History / Security Cloud Workflows

docs: rewrite the wiki as instructions, and run stop-slop over it Every page read as an essay. Each section now answers what you type, what happens, and what to watch out for when that changes what you type. Deleted throughout: the meta sections about the pages themselves ("Do I need this page?", "What this page is not", "The five ways this can break you", "Why the names changed"), the design rationale, the history of what the CLI used to send, and the postmortem narration that belongs in the repo's docs/solutions. Prose drops from 59,853 words to 47,515, and no page grew. Stop-slop pass over all 27 pages: | marker | before | after | |---|---|---| | em dashes in prose | 180 | 0 | | banned adverbs | 332 | 0 | | binary contrasts ("not X, it's Y") | 30 | 0 | | sentences opening on a Wh- word | 25 | 0 | | throat-clearing phrases | 1 | 0 | The 139 remaining adverb matches are `also`, `still`, `already` and `exactly`, none of them on the skill's list, and `still` is load-bearing here: an endpoint that still answers is the case the refusal wording exists for. The 165 remaining universal claims are counted or precise ("prepended to every call", "never in a flag value"), which the rule permits. Six fabricated transcripts corrected against the binary: - Ten blocks showed a `message:` label the CLI never prints. On a terminal it prints the message unlabelled then `hint: `; under `-o json` it prints the error envelope. Both forms now appear where each applies. - `jamf-cli pro icons list` was the example for "the retired name warns, then runs". `pro icon` ships no `list`, so it warned and then exited 2, which is the opposite of the point. Replaced with `pro icons get 1`. - The 401, 404 and 429 hints quoted three strings that are not in `internal/client/client.go`. Replaced with what it emits. - The payload-verification warning showed one comma-joined line with a parenthetical. `formatStoredPayloadWarning` emits a header plus one indented `- path: reason` line per finding, capped at three. Verbatim CLI output inside code blocks keeps its em dashes and its wording. Five remain on that basis, two of them in the `pro setup` credential-source menu, which the CLI itself prints with an em dash. Structural checks: code fences balanced, no table column mismatches, every in-page and cross-page anchor resolves after 24 heading renames, and no command, flag, table row or endpoint lost. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neilmartin83 committed Sep 11, 2026

docs: update wiki for v1.29.0 — the pro command rename v1.29.0 derives every `jamf-cli pro` resource name from the Jamf Pro API's own OpenAPI tags and URL paths instead of from the filename each resource's paths were split into. 163 resources became 135, and 100 former names resolve with a warning until 2027-03-09. New page, `Pro Command Renames`, is the migration reference: the full 96-name table, the four aliases that redirect two tokens deep, the three withdrawn names, the 48 invocations an alias cannot cover, the three former leaves that now print help at exit 0 where they returned data, the nine sub-path command groups, the 19 write operations that were being deleted at generate time, and a script-tree migration recipe. Linked from Home and the sidebar. Every page naming a `pro` command is updated to the new names — 100 occurrences across seven pages — and the retired spellings now appear only where the page is explaining them. Corrections found while verifying against the v1.29.0 binary and two live tenants: - The gateway refused-command list was 75 and is 59. The Classic patch family and `pro policy-properties` are served again; `pro static-computer-groups` no longer exists as a name, so the successor transcript it illustrated is dead and the curated successor table is empty. - An organization-scoped credential on `platform audit` answers `REQUEST_CONTEXT_NOT_PROVIDED`, not `INVALID_REQUEST_CONTEXT_TYPE`; the `'tenant'` in that second message means a tenant header really was sent. - AI Governance is environment-scoped, not organization-scoped. Its spec declares `environment` alone and the wire agrees. - Security Cloud device groups: `update` is the v2 PUT and answers 204 with no body; only the implicit "Default Group" comes back without an `id`, not the whole collection. - `platform setup` checks the scope ID and reports declared scope levels; it no longer returns a Security Cloud entitlement verdict. - `config add-profile` verifies credentials before writing and gained `--no-verify`; `pro setup` gained `--credentials existing|create`. - Classic `--scaffold`/`--set` coverage is 114 of 117, not 111. - `pro backup --resources` does not reject an unknown token alongside a recognised one — documented as it behaves. - The MCP catalog carries `scopes`, and `run_command` returns combined stdout+stderr, so a retired-name warning breaks JSON parsing downstream. - `pro policies` in the MCP page's examples does not exist; it is `pro classic-policies`. Adds the v1.29.0 behaviour changes throughout: every command prints through one output formatter, `--select`/`--compact` narrow rows for every column format, a cobra usage error exits 2, a stray positional is refused on every leaf that documents none, `--scaffold` reaches the commands that take positionals, name lookups accumulate matches across pages and report an unaddressable match, `apply` on the six gateway resources, and a destructive `x-action` sending its own HTTP method. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neilmartin83 committed Sep 11, 2026

docs: --from-file is the one request-body flag name, and gateway resources gained apply Platform and Security Cloud commands took --file where Jamf Pro, Classic, Protect and School took --from-file. They now take --from-file too, with no compat alias, and the body can arrive on stdin instead — which these two products could not do before, making them the only namespaces where scaffold-edit-apply had to route through a temp file. The --file occurrences that remain are the uploads and the --file/--dir YAML imports, which are a different flag with the same name: a --from-file body can always be piped instead, and a multipart upload cannot. Also documents the new apply verb on dns-zones, ztna-apps, ztna-gateways, ztna-grouped-gateways, device-groups and ai-policies, including the two things that differ from Pro's apply — most of these update with PATCH rather than PUT, so omitted fields are kept rather than cleared, and ai-policies replaces `settings` wholesale despite its merge-patch content type — and why the Radar half has no apply and should not. Drops the `--from-file /dev/stdin` workaround from the merge-patch example (pro patch has always read a bare pipe) and the "no piped-stdin route" note from the Security Cloud workflows page, both now false.

neilmartin83 committed Sep 8, 2026

docs: rewrite the wiki prose for voice and first-party register Two passes over all 26 pages, prose only. No command, flag, path, exit code, privilege slug, count or version string changed; code blocks are byte-identical to the previous revision apart from one hand-written shell comment. Voice pass: - Removed every prose em dash (1050 of them). Fenced output and the one not-applicable table placeholder keep theirs. - Cut the marketing register: the "See It in Action" heading, "instant snapshot", "unlocks", "and more", "comprehensive", and the "no scripting, no Postman, no guesswork" negative triple on the front page. - Cut filler adverbs where they carried no technical load, and kept the ones that do: "silently" means no error is raised, "legitimately" marks a valid tenant state, "deliberately" marks a design choice rather than an oversight. - Named the actor where the passive voice hid it: the CLI appends the hint, root.go picks the provider, backup writes the documents, you create the integration. - Renamed nine version-suffixed headings to the parenthetical style already used elsewhere, updating every inbound wiki link in the same pass. First-party pass, since this wiki is published by Jamf and read as though an outside integrator wrote it: - Jamf-as-external-actor now names the system that acts: "before the gateway sees them", "Jamf Protect publishes analytics centrally", "the recommended level for new integrations", "Public-beta credentials stopped working at GA". - "report it to Jamf" is now "report it to Jamf Support". - Product names, Jamf PI-827, the repository URLs, and Jamf-managed / Jamf-published as object classes are untouched; the Protect API returns jamf: true, so that vocabulary is the product's own. - No first-person plural introduced. Two blocks still quote the CLI's edgeBlockedNote verbatim, which says "not Jamf and not your API privileges" and "report it to Jamf". Those stay until the string changes in internal/client/client.go. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neilmartin83 committed Sep 4, 2026

docs: update wiki for v1.28.0 — the Platform API GA migration Two new pages: - Platform API GA Migration: the base URL moves to {region}.api.jamfcloud.com with no /api segment, the pre-GA {region}.apigw.jamf.com is retired and refused by name, public-beta credentials were revoked, and the scope travels in a header rather than a /tenant/{id} URL segment. Carries the refused-command table, exit code 8 and JAMF_CLI_ALLOW_UNPUBLISHED. The table is generated from `commands -o json`, not transcribed: it is 75 entries, not the 48 the repo's own guide claims, and the 24 MDM device actions the guide omits get their own section — losing lock, restart, shutdown and lost mode is the sharpest consequence of a gateway profile. - Jamf Platform Commands: the new `platform` namespace — AI Governance, Jamf Account (organization scope, US-only) and the platform audit event log, which is not `pro audit`. Both were wire-verified against organization-, environment- and tenant-scoped gateway credentials, so the quoted output is real: the exit-8 refusals and their successor sentence, the method-specific "declares GET on this path but not POST" detail behind the device actions, the 403 that names Jamf Account's own picker name, and the retired-host refusal. Per-product updates: - Security Cloud: 68 new commands. The product now has two halves that take different credentials — the Radar API pairs from `security setup` and the platform gateway from `platform setup` — so both pages lead with which half a command belongs to and how to ask the binary. An environment-scoped credential reaches the whole gateway-served half, which corrects the tenant-ID-required framing. - Protect: `backup`, `restore` and `analytics overrides`, none of which the changelog mentions. Includes the prune refusals, the two 0600 files that capture bearer tokens verbatim, and that git drops the mode. - Pro: App Installers are published and no longer refused; Classic writes gained --from-file, --set and --scaffold, with the three refusal messages verbatim and why Classic hides a mistake the server answers 201 for; computers-inventory moved to v4. - Platform API: ddm-reports declaration/device `get` are removed, and the successors require --filter. - Setup, Configuration, Secrets: the three scope levels, the GA host, and that JAMF_AUTH_METHOD is not a variable — the gateway host alone selects platform auth. - Reference pages: exit 8 and the two 403 vocabularies, the three --set dialects, [] instead of null, labelled retries, Go 1.27, the SDK spec source and the committed gateway-coverage manifest. Every one of the 1,295 jamf-cli invocations across the wiki was checked against `commands -o json`; wiki links, heading anchors and code fences all resolve. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neilmartin83 committed Sep 3, 2026

docs: update wiki for v1.23.0 New Jamf Security Cloud namespace + assorted Pro/Platform features. - Add Jamf Security Cloud Commands and Security Cloud Workflows pages (risk, device-lifecycle, SSE stream/status/verification/jwks/well-known) - Wire Security Cloud into _Sidebar, Home, Setup Guide, Configuration (product: security, auth-method: security, JAMFSECURITY_* env vars) - Pro: backup --download-packages; app-installer-deployments export, history, version-update, add-history-note, installation-retry --all, installation-retry-by-computer-id, delete, update; device dateCompleted - Platform: compliance-benchmarks selectedOsVersions - CLI Patterns: update --set fetch-merge-replace; duplicate-serial collision surfacing + pro report duplicate-serials All commands/flags verified against the v1.23.0 binary catalog. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

neilmartin83 committed Jul 14, 2026