oackctl v1.2.0

Added

• oackctl shell completions — Homebrew formula now auto-installs bash, zsh, and fish completions via generate_completions_from_executable. Also available manually via oackctl completion bash|zsh|fish.

• oackctl env var rename — TT_SERVER_URL → OACKCTL_SERVER_URL, TT_TOKEN → OACKCTL_TOKEN, TT_PROFILE → OACKCTL_PROFILE. Old names still work as fallback. --help now shows documentation, LLM context, and GitHub links.

• Probe enrichment status in list view — the probe list endpoint now includes an enrichment object per probe indicating which data sources have been matched ({"cloudflare": true}). Uses a LEFT JOIN on cf_log_entries — no extra round trips. Available as a field mask via ?fields=enrichment. Extensible for future enrichment sources.

• Unified personal notifications — personal notification channels are now managed at the account level with a single defaults mechanism that applies everywhere (monitor alerts, incident notifications, maintenance notifications, update reminders). New endpoints: GET/PUT /api/v1/me/accounts/{accountID}/notification-defaults for managing default channels, POST /api/v1/me/alert-channels/copy for cloning channels between accounts, GET/PUT/DELETE /api/v1/teams/{teamID}/monitors/{monitorID}/my/notifications for per-monitor overrides. Monitor alerts now automatically notify all team members via their personal defaults. Team-personal channels migrated to account-personal. Migration: 000087_unified_personal_notifications.

• Per-subscription and per-incident notification overrides — users can now override their default notification channels for individual status page subscriptions and incident reminders. New endpoints: GET/PUT/DELETE /api/v1/me/subscriptions/{subID}/notifications for subscription overrides, GET/PUT/DELETE /api/v1/accounts/{accountID}/status-pages/{pageID}/incidents/{incidentID}/my/notifications for incident reminder overrides. Same three-state model as per-monitor overrides (defaults / custom / muted). Dispatch logic updated to check overrides before falling back to defaults. Migration: 000088_subscription_incident_notification_overrides.

Removed

• oackctl internal commands removed — removed admin, checkers, users command groups and probes create/update/delete subcommands from oackctl. These use internal-only API endpoints not exposed in the public OpenAPI spec. whoami (GET /me) preserved in new client/me.go.

• Team-personal notification channels — removed /api/v1/teams/{teamID}/my/alert-channels endpoints, service methods, entity constructor (NewPersonalAlertChannel), repository method (ListByTeamIDAndUserID), and oackctl my-channels commands. All personal channels are now account-level via /api/v1/me/alert-channels. Telegram deep-link bot updated to create account-personal channels. Dropped status_page_subscriber_channels table (migration 000089).

• Incident update reminder notifications — the background reminder job now dispatches real notifications to all enabled alert channels belonging to the incident author. Supports all channel types: Slack, Telegram, Discord, Email, Webhook, PagerDuty, and Push. Each notifier uses distinct reminder formatting (🔔 prefix). Webhook payloads include is_reminder flag and incident.reminder event type.

• Incidents & maintenances on the events timeline — status page incidents and maintenances now automatically appear as chart events on every monitor timeline and the /timeline feed across all teams in the account. One chart event per lifecycle — ended_at and metadata updated on each status transition. Soft-deleted when the incident/maintenance is removed. New chart event source: status_page.

• Maintenance notification dispatch — creating a maintenance, posting a maintenance update, or auto-transitioning (scheduled → in_progress → completed) with notify_subscribers: true now dispatches notifications to all matching subscribers. All four formatters (Telegram, Discord, SMTP email, plain email) use maintenance-specific text (🔧 Scheduled Maintenance / ✅ Maintenance Completed) distinct from incident formatting.

• Status page incident notifications — creating an incident or posting an incident update with notify_subscribers: true now actually dispatches notifications. Email subscribers receive plain-text emails; authenticated subscribers receive notifications via their linked personal channels (Discord, Slack, Telegram, etc.). Previously the dispatch was a logging-only stub.

• MCP Phase 1: read-only tools — expanded MCP server from 25 to 58 tools. New read-only tools cover: monitor timeline, traceroutes, comments (monitor/team/account), chart events, external links, probe shares, status pages (pages, components, groups, incidents, maintenances, subscribers, watchdogs, incident templates), Cloudflare zone integrations, PagerDuty integration, CF log entries, account/team invites, team API keys, user profile and preferences, personal alert channels, and bulk monitor snapshots.

• Checker geo override — super admin can manually override all geo fields (country, region, latitude, longitude, ASN, ASN org) for any checker via PUT /api/v1/checkers/{checkerID}/geo-override. Overrides persist across heartbeats and re-registrations (GeoIP lookup is skipped). Clear with DELETE .../geo-override to re-enable auto-detection. New geo_override boolean in checker API response. New geo_override column on checkers table (migration 000086).

• Probe deduplication — createProbe now checks correlation_id before inserting. Duplicate probes (e.g. replayed from an offline buffer) are silently skipped. Stale probes (checked_at > 5 minutes old) skip auto-recovery and health evaluation to avoid flipping current monitor state.

Fixed

• CorrelationID persistence — fixed a bug where correlation_id was set on the input entity but never copied to the probe during createProbe, resulting in all probes being stored with an empty correlation_id.

Added

• Status Page Renderer — dedicated Go binary (cmd/status-page/) serving SSR HTML for public status pages at {slug}.status.oack.io. Autocert TLS (Let's Encrypt HTTP-01), Host-based slug routing with custom domain fallback, dual listeners (HTTPS:443 + HTTP:80 for ACME/redirect), internal listener (localhost:9100 for health, cert provisioning, cache invalidation webhooks). Server-side rendered pages: main status page with components, groups, incidents with timeline, maintenance, and 90-day uptime bars; incident history with pagination; Atom/RSS feed. Email subscribe, verify, unsubscribe flows with token-based lookup. Password protection via bcrypt + JWT session cookies. JSON API for JS auto-refresh (/api/status, /api/incidents, /api/components/{compID}/uptime). Per-IP token bucket rate limiting (120 req/min pages, 60 req/min API). Security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options). Responsive CSS with dark/light mode via prefers-color-scheme. Structured JSON request logging. Health endpoint with DB ping. New GetByCustomDomain on StatusPageRepository. Build: make build-status-page. See PRD_STATUS_PAGE_RENDERER.md.

• Status Pages (Phases 1–10) — account-scoped public status pages with components, component groups, incidents, and scheduled maintenance. New tables: status_pages, status_page_components, status_page_component_groups, status_page_component_history, status_page_incidents, status_page_incident_components, status_page_incident_updates, status_page_maintenances, status_page_maintenance_components, status_page_maintenance_updates. Full CRUD at /api/v1/accounts/{accountID}/status-pages with nested /components, /component-groups, /incidents, and /maintenances endpoints. Public read endpoints at /api/v1/public/status-pages/{slug} (no auth). Globally unique, immutable slugs for subdomain routing ({slug}.status.oack.io). Component statuses: operational, degraded_performance, partial_outage, major_outage, under_maintenance. Incidents have 4 severity levels (minor, medium, major, critical) and forward-only status flow (investigating → identified → monitoring → resolved). Incident creation auto-sets linked component statuses based on severity mapping. Scheduled maintenance with start time, duration, and optional auto component status change (under_maintenance at start, operational at end). Background job auto-transitions maintenances (scheduled → in_progress → completed) every minute. Maintenance extension via duration increase. Plan limits: Free=0 pages, Pro=1 page/20 components, Business=5 pages/100 components. Dual subscriber model: email subscribers with double opt-in verification, and authenticated subscribers via POST/GET/PUT/DELETE /api/v1/me/status-page-subscriptions (immediately confirmed, notifications via personal alert channels). Email subscriber system with double opt-in verification: public POST /public/status-pages/{slug}/subscribers creates unverified subscriber, verification via GET /public/status-pages/verify?token=xxx, unsubscribe via GET /public/status-pages/unsubscribe?token=yyy. Scope-based targeting: subscribe to all updates, specific components, or component groups. Admin subscriber management: list and remove subscribers at .../{pageID}/subscribers. Background job cleans up unverified subscribers after 24h. Notification dispatch stub matches subscribers to affected components based on scope. Watchdog system for auto-incident creation: link monitors to components via .../components/{compID}/watchdogs — configurable auto_create and auto_resolve toggles, hooked into monitor health transitions. Incident update reminders: background job nudges authors when next_reminder_at is overdue. Password-protected status pages: POST /public/status-pages/{slug}/auth with bcrypt verification. Uptime calculation: GET /public/status-pages/{slug}/components/{compID}/uptime?days=90 computes daily uptime % from component history (excludes maintenance, counts partial/major outage as downtime). Atom RSS feed: GET /public/status-pages/{slug}/rss with last 50 incidents and maintenances. Requires account owner or admin role for management. See PRD_STATUS_PAGE.md.

• Push notifications backend (Phase 1) — device token registration and notification preferences for mobile push notifications. New push_devices table for Expo push tokens (POST/GET/DELETE /api/v1/me/devices). New notification_preferences table for per-monitor mute and quiet hours (GET/PUT /api/v1/me/notification-preferences). Expo Push Service dispatcher integrated into the alert pipeline — sends push notifications on monitor down/recovery and SSL/domain expiration events to all team members with registered devices, respecting mute and quiet hours settings. Configure via EXPO_PUSH_ACCESS_TOKEN env var. See PRD_PUSH_NOTIFICATIONS.md.

• External Links (Phase 1) — team-scoped external link templates with variable interpolation. Users can define named URL patterns (e.g. Grafana Loki explore links) with {{variable}} placeholders that get filled in per-probe. New external_links and monitor_external_links tables. CRUD endpoints at /api/v1/teams/{teamID}/external-links (admin/owner). Monitor assignment endpoints at .../monitors/{monitorID}/external-links. Auto-assignment: when a new link's icon URL domain matches existing links, it's automatically assigned to the same monitors. Probe details endpoint now returns interpolated external_links array with ready-to-click URLs. Supported variables: probe fields (id, request_id, correlation_id, cf_ray, status, resolved_target_ip, checker_public_ip, error, referer), timestamps (checked_at with configurable ±window in epoch ms and ISO formats), and monitor fields (id, name, url). Per-link time_window_minutes setting controls the time window for from/to variables.

• Cloudflare Log Stream Enrichment (Phases 1-4) — new cf_zone_integrations table and account-scoped REST endpoints (POST/GET/PUT/DELETE /api/v1/accounts/{accountID}/integrations/cloudflare-zone) for managing CF zone integrations. New cf_log_entries table stores edge-internal telemetry from CF Instant Logs. Background WebSocket connection manager streams real-time logs from CF, matches entries to probes by cf_ray or correlation_id, and upserts into the database. Background reconciliation loop (30s default) matches unlinked entries. New read endpoints: GET .../monitors/{monitorID}/cf-logs (time-range listing) and GET .../probes/{probeID}/cf-log (per-probe); probe details endpoint enriched with inline cf_log section. New cdn_log_enrichment_enabled boolean on monitors for per-monitor opt-in. New correlation_id column on probes for checker-generated trace IDs. Checker now sends Referer: https://app.oack.io/teams/monitor/{monitorID} and X-Oack-Trace: {correlationID} headers on every probe request, and applies monitor-level custom headers. Enable streaming via CF_LOG_STREAM_ENABLED env var; reconciliation interval configurable via CF_LOG_RECONCILIATION_INTERVAL (default 30s). API tokens masked (last 4 chars). Requires account admin/owner to manage integrations.

• CI/CD event ingestion (Phase 5) — new team_api_keys table and management endpoints (POST/GET/DELETE /api/v1/teams/{teamID}/api-keys) for creating headless API keys scoped to a team. Keys use oack_ prefix + 32 random hex chars; only the SHA-256 hash is stored. New POST /api/v1/teams/{teamID}/events/ingest endpoint accepts chart events from CI/CD pipelines using API key auth (Authorization: Bearer oack_...). Events are created with source=webhook and no created_by. started_at defaults to now() if omitted. Requires team owner/admin to create/delete keys; any team member can list keys (prefix only, never the full key). New APIKeyAuth middleware validates keys independently of JWT auth.

• PagerDuty incident sync (inbound) — pagerduty_integrations moved from team-scoped to account-scoped (migration 000076). REST endpoints now at /api/v1/accounts/{accountID}/integrations/pagerduty (CRUD + POST .../sync). Sync fan-out: each PD incident creates a chart_event for every team under the account. Background sync job polls PagerDuty REST API v2 every 60s (configurable via PAGERDUTY_SYNC_INTERVAL), fetches incidents with pagination, and upserts them as chart_events (source=pagerduty, kind=incident). Supports service ID filtering, force-sync trigger, API key masking (last 4 chars), and sync error tracking. Requires account admin/owner role for management; any account member can view (masked). High urgency maps to critical severity, low to warning.

• PagerDuty US/EU region support — new region field ("us" or "eu") on PagerDuty integrations (migration 000077). Users can choose which PagerDuty instance to integrate with: US (api.pagerduty.com) or EU (api.eu.pagerduty.com). Defaults to "us". Region is settable on create and updatable via PUT. Sync uses the region-specific API URL.

• Unified timeline endpoint — new GET /api/v1/teams/{teamID}/monitors/{monitorID}/timeline endpoint that merges comments, alert events, and chart events into a single chronological timeline. Supports from/to time range (RFC3339 or Unix timestamp), include_comments/include_alerts/include_events toggles (default true), and kinds comma-separated chart event filter. Results sorted ascending by started_at, capped at 1000 events. Each event includes type-specific metadata: comments include author info and is_resolved flag; alerts include severity mapping and human-readable titles; chart events include source, kind, URL, and metadata.

• Chart events CRUD — new chart_events table and REST endpoints (POST/GET/PUT/DELETE /api/v1/teams/{teamID}/events) for annotating monitor charts with external events (deploys, incidents, maintenance, etc.). Events can be team-wide or scoped to a specific monitor. Supports time-range listing with kind/source/monitor filters. Author or team admin/owner can update/delete. Source is always manual for user-created events; pagerduty, github, webhook sources reserved for future integrations. JSONB metadata field for arbitrary key-value data. Upsert support with dedup on (team_id, source, external_id).

• PagerDuty alert channel — new pagerduty channel type for alert notifications. Sends monitor down/recovery events via PagerDuty Events API v2 (trigger + resolve with dedup key oack-{monitor_id}). Also supports SSL/domain expiration alerts with appropriate severity mapping (expiring=warning, expired=critical). Available on Pro and Business plans. Config requires routing_key; optional severity override (default critical).

• Additional OAuth providers — login via Slack, Microsoft (Azure AD / Entra ID), Apple (Sign in with Apple), and Yandex. Each provider follows the existing Google/GitHub pattern: redirect → callback → token exchange → user info → FindOrCreate. Providers are independently toggleable via env vars (empty client ID = disabled). New GET /api/v1/auth/providers endpoint returns the list of enabled providers for the frontend. Apple uses form_post response mode and JWT-based client secret (ES256).

• Chart comments (Phases 1–5) — annotate monitor probe charts with threaded comments anchored to a point or time range. Supports create, reply, edit, soft-delete, resolve/reopen threads, and edit history. Per-account limits (seeded from plan) enforced. Guest users are read-only. Phase 3: @mentions with email notifications. Phase 4: cross-scope comment listing (GET /teams/{teamID}/comments, GET /accounts/{accountID}/comments). Phase 5: shared link comments (GET /shares/{token}/comments) when include_comments is enabled on the share.

• Follow redirects control — new follow_redirects boolean field on monitors (default false). When disabled, the checker returns the 3xx response as-is without following the redirect chain. Exposed in API create/update, bulk export/import, duplicate, and oackctl CLI (--follow-redirects flag).

• DNS resolve override — new resolve_override_ip field on monitors. When set, the checker skips DNS resolution and connects directly to the specified IPv4/IPv6 address, while preserving TLS SNI and HTTP Host header from the original URL (curl --resolve equivalent). Traceroute also uses the override IP. dns_ms is reported as 0 when override is active.

• Status code patterns for allowed codes — allowed_status_codes now uses string patterns ("2xx", "3xx") and exact codes ("200", "404") instead of integer arrays. Supports mixed mode (e.g. ["2xx", "301", "404"]). Existing data is migrated automatically.

• Bulk monitor management — export, import (with dry-run preview), and restore monitors in bulk via JSON. Team owners can download all monitors, edit offline, and upload changes atomically. Includes snapshot-based rollback (last 10 snapshots, 30-day retention). Endpoints: GET/POST .../monitors/bulk, GET .../monitors/bulk/snapshots, POST .../monitors/bulk/snapshots/{id}/restore.

• BunnyCDN PoP geo extraction — re-enabled BunnyCDN edge location detection in probe details. Uses the checker's country to disambiguate ambiguous 2-letter PoP codes (US state abbreviations vs international country codes). Server header is parsed from the stored response JSON.

• Probe performance percentiles — probe detail endpoint now includes a performance object with percent-rank for each latency fraction (dns, connect, tls, send, wait, receive, total) over 1d, 7d, 30d, and 90d windows. Computed against successful probes for the same monitor.

• Auto-create default team on account creation — creating a new account now auto-creates a default team, matching the signup onboarding flow.

• Guest account role — new guest role for account members. Invited users default to guest. Guests have read-only access: they cannot create monitors or teams. Existing roles (owner, admin, billing_admin, member) are unchanged.

• Probe sharing via permalinks — share monitor probe data with external users:

  • Create time-ranged share links with configurable expiration (1h, 24h, 7d, 30d, 1y)
  • Two access modes: public (no auth) and authenticated (requires login)
  • Server-side redaction groups: hide monitor name, checker IP, source ASN, and/or HTTP bodies/auth headers
  • Public view endpoints: metadata, probe list, and time-series aggregation
  • Per-user share limit (100 active shares)

• Move team/monitor — team owners can move a team to a different account; monitor admin/owners can move a monitor to a different team (requires write access in both source and target).

• Free account limit — users can own at most 1 free account. Paid accounts (pro, business) are unlimited.

• MCP server — OAuth infrastructure (Phase 1) — OAuth 2.0 authorization code flow for MCP clients:

  • Dynamic client registration (POST /oauth/register, RFC 7591)
  • Authorization endpoint with scoped consent screen — users pick which accounts/teams to share
  • Token endpoint (POST /oauth/token) with authorization_code and refresh_token grants
  • Token revocation (POST /oauth/revoke, RFC 7009)
  • OAuth server metadata (GET /.well-known/oauth-authorization-server, RFC 8414)
  • 1-hour access tokens (JWT with MCP scope) and 90-day refresh tokens with rotation
  • MCP auth middleware for scope-enforced request validation
  • MCP Streamable HTTP endpoint at /mcp/ using mcp-go library
  • Server-side rendered consent screen with dark theme

• MCP server — tools (Phase 2+3) — 21 read-only MCP tools exposing the full monitoring data surface:

  • Account & team navigation: oack_accounts_list, oack_account_get, oack_account_subscription, oack_account_members_list, oack_teams_list, oack_team_get, oack_team_members_list
  • Monitors: oack_monitors_list, oack_monitor_get, oack_monitor_metrics, oack_monitor_expiration
  • Probes: oack_probes_list, oack_probe_get, oack_probes_aggregate (time-series bucketed aggregation)
  • Alerts: oack_alert_channels_list, oack_alert_events_list, oack_monitor_alert_channels
  • Checkers: oack_checkers_list, oack_checker_get
  • Geo: oack_geo_regions
  • Composite: oack_status_overview (counts monitors by health state across authorized teams)
  • All tools enforce OAuth scope — only authorized accounts/teams are accessible

• Operational tooling (Phase 5) — admin endpoints and audit logging for account lifecycle:

  • Admin endpoints (super_admin only): list all accounts, get account, set plan, set status, force-delete, view audit log
  • RequireSuperAdmin middleware guards /api/v1/admin/* routes
  • Audit log: records account lifecycle events (create, delete, restore, ownership transfer, member changes, subscription changes, admin overrides)
  • account_audit_log table with JSONB details column for flexible event metadata
  • Fire-and-forget audit writes (warns on failure, never blocks operations)

• Read-only mode & subscription management (Phase 3) — expired paid subscriptions enter degraded state:

  • Subscription endpoints: GET/PUT /api/v1/accounts/{accountID}/subscription (owner or billing_admin)
  • Write-access gating: all mutating operations (create/update/delete monitors, teams, alert channels) return 402 when subscription is expired or cancelled
  • Read-access gating: metrics and expiration detail endpoints return 402 for expired paid accounts
  • Probe history truncation: list/aggregate endpoints silently clamp to 30-minute window for expired paid accounts
  • Free-tier accounts are never read-only — degradation only applies to lapsed paid plans
  • Account.IsReadOnly(), IsExpired(), IsPaidPlan() entity helpers
  • UpdateSubscription repository method for plan/status changes

• Plan limits & quota enforcement (Phase 2) — enforces plan-based resource limits across the platform:

  • PlanLimits configuration for free/pro/business plans (monitors, teams, members, check interval, channel types, probe retention)
  • QuotaService with structured QuotaError responses (402 Payment Required) including limit/current/max/plan/upgrade_to fields
  • Monitor create/update: enforces max monitors per account and minimum check interval per plan
  • Team create: enforces max teams per account
  • Member add & invite accept: enforces max members per account
  • Alert channel create: gates channel types by plan (e.g. webhook/Slack restricted on free tier)
  • Fail-open design: quota checks skip gracefully when account context is missing (legacy teams)

• Accounts entity (Phase 1) — new top-level billing entity that groups teams. Includes:

  • Account CRUD with soft-delete and 30-day grace period restore
  • Account member management with four roles: owner, admin, billing_admin, member
  • Atomic ownership transfer (Slack/Linear model)
  • Account email invitations with 7-day expiry and auto-accept on signup
  • Team creation under accounts (POST /api/v1/accounts/{accountID}/teams)
  • Auto-create account + team on new user signup (replaces "default" team)
  • Team invite acceptance auto-adds user to parent account as member
  • Backfill migration for existing teams into auto-created accounts
  • Subscription plan field (free/pro/business) and status tracking (active/trialing/past_due/expired/cancelled)
  • Founding member fields for early adopter program

• Checker coordinates — latitude and longitude fields on checker API responses. Populated from MaxMind GeoIP city database on registration and heartbeat. Enables frontend map visualization of checker locations.

• Per-monitor uptime display thresholds — new fields uptime_threshold_good, uptime_threshold_degraded, uptime_threshold_critical on monitors. Configurable breakpoints for SPA color tiers (green/amber/orange/red). Defaults match previous hardcoded values (99.90/99.00/95.00). Thresholds also included in the metrics endpoint response.

• TCP_INFO probe fields — new columns tcp_retransmits, tcp_rtt_us, tcp_segs_out, tcp_segs_in on every probe. Available via API responses and field filtering.

• Pcap capture storage — new probe_captures table stores raw pcap files from debug-mode probes. Probes gain has_pcap and pcap_retransmits fields.

• Pcap download endpoint — GET /api/v1/teams/{teamID}/monitors/{monitorID}/probes/{probeID}/pcap returns binary pcap file with Content-Type: application/vnd.tcpdump.pcap.

• WebSocket read limit increase — checker WS connections now accept up to 512KB messages to accommodate base64-encoded pcap payloads.

• oackctl probes pcap <probeID> — download pcap capture to a local file.

• oackctl CLI Phase 2: all 12 remaining command groups — members, invites, users, preferences, geo, alert-channels, monitor-channels, alerts, probes, checkers, telegram. Full coverage of the HTTP API surface.

• oackctl members list|add|remove|set-role — manage team members.

• oackctl invites list|create|revoke|accept — manage team invites; accept works without --team.

• oackctl users list|get|create|update|delete — admin user management.

• oackctl preferences get|set — user preferences (time format, theme).

• oackctl geo regions — list available geo regions and countries.

• oackctl alert-channels list|create|update|delete|test — team alert channels with JSON config.

• oackctl monitor-channels list|set|add|remove — monitor-channel link management.

• oackctl alerts list — view alert events for a monitor.

• oackctl probes list|get|create|update|delete|aggregate|details — probe results with cursor pagination, time-series aggregation, and detailed probe view.

• oackctl checkers list|get|rename|delete|assignments|set-teams|revoke|disconnect|redirect|clear-redirect — full checker management.

• oackctl telegram create-link|link-status — Telegram integration linking flow.

• MultiRowTableable interface in output package for types that render multiple table rows (used by probe aggregation and monitor metrics).

• oackctl CLI Phase 3: 15 new command groups covering the entire API surface — accounts (CRUD, members, invites, subscription, transfer, restore), status-pages (pages, components, groups, incidents, maintenances, subscribers, watchdogs, templates), api-keys, comments (CRUD, reply, resolve, reopen, edits, cross-scope), external-links (CRUD, assign/unassign), chart-events (CRUD with filters), shares, traces, timeline, cf-logs, admin (accounts, set-plan, set-status, audit-log), pagerduty (CRUD + sync), cf-integrations (CRUD), notifications (defaults, overrides, copy-channels), devices.

• oackctl monitors move|test-alert — move monitor between teams and send test alert.

Changed

• Renamed ttctl to oackctl — binary, package paths, Makefile targets, goreleaser config, docs, and all string references updated.

Removed

• oackctl my-channels — removed team-personal channel commands (replaced by account-level /me/alert-channels).