Add proboctl core skeleton and build system

Introduce the proboctl CLI entry point, root command, version,
completion, iostreams, shared cmdutil helpers (flags, table, JSON,
time formatting), API client with pagination, config management,
goreleaser configuration, and build system integration.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/cli/api/client.go

@@ -0,0 +1,136 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package api
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+
+	"go.probo.inc/probo/pkg/version"
+)
+
+type (
+	Client struct {
+		host       string
+		token      string
+		endpoint   string
+		httpClient *http.Client
+	}
+
+	graphQLRequest struct {
+		Query     string         `json:"query"`
+		Variables map[string]any `json:"variables,omitempty"`
+	}
+
+	graphQLResponse struct {
+		Data   json.RawMessage `json:"data"`
+		Errors []graphQLError  `json:"errors"`
+	}
+
+	graphQLError struct {
+		Message string `json:"message"`
+	}
+)
+
+func NewClient(host string, token string, endpoint string, timeout time.Duration) *Client {
+	return &Client{
+		host:       host,
+		token:      token,
+		endpoint:   endpoint,
+		httpClient: &http.Client{Timeout: timeout},
+	}
+}
+
+func (c *Client) Do(
+	query string,
+	variables map[string]any,
+) (json.RawMessage, error) {
+	raw, err := c.DoRaw(query, variables)
+	if err != nil {
+		return nil, err
+	}
+
+	var resp graphQLResponse
+	if err := json.Unmarshal(raw, &resp); err != nil {
+		return nil, fmt.Errorf("cannot parse GraphQL response: %w", err)
+	}
+
+	if len(resp.Errors) > 0 {
+		msg := resp.Errors[0].Message
+		for _, e := range resp.Errors[1:] {
+			msg += "; " + e.Message
+		}
+		return nil, fmt.Errorf("GraphQL error: %s", msg)
+	}
+
+	return resp.Data, nil
+}
+
+func (c *Client) DoRaw(
+	query string,
+	variables map[string]any,
+) ([]byte, error) {
+	reqBody := graphQLRequest{
+		Query:     query,
+		Variables: variables,
+	}
+
+	body, err := json.Marshal(reqBody)
+	if err != nil {
+		return nil, fmt.Errorf("cannot marshal GraphQL request: %w", err)
+	}
+
+	url := fmt.Sprintf("https://%s%s", c.host, c.endpoint)
+	req, err := http.NewRequest(http.MethodPost, url, bytes.NewReader(body))
+	if err != nil {
+		return nil, fmt.Errorf("cannot create HTTP request: %w", err)
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+c.token)
+	req.Header.Set("User-Agent", version.UserAgent("proboctl"))
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("cannot send HTTP request: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("cannot read HTTP response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		switch resp.StatusCode {
+		case http.StatusUnauthorized:
+			return nil, fmt.Errorf("authentication failed (HTTP 401): token may be invalid or expired, try 'proboctl auth login'")
+		case http.StatusForbidden:
+			return nil, fmt.Errorf("access denied (HTTP 403): you do not have permission to perform this action")
+		default:
+			return nil, fmt.Errorf(
+				"HTTP %d: %s",
+				resp.StatusCode,
+				string(respBody),
+			)
+		}
+	}
+
+	return respBody, nil
+}

pkg/cli/api/pagination.go

@@ -0,0 +1,86 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package api
+
+import (
+	"encoding/json"
+	"fmt"
+	"maps"
+)
+
+type (
+	PageInfo struct {
+		HasNextPage bool    `json:"hasNextPage"`
+		EndCursor   *string `json:"endCursor"`
+	}
+
+	Edge[T any] struct {
+		Node T `json:"node"`
+	}
+
+	Connection[T any] struct {
+		TotalCount int       `json:"totalCount"`
+		Edges      []Edge[T] `json:"edges"`
+		PageInfo   PageInfo  `json:"pageInfo"`
+	}
+)
+
+// Paginate fetches all pages of a connection up to limit items. The extract
+// function pulls the Connection out of the raw GraphQL response data.
+func Paginate[T any](
+	client *Client,
+	query string,
+	variables map[string]any,
+	limit int,
+	extract func(json.RawMessage) (*Connection[T], error),
+) ([]T, int, error) {
+	vars := maps.Clone(variables)
+
+	var (
+		nodes      = make([]T, 0)
+		totalCount int
+	)
+
+	for {
+		remaining := limit - len(nodes)
+		if remaining <= 0 {
+			break
+		}
+		vars["first"] = remaining
+
+		data, err := client.Do(query, vars)
+		if err != nil {
+			return nil, 0, err
+		}
+
+		conn, err := extract(data)
+		if err != nil {
+			return nil, 0, fmt.Errorf("cannot parse response: %w", err)
+		}
+
+		totalCount = conn.TotalCount
+		for _, edge := range conn.Edges {
+			nodes = append(nodes, edge.Node)
+		}
+
+		if !conn.PageInfo.HasNextPage || conn.PageInfo.EndCursor == nil {
+			break
+		}
+
+		vars["after"] = *conn.PageInfo.EndCursor
+	}
+
+	return nodes, totalCount, nil
+}

pkg/cli/config/config.go

@@ -0,0 +1,217 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package config
+
+import (
+	"fmt"
+	"maps"
+	"os"
+	"path/filepath"
+	"slices"
+	"time"
+
+	"gopkg.in/yaml.v3"
+)
+
+const DefaultHTTPTimeout = 30 * time.Second
+
+type (
+	Config struct {
+		Editor      string                 `yaml:"editor,omitempty"`
+		Browser     string                 `yaml:"browser,omitempty"`
+		Pager       string                 `yaml:"pager,omitempty"`
+		Prompt      string                 `yaml:"prompt,omitempty"`
+		HTTPTimeout string                 `yaml:"http_timeout,omitempty"`
+		ActiveHost  string                 `yaml:"active_host,omitempty"`
+		Hosts       map[string]*HostConfig `yaml:"hosts"`
+	}
+
+	HostConfig struct {
+		Token        string `yaml:"token"`
+		Organization string `yaml:"organization"`
+	}
+)
+
+var ValidKeys = []string{
+	"editor",
+	"browser",
+	"pager",
+	"prompt",
+	"http_timeout",
+}
+
+func (c *Config) Get(key string) (string, error) {
+	switch key {
+	case "editor":
+		return c.Editor, nil
+	case "browser":
+		return c.Browser, nil
+	case "pager":
+		return c.Pager, nil
+	case "prompt":
+		return c.Prompt, nil
+	case "http_timeout":
+		return c.HTTPTimeout, nil
+	default:
+		return "", fmt.Errorf("unknown configuration key: %s", key)
+	}
+}
+
+func (c *Config) Set(key, value string) error {
+	switch key {
+	case "editor":
+		c.Editor = value
+	case "browser":
+		c.Browser = value
+	case "pager":
+		c.Pager = value
+	case "prompt":
+		if value != "enabled" && value != "disabled" {
+			return fmt.Errorf("valid values for prompt are 'enabled' or 'disabled'")
+		}
+		c.Prompt = value
+	case "http_timeout":
+		if _, err := time.ParseDuration(value); err != nil {
+			return fmt.Errorf("invalid duration for http_timeout: %w", err)
+		}
+		c.HTTPTimeout = value
+	default:
+		return fmt.Errorf("unknown configuration key: %s", key)
+	}
+	return nil
+}
+
+func (c *Config) HTTPTimeoutDuration() time.Duration {
+	if c.HTTPTimeout == "" {
+		return DefaultHTTPTimeout
+	}
+
+	d, err := time.ParseDuration(c.HTTPTimeout)
+	if err != nil {
+		return DefaultHTTPTimeout
+	}
+
+	return d
+}
+
+func configDir() (string, error) {
+	dir, err := os.UserConfigDir()
+	if err != nil {
+		return "", fmt.Errorf("cannot determine config directory: %w", err)
+	}
+	return filepath.Join(dir, "proboctl"), nil
+}
+
+func configPath() (string, error) {
+	dir, err := configDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(dir, "config.yaml"), nil
+}
+
+func Load() (*Config, error) {
+	path, err := configPath()
+	if err != nil {
+		return nil, err
+	}
+
+	data, err := os.ReadFile(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return &Config{Hosts: make(map[string]*HostConfig)}, nil
+		}
+		return nil, fmt.Errorf("cannot read config file: %w", err)
+	}
+
+	var cfg Config
+	if err := yaml.Unmarshal(data, &cfg); err != nil {
+		return nil, fmt.Errorf("cannot parse config file: %w", err)
+	}
+
+	if cfg.Hosts == nil {
+		cfg.Hosts = make(map[string]*HostConfig)
+	}
+
+	return &cfg, nil
+}
+
+func (c *Config) Save() error {
+	path, err := configPath()
+	if err != nil {
+		return err
+	}
+
+	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+		return fmt.Errorf("cannot create config directory: %w", err)
+	}
+
+	data, err := yaml.Marshal(c)
+	if err != nil {
+		return fmt.Errorf("cannot marshal config: %w", err)
+	}
+
+	if err := os.WriteFile(path, data, 0o600); err != nil {
+		return fmt.Errorf("cannot write config file: %w", err)
+	}
+
+	return nil
+}
+
+func (c *Config) DefaultHost() (string, *HostConfig, error) {
+	if host := os.Getenv("PROBO_HOST"); host != "" {
+		hc := &HostConfig{}
+		if saved, ok := c.Hosts[host]; ok {
+			*hc = *saved
+		}
+		if token := os.Getenv("PROBO_TOKEN"); token != "" {
+			hc.Token = token
+		}
+		return host, hc, nil
+	}
+
+	hosts := slices.Sorted(maps.Keys(c.Hosts))
+
+	if token := os.Getenv("PROBO_TOKEN"); token != "" {
+		if len(hosts) == 0 {
+			return "", nil, fmt.Errorf("PROBO_TOKEN is set but no host configured; run 'proboctl auth login' first")
+		}
+
+		host := hosts[0]
+		if c.ActiveHost != "" {
+			if _, ok := c.Hosts[c.ActiveHost]; ok {
+				host = c.ActiveHost
+			}
+		}
+
+		return host, &HostConfig{
+			Token:        token,
+			Organization: c.Hosts[host].Organization,
+		}, nil
+	}
+
+	if c.ActiveHost != "" {
+		if hc, ok := c.Hosts[c.ActiveHost]; ok {
+			return c.ActiveHost, hc, nil
+		}
+	}
+
+	if len(hosts) > 0 {
+		host := hosts[0]
+		return host, c.Hosts[host], nil
+	}
+
+	return "", nil, fmt.Errorf("not logged in; run 'proboctl auth login' first")
+}

pkg/cli/config/config_test.go

@@ -0,0 +1,131 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package config_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/pkg/cli/config"
+)
+
+func TestDefaultHost(t *testing.T) {
+	t.Run(
+		"PROBO_TOKEN uses active host instead of first alphabetically",
+		func(t *testing.T) {
+			t.Setenv("PROBO_TOKEN", "tok_test")
+			t.Setenv("PROBO_HOST", "")
+
+			cfg := &config.Config{
+				ActiveHost: "beta.probo.inc",
+				Hosts: map[string]*config.HostConfig{
+					"alpha.probo.inc": {
+						Token:        "old-alpha",
+						Organization: "org-alpha",
+					},
+					"beta.probo.inc": {
+						Token:        "old-beta",
+						Organization: "org-beta",
+					},
+				},
+			}
+
+			host, hc, err := cfg.DefaultHost()
+			require.NoError(t, err)
+			assert.Equal(t, "beta.probo.inc", host)
+			assert.Equal(t, "tok_test", hc.Token)
+			assert.Equal(t, "org-beta", hc.Organization)
+		},
+	)
+
+	t.Run(
+		"PROBO_TOKEN falls back to first host when no active host",
+		func(t *testing.T) {
+			t.Setenv("PROBO_TOKEN", "tok_test")
+			t.Setenv("PROBO_HOST", "")
+
+			cfg := &config.Config{
+				Hosts: map[string]*config.HostConfig{
+					"alpha.probo.inc": {
+						Token:        "old",
+						Organization: "org-alpha",
+					},
+					"beta.probo.inc": {
+						Token:        "old",
+						Organization: "org-beta",
+					},
+				},
+			}
+
+			host, hc, err := cfg.DefaultHost()
+			require.NoError(t, err)
+			assert.Equal(t, "alpha.probo.inc", host)
+			assert.Equal(t, "tok_test", hc.Token)
+			assert.Equal(t, "org-alpha", hc.Organization)
+		},
+	)
+
+	t.Run(
+		"PROBO_HOST takes precedence over everything",
+		func(t *testing.T) {
+			t.Setenv("PROBO_HOST", "custom.probo.inc")
+			t.Setenv("PROBO_TOKEN", "tok_env")
+
+			cfg := &config.Config{
+				ActiveHost: "beta.probo.inc",
+				Hosts: map[string]*config.HostConfig{
+					"beta.probo.inc": {
+						Token:        "old",
+						Organization: "org-beta",
+					},
+				},
+			}
+
+			host, hc, err := cfg.DefaultHost()
+			require.NoError(t, err)
+			assert.Equal(t, "custom.probo.inc", host)
+			assert.Equal(t, "tok_env", hc.Token)
+		},
+	)
+
+	t.Run(
+		"active host is used when no env vars set",
+		func(t *testing.T) {
+			t.Setenv("PROBO_HOST", "")
+			t.Setenv("PROBO_TOKEN", "")
+
+			cfg := &config.Config{
+				ActiveHost: "beta.probo.inc",
+				Hosts: map[string]*config.HostConfig{
+					"alpha.probo.inc": {
+						Token:        "tok-alpha",
+						Organization: "org-alpha",
+					},
+					"beta.probo.inc": {
+						Token:        "tok-beta",
+						Organization: "org-beta",
+					},
+				},
+			}
+
+			host, hc, err := cfg.DefaultHost()
+			require.NoError(t, err)
+			assert.Equal(t, "beta.probo.inc", host)
+			assert.Equal(t, "tok-beta", hc.Token)
+			assert.Equal(t, "org-beta", hc.Organization)
+		},
+	)
+}

pkg/cmd/cmdutil/factory.go

@@ -0,0 +1,26 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package cmdutil
+
+import (
+	"go.probo.inc/probo/pkg/cli/config"
+	"go.probo.inc/probo/pkg/cmd/iostreams"
+)
+
+type Factory struct {
+	IOStreams *iostreams.IOStreams
+	Version  string
+	Config   func() (*config.Config, error)
+}

pkg/cmd/cmdutil/flags.go

@@ -0,0 +1,75 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package cmdutil
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/spf13/cobra"
+)
+
+const (
+	OutputJSON  = "json"
+	OutputTable = "table"
+)
+
+// AddOutputFlag registers --output / -o on cmd and returns a pointer to the
+// value. The default is "table". Callers should call ValidateOutputFlag early
+// in RunE, then branch on *p.
+func AddOutputFlag(cmd *cobra.Command) *string {
+	var output string
+	cmd.Flags().StringVarP(
+		&output,
+		"output",
+		"o",
+		"",
+		"Output format: json, table (default)",
+	)
+	return &output
+}
+
+// ValidateOutputFlag checks that value is a supported output format. An empty
+// string is treated as table (the default).
+func ValidateOutputFlag(value *string) error {
+	switch *value {
+	case "":
+		*value = OutputTable
+		return nil
+	case OutputJSON, OutputTable:
+		return nil
+	default:
+		return fmt.Errorf(
+			"invalid --output value %q: valid values are json, table",
+			*value,
+		)
+	}
+}
+
+// ValidateEnum checks that value is one of the allowed values. It returns a
+// user-friendly error mentioning the flag name and the valid choices.
+func ValidateEnum(flag string, value string, allowed []string) error {
+	for _, v := range allowed {
+		if value == v {
+			return nil
+		}
+	}
+	return fmt.Errorf(
+		"invalid --%s value %q: valid values are %s",
+		flag,
+		value,
+		strings.Join(allowed, ", "),
+	)
+}

pkg/cmd/cmdutil/json.go

@@ -0,0 +1,31 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package cmdutil
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+)
+
+// PrintJSON writes v as indented JSON followed by a newline.
+func PrintJSON(out io.Writer, v any) error {
+	data, err := json.MarshalIndent(v, "", "  ")
+	if err != nil {
+		return fmt.Errorf("cannot marshal JSON: %w", err)
+	}
+	_, err = fmt.Fprintln(out, string(data))
+	return err
+}

pkg/cmd/cmdutil/table.go

@@ -0,0 +1,37 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package cmdutil
+
+import (
+	"github.com/charmbracelet/lipgloss"
+	"github.com/charmbracelet/lipgloss/table"
+)
+
+// NewTable returns a pre-styled lipgloss table with the given headers.
+func NewTable(headers ...string) *table.Table {
+	headerStyle := lipgloss.NewStyle().Bold(true).Padding(0, 1)
+	cellStyle := lipgloss.NewStyle().Padding(0, 1)
+
+	return table.New().
+		Border(lipgloss.NormalBorder()).
+		BorderStyle(lipgloss.NewStyle().Foreground(lipgloss.Color("238"))).
+		Headers(headers...).
+		StyleFunc(func(row, col int) lipgloss.Style {
+			if row == table.HeaderRow {
+				return headerStyle
+			}
+			return cellStyle
+		})
+}

pkg/cmd/cmdutil/time.go

@@ -0,0 +1,27 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package cmdutil
+
+import "time"
+
+// FormatTime parses an RFC3339 timestamp and returns a human-friendly
+// local representation. If parsing fails it returns the raw string.
+func FormatTime(raw string) string {
+	t, err := time.Parse(time.RFC3339, raw)
+	if err != nil {
+		return raw
+	}
+	return t.Local().Format("Jan 02, 2006 15:04 MST")
+}

pkg/cmd/completion/completion.go

@@ -0,0 +1,75 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package completion
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+	"go.probo.inc/probo/pkg/cmd/cmdutil"
+)
+
+func NewCmdCompletion(f *cmdutil.Factory) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "completion <shell>",
+		Short: "Generate shell completion scripts",
+		Long: `Generate shell completion scripts for proboctl.
+
+To load completions:
+
+Bash:
+  $ source <(proboctl completion bash)
+  # To load completions for each session, execute once:
+  # Linux:
+  $ proboctl completion bash > /etc/bash_completion.d/proboctl
+  # macOS:
+  $ proboctl completion bash > $(brew --prefix)/etc/bash_completion.d/proboctl
+
+Zsh:
+  $ source <(proboctl completion zsh)
+  # To load completions for each session, execute once:
+  $ proboctl completion zsh > "${fpath[1]}/_proboctl"
+
+Fish:
+  $ proboctl completion fish | source
+  # To load completions for each session, execute once:
+  $ proboctl completion fish > ~/.config/fish/completions/proboctl.fish
+
+PowerShell:
+  PS> proboctl completion powershell | Out-String | Invoke-Expression
+  # To load completions for each session, execute once:
+  PS> proboctl completion powershell > proboctl.ps1`,
+		ValidArgs:             []string{"bash", "zsh", "fish", "powershell"},
+		Args:                  cobra.MatchAll(cobra.ExactArgs(1), cobra.OnlyValidArgs),
+		DisableFlagsInUseLine: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			out := f.IOStreams.Out
+			switch args[0] {
+			case "bash":
+				return cmd.Root().GenBashCompletionV2(out, true)
+			case "zsh":
+				return cmd.Root().GenZshCompletion(out)
+			case "fish":
+				return cmd.Root().GenFishCompletion(out, true)
+			case "powershell":
+				return cmd.Root().GenPowerShellCompletionWithDesc(out)
+			default:
+				return fmt.Errorf("unsupported shell: %s", args[0])
+			}
+		},
+	}
+
+	return cmd
+}

pkg/cmd/iostreams/iostreams.go

@@ -0,0 +1,104 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package iostreams
+
+import (
+	"bytes"
+	"io"
+	"os"
+
+	"github.com/charmbracelet/lipgloss"
+	"github.com/muesli/termenv"
+	"golang.org/x/term"
+)
+
+type IOStreams struct {
+	In     io.ReadCloser
+	Out    io.Writer
+	ErrOut io.Writer
+
+	// ForceNonInteractive disables all interactive prompts. Set by the
+	// --no-interactive global flag or the PROBO_NO_INTERACTIVE env var.
+	ForceNonInteractive bool
+
+	// ForceNoColor disables ANSI color output. Set by the --no-color
+	// global flag, the NO_COLOR env var, or TERM=dumb.
+	ForceNoColor bool
+}
+
+func (s *IOStreams) IsInteractive() bool {
+	if s.ForceNonInteractive {
+		return false
+	}
+	return s.isStdinTTY() && s.isStdoutTTY()
+}
+
+func (s *IOStreams) isStdinTTY() bool {
+	if f, ok := s.In.(*os.File); ok {
+		return term.IsTerminal(int(f.Fd()))
+	}
+	return false
+}
+
+func (s *IOStreams) isStdoutTTY() bool {
+	if f, ok := s.Out.(*os.File); ok {
+		return term.IsTerminal(int(f.Fd()))
+	}
+	return false
+}
+
+func (s *IOStreams) IsStdinTTY() bool {
+	return s.isStdinTTY()
+}
+
+func (s *IOStreams) IsStdoutTTY() bool {
+	if s.ForceNonInteractive {
+		return false
+	}
+	return s.isStdoutTTY()
+}
+
+func (s *IOStreams) ColorEnabled() bool {
+	if s.ForceNoColor {
+		return false
+	}
+	return s.isStdoutTTY()
+}
+
+// ApplyColorProfile configures the lipgloss default renderer based on
+// the current color settings. Call this after ForceNoColor has been set.
+func (s *IOStreams) ApplyColorProfile() {
+	if s.ForceNoColor {
+		lipgloss.SetColorProfile(termenv.Ascii)
+	}
+}
+
+func System() *IOStreams {
+	return &IOStreams{
+		In:     os.Stdin,
+		Out:    os.Stdout,
+		ErrOut: os.Stderr,
+	}
+}
+
+func Test() (*IOStreams, *bytes.Buffer, *bytes.Buffer) {
+	out := new(bytes.Buffer)
+	errOut := new(bytes.Buffer)
+	return &IOStreams{
+		In:     io.NopCloser(new(bytes.Buffer)),
+		Out:    out,
+		ErrOut: errOut,
+	}, out, errOut
+}

pkg/cmd/root/root.go

@@ -0,0 +1,80 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package root
+
+import (
+	"github.com/spf13/cobra"
+	cmdapi "go.probo.inc/probo/pkg/cmd/api"
+	"go.probo.inc/probo/pkg/cmd/auth"
+	"go.probo.inc/probo/pkg/cmd/browse"
+	"go.probo.inc/probo/pkg/cmd/cmdutil"
+	"go.probo.inc/probo/pkg/cmd/completion"
+	cmdconfig "go.probo.inc/probo/pkg/cmd/config"
+	"go.probo.inc/probo/pkg/cmd/control"
+	"go.probo.inc/probo/pkg/cmd/framework"
+	"go.probo.inc/probo/pkg/cmd/org"
+	"go.probo.inc/probo/pkg/cmd/risk"
+	"go.probo.inc/probo/pkg/cmd/soa"
+	"go.probo.inc/probo/pkg/cmd/user"
+	"go.probo.inc/probo/pkg/cmd/version"
+	"go.probo.inc/probo/pkg/cmd/webhook"
+)
+
+func NewCmdRoot(f *cmdutil.Factory) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:           "proboctl <command> [flags]",
+		Short:         "Probo CLI",
+		Long:          "proboctl is a command-line tool for interacting with the Probo platform.",
+		SilenceUsage:  true,
+		SilenceErrors: true,
+		PersistentPreRun: func(cmd *cobra.Command, args []string) {
+			if noInteractive, _ := cmd.Flags().GetBool("no-interactive"); noInteractive {
+				f.IOStreams.ForceNonInteractive = true
+			}
+			if noColor, _ := cmd.Flags().GetBool("no-color"); noColor {
+				f.IOStreams.ForceNoColor = true
+			}
+			f.IOStreams.ApplyColorProfile()
+		},
+	}
+
+	cmd.PersistentFlags().Bool(
+		"no-interactive",
+		false,
+		"Disable interactive prompts (also set via PROBO_NO_INTERACTIVE=1, CI=true, or TERM=dumb)",
+	)
+
+	cmd.PersistentFlags().Bool(
+		"no-color",
+		false,
+		"Disable ANSI color output (also set via NO_COLOR or TERM=dumb)",
+	)
+
+	cmd.AddCommand(cmdapi.NewCmdAPI(f))
+	cmd.AddCommand(auth.NewCmdAuth(f))
+	cmd.AddCommand(browse.NewCmdBrowse(f))
+	cmd.AddCommand(completion.NewCmdCompletion(f))
+	cmd.AddCommand(cmdconfig.NewCmdConfig(f))
+	cmd.AddCommand(control.NewCmdControl(f))
+	cmd.AddCommand(framework.NewCmdFramework(f))
+	cmd.AddCommand(org.NewCmdOrg(f))
+	cmd.AddCommand(risk.NewCmdRisk(f))
+	cmd.AddCommand(soa.NewCmdSoa(f))
+	cmd.AddCommand(user.NewCmdUser(f))
+	cmd.AddCommand(version.NewCmdVersion(f))
+	cmd.AddCommand(webhook.NewCmdWebhook(f))
+
+	return cmd
+}

pkg/cmd/version/version.go

@@ -0,0 +1,49 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package version
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+	"go.probo.inc/probo/pkg/cmd/cmdutil"
+	"go.probo.inc/probo/pkg/version"
+)
+
+func NewCmdVersion(f *cmdutil.Factory) *cobra.Command {
+	return &cobra.Command{
+		Use:   "version",
+		Short: "Print the version of proboctl",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			info := version.GetBuildInfo()
+
+			v := f.Version
+			if v == "" || v == "unknown" {
+				v = info.Version
+			}
+
+			_, _ = fmt.Fprintf(
+				f.IOStreams.Out,
+				"proboctl version %s (commit: %s, built: %s, go: %s)\n",
+				v,
+				info.Commit,
+				info.BuildDate,
+				info.GoVersion,
+			)
+
+			return nil
+		},
+	}
+}