[mscoutermarsh]

Add pscale service-token duplicate <id> --name <name>, which copies a service token and prints the new id and secret the same way service-token create does.

Decisions, testing, and risks

• POST /v1/organizations/:organization/service-tokens/:id/duplicate with body {"name":"<name>"}. The response is printed with the same secret formatter as service-token create.
• --name is required. --org stays the existing required persistent flag on service-token. No other flags.
• Auth and not-found handling match the other service-token commands. Service-token authentication is still rejected by the parent command.
• Test: TestServiceToken_DuplicateCmd in internal/cmd/token/create_test.go runs service-token duplicate, checks the duplicate request (method, path, bearer auth, name body), and checks the printed id and secret.
• Skipped a separate client unit test, a human-format test, and an AGENTS.md section. The command test hits the real client, create already covers the shared printer, and AGENTS.md does not document the service-token commands.
• Risk: the command writes the one-time secret to stdout, same as create.

  

[cursor]

Risk: medium. Approved. Cursor Bugbot completed with no findings that need human review; Cursor Security Agent was not running on this PR. The change is a bounded CLI wrapper around the existing service-token duplicate API, with a command test covering the request and secret output.

  

_{Sent by Cursor Approval Agent: cli-reviewer}