feat(tags): Add support for asset tagging

[Rutvik G (rutvik-gs)]

How to test

1. CRUD

censys tags create "$TAG" --description "cencli demo" --privacy private
censys tags list --name "$TAG"
censys tags list --order-by created_at_desc --page-size 5
censys tags get "$TAG"                    # Assets: 0 — the count is always reported now
censys tags get "$TAG" -O tree
censys tags get "$TAG" -O yaml            # asset_count present in the payload
censys tags update "$TAG" --privacy shared --description "now shared"
censys tags update "$TAG" --clear-description
censys tags get "$TAG"

2. Assign / unassign explicit assets

censys tags assign "$TAG" 8.8.8.8
censys tags assign "$TAG" 1.1.1.1 censys.io:443
echo "9.9.9.9" | censys tags assign "$TAG" --input-file -

censys tags assignments "$TAG"
censys tags assignments "$TAG" --asset-type host
censys tags assignments "$TAG" --asset 8.8.8.8
censys tags assignments "$TAG" --streaming
censys tags get "$TAG"                    # count should match what assignments listed

# every asset already tagged -> full table of failures, then exit 1
censys tags assign "$TAG" 8.8.8.8 1.1.1.1; echo $?
censys tags assign "$TAG" 8.8.8.8 1.1.1.1 -O json   # array still emitted, error + error_status per row

censys tags unassign "$TAG" 9.9.9.9                 # single asset — no prompt
censys tags unassign "$TAG" 1.1.1.1 censys.io:443   # multiple — no prompt either now
censys tags assignments "$TAG"

3. Bulk assign (async job)

censys tags assign "$TAG" --query 'host.services.port: 22' --max-assets 5 --wait --yes

# submit without --wait, then copy the ID from the output into the next command
censys tags assign "$TAG" --query 'host.services.port: 443' --max-assets 5 --yes
OP=<paste-operation-id>

censys tags operations get "$TAG" "$OP" --wait
censys tags operations list "$TAG"
censys tags operations list --page-size 5                 # org-wide
censys tags operations list --type bulk_create --status succeeded --page-size 5
censys tags get "$TAG"

4. Cancel a running job

# big enough to still be running — tags up to 2000 assets, step 5 removes them
censys tags assign "$TAG" --query 'host.services.port: 80' --max-assets 2000 --yes
BIG=<paste-operation-id>

censys tags operations cancel "$TAG" "$BIG"     # no prompt, no --yes — cancel only stops fur
censys tags operations get "$TAG" "$BIG"
censys tags operations list "$TAG" --status cancelled

If the job finishes first you'll get Conflict / Tag operation not cancellable (exit 1) instead — expected, just not the happy path.

5. Bulk unassign (async job)

censys tags unassign "$TAG" --created-after 2026-07-01T00:00:00Z --wait --yes
censys tags unassign "$TAG" --all --wait --yes
censys tags assignments "$TAG"
censys tags get "$TAG"                          # Assets: 0
censys tags operations list "$TAG" --type bulk_delete

6. Guardrails — all rejected before any request, exit 2

censys tags assign   "$TAG" 8.8.8.8 --query 'host.services.port: 22'
censys tags unassign "$TAG" 8.8.8.8 --all
censys tags unassign "$TAG" --all --created-before 2026-01-01T00:00:00Z
censys tags unassign "$TAG" --created-before 2020-01-01T00:00:00Z --created-after 2026-01-01T00:00:00Z
censys tags assign   "$TAG" 8.8.8.8 --max-assets 10
censys tags unassign "$TAG" 8.8.8.8 --wait
censys tags unassign "$TAG" --all --timeout 5m
censys tags operations cancel "$TAG" not-a-uuid
censys tags unassign "$TAG" --all < /dev/null

# --yes is bulk-only now: rejected where nothing prompts
censys tags assign   "$TAG" 8.8.8.8 --yes
censys tags unassign "$TAG" 8.8.8.8 1.1.1.1 --yes
censys tags operations cancel "$TAG" <op-id> --yes      # unknown flag
censys tags get "$TAG" --asset-count                    # unknown flag

# one asset filter, however it is spelled
censys tags assignments "$TAG" --asset 8.8.8.8,1.1.1.1
censys tags assignments "$TAG" --asset 8.8.8.8 --asset 1.1.1.1

7. A tag whose name looks like a UUID

UUIDNAME=11111111-1111-1111-1111-111111111111
censys tags create "$UUIDNAME"
censys tags get "$UUIDNAME"                     # all of these used to 404
censys tags update "$UUIDNAME" --privacy shared
censys tags assign "$UUIDNAME" 8.8.8.8
censys tags assignments "$UUIDNAME"
censys tags unassign "$UUIDNAME" --all --wait --yes
censys tags delete "$UUIDNAME" --yes

censys tags get 00000000-0000-4000-8000-000000000000   # neither ID nor name — still fails, exit 1

8. Rename and delete

censys tags update "$TAG" --name "$TAG-renamed"
censys tags get "$TAG-renamed"
censys tags delete "$TAG-renamed" < /dev/null      # refuses: needs --yes
censys tags delete "$TAG-renamed"                  # real prompt, answer it
censys tags list --name "$TAG-renamed"

[Matt Farmer (frmrm)]

leaving a test review to kick the job over