@aident-ai/cli 0.1.2 → 0.1.3-rc.0

package/README.md

@@ -33,6 +33,14 @@ Use `--oob` for browserless auth environments:
 aident login --oob
 ```
 
+To revoke the stored OAuth token and remove `~/.aident/credentials.json`:
+
+```bash
+aident logout
+```
+
+When using `AIDENT_TOKEN`, unset it in your shell after running `aident logout`.
+
 ## Packages
 
 Loadout is always enabled by default. Add Playbook only when an agent needs to create, execute, or manage playbooks.
@@ -50,9 +58,9 @@ aident --packages playbook playbooks execute --playbookId pb_123 --json
 
 ```bash
 aident capabilities search --query "send email"
-aident capabilities get --name "gmail_tools.gmail_send_email"
-aident capabilities execute --name "gmail_tools.gmail_send_email" --input '{"to":"user@example.com"}'
-aident vault status --integrationId github_tools
+aident capabilities get --name "composio:gmail_tools:gmail_send_email"
+aident capabilities execute --name "composio:gmail_tools:gmail_send_email" --input '{"to":"user@example.com"}'
+aident vault status --integrationId composio:github_tools
 aident integrations migrate-local --json
 aident integrations migrate-local --apply --integrationIds github_tools,slack_tools --json
 aident audit recent --limit 20
@@ -86,6 +94,9 @@ Environment overrides:
 | `AIDENT_PACKAGE`  | Focus one package for one invocation.                       |
 | `AIDENT_PACKAGES` | Enable add-on packages for one invocation, e.g. `playbook`. |
 
+OAuth credentials are shared across HTTPS Aident hosts under `aident.ai`, so changing `baseUrl` or `AIDENT_BASE_URL`
+between production, RC, staging, or preview hosts does not require another login. Custom hosts remain isolated.
+
 ## How It Works
 
 Discovery fetches `/api/openapi/{package}.json` and reads the package command catalog embedded in the OpenAPI document.

package/dist/cli.mjs

@@ -1,5 +1,8 @@
 #!/usr/bin/env node
 
+// src/cli.ts
+import { readFile as readFile6 } from "node:fs/promises";
+
 // src/auth.ts
 import { spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
@@ -444,16 +447,160 @@ function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 
+// src/catalogCache.ts
+import crypto from "node:crypto";
+import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join2 } from "node:path";
+
+// src/config.ts
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+// src/packages.ts
+var CLI_PACKAGES = ["loadout", "playbook", "intern"];
+var DEFAULT_CLI_PACKAGES = ["loadout"];
+function parseCliPackage(value) {
+  if (typeof value !== "string")
+    throw new Error(`Unsupported Aident package: ${String(value)}`);
+  const normalized = value.trim().toLowerCase();
+  if (!CLI_PACKAGES.includes(normalized))
+    throw new Error(`Unsupported Aident package: ${value}`);
+  return normalized;
+}
+function normalizeCliPackages(value) {
+  const rawPackages = value === undefined || value === null || value === "" ? [] : Array.isArray(value) ? value : String(value).split(/[,\s]+/);
+  const packages = ["loadout"];
+  for (const rawPackage of rawPackages) {
+    if (rawPackage === undefined || rawPackage === null || rawPackage === "")
+      continue;
+    const cliPackage = parseCliPackage(rawPackage);
+    if (!packages.includes(cliPackage))
+      packages.push(cliPackage);
+  }
+  return packages;
+}
+function formatCliPackages(packages) {
+  return packages.join(",");
+}
+
+// src/config.ts
+function getAidentDir() {
+  const home = process.env.HOME || process.env.USERPROFILE || homedir();
+  return join(home, ".aident");
+}
+function getConfigFile() {
+  return join(getAidentDir(), "config.json");
+}
+var DEFAULT_BASE_URL = "https://loadout.aident.ai";
+var CONFIG_KEYS = ["baseUrl", "packages"];
+async function readConfig() {
+  try {
+    const text = await readFile(getConfigFile(), "utf-8");
+    const parsed = JSON.parse(text);
+    if (!parsed || typeof parsed !== "object")
+      return {};
+    return parsed;
+  } catch {
+    return {};
+  }
+}
+async function writeConfig(config) {
+  await mkdir(getAidentDir(), { recursive: true, mode: 448 });
+  await writeFile(getConfigFile(), JSON.stringify(config, null, 2) + `
+`, { mode: 420 });
+}
+async function setConfigValue(key, value) {
+  const config = await readConfig();
+  config[key] = value;
+  await writeConfig(config);
+}
+async function unsetConfigValue(key) {
+  const config = await readConfig();
+  delete config[key];
+  await writeConfig(config);
+}
+async function resolveDefaultBaseUrl() {
+  const env = process.env.AIDENT_BASE_URL?.trim();
+  if (env)
+    return env;
+  const config = await readConfig();
+  if (typeof config.baseUrl === "string" && config.baseUrl.trim() !== "") {
+    return config.baseUrl.trim();
+  }
+  return DEFAULT_BASE_URL;
+}
+async function resolveDefaultPackages() {
+  const env = process.env.AIDENT_PACKAGES?.trim() || process.env.AIDENT_PACKAGE?.trim();
+  if (env)
+    return normalizeCliPackages(env);
+  const config = await readConfig();
+  return normalizeCliPackages(config.packages ?? DEFAULT_CLI_PACKAGES);
+}
+function isKnownConfigKey(key) {
+  return CONFIG_KEYS.includes(key);
+}
+function normalizeBaseUrl(url) {
+  let trimmed = url.trim();
+  if (!/^https?:\/\//i.test(trimmed))
+    trimmed = `https://${trimmed}`;
+  return trimmed.replace(/\/+$/, "");
+}
+
 // src/version.ts
-var VERSION = "0.1.2";
+var VERSION = "0.1.3-rc.0";
+
+// src/catalogCache.ts
+var CACHE_TTL_MS = 5 * 60 * 1000;
+async function genReadCachedCatalog(params) {
+  if (process.env.AIDENT_CLI_DISABLE_CATALOG_CACHE === "1")
+    return null;
+  try {
+    const cached = JSON.parse(await readFile2(getCacheFile(params), "utf8"));
+    if (cached.credentialFingerprint !== getCredentialFingerprint(params.accessToken) || Date.now() - cached.cachedAt > CACHE_TTL_MS || !isCommandCatalog(cached.catalog))
+      return null;
+    return cached.catalog;
+  } catch {
+    return null;
+  }
+}
+async function genWriteCachedCatalog(params, catalog) {
+  if (process.env.AIDENT_CLI_DISABLE_CATALOG_CACHE === "1")
+    return;
+  try {
+    const cacheDir = join2(getAidentDir(), "cache");
+    await mkdir2(cacheDir, { recursive: true, mode: 448 });
+    await writeFile2(getCacheFile(params), JSON.stringify({
+      cachedAt: Date.now(),
+      catalog,
+      credentialFingerprint: getCredentialFingerprint(params.accessToken)
+    }), { mode: 384 });
+  } catch {}
+}
+function getCacheFile(params) {
+  const key = crypto.createHash("sha256").update([params.baseUrl, params.packageName, params.installedSkillVersion ?? "", VERSION].join("\x00")).digest("hex").slice(0, 16);
+  return join2(getAidentDir(), "cache", `catalog-${key}.json`);
+}
+function getCredentialFingerprint(accessToken) {
+  return crypto.createHash("sha256").update(accessToken).digest("hex").slice(0, 16);
+}
+function isCommandCatalog(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const catalog = value;
+  return Array.isArray(catalog.packages) && Array.isArray(catalog.domains) && Array.isArray(catalog.commands);
+}
 
 // src/client.ts
+var CLI_CATALOG_DURATION_HEADER = "x-aident-cli-catalog-duration-ms";
+
 class CliClient {
   creds;
   credentialSource;
   packages;
   installedSkillVersion;
   commandOperations = new Map;
+  catalogDurationMs = null;
   constructor(creds, credentialSource = "stored", packages, installedSkillVersion = null) {
     this.creds = creds;
     this.credentialSource = credentialSource;
@@ -475,6 +622,14 @@ class CliClient {
     this.creds = creds;
   }
   async getCatalog() {
+    const startedAt = Date.now();
+    try {
+      return await this.fetchCatalog();
+    } finally {
+      this.catalogDurationMs = Date.now() - startedAt;
+    }
+  }
+  async fetchCatalog() {
     if (this.packages.length === 1) {
       const packageName = this.packages[0];
       const result = await this.fetchOpenApiCatalog(packageName);
@@ -503,14 +658,37 @@ class CliClient {
         }
       };
     }
-    return this.fetchJson("POST", this.operationPath(operation.packageName, operation.operationId), args);
+    return this.fetchJson("POST", this.operationPath(operation.packageName, operation.operationId), args, this.takeCatalogTimingHeaders());
   }
   async execOperation(packageName, operationId, args) {
-    return this.fetchJson("POST", this.operationPath(packageName, operationId), args);
+    return this.fetchJson("POST", this.operationPath(packageName, operationId), args, this.takeCatalogTimingHeaders());
+  }
+  takeCatalogTimingHeaders() {
+    if (this.catalogDurationMs === null)
+      return;
+    const headers = { [CLI_CATALOG_DURATION_HEADER]: String(this.catalogDurationMs) };
+    this.catalogDurationMs = null;
+    return headers;
   }
   async fetchOpenApiCatalog(packageName) {
+    const cacheParams = {
+      accessToken: this.creds.access_token,
+      baseUrl: this.baseUrl,
+      packageName,
+      installedSkillVersion: this.installedSkillVersion
+    };
+    const cached = await genReadCachedCatalog(cacheParams);
+    if (cached)
+      return { status: 200, body: cached };
     const headers = packageName === "loadout" && this.installedSkillVersion ? { "x-aident-skill-version": this.installedSkillVersion } : undefined;
-    const result = await this.fetchJson("GET", this.catalogPath(packageName), undefined, headers);
+    const path = this.catalogPath(packageName);
+    let result;
+    try {
+      result = await this.fetchJson("GET", path, undefined, headers);
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      throw new Error(`Unable to reach the Aident ${packageName} command catalog at ${this.baseUrl}${path}. Allow outbound HTTPS access to ${this.baseUrl} and retry. (${detail})`);
+    }
     const catalog = result.body["x-aident-command-catalog"];
     if (result.status !== 200 || !catalog) {
       return {
@@ -521,6 +699,7 @@ class CliClient {
     if (packageName === "loadout" && result.body["x-aident-loadout-skill"]) {
       catalog.loadoutSkill = result.body["x-aident-loadout-skill"];
     }
+    await genWriteCachedCatalog(cacheParams, catalog);
     return { status: result.status, body: catalog };
   }
   catalogPath(packageName) {
@@ -603,111 +782,16 @@ function mergeCatalogs(catalogs, packages, onCommand) {
   };
 }
 
-// src/config.ts
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { join } from "node:path";
-
-// src/packages.ts
-var CLI_PACKAGES = ["loadout", "playbook", "intern"];
-var DEFAULT_CLI_PACKAGES = ["loadout"];
-function parseCliPackage(value) {
-  if (typeof value !== "string")
-    throw new Error(`Unsupported Aident package: ${String(value)}`);
-  const normalized = value.trim().toLowerCase();
-  if (!CLI_PACKAGES.includes(normalized))
-    throw new Error(`Unsupported Aident package: ${value}`);
-  return normalized;
-}
-function normalizeCliPackages(value) {
-  const rawPackages = value === undefined || value === null || value === "" ? [] : Array.isArray(value) ? value : String(value).split(/[,\s]+/);
-  const packages = ["loadout"];
-  for (const rawPackage of rawPackages) {
-    if (rawPackage === undefined || rawPackage === null || rawPackage === "")
-      continue;
-    const cliPackage = parseCliPackage(rawPackage);
-    if (!packages.includes(cliPackage))
-      packages.push(cliPackage);
-  }
-  return packages;
-}
-function formatCliPackages(packages) {
-  return packages.join(",");
-}
-
-// src/config.ts
-function getAidentDir() {
-  const home = process.env.HOME || process.env.USERPROFILE || homedir();
-  return join(home, ".aident");
-}
-function getConfigFile() {
-  return join(getAidentDir(), "config.json");
-}
-var DEFAULT_BASE_URL = "https://loadout.aident.ai";
-var CONFIG_KEYS = ["baseUrl", "packages"];
-async function readConfig() {
-  try {
-    const text = await readFile(getConfigFile(), "utf-8");
-    const parsed = JSON.parse(text);
-    if (!parsed || typeof parsed !== "object")
-      return {};
-    return parsed;
-  } catch {
-    return {};
-  }
-}
-async function writeConfig(config) {
-  await mkdir(getAidentDir(), { recursive: true, mode: 448 });
-  await writeFile(getConfigFile(), JSON.stringify(config, null, 2) + `
-`, { mode: 420 });
-}
-async function setConfigValue(key, value) {
-  const config = await readConfig();
-  config[key] = value;
-  await writeConfig(config);
-}
-async function unsetConfigValue(key) {
-  const config = await readConfig();
-  delete config[key];
-  await writeConfig(config);
-}
-async function resolveDefaultBaseUrl() {
-  const env = process.env.AIDENT_BASE_URL?.trim();
-  if (env)
-    return env;
-  const config = await readConfig();
-  if (typeof config.baseUrl === "string" && config.baseUrl.trim() !== "") {
-    return config.baseUrl.trim();
-  }
-  return DEFAULT_BASE_URL;
-}
-async function resolveDefaultPackages() {
-  const env = process.env.AIDENT_PACKAGES?.trim() || process.env.AIDENT_PACKAGE?.trim();
-  if (env)
-    return normalizeCliPackages(env);
-  const config = await readConfig();
-  return normalizeCliPackages(config.packages ?? DEFAULT_CLI_PACKAGES);
-}
-function isKnownConfigKey(key) {
-  return CONFIG_KEYS.includes(key);
-}
-function normalizeBaseUrl(url) {
-  let trimmed = url.trim();
-  if (!/^https?:\/\//i.test(trimmed))
-    trimmed = `https://${trimmed}`;
-  return trimmed.replace(/\/+$/, "");
-}
-
 // src/credentials.ts
-import { mkdir as mkdir2, readFile as readFile2, rm, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join2 } from "node:path";
+import { mkdir as mkdir3, readFile as readFile3, rm, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join3 } from "node:path";
 var REFRESH_WINDOW_MS = 24 * 60 * 60 * 1000;
 function getCredentialsFile() {
-  return join2(getAidentDir(), "credentials.json");
+  return join3(getAidentDir(), "credentials.json");
 }
 async function readCredentials() {
   try {
-    const content = await readFile2(getCredentialsFile(), "utf-8");
+    const content = await readFile3(getCredentialsFile(), "utf-8");
     const parsed = JSON.parse(content);
     if (!parsed.access_token || !parsed.base_url)
       return null;
@@ -717,12 +801,31 @@ async function readCredentials() {
   }
 }
 async function writeCredentials(creds) {
-  await mkdir2(getAidentDir(), { recursive: true, mode: 448 });
-  await writeFile2(getCredentialsFile(), JSON.stringify(creds, null, 2), { mode: 384 });
+  await mkdir3(getAidentDir(), { recursive: true, mode: 448 });
+  await writeFile3(getCredentialsFile(), JSON.stringify(creds, null, 2), { mode: 384 });
 }
 async function clearCredentials() {
   await rm(getCredentialsFile(), { force: true });
 }
+function credentialsForBaseUrl(creds, baseUrl) {
+  const credentialsBaseUrl = creds.base_url.replace(/\/+$/, "");
+  const requestedBaseUrl = baseUrl.replace(/\/+$/, "");
+  if (credentialsBaseUrl === requestedBaseUrl)
+    return { ...creds, base_url: requestedBaseUrl };
+  if (!getSharedAidentBaseUrl(credentialsBaseUrl))
+    return null;
+  const sharedBaseUrl = getSharedAidentBaseUrl(requestedBaseUrl);
+  if (!sharedBaseUrl)
+    return null;
+  return { ...creds, base_url: sharedBaseUrl };
+}
+async function clearCredentialsForIncompatibleBaseUrl(baseUrl) {
+  const creds = await readCredentials();
+  if (!creds || credentialsForBaseUrl(creds, baseUrl))
+    return null;
+  await clearCredentials();
+  return creds.base_url;
+}
 function isExpired(creds) {
   if (!creds.expires_at)
     return false;
@@ -731,11 +834,23 @@ function isExpired(creds) {
     return false;
   return Date.now() >= expiresAt - REFRESH_WINDOW_MS;
 }
+function getSharedAidentBaseUrl(baseUrl) {
+  try {
+    const url = new URL(baseUrl);
+    if (url.protocol !== "https:" || url.port !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "" || url.hostname !== "aident.ai" && !url.hostname.endsWith(".aident.ai")) {
+      return null;
+    }
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
 
 // src/loadoutSkill.ts
-import { readFile as readFile3 } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { readFile as readFile4, realpath } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import { join as join3 } from "node:path";
+import { dirname, join as join4, resolve } from "node:path";
 async function fetchLoadoutSkillMetadata(baseUrl) {
   const res = await fetch(`${baseUrl.replace(/\/+$/, "")}/.well-known/loadout-skill.json`, {
     method: "GET",
@@ -756,34 +871,104 @@ function isLocalIntegrationMigrationPromptEnabled(metadata) {
   return metadata?.localIntegrationMigrationPromptEnabled === true;
 }
 function getInstalledLoadoutSkillCandidates(cwd = process.cwd(), home = homedir2()) {
-  const skillFile = join3("skills", "aident-skill", "SKILL.md");
-  return [
-    join3(cwd, ".claude", skillFile),
-    join3(cwd, ".agents", skillFile),
-    join3(home, ".claude", skillFile),
-    join3(home, ".codex", skillFile),
-    join3(home, ".cursor", skillFile),
-    join3(home, ".agents", skillFile),
-    join3(home, ".gemini", "extensions", "aident-skill", "SKILL.md")
-  ];
+  const skillFile = join4("skills", "aident-skill", "SKILL.md");
+  const candidates = [];
+  const paths = new Set;
+  const add = (agent, scope, root, folder = "") => {
+    const path = join4(root, folder, skillFile);
+    if (paths.has(path))
+      return;
+    paths.add(path);
+    candidates.push({ agent, scope, path });
+  };
+  for (const root of getProjectRoots(cwd)) {
+    add("shared" /* Shared */, "project" /* Project */, root, ".agents");
+    add("claude-code" /* ClaudeCode */, "project" /* Project */, root, ".claude");
+    add("cursor" /* Cursor */, "project" /* Project */, root, ".cursor");
+    add("gemini" /* Gemini */, "project" /* Project */, root, ".gemini");
+    add("workbuddy" /* WorkBuddy */, "project" /* Project */, root, ".workbuddy");
+  }
+  add("shared" /* Shared */, "global" /* Global */, home, ".agents");
+  add("shared" /* Shared */, "global" /* Global */, home, join4(".config", "agents"));
+  add("claude-code" /* ClaudeCode */, "global" /* Global */, home, ".claude");
+  add("codex" /* Codex */, "global" /* Global */, home, ".codex");
+  add("cursor" /* Cursor */, "global" /* Global */, home, ".cursor");
+  add("gemini" /* Gemini */, "global" /* Global */, home, ".gemini");
+  add("workbuddy" /* WorkBuddy */, "global" /* Global */, home, ".workbuddy");
+  add("codex" /* Codex */, "admin" /* Admin */, "/etc/codex");
+  return candidates;
 }
 function formatLoadoutSkillWarnings(metadata) {
   const warnings = metadata?.notices.filter((notice) => notice.severity === "warning") ?? [];
   return warnings.map((notice) => `${colors.yellow}Warning:${colors.reset} ${notice.message}`);
 }
-async function findInstalledLoadoutSkillVersion(candidates = getInstalledLoadoutSkillCandidates()) {
-  for (const candidate of candidates) {
-    let content;
+function isLoadoutSkillVersionBehind(installed, current) {
+  const installedParts = parseSkillVersion(installed);
+  const currentParts = parseSkillVersion(current);
+  if (!installedParts || !currentParts)
+    return false;
+  for (let i = 0;i < installedParts.length; i++) {
+    if (installedParts[i] !== currentParts[i])
+      return installedParts[i] < currentParts[i];
+  }
+  return false;
+}
+async function scanInstalledLoadoutSkills(candidates = getInstalledLoadoutSkillCandidates()) {
+  const matches = await Promise.all(candidates.map(async (candidate) => {
     try {
-      content = await readFile3(candidate, "utf-8");
+      const [content, resolvedPath] = await Promise.all([
+        readFile4(candidate.path, "utf-8"),
+        realpath(candidate.path)
+      ]);
+      const match = /^version:\s*(\d+\.\d+\.\d+)\s*$/m.exec(content);
+      return match ? { candidate, resolvedPath, version: match[1] } : null;
     } catch {
-      continue;
+      return null;
     }
-    const match = /^version:\s*(\d+\.\d+\.\d+)\s*$/m.exec(content);
-    if (match)
-      return match[1];
+  }));
+  const installed = [];
+  const resolvedPaths = new Set;
+  for (const match of matches) {
+    if (!match || resolvedPaths.has(match.resolvedPath))
+      continue;
+    resolvedPaths.add(match.resolvedPath);
+    installed.push({ ...match.candidate, version: match.version });
+  }
+  return installed;
+}
+async function findInstalledLoadoutSkillVersion(candidates = getInstalledLoadoutSkillCandidates()) {
+  const installed = await scanInstalledLoadoutSkills(candidates);
+  return installed.reduce((oldest, skill) => !oldest || isLoadoutSkillVersionBehind(skill.version, oldest) ? skill.version : oldest, null);
+}
+function formatLoadoutAgentHost(agent) {
+  switch (agent) {
+    case "claude-code" /* ClaudeCode */:
+      return "Claude Code";
+    case "codex" /* Codex */:
+      return "Codex";
+    case "cursor" /* Cursor */:
+      return "Cursor";
+    case "gemini" /* Gemini */:
+      return "Gemini";
+    case "workbuddy" /* WorkBuddy */:
+      return "WorkBuddy";
+    case "shared" /* Shared */:
+      return "Shared agents";
+  }
+}
+function getProjectRoots(cwd) {
+  const start = resolve(cwd);
+  const roots = [];
+  let current = start;
+  while (true) {
+    roots.push(current);
+    if (existsSync(join4(current, ".git")))
+      return roots;
+    const parent = dirname(current);
+    if (parent === current)
+      return [start];
+    current = parent;
   }
-  return null;
 }
 function isLoadoutSkillNotice(value) {
   if (!value || typeof value !== "object")
@@ -791,27 +976,56 @@ function isLoadoutSkillNotice(value) {
   const body = value;
   return typeof body.id === "string" && (body.severity === "info" || body.severity === "warning") && typeof body.message === "string";
 }
+function parseSkillVersion(version) {
+  const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version.trim());
+  return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
+}
 
 // src/doctor.ts
-async function runDoctor(opts) {
+async function runDoctor(opts, skillCandidates = getInstalledLoadoutSkillCandidates()) {
   const checks = [];
   checks.push(checkNodeVersion());
   checks.push(await checkConfig());
   checks.push(await checkCredentials(opts.baseUrl));
   checks.push(await checkServerReachable(opts.baseUrl));
-  checks.push(await checkLoadoutSkillMetadata(opts.baseUrl));
+  checks.push(...await checkLoadoutSkills(opts.baseUrl, skillCandidates));
   const ok = checks.every((c) => c.ok);
   return { ok, checks, ...opts };
 }
-async function checkLoadoutSkillMetadata(baseUrl) {
-  const metadata = await fetchLoadoutSkillMetadata(baseUrl);
-  if (!metadata)
-    return { name: "Loadout skill", ok: true, detail: "freshness metadata unavailable" };
-  return {
-    name: "Loadout skill",
-    ok: true,
-    detail: `v${metadata.skillVersion}; ${metadata.updatePrompt}`
-  };
+async function checkLoadoutSkills(baseUrl, candidates) {
+  const [metadata, installedSkills] = await Promise.all([
+    fetchLoadoutSkillMetadata(baseUrl),
+    scanInstalledLoadoutSkills(candidates)
+  ]);
+  if (installedSkills.length === 0) {
+    return [
+      {
+        name: "Loadout skills",
+        ok: true,
+        detail: metadata ? `none found; latest v${metadata.skillVersion}; ${metadata.updatePrompt}` : "none found; freshness metadata unavailable"
+      }
+    ];
+  }
+  return installedSkills.map((skill) => {
+    const name = `Loadout skill (${formatLoadoutAgentHost(skill.agent)})`;
+    const location = `${skill.scope}; ${skill.path}`;
+    if (!metadata) {
+      return { name, ok: true, detail: `installed v${skill.version}; latest unavailable; ${location}` };
+    }
+    if (isLoadoutSkillVersionBehind(skill.version, metadata.skillVersion)) {
+      return {
+        name,
+        ok: true,
+        warning: true,
+        detail: `installed v${skill.version}; latest v${metadata.skillVersion}; ${location}; ${metadata.updatePrompt}`
+      };
+    }
+    return {
+      name,
+      ok: true,
+      detail: skill.version === metadata.skillVersion ? `installed v${skill.version} (latest); ${location}` : `installed v${skill.version}; published v${metadata.skillVersion}; ${location}`
+    };
+  });
 }
 function checkNodeVersion() {
   const version = process.versions.node;
@@ -840,14 +1054,14 @@ async function checkCredentials(baseUrl) {
   if (!creds) {
     return { name: "Authenticated", ok: false, detail: "no credentials — run `aident login`" };
   }
-  if (creds.base_url !== baseUrl) {
+  if (!credentialsForBaseUrl(creds, baseUrl)) {
     return {
       name: "Authenticated",
       ok: false,
       detail: `credentials are for ${creds.base_url} but config baseUrl is ${baseUrl} — run \`aident login\``
     };
   }
-  return { name: "Authenticated", ok: true, detail: `signed in to ${creds.base_url}` };
+  return { name: "Authenticated", ok: true, detail: `signed in to ${baseUrl}` };
 }
 async function checkServerReachable(baseUrl) {
   try {
@@ -879,7 +1093,7 @@ async function checkServerReachable(baseUrl) {
 // src/help.ts
 var LOCAL_HELP_COMMANDS = [
   { command: "login", description: "Authenticate with Aident" },
-  { command: "logout", description: "Revoke the current token" },
+  { command: "logout", description: "Sign out and remove local credentials" },
   { command: "whoami", description: "Show current user" },
   { command: "config show", description: "Print persistent config" },
   { command: "config set <key> <value>", description: "Persist a config value" },
@@ -932,7 +1146,7 @@ function renderHelp(catalog) {
   lines.push("USAGE:");
   lines.push("  aident <domain> <command> [--flag value ...] [--json]");
   lines.push("  aident login            Authenticate with Aident");
-  lines.push("  aident logout           Revoke the current token");
+  lines.push("  aident logout           Sign out and remove local credentials");
   lines.push("  aident whoami           Show current user");
   lines.push("  aident <domain> help    List commands in a domain");
   lines.push("  aident <domain> <command> help    Show input schema and examples");
@@ -972,6 +1186,18 @@ function renderLoginHelp() {
   ].join(`
 `);
 }
+function renderLogoutHelp() {
+  return [
+    `${colors.bold}AIDENT LOGOUT${colors.reset}`,
+    "",
+    "USAGE:",
+    "  aident logout",
+    "",
+    "Revokes the stored OAuth token and removes ~/.aident/credentials.json.",
+    "If AIDENT_TOKEN is set, unset it in your shell to finish signing out."
+  ].join(`
+`);
+}
 function renderDomainHelp(catalog, domain) {
   const cmds = catalog.commands.filter((c) => c.domain === domain);
   if (cmds.length === 0)
@@ -987,20 +1213,27 @@ function renderDomainHelp(catalog, domain) {
   lines.push("");
   lines.push("COMMANDS:");
   for (const c of cmds) {
-    lines.push(`  ${c.command.padEnd(28)} ${c.description}`);
+    if (c.command === domain && c.cliActionSubcommands?.length) {
+      for (const subcommand of c.cliActionSubcommands) {
+        lines.push(`  ${subcommand.padEnd(28)} ${c.description}`);
+      }
+    } else {
+      lines.push(`  ${c.command.padEnd(28)} ${c.description}`);
+    }
   }
   lines.push("");
   lines.push(`Run "aident ${display} <command> help" for input schema and examples.`);
   return lines.join(`
 `);
 }
-function renderCommandHelp(catalog, domain, command) {
+function renderCommandHelp(catalog, domain, command, subcommand) {
   const cmd = catalog.commands.find((c) => c.domain === domain && c.command === command);
   if (!cmd)
     return `Unknown command: ${domain} ${command}`;
   const display = domain.startsWith("admin:") ? `admin ${domain.replace("admin:", "")}` : domain;
+  const commandSuffix = subcommand ? ` ${subcommand}` : domain === command ? "" : ` ${command}`;
   const lines = [];
-  lines.push(`${colors.bold}AIDENT ${display.toUpperCase()} ${command.toUpperCase()}${colors.reset}`);
+  lines.push(`${colors.bold}AIDENT ${display.toUpperCase()}${commandSuffix.toUpperCase()}${colors.reset}`);
   lines.push("");
   lines.push(cmd.description);
   if (cmd.longDescription) {
@@ -1013,10 +1246,16 @@ function renderCommandHelp(catalog, domain, command) {
     lines.push("");
     lines.push("INPUT:");
     for (const [key, val] of Object.entries(schema.properties)) {
+      if (key === "action" && cmd.cliActionSubcommands?.length)
+        continue;
       const tag = required.has(key) ? "" : " (optional)";
       const type = val.type ? ` ${colors.dim}<${val.type}>${colors.reset}` : "";
       lines.push(`  --${key.padEnd(24)}${type} ${val.description ?? ""}${tag}`);
     }
+    if (Object.values(schema.properties).some((val) => val.type === "string")) {
+      lines.push("");
+      lines.push(`  ${colors.dim}String flags also accept --<flag>-file <path> to read the value from a local file.${colors.reset}`);
+    }
   }
   if (cmd.outputDescription) {
     lines.push("");
@@ -1025,10 +1264,13 @@ function renderCommandHelp(catalog, domain, command) {
   if (cmd.examples && cmd.examples.length > 0) {
     lines.push("");
     lines.push("EXAMPLES:");
-    for (const ex of cmd.examples) {
+    const examples = subcommand ? cmd.examples.filter((example) => example.args.action === subcommand) : cmd.examples;
+    for (const ex of examples) {
       lines.push(`  ${colors.dim}# ${ex.description}${colors.reset}`);
-      const argStr = Object.entries(ex.args).map(([k, v]) => `--${k} ${typeof v === "string" ? `"${v}"` : JSON.stringify(v)}`).join(" ");
-      lines.push(`  aident ${display} ${command} ${argStr}`);
+      const action = typeof ex.args.action === "string" && cmd.cliActionSubcommands?.includes(ex.args.action) ? ex.args.action : undefined;
+      const argStr = Object.entries(ex.args).filter(([key]) => key !== "action" || !action).map(([k, v]) => `--${k} ${typeof v === "string" ? `"${v}"` : JSON.stringify(v)}`).join(" ");
+      const exampleSuffix = action ? ` ${action}` : commandSuffix;
+      lines.push(`  aident ${display}${exampleSuffix} ${argStr}`);
       lines.push("");
     }
   }
@@ -1038,9 +1280,9 @@ function renderCommandHelp(catalog, domain, command) {
 
 // src/localIntegrationMigration.ts
 import { createHash as createHash2 } from "node:crypto";
-import { readFile as readFile4 } from "node:fs/promises";
+import { readFile as readFile5 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
-import { basename, join as join4 } from "node:path";
+import { basename, join as join5 } from "node:path";
 var LOCAL_INTEGRATION_MIGRATION_PROMPTED_AT_KEY = "localIntegrationMigrationPromptedAt";
 var LOCAL_INTEGRATION_MIGRATION_SKIPPED_AT_KEY = "localIntegrationMigrationSkippedAt";
 var LOCAL_INTEGRATION_MIGRATION_COMPLETED_AT_KEY = "localIntegrationMigrationCompletedAt";
@@ -1154,44 +1396,44 @@ function formatLocalIntegrationMigrationPlan(plan) {
 }
 function localConfigFiles(cwd, homeDir) {
   return [
-    { path: join4(cwd, ".mcp.json"), source: "mcp_config", kind: "json" },
+    { path: join5(cwd, ".mcp.json"), source: "mcp_config", kind: "json" },
     {
-      path: join4(cwd, ".cursor", "mcp.json"),
+      path: join5(cwd, ".cursor", "mcp.json"),
       source: "mcp_config",
       kind: "json"
     },
     {
-      path: join4(cwd, ".vscode", "mcp.json"),
+      path: join5(cwd, ".vscode", "mcp.json"),
       source: "mcp_config",
       kind: "json"
     },
     {
-      path: join4(homeDir, ".claude.json"),
+      path: join5(homeDir, ".claude.json"),
       source: "agent_config",
       kind: "json"
     },
     {
-      path: join4(homeDir, "Library", "Application Support", "Claude", "claude_desktop_config.json"),
+      path: join5(homeDir, "Library", "Application Support", "Claude", "claude_desktop_config.json"),
       source: "agent_config",
       kind: "json"
     },
     {
-      path: join4(homeDir, "AppData", "Roaming", "Claude", "claude_desktop_config.json"),
+      path: join5(homeDir, "AppData", "Roaming", "Claude", "claude_desktop_config.json"),
       source: "agent_config",
       kind: "json"
     },
     {
-      path: join4(homeDir, ".config", "Claude", "claude_desktop_config.json"),
+      path: join5(homeDir, ".config", "Claude", "claude_desktop_config.json"),
       source: "agent_config",
       kind: "json"
     },
     {
-      path: join4(homeDir, ".cursor", "mcp.json"),
+      path: join5(homeDir, ".cursor", "mcp.json"),
       source: "mcp_config",
       kind: "json"
     },
     {
-      path: join4(homeDir, ".aident", "config.json"),
+      path: join5(homeDir, ".aident", "config.json"),
       source: "aident_cli_config",
       kind: "aident-config"
     }
@@ -1199,7 +1441,7 @@ function localConfigFiles(cwd, homeDir) {
 }
 async function readOptionalText(path) {
   try {
-    return await readFile4(path, "utf-8");
+    return await readFile5(path, "utf-8");
   } catch {
     return null;
   }
@@ -1554,6 +1796,38 @@ function coerce(val) {
   }
   return val;
 }
+async function applyFileValueFlags(flags, schema, readFile6) {
+  const props = schema?.properties ?? {};
+  const out = { ...flags };
+  for (const key of Object.keys(flags)) {
+    if (!key.endsWith("-file") || key in props)
+      continue;
+    const base = key.slice(0, -"-file".length);
+    const prop = base ? props[base] : undefined;
+    const types = Array.isArray(prop?.type) ? prop.type : prop?.type ? [prop.type] : [];
+    if (!types.includes("string"))
+      continue;
+    if (base in out) {
+      return { error: { code: "invalid-input", message: `Pass either --${base} or --${key}, not both.` } };
+    }
+    const path = out[key];
+    if (typeof path !== "string" || !path.trim()) {
+      return { error: { code: "invalid-input", message: `--${key} requires a file path.` } };
+    }
+    try {
+      out[base] = await readFile6(path);
+    } catch (error) {
+      return {
+        error: {
+          code: "invalid-input",
+          message: `Unable to read --${key} ${path}: ${error instanceof Error ? error.message : String(error)}`
+        }
+      };
+    }
+    delete out[key];
+  }
+  return { flags: out };
+}
 function coerceArgsToSchema(args, schema) {
   const props = schema?.properties;
   if (!props)
@@ -1578,6 +1852,72 @@ function coerceArgsToSchema(args, schema) {
   }
   return out;
 }
+function shouldRejectRemainingArgs(domain, command) {
+  return domain === "audit" && command === "audit" || domain === "vault" && command === "vault";
+}
+function parseJsonObjectArg(value) {
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("{"))
+    return null;
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return { error: { code: "invalid-input", message: "JSON command input must be an object." } };
+    }
+    return { args: parsed };
+  } catch (error) {
+    return {
+      error: {
+        code: "invalid-input",
+        message: `Invalid JSON command input: ${error instanceof Error ? error.message : String(error)}`
+      }
+    };
+  }
+}
+function buildCommandArgs(params) {
+  const remaining = [...params.remaining];
+  const positionalJson = remaining.length === 1 ? parseJsonObjectArg(remaining[0]) : null;
+  if (positionalJson?.error)
+    return positionalJson;
+  const args = { ...positionalJson?.args ?? {}, ...params.flags };
+  for (const reserved of RESERVED_CLI_FLAGS) {
+    delete args[reserved];
+  }
+  if (positionalJson?.args)
+    remaining.pop();
+  if (params.subcommand) {
+    if (args.action !== undefined) {
+      return {
+        error: {
+          code: "invalid-input",
+          message: `Do not combine ${params.domain} ${params.subcommand} with --action.`
+        }
+      };
+    }
+    args.action = params.subcommand;
+  }
+  const required = new Set(params.schema?.required ?? []);
+  const props = params.schema?.properties ?? {};
+  for (const key of Object.keys(props)) {
+    if (remaining.length === 0)
+      break;
+    if (!required.has(key))
+      continue;
+    if (key in args)
+      continue;
+    args[key] = remaining.shift();
+  }
+  if (remaining.length > 0 && shouldRejectRemainingArgs(params.domain, params.command)) {
+    const commandLabel = params.subcommand ? `${params.domain} ${params.subcommand}` : params.domain === params.command ? params.domain : `${params.domain} ${params.command}`;
+    return {
+      error: {
+        code: "invalid-input",
+        message: `Unexpected arguments for ${commandLabel}: ${remaining.join(" ")}`
+      }
+    };
+  }
+  return { args: coerceArgsToSchema(args, params.schema) };
+}
 function resolveCommand(positional, knownCommands) {
   if (positional.length === 0)
     return null;
@@ -1587,16 +1927,32 @@ function resolveCommand(positional, knownCommands) {
     domain = `admin:${positional[1]}`;
     consumed = 2;
   }
-  const remaining = positional.slice(consumed);
-  if (remaining.length === 0)
-    return { domain, command: "", remaining: [] };
   const domainCommands = knownCommands.filter((c) => c.domain === domain);
+  const remaining = positional.slice(consumed);
+  if (remaining.length === 0) {
+    const selfCommand2 = domainCommands.find((candidate) => candidate.command === domain);
+    return {
+      domain,
+      command: selfCommand2?.cliActionSubcommands?.length ? "" : selfCommand2?.command ?? "",
+      remaining: []
+    };
+  }
   for (let len = Math.min(remaining.length, 5);len >= 1; len--) {
     const candidate = remaining.slice(0, len).join(" ");
     if (domainCommands.some((c) => c.command === candidate)) {
       return { domain, command: candidate, remaining: remaining.slice(len) };
     }
   }
+  const selfCommand = domainCommands.find((candidate) => candidate.command === domain);
+  const subcommand = remaining[0];
+  if (selfCommand?.cliActionSubcommands?.includes(subcommand)) {
+    return {
+      domain,
+      command: selfCommand.command,
+      subcommand,
+      remaining: remaining.slice(1)
+    };
+  }
   return { domain, command: remaining[0], remaining: remaining.slice(1) };
 }
 
@@ -1623,11 +1979,17 @@ async function callWithRefresh(client, call, deps = defaultDeps) {
   const creds = await deps.readCredentials();
   if (!creds)
     return first;
-  const refreshed = await deps.refreshToken(creds);
+  const activeCredentials = credentialsForBaseUrl(creds, client.baseUrl);
+  if (!activeCredentials)
+    return first;
+  const refreshed = await deps.refreshToken(activeCredentials);
   if (!refreshed)
     return first;
-  await deps.writeCredentials(refreshed);
-  client.updateCredentials(refreshed);
+  const updatedCredentials = credentialsForBaseUrl(refreshed, client.baseUrl);
+  if (!updatedCredentials)
+    return first;
+  await deps.writeCredentials(updatedCredentials);
+  client.updateCredentials(updatedCredentials);
   const retried = await call(client);
   if (retried.status === 426) {
     deps.onUpgradeRequired(extractUpgradeMessage(retried.body));
@@ -1643,8 +2005,7 @@ function extractUpgradeMessage(body) {
 var LOADOUT_CAPABILITIES_SEARCH_OPERATION = "loadout_capabilities_search";
 var LOADOUT_CAPABILITIES_EXECUTE_OPERATION = "loadout_capabilities_execute";
 var LOADOUT_CAPABILITIES_FEEDBACK_OPERATION = "loadout_capabilities_feedback";
-var LOADOUT_VAULT_STATUS_OPERATION = "loadout_vault_status";
-var LOADOUT_VAULT_CONNECT_OPERATION = "loadout_vault_connect";
+var LOADOUT_VAULT_OPERATION = "loadout_vault";
 var LOADOUT_LOCAL_MIGRATION_EVENT_OPERATION = "loadout_vault_local_migration_event";
 var LOCAL_MIGRATION_SEARCH_BATCH_SIZE = 10;
 var LOCAL_MIGRATION_SEARCH_RESULT_MAX_DEPTH = 4;
@@ -1675,7 +2036,7 @@ async function main() {
       await runLogin(parsed);
       return;
     case "logout":
-      await runLogout();
+      await runLogout(parsed);
       return;
     case "whoami":
       await runWhoami(parsed);
@@ -1739,14 +2100,24 @@ async function runLogin(parsed) {
   logInfo(`${colors.green}Signed in to ${creds.base_url}${colors.reset}`);
   await setConfigValue("baseUrl", creds.base_url);
 }
-async function runLogout() {
+async function runLogout(parsed) {
+  if (parsed.isHelp) {
+    logInfo(renderLogoutHelp());
+    return;
+  }
+  const envToken = process.env.AIDENT_TOKEN;
   const creds = await readCredentials();
   if (!creds) {
-    logInfo("Not signed in.");
+    await clearCredentials();
+    logInfo(envToken ? "AIDENT_TOKEN is set. Unset it in your shell to sign out." : "Not signed in.");
     return;
   }
   await logout(creds);
   await clearCredentials();
+  if (envToken) {
+    logInfo(`${colors.green}Stored credentials removed.${colors.reset} AIDENT_TOKEN is still set; unset it in your shell to sign out.`);
+    return;
+  }
   logInfo(`${colors.green}Signed out.${colors.reset}`);
 }
 async function runWhoami(parsed) {
@@ -1841,9 +2212,9 @@ async function runConfigCmd(parsed) {
       const value = normalizeBaseUrl(rawValue);
       await setConfigValue(key, value);
       logInfo(`${colors.green}Set${colors.reset} ${key} = ${value}`);
-      const creds = await readCredentials();
-      if (creds && creds.base_url !== value) {
-        logInfo(`${colors.yellow}Note:${colors.reset} existing credentials are for ${creds.base_url}. Run \`aident login\` to authenticate against ${value}.`);
+      const clearedCredentialsBaseUrl = await clearCredentialsForIncompatibleBaseUrl(value);
+      if (clearedCredentialsBaseUrl) {
+        logInfo(`${colors.yellow}Cleared credentials for ${clearedCredentialsBaseUrl}.${colors.reset} Run \`aident login\` to authenticate against ${value}.`);
       }
     } else {
       const value = normalizeCliPackages(rawValue);
@@ -1861,6 +2232,13 @@ async function runConfigCmd(parsed) {
     }
     await unsetConfigValue(key);
     logInfo(`${colors.green}Unset${colors.reset} ${key}`);
+    if (key === "baseUrl") {
+      const baseUrl = await resolveDefaultBaseUrl();
+      const clearedCredentialsBaseUrl = await clearCredentialsForIncompatibleBaseUrl(baseUrl);
+      if (clearedCredentialsBaseUrl) {
+        logInfo(`${colors.yellow}Cleared credentials for ${clearedCredentialsBaseUrl}.${colors.reset} Run \`aident login\` to authenticate against ${baseUrl}.`);
+      }
+    }
     return;
   }
   logErr(`Unknown config subcommand: ${sub}`);
@@ -1927,7 +2305,7 @@ async function runDoctorCmd(format) {
   logInfo(`${colors.bold}Aident CLI doctor${colors.reset}`);
   logInfo("");
   for (const c of report.checks) {
-    const mark = c.ok ? `${colors.green}ok${colors.reset}` : `${colors.red}x${colors.reset}`;
+    const mark = !c.ok ? `${colors.red}x${colors.reset}` : c.warning ? `${colors.yellow}warning${colors.reset}` : `${colors.green}ok${colors.reset}`;
     logInfo(`  ${mark} ${c.name.padEnd(22)} ${colors.dim}${c.detail}${colors.reset}`);
   }
   logInfo("");
@@ -1949,7 +2327,7 @@ async function runSetup(parsed) {
   }
   logInfo("");
   const existing = await readCredentials();
-  if (existing && existing.base_url === chosen) {
+  if (existing && credentialsForBaseUrl(existing, chosen)) {
     logInfo(`${colors.green}Already signed in${colors.reset} to ${chosen}.`);
   } else {
     const proceed = (await readLine(`Open browser to authenticate now? [Y/n]: `)).trim().toLowerCase();
@@ -2113,7 +2491,8 @@ async function genFetchLoadoutIntegrations(client, queries) {
 async function genEnrichLoadoutIntegrationsWithVaultStatus(client, integrations) {
   if (integrations.length === 0)
     return integrations;
-  const result = await callWithRefresh(client, (c) => c.execOperation("loadout", LOADOUT_VAULT_STATUS_OPERATION, {
+  const result = await callWithRefresh(client, (c) => c.execOperation("loadout", LOADOUT_VAULT_OPERATION, {
+    action: "status",
     integrationIds: integrations.map((integration) => integration.id)
   }));
   if (!result.body.success)
@@ -2137,7 +2516,7 @@ async function genApplyLocalIntegrationMigration(client, plan, selectedIntegrati
       connectResults.push({ integrationId, skipped: "not-connectable" });
       continue;
     }
-    const result = await callWithRefresh(client, (c) => c.execOperation("loadout", LOADOUT_VAULT_CONNECT_OPERATION, { integrationId }));
+    const result = await callWithRefresh(client, (c) => c.execOperation("loadout", LOADOUT_VAULT_OPERATION, { action: "connect", integrationId }));
     const entry = { integrationId, result: result.body };
     if (result.body.success) {
       entry.validation = await genValidateLocalIntegrationConnection(client, integrationId);
@@ -2162,7 +2541,7 @@ async function tryRecordLocalMigrationEvent(client, action, properties = {}) {
   }
 }
 async function genValidateLocalIntegrationConnection(client, integrationId) {
-  const result = await callWithRefresh(client, (c) => c.execOperation("loadout", LOADOUT_VAULT_STATUS_OPERATION, { integrationId }));
+  const result = await callWithRefresh(client, (c) => c.execOperation("loadout", LOADOUT_VAULT_OPERATION, { action: "status", integrationId }));
   if (!result.body.success) {
     return {
       success: false,
@@ -2315,7 +2694,7 @@ async function trySubmitLocalMigrationFeedback(client, integrationId, comment) {
 }
 function formatLocalMigrationValidationFeedback(entry) {
   const validation = entry.validation;
-  const validationMethod = validation?.providerCapabilityName ? "read_only_capability" : "vault_status";
+  const validationMethod = validation?.providerCapabilityName ? "read_only_capability" : "vault";
   const parts = [
     "Local integration migration validation failed.",
     `integrationId=${entry.integrationId}`,
@@ -2585,29 +2964,28 @@ async function runCommand(parsed) {
     return;
   }
   if (parsed.isHelp) {
-    logInfo(renderCommandHelp(catalog, resolved.domain, resolved.command));
+    logInfo(renderCommandHelp(catalog, resolved.domain, resolved.command, resolved.subcommand));
     return;
   }
-  let args = { ...parsed.flags };
-  for (const reserved of RESERVED_CLI_FLAGS) {
-    delete args[reserved];
-  }
   const schema = cmdInfo.inputSchema;
-  if (resolved.remaining.length > 0) {
-    const required = new Set(schema?.required ?? []);
-    const props = schema?.properties ?? {};
-    for (const key of Object.keys(props)) {
-      if (resolved.remaining.length === 0)
-        break;
-      if (!required.has(key))
-        continue;
-      if (key in args)
-        continue;
-      args[key] = resolved.remaining.shift();
-    }
+  const fileFlags = await applyFileValueFlags(parsed.flags, schema, (path) => readFile6(path, "utf8"));
+  if (fileFlags.error) {
+    emitLocalCommandResult(parsed.format, false, undefined, fileFlags.error.code, fileFlags.error.message);
+    return;
   }
-  args = coerceArgsToSchema(args, schema);
-  const result = await callWithRefresh(client, (c) => c.exec(resolved.domain, resolved.command, args));
+  const builtArgs = buildCommandArgs({
+    flags: fileFlags.flags,
+    subcommand: resolved.subcommand,
+    remaining: resolved.remaining,
+    schema,
+    domain: resolved.domain,
+    command: resolved.command
+  });
+  if (builtArgs.error) {
+    emitLocalCommandResult(parsed.format, false, undefined, builtArgs.error.code, builtArgs.error.message);
+    return;
+  }
+  const result = await callWithRefresh(client, (c) => c.exec(resolved.domain, resolved.command, builtArgs.args ?? {}));
   emitResult(result, parsed.format, resolved);
 }
 function emitResult(result, format, resolved) {
@@ -2619,7 +2997,8 @@ function emitResult(result, format, resolved) {
     return;
   }
   if (body.success) {
-    logInfo(`${colors.green}ok${colors.reset} ${resolved.domain} ${resolved.command}`);
+    const commandLabel = resolved.subcommand ? `${resolved.domain} ${resolved.subcommand}` : resolved.domain === resolved.command ? resolved.domain : `${resolved.domain} ${resolved.command}`;
+    logInfo(`${colors.green}ok${colors.reset} ${commandLabel}`);
     if (body.data !== undefined)
       logInfo(JSON.stringify(body.data, null, 2));
     if (body.meta)
@@ -2650,9 +3029,9 @@ async function getAuthenticatedClient(packages) {
   const envToken = process.env.AIDENT_TOKEN;
   const envBaseUrl = process.env.AIDENT_BASE_URL?.trim();
   if (envToken) {
-    const baseUrl = envBaseUrl || (await readCredentials())?.base_url || await resolveDefaultBaseUrl();
+    const baseUrl2 = envBaseUrl || (await readCredentials())?.base_url || await resolveDefaultBaseUrl();
     return new CliClient({
-      base_url: normalizeBaseUrl(baseUrl),
+      base_url: normalizeBaseUrl(baseUrl2),
       client_id: "",
       access_token: envToken
     }, "env", activePackages, installedSkillVersion);
@@ -2660,9 +3039,13 @@ async function getAuthenticatedClient(packages) {
   let creds = await readCredentials();
   if (!creds)
     return null;
-  if (envBaseUrl && normalizeBaseUrl(envBaseUrl) !== creds.base_url) {
-    logErr(`${colors.yellow}Warning:${colors.reset} AIDENT_BASE_URL=${envBaseUrl} does not match the host your token was issued for (${creds.base_url}). Ignoring the env override; run \`aident login --base-url ${envBaseUrl}\` to authenticate against the new host.`);
+  const baseUrl = normalizeBaseUrl(envBaseUrl || await resolveDefaultBaseUrl());
+  const activeCredentials = credentialsForBaseUrl(creds, baseUrl);
+  if (!activeCredentials) {
+    logErr(`${colors.yellow}Warning:${colors.reset} ${baseUrl} does not match the host your token was issued for (${creds.base_url}). Run \`aident login --base-url ${baseUrl}\` to authenticate against the new host.`);
+    return null;
   }
+  creds = activeCredentials;
   if (isExpired(creds)) {
     const refreshed = await refreshToken(creds);
     if (refreshed) {
@@ -2685,7 +3068,7 @@ async function fetchCatalog(client, options = {}) {
     }
     return null;
   }
-  if (res.status !== 200 || !isCommandCatalog(res.body)) {
+  if (res.status !== 200 || !isCommandCatalog2(res.body)) {
     logErr(`Failed to fetch command catalog (HTTP ${res.status}): ${JSON.stringify(res.body)}`);
     process.exitCode = 1;
     return null;
@@ -2710,7 +3093,7 @@ async function readConfiguredPackages() {
   const config = await readConfig();
   return normalizeCliPackages(config.packages);
 }
-function isCommandCatalog(body) {
+function isCommandCatalog2(body) {
   if (!body || typeof body !== "object")
     return false;
   const b = body;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aident-ai/cli",
-  "version": "0.1.2",
+  "version": "0.1.3-rc.0",
   "description": "Aident CLI — umbrella access to Loadout integrations, Playbook automation, Intern tools, and the Aident platform.",
   "homepage": "https://aident.ai",
   "repository": {