History

docs: update the wiki for v1.35.0 --dry-run for Protect, School and Pro uploads; writes no longer re-sent; pro backup 0600/0700 and credential warning; terminal-safe output and CSV formula guard; --select columns in select order and --page projection; --from-file line checks; packages upload declares Content-Length, goes straight to JCDS on a Jamf Cloud distribution point and reports an unhashed large package as unverified; MCP refuses api-roles, api-integrations writes and supervision-identities download. Wire-checked against v1.35.0 on a platform sandbox profile. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

neilmartin83 committed Oct 29, 2026

docs: update the wiki for v1.34.0 Platform environments, tenants and deal-registration create/get; config validate reports credentials as set and gains --auth; macOS keychain items trust jamf-cli; MDM device actions work on a gateway profile (53 refused entries down to 36); pro environment-type removed; computer unlock-user-account; packages upload hash verification; ad-hoc Casper policies left out of reports; gateway request pacing. Wire-checked against v1.34.0 with -n previews and read-only calls. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

neilmartin83 committed Oct 23, 2026

docs: update the wiki for v1.33.0 pro setup --scope standard withholds the privileges that grant privileges or logins. import-profile keeps the profile as installed and takes over where it can; --convert replaces --legacy. pro bulk moves to classic-policies enable/disable and group add-members/remove-members; send-command refuses ten of twelve commands. Device actions exit 7 on a partial failure and --from-file lists take UDIDs, management IDs and names. MCP run_command refuses the writes that change who can log in. Gateway refusals drop from 59 to 53 (restart, shutdown, remote desktop now routed). Generated Pro writes take --from-file; Classic profile writes edit the element the server reads; gateway uploads go out chunked; -vv traces wire headers and -v works for Protect, School and Security Cloud. make sync-specs is retired; the skill and hook name real spec files. Wire-checked against v1.33.0 on platform-nmjspp. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

neilmartin83 committed Oct 9, 2026

docs: give the Community Showcase its own section near the top of Home It sits second, after Getting Started, and leads Contents and the sidebar again. Home still names no projects, so the showcase page stays the one list to maintain. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

neilmartin83 committed Oct 3, 2026

docs: restructure Home: getting started first, short examples and upgrade notes, no showcase copy Home kept a second, stale list of three showcase projects; the Community Showcase page is now the only list. Getting Started moves to the top, the examples drop from 25 commands to six, and the upgrade callout becomes a four-line Upgrading section that points at the CHANGELOG. Community moves to the end of Contents and the sidebar. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

neilmartin83 committed Oct 3, 2026

docs: credit Blueprint Conversion Utility to Jarred Wheeler Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

neilmartin83 committed Oct 3, 2026

docs: update the wiki for v1.32.0 and add Blueprint Conversion Utility Device secrets move to --new-password-file, --pin-file and --unlock-token-file, and set-recovery-lock clears only with --clear. --set refuses credential fields on Pro, Platform and Security Cloud. scope --computer/--mobile-device resolve to an ID and need a Read privilege. --all honours a smaller --page-size and halves a timed-out page; a sent write or a timeout is no longer retried. MCP list_commands takes prefix/query and returns NDJSON; run_command refuses local paths outside --input-dir. Smaller notes on Classic --name, --group, School and Protect identifier matching, the Radar host and the redactor. Wire-checked against v1.32.0 on pro-nmartin, platform-nmjspp and school-nmartin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

neilmartin83 committed Oct 3, 2026

docs: correct pagination, group member counts and blueprint YAML for v1.31.1 Behaviour changes only; the release notes carry the rest. - `--all` requests the endpoint's maximum, 2000 on most Jamf Pro lists, and ignores `--page-size`. Flag table corrected, the two stderr notices quoted, the per-endpoint ceilings listed. `--page 0` and `--all=false --page-size N` added as examples, the second replacing a `--page-size 50` that has never worked on its own. - The gateway `-v` sample now reads `page-size=2000`. - `group-tools` member counts: every group reported 0 before v1.31.1, so `list --empty` listed the instance and `pro audit` emitted no "Empty smart groups" finding. `--unused` no longer names a group that holds members. - A blueprint YAML export round-trips from v1.31.1 only, and `apply` refuses an older one. Noted where the round trip is documented, on three pages. Wire-verified against platform-mockingbird on v1.31.0 and v1.31.1: the page-size=2000 request, both notices verbatim, `--limit 1` lowering the page to 1, `--page 0` sending one request, 0 of 25 groups counted on v1.31.0 against 5 on v1.31.1, `--empty` at 25 against 20, the audit finding absent then reporting 9, and the refused v1.31.0 YAML export. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neilmartin83 committed Sep 18, 2026

docs: re-verify the lab page against v1.31.1 Re-ran every command on the page against the sandbox on v1.31.1. All 12 guided blocks and all 42 non-mutating buffet blocks pass unchanged, so the four fixes in that release need no rewording. Three measured figures moved: - The version the page claims it was checked against. - `pro audit` now takes about 15 seconds rather than 20 (14.8s, 16.0s and 16.2s over three runs, against 21.3s on v1.31.0). PR #389 made `--all` page at the endpoint's maximum, so the audit's sweeps cost fewer requests. - `dashboard` prints five Jamf Security Cloud errors to stderr, not four. Checked and unchanged: 15 reports, 17 blueprint components, 15 baselines, 104 rules in the CIS Level 1 scaffold, 12 members in JNUC Lab - macOS 26, the 45/60/192 fleet counts, and the six table column labels. Worth noting for the lab: `pro audit` now emits its "Empty smart groups" finding, at 29 groups. PR #387 fixed the check that could never fire, so the audit output a participant sees is one finding richer than it was. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neilmartin83 committed Sep 18, 2026

Updated Hands On With Jamf Concepts (markdown)

neilmartin83 committed Sep 18, 2026

chore: remove the renderer probe

neilmartin83 committed Sep 18, 2026

chore: temporary renderer probe (removed in the next commit)

neilmartin83 committed Sep 18, 2026

docs: open Self Service first for the sandbox credentials Self Service holds the username and password for the Jamf Pro web interface, so opening it is now the first step, ahead of the numbered sections and outside the five-minute budget. Delivered as an `open` command in a code block rather than a markdown link. GitHub strips unknown URL schemes: `[text](jamfselfservice://...)` renders as bare text with no anchor at all, which looks like a link and does nothing, and hides the URL so it cannot even be copied. A code block keeps the copy button every other step on the page uses. The buffet's browser recipes now point back at it, since those are the commands that ask for a sign-in. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neilmartin83 committed Sep 18, 2026

docs: correct the lab page's Home.md summary The summary predated the restructure. It advertised ten minutes and a power commands section, where the page now runs five minutes and folds those commands into the buffet. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neilmartin83 committed Sep 18, 2026

docs: add the JNUC hands-on lab page A guided five-minute walk through jamf-cli for walk-up participants at the "Hands-on with Jamf Concepts" session, followed by a buffet of recipes for anyone who finishes early or already knows the CLI. Written against a sandbox tenant on v1.31.0, and every command was run there rather than reasoned about. The guided path is 11 blocks, which measured at about four minutes once reading the line, pasting it and understanding the output are counted. An earlier draft had 56 blocks in sections labelled nine minutes; at a realistic 22 seconds a block that was over twenty. Three things the testing changed: - The default output format follows the destination: a table on a TTY, JSON through a pipe. Examples verified only through a pipe therefore did not match what a participant sees, so the page teaches the rule and pins -o on every projection. - `--field` and `--select` resolve against the rendered row shape, so a table takes its column labels and -o json takes the record's dot paths. Confirmed as intended behaviour and documented rather than worked around. - Three `| head -N` examples truncated JSON mid-array into invalid documents. They now project with jq instead. The page names fixtures that exist on the lab tenant: the JNUC Lab computer groups, the Playground policy, the Math Settings blueprint and the CIS Level 1 benchmark. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neilmartin83 committed Sep 18, 2026

docs: update the wiki for v1.31.0 v1.31.0 adds two leaves (1,764 -> 1,766) and one flag, all serving the new cross-product HTML fleet report: - New page Fleet Dashboard, covering `dashboard`: the two collection tiers and their costs, `--include-profile`'s different-product rule, why the destination is `--out-file` rather than a redirect, the four global flags it does not honour, and the exit-code table. - MCP Server: `generate_report` is a third tool, so "two generic tools" and the leaf count were both stale. Also corrects the security model, which claimed `run_command` rejects "five" flags matched exactly. It now matches seven by prefix and blocks eight command paths outright, `dashboard` among them. - Configuration & Profiles: `config set-report-dir` and the global `report-dir` key, including the world-writable refusal. - Setup Guide, Error Handling, Claude Code Skills, Home and the sidebar pick up `--report-dir`, dashboard's exit 7, and the new page. Verified against a v1.31.0 build: every command and flag exists in `commands -o json`, and `dashboard` was run live against an environment-scoped platform profile to confirm a product the credential cannot reach is omitted with exit 0 rather than failed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neilmartin83 committed Sep 18, 2026

docs: unescape HTML entities the renderer shows literally `jamf-cli pro &lt;resource&gt; &lt;action&gt; [flags]` sat inside a fenced code block, where nothing decodes an entity, so the usage line on the page's first screen read `&lt;resource&gt;`. It has been wrong since the wiki was split by product; every other `<id>` and `<resource>` in a code block is written bare and renders correctly. Also dropped `&amp;` from two list labels and one heading, where the renderer decodes it and the entity bought nothing. The rendered heading text is unchanged, so the anchor is too. Three `&amp;` / `&lt;` occurrences are kept: they sit inside inline code spans documenting PI-827 and the per-payload-type escaping, where the entity text is the thing being described rather than markup. Swept the other 24 pages for the same class of defect: no other entity, and no bare `<tag>` in prose for the renderer to swallow. The remaining backslash escapes are `\|` inside table cells and shell alternation, both required. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neilmartin83 committed Sep 16, 2026

docs: update the wiki for v1.30.0 The breaking change is the Classic `scope` subcommands. They took the resource name as a bare positional through v1.29.0 and now take `[<id>]` with `--name` as the alternative, refused together, so every scope example on Jamf Pro Commands and Pro Workflows was an exit 2. The single flag/section table went with it: each command registers only its own resource's categories now, so a cross-family flag no longer exists on it and one table for nine resources was wrong on seven. Replaced with a per-resource matrix read off the catalog, plus the section validity each category carries. `--ibeacon`, `--class` and restricted-software `--user` are documented as newly writable, and `--class` gets the two-request mechanism, since an operator counting requests needs it. `classic-user-groups` is gone from the scopeable list. It has never carried `scope` in any release; checked against both the v1.29.0 and v1.30.0 catalogs. `open` is new in all four product namespaces and is documented on each product page, with the cross-product pattern on CLI Patterns: the print- instead-of-launch triggers, `--field url`, and the per-product URL ladders, which differ. `pro open` takes one of 139 named sections and is the only one that can send a request. The section list is not pasted anywhere; `pro open --list` is the source. Also: the published Classic API caught up to 11.32.0, so the "which trails the Pro API's version" caveat is gone from the binary and from the four pages quoting it, and `pro classic-computer-configs` is now recorded as dead rather than unpublished. `preview` is a new catalog key on the thirteen AI Governance commands. `pro sso-settings oidc-broker-config` and `pro jamf-pro-notifications delete --all` are documented, the latter with the v1.29.0 defect where `-n` sent a live tenant-wide DELETE. The platform SDK's move to the jamf org is on Architecture & Development, with jamfprotect-go-sdk called out as staying put. Every invocation on every page was resolved against `commands -o json` from the v1.30.0 binary and every long flag checked against that command's own flag set; two pre-existing `security ztna-gateways create --file` examples were stale since v1.29.0 and are now `--from-file`. Quoted CLI output was captured from the binary against a live instance and a gateway profile. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neilmartin83 committed Sep 16, 2026

Updated Platform API GA Migration (markdown)

neilmartin83 committed Sep 14, 2026

docs: rewrite the wiki as instructions, and run stop-slop over it Every page read as an essay. Each section now answers what you type, what happens, and what to watch out for when that changes what you type. Deleted throughout: the meta sections about the pages themselves ("Do I need this page?", "What this page is not", "The five ways this can break you", "Why the names changed"), the design rationale, the history of what the CLI used to send, and the postmortem narration that belongs in the repo's docs/solutions. Prose drops from 59,853 words to 47,515, and no page grew. Stop-slop pass over all 27 pages: | marker | before | after | |---|---|---| | em dashes in prose | 180 | 0 | | banned adverbs | 332 | 0 | | binary contrasts ("not X, it's Y") | 30 | 0 | | sentences opening on a Wh- word | 25 | 0 | | throat-clearing phrases | 1 | 0 | The 139 remaining adverb matches are `also`, `still`, `already` and `exactly`, none of them on the skill's list, and `still` is load-bearing here: an endpoint that still answers is the case the refusal wording exists for. The 165 remaining universal claims are counted or precise ("prepended to every call", "never in a flag value"), which the rule permits. Six fabricated transcripts corrected against the binary: - Ten blocks showed a `message:` label the CLI never prints. On a terminal it prints the message unlabelled then `hint: `; under `-o json` it prints the error envelope. Both forms now appear where each applies. - `jamf-cli pro icons list` was the example for "the retired name warns, then runs". `pro icon` ships no `list`, so it warned and then exited 2, which is the opposite of the point. Replaced with `pro icons get 1`. - The 401, 404 and 429 hints quoted three strings that are not in `internal/client/client.go`. Replaced with what it emits. - The payload-verification warning showed one comma-joined line with a parenthetical. `formatStoredPayloadWarning` emits a header plus one indented `- path: reason` line per finding, capped at three. Verbatim CLI output inside code blocks keeps its em dashes and its wording. Five remain on that basis, two of them in the `pro setup` credential-source menu, which the CLI itself prints with an em dash. Structural checks: code fences balanced, no table column mismatches, every in-page and cross-page anchor resolves after 24 heading renames, and no command, flag, table row or endpoint lost. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neilmartin83 committed Sep 11, 2026

docs: update wiki for v1.29.0 — the pro command rename v1.29.0 derives every `jamf-cli pro` resource name from the Jamf Pro API's own OpenAPI tags and URL paths instead of from the filename each resource's paths were split into. 163 resources became 135, and 100 former names resolve with a warning until 2027-03-09. New page, `Pro Command Renames`, is the migration reference: the full 96-name table, the four aliases that redirect two tokens deep, the three withdrawn names, the 48 invocations an alias cannot cover, the three former leaves that now print help at exit 0 where they returned data, the nine sub-path command groups, the 19 write operations that were being deleted at generate time, and a script-tree migration recipe. Linked from Home and the sidebar. Every page naming a `pro` command is updated to the new names — 100 occurrences across seven pages — and the retired spellings now appear only where the page is explaining them. Corrections found while verifying against the v1.29.0 binary and two live tenants: - The gateway refused-command list was 75 and is 59. The Classic patch family and `pro policy-properties` are served again; `pro static-computer-groups` no longer exists as a name, so the successor transcript it illustrated is dead and the curated successor table is empty. - An organization-scoped credential on `platform audit` answers `REQUEST_CONTEXT_NOT_PROVIDED`, not `INVALID_REQUEST_CONTEXT_TYPE`; the `'tenant'` in that second message means a tenant header really was sent. - AI Governance is environment-scoped, not organization-scoped. Its spec declares `environment` alone and the wire agrees. - Security Cloud device groups: `update` is the v2 PUT and answers 204 with no body; only the implicit "Default Group" comes back without an `id`, not the whole collection. - `platform setup` checks the scope ID and reports declared scope levels; it no longer returns a Security Cloud entitlement verdict. - `config add-profile` verifies credentials before writing and gained `--no-verify`; `pro setup` gained `--credentials existing|create`. - Classic `--scaffold`/`--set` coverage is 114 of 117, not 111. - `pro backup --resources` does not reject an unknown token alongside a recognised one — documented as it behaves. - The MCP catalog carries `scopes`, and `run_command` returns combined stdout+stderr, so a retired-name warning breaks JSON parsing downstream. - `pro policies` in the MCP page's examples does not exist; it is `pro classic-policies`. Adds the v1.29.0 behaviour changes throughout: every command prints through one output formatter, `--select`/`--compact` narrow rows for every column format, a cobra usage error exits 2, a stray positional is refused on every leaf that documents none, `--scaffold` reaches the commands that take positionals, name lookups accumulate matches across pages and report an unaddressable match, `apply` on the six gateway resources, and a destructive `x-action` sending its own HTTP method. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neilmartin83 committed Sep 11, 2026

docs: --from-file is the one request-body flag name, and gateway resources gained apply Platform and Security Cloud commands took --file where Jamf Pro, Classic, Protect and School took --from-file. They now take --from-file too, with no compat alias, and the body can arrive on stdin instead — which these two products could not do before, making them the only namespaces where scaffold-edit-apply had to route through a temp file. The --file occurrences that remain are the uploads and the --file/--dir YAML imports, which are a different flag with the same name: a --from-file body can always be piped instead, and a multipart upload cannot. Also documents the new apply verb on dns-zones, ztna-apps, ztna-gateways, ztna-grouped-gateways, device-groups and ai-policies, including the two things that differ from Pro's apply — most of these update with PATCH rather than PUT, so omitted fields are kept rather than cleared, and ai-policies replaces `settings` wholesale despite its merge-patch content type — and why the Radar half has no apply and should not. Drops the `--from-file /dev/stdin` workaround from the merge-patch example (pro patch has always read a bare pipe) and the "no piped-stdin route" note from the Security Cloud workflows page, both now false.

neilmartin83 committed Sep 8, 2026

docs: correct the Platform API GA date to 2026-09-03 Six pages stated 2026-09-01. Only the GA-date sentences changed; the wire-probe and observation dates that happen to read 2026-09-01, and the `--since` timestamps in the audit examples, are unrelated and untouched. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neilmartin83 committed Sep 4, 2026

Updated Platform API GA Migration (markdown)

neilmartin83 committed Sep 4, 2026

docs: rewrite the wiki prose for voice and first-party register Two passes over all 26 pages, prose only. No command, flag, path, exit code, privilege slug, count or version string changed; code blocks are byte-identical to the previous revision apart from one hand-written shell comment. Voice pass: - Removed every prose em dash (1050 of them). Fenced output and the one not-applicable table placeholder keep theirs. - Cut the marketing register: the "See It in Action" heading, "instant snapshot", "unlocks", "and more", "comprehensive", and the "no scripting, no Postman, no guesswork" negative triple on the front page. - Cut filler adverbs where they carried no technical load, and kept the ones that do: "silently" means no error is raised, "legitimately" marks a valid tenant state, "deliberately" marks a design choice rather than an oversight. - Named the actor where the passive voice hid it: the CLI appends the hint, root.go picks the provider, backup writes the documents, you create the integration. - Renamed nine version-suffixed headings to the parenthetical style already used elsewhere, updating every inbound wiki link in the same pass. First-party pass, since this wiki is published by Jamf and read as though an outside integrator wrote it: - Jamf-as-external-actor now names the system that acts: "before the gateway sees them", "Jamf Protect publishes analytics centrally", "the recommended level for new integrations", "Public-beta credentials stopped working at GA". - "report it to Jamf" is now "report it to Jamf Support". - Product names, Jamf PI-827, the repository URLs, and Jamf-managed / Jamf-published as object classes are untouched; the Protect API returns jamf: true, so that vocabulary is the product's own. - No first-person plural introduced. Two blocks still quote the CLI's edgeBlockedNote verbatim, which says "not Jamf and not your API privileges" and "report it to Jamf". Those stay until the string changes in internal/client/client.go. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neilmartin83 committed Sep 4, 2026

docs: update wiki for v1.28.0 — the Platform API GA migration Two new pages: - Platform API GA Migration: the base URL moves to {region}.api.jamfcloud.com with no /api segment, the pre-GA {region}.apigw.jamf.com is retired and refused by name, public-beta credentials were revoked, and the scope travels in a header rather than a /tenant/{id} URL segment. Carries the refused-command table, exit code 8 and JAMF_CLI_ALLOW_UNPUBLISHED. The table is generated from `commands -o json`, not transcribed: it is 75 entries, not the 48 the repo's own guide claims, and the 24 MDM device actions the guide omits get their own section — losing lock, restart, shutdown and lost mode is the sharpest consequence of a gateway profile. - Jamf Platform Commands: the new `platform` namespace — AI Governance, Jamf Account (organization scope, US-only) and the platform audit event log, which is not `pro audit`. Both were wire-verified against organization-, environment- and tenant-scoped gateway credentials, so the quoted output is real: the exit-8 refusals and their successor sentence, the method-specific "declares GET on this path but not POST" detail behind the device actions, the 403 that names Jamf Account's own picker name, and the retired-host refusal. Per-product updates: - Security Cloud: 68 new commands. The product now has two halves that take different credentials — the Radar API pairs from `security setup` and the platform gateway from `platform setup` — so both pages lead with which half a command belongs to and how to ask the binary. An environment-scoped credential reaches the whole gateway-served half, which corrects the tenant-ID-required framing. - Protect: `backup`, `restore` and `analytics overrides`, none of which the changelog mentions. Includes the prune refusals, the two 0600 files that capture bearer tokens verbatim, and that git drops the mode. - Pro: App Installers are published and no longer refused; Classic writes gained --from-file, --set and --scaffold, with the three refusal messages verbatim and why Classic hides a mistake the server answers 201 for; computers-inventory moved to v4. - Platform API: ddm-reports declaration/device `get` are removed, and the successors require --filter. - Setup, Configuration, Secrets: the three scope levels, the GA host, and that JAMF_AUTH_METHOD is not a variable — the gateway host alone selects platform auth. - Reference pages: exit 8 and the two 403 vocabularies, the three --set dialects, [] instead of null, labelled retries, Go 1.27, the SDK spec source and the committed gateway-coverage manifest. Every one of the 1,295 jamf-cli invocations across the wiki was checked against `commands -o json`; wiki links, heading anchors and code fences all resolve. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neilmartin83 committed Sep 3, 2026

docs: update wiki for v1.27.0 - Protect: new unified-logging-filter-sets (ulfs) command family, plan attachment via unifiedLoggingFilterSets, additive-collection semantics, plus a grouping workflow and export/apply round-trip. - Platform: import-profile takes a Classic ID positionally (--name for display names); components configuration-profile gains --id; note the rules list --baseline-id fix that returned 0 rules for every baseline. - CLI Patterns: apply/--name are only generated where the collection answers a GET — corrected the v1.12.0 merge-patch apply list and the --name resource row, and named the resources that lost each. - Pro: bulk add-to-group/remove-from-group examples used --group where --target-group is required (pre-existing error); documented serial resolution and unresolved-entry accounting for --from-file; CR/CRLF normalisation in profile payload verification; 11.31.0 spec additions. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neilmartin83 committed Aug 18, 2026

docs: update wiki for v1.25.0–v1.26.0 The wiki was last updated for v1.24.0, so this covers four releases. v1.26.0: - New "Release Update Notice" section in Configuration & Profiles: the once-a-day newer-release advisory, its three opt-outs (--no-update-check / JAMF_CLI_NO_UPDATE_CHECK / update-check: false), every suppression rule, caching, and why the module proxy is the source. Cross-referenced from Output Formats (it counts as an advisory hint), CI/CD (never fires in a pipeline), Setup Guide (staying current), and the tenant version check in Jamf Pro Commands (the mirror case). - Global flag, env var, config key, and `config show` field tables updated. - New "Payload wire handling" section for the Classic config-profile commands: the PI-827 409, what the CLI now normalises automatically (escaping, signed mobileconfigs, binary plists, embedded CDATA), the post-write verification warning, and why it does not extend to AppConfig. v1.25.x: - New "Application Usage (Classic API)" section plus a Pro Workflows recipe for classic-computer-app-usage. - CLI Patterns: typed --set values (array/object take JSON) and the write-only field warnings. - Platform API Commands: replaced the v1.24.0 "accepts almost every Apple payload" claim with the probed payload-type registry — out-of-registry types are MCX-wrapped rather than failing the import, Jamf's com.apple.preferences.users spelling is rewritten, and MCX unwrapping is narrower and no longer fetches from GitHub. Also corrects the Platform identifier convention throughout: Platform commands take a positional <id> with --name for lookup, not Protect's positional <name>. ~20 examples across Platform API Commands, Platform Workflows, CLI Patterns, Jamf School Commands, and School Workflows passed names positionally, which the API receives as an ID and 404s. Documented exceptions (blueprints clone, compliance-benchmarks export/clone, platform-device-groups add-members/remove-members, platform-devices get/delete, ddm-reports device) called out explicitly. Every jamf-cli invocation in the changed pages was validated against `jamf-cli commands -o json` from a v1.26.0 build.

neilmartin83 committed Jul 31, 2026

docs: update wiki for v1.24.0 (+ fix #297, #295) v1.24.0 features: - Platform: blueprints import-profile denylist model (wider payload support, System Policy – Kernel Extensions), smart Custom Settings (MCX) unwrapping, --computer-group/--mobile-device-group scope override + empty-scope guard - Platform: benchmark-reports --name (resolve by benchmark title) - Pro: classic-computer-history / classic-mobile-history --subset (server-side section narrowing) and --serial alias for --serialnumber (also on classic-mobile-devices get) - Correct classic read-only resource note (history is get-only; classic-accounts is list-only) Fix #297: ddm-reports `device declarations` and `declaration devices` require --filter — added it to every example across Platform API/ Workflows, School, Setup Guide, and CI/CD pages, with the allowed RSQL fields documented. Fix #295: MCP Server page now documents OpenAI Codex CLI setup (~/.codex/config.toml + `codex mcp add`), explains ChatGPT is not a direct fit (stdio-only server vs ChatGPT's remote HTTPS MCP requirement) with the bridge caveats, and answers the read-only question (no CLI flag; enforce via a read-only Jamf API role). All commands/flags verified against the v1.24.0 binary catalog. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

neilmartin83 committed Jul 17, 2026

docs: update wiki for v1.23.0 New Jamf Security Cloud namespace + assorted Pro/Platform features. - Add Jamf Security Cloud Commands and Security Cloud Workflows pages (risk, device-lifecycle, SSE stream/status/verification/jwks/well-known) - Wire Security Cloud into _Sidebar, Home, Setup Guide, Configuration (product: security, auth-method: security, JAMFSECURITY_* env vars) - Pro: backup --download-packages; app-installer-deployments export, history, version-update, add-history-note, installation-retry --all, installation-retry-by-computer-id, delete, update; device dateCompleted - Platform: compliance-benchmarks selectedOsVersions - CLI Patterns: update --set fetch-merge-replace; duplicate-serial collision surfacing + pro report duplicate-serials All commands/flags verified against the v1.23.0 binary catalog. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

neilmartin83 committed Jul 14, 2026