@aifabrix/builder 2.55.0 → 2.56.0

package/lib/commands/agent-kit.js

@@ -1,6 +1,6 @@
 /**
  * `aifabrix agent-kit` command group.
- * @fileoverview Install, init, status, update, validate, remote create
+ * @fileoverview Install, init, status, update, validate, remote create, start
  */
 
 'use strict';
@@ -9,6 +9,7 @@ const logger = require('../utils/logger');
 const { handleCommandError } = require('../utils/cli-utils');
 const { formatSuccessLine, formatBlockingError, formatWarningLine } = require('../utils/cli-layout-chalk');
 const { runInstall, runUpdate } = require('../agent-kit/run');
+const { runStart } = require('../agent-kit/start');
 const path = require('path');
 const { runInit, runRemoteCreate } = require('../agent-kit/init');
 const { enrichInitHostOptions, enrichInitRemoteOptions, enrichRemoteOptions, enrichApproveAllOptions } = require('../agent-kit/remote-prompts');
@@ -26,7 +27,11 @@ const {
   UPDATE_HELP,
   VALIDATE_HELP,
   INIT_HELP,
-  REMOTE_HELP
+  REMOTE_GROUP_HELP,
+  REMOTE_HELP,
+  START_HELP,
+  HOST_OPTION_HELP,
+  APPROVE_ALL_OPTION_HELP
 } = require('./agent-kit-help');
 
 /**
@@ -91,6 +96,34 @@ function emitRemoteReport(json, asJson) {
   logger.log(formatSuccessLine(json.dryRun ? 'Dry-run complete' : 'Done'));
 }
 
+/**
+ * @param {object} json
+ * @param {boolean} asJson
+ * @returns {void}
+ */
+function emitStartReport(json, asJson) {
+  if (asJson) {
+    logger.log(JSON.stringify(json, null, 2));
+    return;
+  }
+  logger.log(`App        ${json.app}`);
+  logger.log(`Session    ${json.session}`);
+  if (json.remoteControlName) {
+    logger.log(`Remote     ${json.remoteControlName}`);
+  }
+  logger.log(`Path       ${json.path}`);
+  logger.log(`Launch     ${json.launch.join(' ')}`);
+  if (json.executed && json.detach) {
+    logger.log(formatSuccessLine('Session started in background'));
+    return;
+  }
+  if (json.executed) {
+    logger.log(formatSuccessLine('Session ended'));
+    return;
+  }
+  logger.log(formatSuccessLine(json.dryRun ? 'Dry-run complete' : 'Ready'));
+}
+
 /**
  * @param {Function} runner
  * @param {object} options
@@ -125,6 +158,7 @@ function setupAgentKitCommands(program) {
   addUpdateCommand(group);
   addValidateCommand(group);
   addRemoteCommand(group);
+  addStartCommand(group);
 }
 
 /**
@@ -134,16 +168,16 @@ function addInitCommand(group) {
   group
     .command('init [nameOrPath]')
     .description('Create a customer workspace skeleton, git repo, and Agent Kit')
-    .option('--host <target>', 'all, cursor, codex, or claude (omit on TTY to choose)', 'all')
+    .option('--host <target>', HOST_OPTION_HELP, 'all')
     .option('--scm <kind>', 'git or none', 'git')
-    .option('--remote', 'Create private hosting remote and push (requires auth)')
+    .option('--remote', 'Create private GitHub remote and push (requires auth)')
     .option('--no-remote', 'Force local-only (skip remote prompt on TTY)')
     .option('--org <owner>', 'Hosting org or user (required with --remote when non-TTY)')
     .option('--visibility <mode>', 'private or public', 'private')
     .option('--license <kind>', 'mit or none', 'none')
     .option('--force', 'Allow non-empty target directory')
     .option('--yes', 'Silent: skip TTY confirm (pair with --host and --org); also auto-approves host permissions')
-    .option('--approve-all', 'Write Claude Code and Codex auto-approve configs')
+    .option('--approve-all [host]', APPROVE_ALL_OPTION_HELP)
     .option('--skip-approve-all', 'Do not write Claude Code or Codex auto-approve configs')
     .option('--dry-run', 'Plan writes without changing files')
     .option('--json', 'Machine-readable output')
@@ -177,10 +211,13 @@ function addInitCommand(group) {
  * @param {import('commander').Command} group
  */
 function addRemoteCommand(group) {
-  const remote = group.command('remote').description('Hosting remotes for an Agent Kit workspace');
+  const remote = group
+    .command('remote')
+    .description('Create a GitHub repository for this workspace and push')
+    .addHelpText('after', REMOTE_GROUP_HELP);
   remote
     .command('create')
-    .description('Create a private GitHub remote and push the current workspace')
+    .description('Create a private GitHub repository (origin) and push this workspace')
     .option('--org <owner>', 'Hosting org or user (required when non-TTY)')
     .option('--name <repo>', 'Remote repository name (default: directory basename)')
     .option('--visibility <mode>', 'private or public', 'private')
@@ -215,8 +252,8 @@ function addInstallCommand(group) {
   group
     .command('install')
     .description('Install the Agent Kit into the current git repository')
-    .option('--host <target>', 'all, cursor, codex, or claude', 'all')
-    .option('--approve-all', 'Write Claude Code and Codex auto-approve configs')
+    .option('--host <target>', HOST_OPTION_HELP, 'all')
+    .option('--approve-all [host]', APPROVE_ALL_OPTION_HELP)
     .option('--skip-approve-all', 'Do not write Claude Code or Codex auto-approve configs')
     .option('--yes', 'Silent: auto-approve host permission configs without asking')
     .option('--dry-run', 'Plan writes without changing files')
@@ -225,7 +262,8 @@ function addInstallCommand(group) {
     .action(async(options) => {
       try {
         const interactive = Boolean(process.stdout.isTTY) && !options.json;
-        const merged = await enrichApproveAllOptions(options, { interactive });
+        const withHost = await enrichInitHostOptions(options, { interactive });
+        const merged = await enrichApproveAllOptions(withHost, { interactive });
         await runLeaf(runInstall, merged, true);
       } catch (error) {
         handleCommandError(error, 'agent-kit install');
@@ -287,8 +325,8 @@ function addUpdateCommand(group) {
   group
     .command('update')
     .description('Update managed Agent Kit files from this Builder release')
-    .option('--host <target>', 'all, cursor, codex, or claude (omit to keep recorded hosts)')
-    .option('--approve-all', 'Write Claude Code and Codex auto-approve configs')
+    .option('--host <target>', `${HOST_OPTION_HELP} (omit to keep recorded hosts)`)
+    .option('--approve-all [host]', APPROVE_ALL_OPTION_HELP)
     .option('--skip-approve-all', 'Do not write Claude Code or Codex auto-approve configs')
     .option('--yes', 'Silent: auto-approve host permission configs without asking')
     .option('--dry-run', 'Plan writes without changing files')
@@ -343,4 +381,37 @@ async function runValidateLeaf(options) {
   }
 }
 
+/**
+ * @param {import('commander').Command} group
+ */
+function addStartCommand(group) {
+  group
+    .command('start <app>')
+    .description('Start Claude Code or Codex in tmux (does not install skills)')
+    .option('--approve-all', 'Write auto-approve config for this app only')
+    .option('--skip-approve-all', 'Do not write auto-approve configs')
+    .option('--yes', 'Same as --approve-all')
+    .option('--detach', 'Create the tmux session in the background (no attach)')
+    .option(
+      '--name <session>',
+      'tmux session name (default: last folder of this git workspace)'
+    )
+    .option(
+      '--remote-control',
+      'Claude Code only: same session on this PC, claude.ai/code, and the Claude mobile app'
+    )
+    .option('--dry-run', 'Print the launch command without starting it')
+    .option('--json', 'Machine-readable output')
+    .addHelpText('after', START_HELP)
+    .action(async(app, options) => {
+      try {
+        const json = runStart({ ...options, app });
+        emitStartReport(json, Boolean(options.json));
+      } catch (error) {
+        handleCommandError(error, 'agent-kit start');
+        process.exitCode = 1;
+      }
+    });
+}
+
 module.exports = { setupAgentKitCommands };

package/lib/commands/auth-status-user.js

@@ -0,0 +1,99 @@
+/**
+ * Resolve the signed-in username for `aifabrix auth status`.
+ *
+ * @fileoverview Unwrap controller auth/user payloads and pick a display username
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const { unwrapControllerData } = require('../identity/identity-response-helpers');
+
+/**
+ * @param {...*} values
+ * @returns {string}
+ */
+function firstNonEmptyString(...values) {
+  for (const value of values) {
+    if (typeof value === 'string' && value.trim()) {
+      return value.trim();
+    }
+  }
+  return '';
+}
+
+/**
+ * Decode a JWT payload for display only. Does not verify the signature.
+ * @param {string} token
+ * @returns {Object|null}
+ */
+function decodeJwtPayload(token) {
+  if (!token || typeof token !== 'string') {
+    return null;
+  }
+  const parts = token.split('.');
+  if (parts.length < 2) {
+    return null;
+  }
+  try {
+    const b64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+    const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, '=');
+    const payload = JSON.parse(Buffer.from(padded, 'base64').toString('utf8'));
+    return payload && typeof payload === 'object' ? payload : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {Object|null|undefined} user
+ * @param {string} [token]
+ * @returns {string}
+ */
+function resolveDisplayUsername(user, token) {
+  const fromUser = firstNonEmptyString(
+    user && user.username,
+    user && user.preferredUsername,
+    user && user.preferred_username,
+    user && user.email
+  );
+  if (fromUser) {
+    return fromUser;
+  }
+  const payload = decodeJwtPayload(token);
+  return firstNonEmptyString(
+    payload && payload.preferred_username,
+    payload && payload.preferredUsername,
+    payload && payload.email,
+    payload && payload.upn
+  );
+}
+
+/**
+ * @param {Object|null|undefined} response
+ * @param {string} [token]
+ * @returns {{ authenticated: boolean, user: Object|null, username: string }}
+ */
+function parseAuthUserResponse(response, token) {
+  const payload = unwrapControllerData(response);
+  if (!payload || typeof payload !== 'object') {
+    return { authenticated: false, user: null, username: '' };
+  }
+  const rawUser = payload.user && typeof payload.user === 'object' ? payload.user : null;
+  const username = resolveDisplayUsername(rawUser, token);
+  const user = username && (!rawUser || !rawUser.username)
+    ? { ...(rawUser || {}), username }
+    : rawUser;
+  return {
+    authenticated: payload.authenticated !== false,
+    user,
+    username
+  };
+}
+
+module.exports = {
+  decodeJwtPayload,
+  resolveDisplayUsername,
+  parseAuthUserResponse
+};

package/lib/commands/auth-status.js

@@ -34,6 +34,7 @@ const {
   displayStoredClientTokensSection,
   tryResolveClientTokenAuth
 } = require('./auth-status-client-tokens');
+const { parseAuthUserResponse } = require('./auth-status-user');
 
 /**
  * Format expiration date for display
@@ -71,11 +72,13 @@ async function checkDeviceToken(controllerUrl) {
     const response = await getAuthUser(controllerUrl, authConfig);
 
     if (response.success && response.data) {
+      const parsed = parseAuthUserResponse(response, deviceToken.token);
       return {
         type: 'Device Token',
         token: deviceToken.token,
-        authenticated: response.data.authenticated !== false,
-        user: response.data.user,
+        authenticated: parsed.authenticated,
+        user: parsed.user,
+        username: parsed.username,
         expiresAt: deviceToken.expiresAt
       };
     }
@@ -113,11 +116,13 @@ async function validateClientToken(token, controllerUrl, environment, appName, e
     const response = await getAuthUser(controllerUrl, authConfig);
 
     if (response.success && response.data) {
+      const parsed = parseAuthUserResponse(response, token);
       return {
         type: 'Client Token',
         token: token,
-        authenticated: response.data.authenticated !== false,
-        user: response.data.user,
+        authenticated: parsed.authenticated,
+        user: parsed.user,
+        username: parsed.username,
         expiresAt: expiresAt,
         appName: appName
       };
@@ -185,6 +190,11 @@ function displayTokenInfo(tokenInfo) {
   logger.log(`  Status: ${statusIcon} ${statusText}`);
   logger.log(`  Token Type: ${chalk.cyan(tokenInfo.type)}`);
 
+  if (tokenInfo.authenticated) {
+    const username = tokenInfo.username || (tokenInfo.user && tokenInfo.user.username);
+    logger.log(`  User: ${username ? chalk.cyan(username) : chalk.gray('—')}`);
+  }
+
   if (tokenInfo.appName) {
     logger.log(`  Application: ${chalk.cyan(tokenInfo.appName)}`);
   }

package/lib/commands/datasource-load-export-cli.js

@@ -7,6 +7,7 @@
 'use strict';
 
 const logger = require('../utils/logger');
+const { writeJsonEnvelopeAndExit } = require('../utils/cli-json-exit');
 const { formatBlockingError } = require('../utils/cli-test-layout-chalk');
 const { runDatasourceLoad } = require('../datasource/bulk-loader-service');
 const { runDatasourceExport } = require('../datasource/datasource-exporter-service');
@@ -82,7 +83,9 @@ async function datasourceLoadAction(datasourceKey, options) {
 
     if (options.json) {
       const { context: _ctx, ...payload } = result;
-      logger.log(JSON.stringify(payload, null, 2));
+      // exitCode 0 — write and resolve, never exit here; this action always
+      // exits unconditionally below with the real computed code.
+      await writeJsonEnvelopeAndExit(payload, 0);
     } else {
       displayDatasourceLoadTTY(result, { environment: options.env, verbose: options.verbose });
     }
@@ -112,7 +115,9 @@ async function datasourceExportAction(datasourceKey, options) {
 
     if (options.json) {
       const { context: _ctx, ...payload } = result;
-      logger.log(JSON.stringify(payload, null, 2));
+      // exitCode 0 — write and resolve, never exit here; this action always
+      // exits unconditionally below with the real computed code.
+      await writeJsonEnvelopeAndExit(payload, 0);
     } else {
       displayDatasourceExportTTY(result, { environment: options.env, verbose: options.verbose });
     }

package/lib/commands/datasource-test-trust-cli.js

@@ -7,6 +7,7 @@
 'use strict';
 
 const logger = require('../utils/logger');
+const { writeJsonEnvelopeAndExit } = require('../utils/cli-json-exit');
 const { formatBlockingError } = require('../utils/cli-test-layout-chalk');
 const { runDatasourceAgentTrust } = require('../datasource/agent-trust-run');
 const { writeTrustDebugLogAndPrint } = require('../datasource/agent-trust-debug-log');
@@ -52,7 +53,10 @@ async function finalizeDatasourceVerifyTrust(datasourceKey, options, result) {
     strict: options.strict === true
   };
   if (options.json) {
-    logger.log(JSON.stringify(result.trustRun, null, 2));
+    // exitCode 0 here means "write and resolve, never exit" — the real exit
+    // code is decided below and the caller exits unconditionally, even on
+    // success, so process.exit() must stay solely the caller's job.
+    await writeJsonEnvelopeAndExit(result.trustRun, 0);
   } else if (options.summary) {
     const tr = result.trustRun;
     logger.log(

package/lib/commands/governance-command-action.js

@@ -6,6 +6,7 @@
 
 const logger = require('../utils/logger');
 const { handleCommandError } = require('../utils/cli-utils');
+const { writeJsonEnvelopeAndExit } = require('../utils/cli-json-exit');
 const { runGovernanceGenerateForExternalSystem } = require('./governance-generate-external');
 const { runGovernanceVerifyForExternalSystem } = require('./governance-verify-external');
 const { runGovernanceUploadForExternalSystem } = require('./governance-upload-external');
@@ -75,12 +76,12 @@ async function governanceVerifyHandler(systemKey, options, cmd) {
   try {
     const opts = normalizeGovernanceOptions(options, cmd);
     const result = await runGovernanceVerifyForExternalSystem(systemKey, opts);
+    const exitCode = exitCodeFromVerdict(result.verdict);
     if (opts.json) {
-      logger.log(JSON.stringify(buildJsonEnvelope(result, opts.verbose), null, 2));
-    } else {
-      displayVerifyGovernanceTTY(result.systemKey, result, { details: opts.verbose });
+      await writeJsonEnvelopeAndExit(buildJsonEnvelope(result, opts.verbose), exitCode);
+      return;
     }
-    const exitCode = exitCodeFromVerdict(result.verdict);
+    displayVerifyGovernanceTTY(result.systemKey, result, { details: opts.verbose });
     if (exitCode !== 0) {
       process.exit(exitCode);
     }

package/lib/commands/identity-membership-role-cache.js

@@ -35,7 +35,12 @@ const ROLE_LIST_COLUMNS = [
     label: 'Groups',
     width: 44,
     value: (r) => {
-      const groups = Array.isArray(r.groups) ? r.groups.filter(Boolean) : [];
+      const groups = Array.isArray(r.groups)
+        ? r.groups.filter(Boolean)
+        : (r.mappings || [])
+          .filter((mapping) => mapping?.isActive !== false)
+          .map((mapping) => mapping?.groupName)
+          .filter(Boolean);
       return groups.length > 0 ? groups.join(', ') : '—';
     }
   }

package/lib/commands/lifecycle-command-action.js

@@ -6,8 +6,8 @@
 
 'use strict';
 
-const logger = require('../utils/logger');
 const { handleCommandError } = require('../utils/cli-utils');
+const { writeJsonEnvelopeAndExit } = require('../utils/cli-json-exit');
 const { cliOptsSkipPublish } = require('../utils/cli-sync-options');
 const { runLifecycleForExternalSystem } = require('./lifecycle-external');
 const { displayLifecycleReportTTY } = require('../lifecycle/report-display');
@@ -65,6 +65,12 @@ async function runLifecycleCommandAction(appName, options, cmd) {
   const result = await runLifecycleForExternalSystem(appName, opts);
   const report = result.report;
 
+  const pillarVerdict = lifecycleVerdictFromReport(report);
+  const exitCode =
+    pillarVerdict === VERDICT.VERIFIED
+      ? 0
+      : exitCodeFromVerdict(pillarVerdict, { partial: pillarVerdict === VERDICT.NOT_VERIFIED });
+
   if (opts.json) {
     const envelope = {
       systemKey: result.systemKey,
@@ -82,22 +88,17 @@ async function runLifecycleCommandAction(appName, options, cmd) {
     if (opts.verbose) {
       envelope.datasources = report.datasources;
     }
-    logger.log(JSON.stringify(envelope, null, 2));
-  } else {
-    displayLifecycleReportTTY(result.systemKey, report, {
-      details: opts.verbose,
-      openApiPublished: result.openApiPublished === true,
-      certificationProgress: result.certificationProgress ?? null,
-      dataplaneUrl: result.dataplaneUrl ?? null,
-      dataplaneUiBaseUrl: result.dataplaneUiBaseUrl ?? null
-    });
+    await writeJsonEnvelopeAndExit(envelope, exitCode);
+    return;
   }
 
-  const pillarVerdict = lifecycleVerdictFromReport(report);
-  const exitCode =
-    pillarVerdict === VERDICT.VERIFIED
-      ? 0
-      : exitCodeFromVerdict(pillarVerdict, { partial: pillarVerdict === VERDICT.NOT_VERIFIED });
+  displayLifecycleReportTTY(result.systemKey, report, {
+    details: opts.verbose,
+    openApiPublished: result.openApiPublished === true,
+    certificationProgress: result.certificationProgress ?? null,
+    dataplaneUrl: result.dataplaneUrl ?? null,
+    dataplaneUiBaseUrl: result.dataplaneUiBaseUrl ?? null
+  });
   if (exitCode !== 0) {
     process.exit(exitCode);
   }

package/lib/commands/login-credentials.js

@@ -15,6 +15,7 @@ const { getToken } = require('../api/auth.api');
 const { formatApiError } = require('../utils/api-error-handler');
 const { loadClientCredentials } = require('../utils/token-manager');
 const logger = require('../utils/logger');
+const { writeStreamAndWait } = require('../utils/write-stream-and-wait');
 
 /**
  * Tries to load credentials from secrets file
@@ -136,7 +137,7 @@ function handleLoginError(response, appName) {
  * @param {Object} response - API response
  * @returns {Object} Token data object
  */
-function extractTokenData(response) {
+async function extractTokenData(response) {
   // OpenAPI spec response: { success: boolean, token: string, expiresIn: number, expiresAt: string, ... }
   // Handle both flat and nested response structures (some APIs wrap in data field)
   // If response.data exists, use it; otherwise use response directly
@@ -146,7 +147,10 @@ function extractTokenData(response) {
   if (!responseData || !responseData.token) {
     logger.error(formatBlockingError('Invalid response: missing token'));
     if (responseData) {
-      logger.error(chalk.gray(`Response structure: ${JSON.stringify(responseData, null, 2)}`));
+      await writeStreamAndWait(
+        process.stderr,
+        `${chalk.gray(`Response structure: ${JSON.stringify(responseData, null, 2)}`)}\n`
+      );
     }
     process.exit(1);
   }
@@ -190,9 +194,10 @@ async function handleCredentialsLogin(controllerUrl, appName, clientId, clientSe
 
   if (!response.success) {
     handleLoginError(response, appName);
+    return;
   }
 
-  const responseData = extractTokenData(response);
+  const responseData = await extractTokenData(response);
   const expiresAt = calculateTokenExpiration(responseData);
 
   return {

package/lib/commands/login-device.js

@@ -15,6 +15,7 @@ const ora = require('ora');
 const { setCurrentEnvironment, saveDeviceToken, setControllerUrl } = require('../core/config');
 const { initiateDeviceCodeFlow } = require('../api/auth.api');
 const { pollDeviceCodeToken, displayDeviceCodeInfo } = require('../utils/api');
+const { resolveDeviceVisitUrl } = require('../utils/device-code');
 const logger = require('../utils/logger');
 const { formatSuccessLine } = require('../utils/cli-layout-chalk');
 
@@ -42,6 +43,10 @@ async function getEnvironmentKey(environment) {
     return envKey;
   }
 
+  if (!process.stdin || process.stdin.isTTY === false) {
+    return 'dev';
+  }
+
   const envPrompt = await inquirer.prompt([{
     type: 'input',
     name: 'environment',
@@ -255,10 +260,8 @@ function logDeviceFlowError(deviceError, opts) {
 }
 
 function printCompactDeviceUrl(deviceCodeResponse) {
-  const visitUrl =
-    deviceCodeResponse.verification_uri_complete ||
-    `${deviceCodeResponse.verification_uri}?user_code=${deviceCodeResponse.user_code}`;
-  logger.log('\nOpen browser to authenticate:');
+  const visitUrl = resolveDeviceVisitUrl(deviceCodeResponse);
+  logger.log('\nOpen this URL to authenticate:');
   logger.log(chalk.yellow(`${visitUrl}\n`));
 }
 
@@ -289,7 +292,13 @@ async function handleDeviceCodeLogin(controllerUrl, environment, online, scope,
     const deviceCodeResponse = convertDeviceCodeResponse(apiResponse);
 
     if (!opts.compact) {
-      displayDeviceCodeInfo(deviceCodeResponse.user_code, deviceCodeResponse.verification_uri, logger, chalk);
+      displayDeviceCodeInfo(
+        deviceCodeResponse.user_code,
+        deviceCodeResponse.verification_uri,
+        logger,
+        chalk,
+        deviceCodeResponse.verification_uri_complete
+      );
     } else {
       printCompactDeviceUrl(deviceCodeResponse);
     }

package/lib/commands/login.js

@@ -16,9 +16,13 @@ const { setCurrentEnvironment, saveClientToken, setControllerUrl } = require('..
 const logger = require('../utils/logger');
 const { handleCredentialsLogin } = require('./login-credentials');
 const { handleDeviceCodeLogin } = require('./login-device');
-const { resolveControllerUrl } = require('../utils/controller-url');
+const { resolveControllerUrl, discoverControllerBaseUrl } = require('../utils/controller-url');
 const { tryRefreshDataplaneVersionAfterLogin } = require('./auth-status-dataplane-version');
 
+function isInteractiveStdin() {
+  return Boolean(process.stdin && process.stdin.isTTY);
+}
+
 /**
  * Determine and validate authentication method
  * @async
@@ -34,6 +38,10 @@ async function determineAuthMethod(method) {
     return method;
   }
 
+  if (!isInteractiveStdin()) {
+    return 'device';
+  }
+
   const authMethod = await inquirer.prompt([{
     type: 'list',
     name: 'method',
@@ -86,6 +94,8 @@ async function normalizeControllerUrl(options) {
     controllerUrl = await resolveControllerUrl();
   }
   controllerUrl = String(controllerUrl).trim().replace(/\/+$/, '');
+  const inputUrl = controllerUrl;
+  controllerUrl = await discoverControllerBaseUrl(controllerUrl);
   if (!options.skipControllerUrlPersist) {
     const persistUrl = options.tokenControllerUrl
       ? String(options.tokenControllerUrl).trim().replace(/\/+$/, '')
@@ -93,6 +103,9 @@ async function normalizeControllerUrl(options) {
     await setControllerUrl(persistUrl);
   }
   if (!options.compact) {
+    if (controllerUrl !== inputUrl) {
+      logger.log(chalk.gray(`Using controller ${controllerUrl}`));
+    }
     logger.log(chalk.gray(`Controller URL: ${controllerUrl}`));
   }
   return controllerUrl;