — six findings were dropped as already settled (the --sort-order pairing,
dataset update's exit-1 empty-body guard, the --data-source-id non-rename, https-only URLs,
CSV formula neutralisation, and the this.flags style split in data-source).

The contract work is holding. A pass re-derived every request body, query parameter and
idempotency route from a freshly-pulled ingestion-api master and found no drift. All 31
commands that send a body have a lastBody() assertion. The organization/account rename is
complete across src/, README, CHANGELOG, oclif.topics and the bundled skills — 91 commands,
all four surfaces agreeing.

What is left is one regression in the newest commit and two hygiene issues. None of them are in
the V2 contract layer.

Verdict: REQUEST CHANGES — B1 · W3 · S8

---

Blocker

B1 — The masked prompt never settles on a closed stdin, so auth login exits 13

src/lib/prompt.ts:8-63 (mask branch), reached from src/commands/auth/login.ts:32
Found by correctness and security, independently. Validator: CONFIRMED.

c0346ce rewrote both prompt branches and fixed exactly this hazard for the readline branch —
rl.on('close', …) plus a SIGINT handler, with a comment naming the consequence: "Without
these the promise never settles on Ctrl-C or a closed stdin, and Node exits 13 with 'unsettled
top-level await'." The mask branch it rewrote in the same commit got no equivalent. It registers
only process.stdin.on('data', onData) and calls resume(); finish() removes only 'data'.
There is no path to settle on EOF.

Three user-visible cases, all on the scripted path:

• databox auth login < /dev/null, or any CI step that closes stdin → exit 13 with a Node
  internal warning, instead of API key is required. (exit 1)
• printf 'KEY' | databox auth login (no trailing newline) → same; the key accumulates in
  input but is never committed
• sleep 60 | databox auth login → hangs for the pipe's lifetime

13 is not one of the exit codes this PR's own contract documents, and auth login is the first
command anyone runs.

Fix — mirror the readline branch, settling through the same finish() so the terminal is restored:

const onEnd = () => {
  finish()
  resolve(input)   // auth login already turns '' into `API key is required.` (exit 1)
}
process.stdin.on('end', onEnd)
// remove it in finish(), alongside removeListener('data', onData)

The harness already has what is needed: fakeTerminal().end() exists and is used in the confirm
block — the prompt with mask block just has no EOF case, which is why npm test cannot see this.

---

Warnings

W1 — npm test on Windows overwrites the developer's real API key

test/helpers.ts:17-30, src/lib/config.ts:12-14

setupTestConfig redirects config by setting process.env.HOME, but config.ts resolves via
os.homedir(), which on win32 reads USERPROFILE. The override is inert. Verified empirically:
with HOME set to a temp dir, os.homedir() still returns the real profile.

Two effects:

1. npm test reports 110 passing / 447 failing on Windows — not real bugs; every test writes
   to a directory the app never reads, then fails "Not authenticated". With USERPROFILE also
   set, it is 556/557.
2. Worse: test/commands/auth/login.test.ts carries a comment saying that without a throwaway
   HOME it writes the developer's own config. On Windows that guard does nothing, so npm test
   writes my-test-key and then bad-key into
   %USERPROFILE%\.config\databox-cli\config.json — silently destroying a working key.

CI is genuinely green because .github/workflows/test.yml runs ubuntu-latest, so this is
invisible there.

Fix — set USERPROFILE alongside HOME in setupTestConfig/setupEmptyConfig, and restore
both in cleanupTestConfig.

W2 — The empty-value sweep (d6e54c1) missed four sibling flags

dataset/create.ts:50 and :38-43, data-source/create.ts:32-42, dataset/ingest.ts:53

d6e54c1 moved --synonyms and --metadata to !== undefined and added a blank check to
dataset duplicate --name. The same truthiness pattern survives on:

• dataset create --schema "" → silently creates a schemaless dataset
• data-source create --timezone "" → silently dropped
• dataset create --name "" → no blank check, while its four siblings have one
• dataset ingest --records "" → the worst: falls through to the --file branch and then to
  stdin, reporting Provide data via --records, --file, or stdin pipe. when --records was
  provided — or, off a TTY, silently consuming stdin instead

The clearest evidence is inside a single file: data-source/create.ts adds a blank-name check
with a comment explaining the API rejects it, then guards --timezone with bare truthiness two
lines later.

Fix — !== undefined on the three, .trim() === '' on dataset create --name. The regression
tests belong in the e2e suite: @oclif/test's runCommand cannot pass an empty-string flag value,
which is why the existing test/validation/ sweep cannot reach these.

W3 — Ten e2e assertions match result.stderr instead of errorText(result)

auth.e2e.ts:31, cli-contract.e2e.ts:52,69,247,264, dataset.e2e.ts:461,
data-source.e2e.ts:191, metric.e2e.ts:167, organization.e2e.ts:129, user.e2e.ts:67

.claude/rules/e2e-testing.md mandates errorText() because the CLI hard-wraps and adds oclif's
› gutter, so a phrase can split across lines with padding. The helper is defined in the same
suite and used correctly 24 times elsewhere — this is inconsistent application, not a missing
helper. .to.include('databox auth login') is precisely the multi-word phrase a wrap can break.

Fix — swap the ten content-matching sites. The to.not.be.empty checks are fine as they are.

---

Suggestions

S1	api-client.ts:192, ask-genie.ts:77	fetch defaults to redirect: 'follow', and the Fetch standard strips only Authorization/Cookie across origins — so x-api-key is re-sent to a redirect target. redirect: 'error', mapped through the existing connectionError(). Judged genuinely separable from the backlogged https-only item (it does not break the local ingestion-api workflow), but it needs either an open redirect on the API host or an already-hostile DATABOX_API_URL, so not merge-blocking
S2	data-source/set-timezone.ts:34-41, dataset/set-timezone.ts:31-37	--purge-data really does purge (confirmed in DataSourceService.cs:163), but the success line never says so. Reported as a missing --force; downgraded, because --force guards commands that destroy on bare invocation, and typing --purge-data is itself the deliberate gesture
S3	metric/drilldown.ts:49,72-73	Validates sort-order/sort-by from a local this.parse() but sends this.flags. The command declares no static args, so the parse call is pure duplication — a one-line deletion
S4	dataset/ingest.ts:53-58	Hand-rolls the parseJsonFlag pattern for --records; behaviourally equivalent, only the wording has drifted ("Invalid JSON in" vs "for")
S5	api-client.ts:131,145,152	body ? JSON.stringify(body) : undefined drops a falsy parsed body, so update-modification --data 'null' sends a bodiless PUT with no Content-Type. body !== undefined is the intended test
S6	billing/invoices.ts:17, databoard/list.ts:16, integration/list.ts:12	Re-declare {page, pageSize, totalItems} inline; six siblings import Pagination from lib/flags.js
S7	integration/list.ts:48	String(row.supportsDatasets) prints true/false where every sibling boolean column prints yes/no
S8	skills/databox-metrics/SKILL.md	databoard metrics is documented there, databoard list is in no skill file — a one-row addition. (Reported as a missing bundled skill; that was refuted — profile and activity-log have no dedicated skill either, and both databoard commands are in the README reference)

Three smaller credential-hygiene notes, none blocking: auth login calls saveConfig() before
validating, so a mistyped key overwrites a working one; loadConfig() never repairs the mode of a
pre-PR world-readable config.json; .gitignore has no .env entry, and this repo is public.

---

What held up well

• test/e2e/helpers/environments.ts retires the CodeQL clear-text-logging finding
  structurally, not by redaction. targetOf() copies fields explicitly rather than spreading,
  so the printable object provably holds no key at runtime; describeRequest() takes method and
  URL so headers are never in scope; and expectNoKey() compares as a boolean because a chai
  to.not.include(key) failure would print the key at the exact moment it leaked. A redaction
  filter would not have earned this.
• lib/flags.ts:89-99 — --all's page cap is computed from what the API actually served
  (Math.max(1, Math.min(pageSize, items.length))), not the echoed pageSize. An endpoint that
  ignores page terminates instead of looping forever, and a short result is reported on stderr
  rather than passed off as complete.
• analyze/ask-genie.ts:167-187 — readChunk rejects before calling reader.cancel(),
  with a comment explaining why. Swapped, a stalled stream would have ended the loop cleanly and
  printed a truncated answer as a complete one with exit 0.

---

Coverage

Pass	Findings	Note
Correctness	1 B, 3 W, 2 S	One warning dismissed on the C# contract (preview-modification's Pagination is non-nullable and eagerly initialised, so the CLI's required type is a correct mirror)
Security	2 W, 3 S	No credentials in 36 commits or any tracked file; --verbose proven structurally unable to print the key
Consistency (dataset/data-source/databoard/integration/billing)	2 W, 2 S	Bodies re-verified against freshly-pulled ingestion-api master
Consistency (metric/account/organization/connection/user/profile/auth/analyze/activity-log)	1 W, 2 S	Rename complete: 91 commands ↔ topics ↔ README ↔ CHANGELOG ↔ skills
Testing	1 W	All 31 body-sending commands have lastBody(); npm test run for real
Validation	3 confirmed, 5 downgraded, 1 dismissed	Raised the Windows harness issue from a note to a warning

---

Two candidates worth codifying

Both are patterns that recurred across files, and both were round-2 fixes that did not sweep:

1. .claude/rules/commands.md — An optional string flag is guarded with !== undefined,
   never truthiness, and a required name flag rejects blank. Truthiness silently drops
   --flag "", which the user typed deliberately; the API would have rejected it with a message.
   This exact class produced W2's four call sites after being fixed on three others in d6e54c1.
2. .claude/rules/testing.md — A test that redirects the config directory must set both
   HOME and USERPROFILE, and restore both. os.homedir() reads USERPROFILE on win32, so a
   HOME-only override is inert there and the suite writes the developer's real credentials.
   The comment in login.test.ts shows the hazard was known; only the platform half was missed,
   and CI cannot catch it.

🤖 Generated with Claude Code

[bwiz]

Thanks for the round-3 pass. Everything is addressed except one item, which we're leaving as a deliberate choice (at the end).

The review was written against 33de939. After that, 7e9f776 and f112c4e had already landed, and the rest is in d029f5e and 88e2e41.

Blocker

B1: masked prompt never settles on a closed stdin. Already fixed in 7e9f776.

• With no terminal, auth login no longer uses the masked prompt. It reads the first line of stdin through readPipedLine(), which settles when the input ends:
  • auth login </dev/null exits 2 with "No API key provided: stdin is not a terminal and nothing was piped", and saves nothing.
  • printf 'KEY' | databox auth login (no newline) saves the key.
  • sleep 60 | databox auth login waits, as the README documents.
• At a terminal, the masked prompt now also handles end, with a test for it.
• confirm() uses the same path: piped y/yes confirms, any other answer declines (exit 0), and empty input exits 2.

Warnings

W1: USERPROFILE (d029f5e).

• setupTestConfig, setupEmptyConfig and the e2e child env now set both HOME and USERPROFILE.
• Cleanup restores each variable, or deletes it if it was unset.
• The originals are saved once, so calling setup twice no longer records the temp directory as the original home.
• A test covers this. The rule is in testing.md.

W2: empty values (88e2e41). A value the user typed is never dropped silently any more:

• --schema "", --records "" and --file "" fail with exit 2 before the request. --records and --file no longer fall through to stdin.
• --timezone "" is sent, and the API rejects it with "Invalid timezone value".
• --integration-key "" is refused locally with exit 2. The API would accept it (IntegrationKey ?? "ingestion") and store an empty type.
• A blank --name on dataset create and metric create fails with exit 2, like the other create commands.
• Each case has an e2e test.
• The rule in commands.md is: never drop --flag "" silently. Send it where the API validates the field; otherwise refuse it locally.

W3: errorText (d029f5e / 88e2e41). All ten sites now use errorText(result). The only result.stderr matches left are the --verbose trace lines, which are not wrapped error text.

Suggestions (all in 88e2e41)

• S1: redirect: 'error' in both the API client and ask-genie. A refused redirect exits 2 with its own message, naming --api-url / --service-url. Both have tests. The rule is in api-client.md.
• S2: set-timezone --purge-data now says the existing data was purged.
• S3: the duplicate parse() in metric drilldown is removed.
• S4: --records goes through parseJsonFlag.
• S5: body === undefined ? undefined : JSON.stringify(body), so --data 'null' sends null with Content-Type.
• S6: the shared Pagination type is imported in the three commands.
• S7: integration list prints yes/no.
• S8: databoard list is added to the metrics skill.
• Credential notes:
  • .env and .env.* are now in .gitignore.
  • saveConfig() already applies chmod 600 on every write, so an old world-readable file is fixed the next time the config is saved.
  • auth login saving before validating is deliberate, and the README documents it. Saving even when the check fails means an offline login still works. We may change it later to keep the old key when the API answers 401.

Verified

• Typecheck, lint and npm test: 591 passing, 0 failing. Every new test failed against the code before its fix.
• e2e against production (auth, data-source, cli-contract, organization, metric, dataset, user): 117 passing. One test is pending with its reason printed (DATABOX_E2E_ACCOUNT_ID is not set). No test resources were left behind.

Also since round 2: the ingest limits now match what production enforces (500 records, 30,000,000 bytes). We measured both on 2026-09-25, and ingestion-api's docs still say 10,000 records and 100 MB.