@descix/cli 1.0.1 → 1.0.4

package/lib/oauth-client.js

@@ -0,0 +1,164 @@
+/**
+ * DeSciX CLI OAuth client — WS-HEADLESS-MVP-A1
+ * (mcp-oauth-longlived-tokens-design-2026-06-30.md §2.1/§2.2)
+ *
+ * The gcloud-ADC-style long-lived credential layer for the CLI/MCP:
+ *   - PKCE S256 pair generation (binds code redemption to THIS process)
+ *   - Dynamic Client Registration (RFC 7591) for the CLI public client
+ *   - authorization_code redemption (the device→OAuth bridge hands the code
+ *     back through device_check_status — no browser redirect surface)
+ *   - refresh_token grant (silent refresh; the AS rotates on use)
+ *   - RFC 7009 revocation (descix logout)
+ *
+ * These are the OAuth AS's OWN HTTP endpoints (/oauth/*), NOT /apifront commands —
+ * the CLI POSTs to them directly, exactly as any OAuth client would (design §5:
+ * "CLI-is-HTTP-only — the CLI just POSTs to /oauth/token"). Everything else in the
+ * CLI still routes /apifront/ via DeSciXApiClient.
+ */
+
+import crypto from 'crypto';
+import axios from 'axios';
+
+/** OOB redirect URI for the CLI public client — the bridge returns the code via the
+ *  device-status poll, never via redirect, but the OAuth records still carry a
+ *  registered redirect_uri which redemption must echo (RFC 6749 §4.1.3). */
+export const OOB_REDIRECT_URI = 'urn:ietf:wg:oauth:2.0:oob';
+
+/** Default scope requested by `descix login`. The scope is a CEILING, not a grant:
+ *  write/admin are honored only on internal-posture deployments and, even there, the
+ *  server's checkCommandPermission decides per-user. On public deployments the wider
+ *  scopes are inert by construction (design §2.3). */
+export const DEFAULT_OAUTH_SCOPE = 'mcp:read mcp:tools mcp:write mcp:admin';
+
+/** Generate a PKCE S256 verifier/challenge pair. */
+export function generatePkcePair() {
+  const verifier = crypto.randomBytes(32).toString('base64url');
+  const challenge = crypto.createHash('sha256').update(verifier).digest('base64url');
+  return { verifier, challenge };
+}
+
+/** Shared axios config for the AS endpoints (self-signed local dev handling
+ *  mirrors DeSciXApiClient). */
+async function axiosConfigFor(baseUrl) {
+  const config = { timeout: 30000, validateStatus: () => true };
+  if (baseUrl.includes('localhost') || baseUrl.includes('127.0.0.1')) {
+    const https = await import('https');
+    config.httpsAgent = new https.Agent({ rejectUnauthorized: false });
+  }
+  return config;
+}
+
+/**
+ * Register the CLI as an OAuth public client (RFC 7591 DCR).
+ * @returns {Promise<string>} client_id
+ */
+export async function registerOAuthClient(baseUrl, { clientName = 'descix-cli' } = {}) {
+  const config = await axiosConfigFor(baseUrl);
+  const resp = await axios.post(`${baseUrl}/oauth/register`, {
+    client_name: clientName,
+    redirect_uris: [OOB_REDIRECT_URI],
+    grant_types: ['authorization_code', 'refresh_token'],
+    response_types: ['code'],
+    token_endpoint_auth_method: 'none',
+  }, config);
+  if (resp.status !== 201 || !resp.data?.client_id) {
+    throw new Error(`OAuth client registration failed (HTTP ${resp.status}): ${JSON.stringify(resp.data)}`);
+  }
+  return resp.data.client_id;
+}
+
+/** POST /oauth/token — shared form-encoded grant helper. */
+async function tokenGrant(baseUrl, form) {
+  const config = await axiosConfigFor(baseUrl);
+  config.headers = { 'Content-Type': 'application/x-www-form-urlencoded' };
+  const resp = await axios.post(`${baseUrl}/oauth/token`, new URLSearchParams(form).toString(), config);
+  if (resp.status !== 200 || !resp.data?.access_token) {
+    const err = new Error(`OAuth token grant '${form.grant_type}' failed (HTTP ${resp.status}): ` +
+      `${resp.data?.error || 'unknown'} — ${resp.data?.error_description || JSON.stringify(resp.data)}`);
+    err.oauthError = resp.data?.error || null;
+    err.httpStatus = resp.status;
+    throw err;
+  }
+  return resp.data; // { access_token, token_type, expires_in, refresh_token, scope }
+}
+
+/**
+ * Redeem the device-bridge authorization code (PKCE) for the token pair.
+ * @returns {Promise<Object>} { access_token, expires_in, refresh_token, scope }
+ */
+export async function redeemAuthorizationCode(baseUrl, { code, clientId, codeVerifier }) {
+  return tokenGrant(baseUrl, {
+    grant_type: 'authorization_code',
+    code,
+    redirect_uri: OOB_REDIRECT_URI,
+    client_id: clientId,
+    code_verifier: codeVerifier,
+  });
+}
+
+/**
+ * Silent refresh (gcloud-ADC analogue). The AS ROTATES the refresh token on use —
+ * callers MUST persist BOTH returned tokens or the next refresh trips reuse-detection
+ * and revokes the whole chain.
+ * @returns {Promise<Object>} { access_token, expires_in, refresh_token, scope }
+ */
+export async function refreshOAuthTokens(baseUrl, { refreshToken, clientId }) {
+  return tokenGrant(baseUrl, {
+    grant_type: 'refresh_token',
+    refresh_token: refreshToken,
+    client_id: clientId,
+  });
+}
+
+/**
+ * RFC 7009 revocation (used by `descix logout`). 200 is returned even for
+ * unknown tokens; only a transport/server failure throws.
+ */
+export async function revokeOAuthToken(baseUrl, { token, clientId }) {
+  const config = await axiosConfigFor(baseUrl);
+  config.headers = { 'Content-Type': 'application/x-www-form-urlencoded' };
+  const resp = await axios.post(`${baseUrl}/oauth/revoke`, new URLSearchParams({
+    token,
+    token_type_hint: 'refresh_token',
+    ...(clientId ? { client_id: clientId } : {}),
+  }).toString(), config);
+  if (resp.status !== 200) {
+    throw new Error(`OAuth revocation failed (HTTP ${resp.status}): ${JSON.stringify(resp.data)}`);
+  }
+  return true;
+}
+
+/**
+ * Build the persisted `oauth` credential block for wallet.json from a token response.
+ * Single shape owner — ensureSession/login/logout all consume this contract.
+ */
+export function buildOAuthCredentialBlock({ clientId, tokens, tokenEndpointBase, scope }) {
+  return {
+    client_id: clientId,
+    access_token: tokens.access_token,
+    access_token_expires_at: new Date(Date.now() + (tokens.expires_in * 1000)).toISOString(),
+    refresh_token: tokens.refresh_token,
+    scope: tokens.scope || scope || null,
+    token_endpoint: `${tokenEndpointBase}/oauth/token`,
+  };
+}
+
+/** Is the cached OAuth access token still fresh (with clock-skew margin)? */
+export function isOAuthAccessTokenFresh(oauthBlock, skewMs = 60000) {
+  if (!oauthBlock?.access_token || !oauthBlock?.access_token_expires_at) return false;
+  const expiresAt = Date.parse(oauthBlock.access_token_expires_at);
+  if (Number.isNaN(expiresAt)) return false;
+  return (expiresAt - Date.now()) > skewMs;
+}
+
+export default {
+  OOB_REDIRECT_URI,
+  DEFAULT_OAUTH_SCOPE,
+  generatePkcePair,
+  registerOAuthClient,
+  redeemAuthorizationCode,
+  refreshOAuthTokens,
+  revokeOAuthToken,
+  buildOAuthCredentialBlock,
+  isOAuthAccessTokenFresh,
+};

package/lib/origin.js

@@ -0,0 +1,143 @@
+/**
+ * THE ONE OWNER OF "which DeSciX origin does this invocation talk to, and who chose it".
+ *
+ * WHY (measured 2026-08-29, published @descix/cli 1.0.1): `getApiUrl()` on an unconfigured
+ * workspace returned the production origin and said NOTHING. A developer who had configured
+ * nothing and a developer who had deliberately chosen production produced byte-identical
+ * results, and the CLI then reported that origin back in agent-instruction files, in
+ * `config show`, and in the wallet it minted.
+ *
+ * THE RULE THIS ENFORCES (contract I1 as amended by (A'), rev 2, 2026-08-30):
+ *   · An unconfigured workspace resolves to the DECLARED DEFAULT, production. That is the
+ *     shipped product's target and CEO-D-2026-08-18 stands. The PROD target was never the
+ *     defect.
+ *   · SILENCE was the defect. Every resolution carries its SOURCE, and every network-bound
+ *     command PRINTS it — always, not only on the default. "Chose prod" and "chose nothing"
+ *     are distinguished by `source`, never by a null nobody sees.
+ *   · A CONFIGURED-but-invalid origin still FAILS LOUD, naming the fix. Landing on the default
+ *     is a product decision; silently discarding something the developer actually typed is not.
+ *
+ * NO SECOND SPELLING OF THE DEFAULT. The origin table has ONE owner, `@descix/app-sdk/dev`,
+ * and this module IMPORTS the production origin from it rather than writing the literal down.
+ * That is deliberate and it is load-bearing for acceptance A1: `grep` of the packed tarball for
+ * the production literal outside the one owner returns 0 because there is no second copy to
+ * find -- not even here.
+ *
+ * This file imports nothing from the CLI, so it can be consumed by `workspace-config.js`
+ * without a cycle.
+ */
+import { DEFAULT_API_URL } from '@descix/app-sdk/dev';
+
+/**
+ * The single spelling of "are these two origins the same origin" — trailing slashes and
+ * surrounding whitespace do not make an origin different.
+ *
+ * Exported because other modules compare origins against ENV_MAP and MUST use the same
+ * comparison this module resolves with; a second private copy is how the two drift.
+ *
+ * @param {string} origin
+ * @returns {string}
+ */
+export function normalizeOrigin(origin) {
+    return String(origin).trim().replace(/\/+$/, '');
+}
+
+/**
+ * Thrown when a source NAMED an origin and that origin is not usable. Carries a `code` so
+ * callers can recognise it without matching on message text.
+ *
+ * This is the loud failure I1 requires. It replaced `OriginUnresolvedError`, which fired when
+ * NOTHING was configured — a case that is no longer a failure at all under (A'), because the
+ * declared default answers it. The old error was DELETED rather than fenced: an unreachable
+ * error path kept "just in case" is the compat fence CEO-D-2026-07-26 forbids.
+ */
+export class OriginInvalidError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'OriginInvalidError';
+        this.code = 'ORIGIN_INVALID';
+    }
+}
+
+/**
+ * The resolution order, most explicit first. Each entry is [human-readable source, key].
+ * The ORDER is the contract; the array is the only place it is written down.
+ */
+const PRECEDENCE = [
+    ['DESCIX_API_URL (or --api-url / --env)', 'envVar'],
+    ['.descix/workspace.json env.apiUrl', 'workspaceEnvApiUrl'],
+    ['.descix/workspace.json apiUrl (legacy)', 'legacyApiUrl'],
+    ['~/.descix/config.json api_url', 'globalApiUrl'],
+];
+
+/** The remedy text every failure prints. One spelling, so every surface says the same thing. */
+export const ORIGIN_REMEDY =
+    'Choose one explicitly:\n' +
+    '  descix config init --env dev|demo|prod  (persists env.apiUrl in .descix/workspace.json)\n' +
+    '  descix --env dev|demo|prod <command>    (this invocation only)\n' +
+    '  export DESCIX_API_URL=https://...       (this shell only)';
+
+/**
+ * The SOURCE label for a resolution nobody configured. Exported so the printed env line, the
+ * tests and any consumer all use one spelling instead of three that drift.
+ *
+ * The wording is the contract's own (I1, rev 2): it names the state AND the one command that
+ * changes it, because a developer who reads "prod" and does not want prod needs the fix in the
+ * same line, not in a doc.
+ */
+export const DEFAULT_ORIGIN_SOURCE =
+    'default — no workspace config; `descix config init --env dev` targets DEV';
+
+/**
+ * Is this string usable as an API origin? Absolute http(s) URLs only.
+ * @param {string} value
+ * @returns {boolean}
+ */
+function isUsableOrigin(value) {
+    let parsed;
+    try {
+        parsed = new URL(String(value).trim());
+    } catch {
+        return false;
+    }
+    return parsed.protocol === 'http:' || parsed.protocol === 'https:';
+}
+
+/**
+ * Resolve the API origin from the sources a caller has in hand.
+ *
+ * @param {object} sources
+ * @param {string|null} [sources.envVar]              process.env.DESCIX_API_URL
+ * @param {string|null} [sources.workspaceEnvApiUrl]  workspace.json env.apiUrl
+ * @param {string|null} [sources.legacyApiUrl]        workspace.json top-level apiUrl
+ * @param {string|null} [sources.globalApiUrl]        ~/.descix/config.json api_url
+ * @returns {{ origin: string, source: string, isDefault: boolean }} the origin AND which source
+ *          supplied it — the source is returned because "where did this come from" is the
+ *          question every misreport in this contract failed to answer. It NEVER returns null
+ *          and it never throws for an absent configuration.
+ * @throws {OriginInvalidError} when a source NAMED an origin that cannot be used. Falling back
+ *         to the default here would silently discard what the developer typed, which is the
+ *         same class of defect from the other direction.
+ */
+export function resolveOrigin(sources = {}) {
+    for (const [label, key] of PRECEDENCE) {
+        const value = sources[key];
+        if (typeof value === 'string' && value.trim() !== '') {
+            if (!isUsableOrigin(value)) {
+                throw new OriginInvalidError(
+                    `The DeSciX API origin configured in ${label} is not a usable origin: "${String(value).trim()}".\n` +
+                    'An origin must be an absolute http(s) URL, e.g. https://dev.descix.net.\n\n' +
+                    ORIGIN_REMEDY,
+                );
+            }
+            return { origin: normalizeOrigin(value), source: label, isDefault: false };
+        }
+    }
+    // Nothing was configured. That is not a failure — it is the shipped product's declared
+    // target, and the caller is required to PRINT that it landed here.
+    return {
+        origin: normalizeOrigin(DEFAULT_API_URL),
+        source: DEFAULT_ORIGIN_SOURCE,
+        isDefault: true,
+    };
+}

package/lib/service-api-client.js

@@ -0,0 +1,95 @@
+/**
+ * Service-context DeSciX api-client — the CLI's REST api-client, packaged for reuse inside
+ * an APP MICROSERVICE running in the cloud.
+ *
+ * AUTH MODEL (CEO-D-2026-06-02-APP-MICROSERVICE-IS-CLI-CLIENT-WALLET-SIG):
+ *   "An app microservice is just THE CLI's REST api-client running in the cloud." It
+ *   authenticates to /apifront EXACTLY like the CLI does — it holds the DEVELOPER'S OWN
+ *   durable credential (wallet_address + the `signature` from .descix/wallet.json), presents
+ *   it to `reconnect_by_wallet` to mint a session access_token, and makes /apifront calls AS
+ *   THE DEVELOPER. There is NO new apifront auth path: this is the existing CLI wallet-signature
+ *   -> session path (api-client buildRequestBody + ensureSession -> reconnect_by_wallet).
+ *   NO SA-OIDC, NO delegate signature / X-NFT-ID / SERVICE_KEY, NO Signer, NO OWNER_SIGNATURE.
+ *
+ * Difference from the CLI: a Cloud Run service has no `.descix/wallet.json` and no TTY. So:
+ *   - the developer credential is supplied EXPLICITLY (read from the service's config — the
+ *     GITIGNORED dev-overrides.json in dev / a SECRET in prod, NEVER checked-in
+ *     defaults-config.json, because the signature is a credential), and
+ *   - on a session-refresh failure it HARD-FAILS (serviceMode) — it never tries interactive
+ *     device login.
+ *
+ * The credential is the developer's own / their responsibility (their API call), same risk
+ * profile as wallet.json. HARD-FAIL (no fallback) if wallet_address or signature is absent.
+ */
+
+import { DeSciXApiClient } from './api-client.js';
+
+/**
+ * Build a headless service-context api-client bound to a Core broker URL and the developer's
+ * durable wallet credential.
+ *
+ * @param {object} cfg
+ * @param {string} cfg.baseUrl       - Core broker base URL (e.g. utils.CORE_API_URL). The
+ *                                      api-client appends `/apifront/`. Required.
+ * @param {string} cfg.walletAddress - The developer's wallet address. Required.
+ * @param {string} cfg.signature     - The developer's durable `signature` (from their
+ *                                      .descix/wallet.json). Required.
+ * @param {string} [cfg.userId]      - Optional developer user_id (resolved by reconnect_by_wallet
+ *                                      if omitted).
+ * @returns {{ client: DeSciXApiClient, invoke: (command: string, params?: object) => Promise<any> }}
+ *          `client` is the underlying api-client; `invoke(command, params)` returns Core's
+ *          `message` payload (the same shape `fetchAppAsset`'s invoker expects).
+ */
+export function createServiceApiClient({ baseUrl, walletAddress, signature, userId } = {}) {
+  // The api-client appends `/apifront/`; accept either a bare origin or a `.../apifront` URL
+  // and normalize to the origin so we never double-append.
+  if (!baseUrl || typeof baseUrl !== 'string') {
+    throw new Error(
+      'createServiceApiClient: baseUrl is required (the Core broker URL, e.g. utils.CORE_API_URL). No fallback.'
+    );
+  }
+  if (!walletAddress || typeof walletAddress !== 'string') {
+    throw new Error(
+      'createServiceApiClient: walletAddress is required — the developer credential. Put it in the ' +
+      'GITIGNORED dev-overrides.json (dev) / a secret (prod), never defaults-config.json. No fallback.'
+    );
+  }
+  if (!signature || typeof signature !== 'string') {
+    throw new Error(
+      'createServiceApiClient: signature is required — the developer durable credential (from their ' +
+      '.descix/wallet.json). Put it in the GITIGNORED dev-overrides.json (dev) / a secret (prod), ' +
+      'never defaults-config.json. No fallback.'
+    );
+  }
+
+  const origin = baseUrl.replace(/\/apifront\/?$/, '').replace(/\/$/, '');
+
+  const client = new DeSciXApiClient({ baseUrl: origin, serviceMode: true });
+  // Provide the developer credential directly — NO wallet-file / workspace walk in a service.
+  client.setCredentials({
+    userId: userId || null,
+    accessToken: null,            // minted on first call via reconnect_by_wallet
+    walletAddress,
+    signature,
+    communityId: null,
+    tokenSymbol: null,
+  });
+  // Mark initialized so the client never tries to discover a workspace/wallet on disk.
+  client._initialized = true;
+
+  /**
+   * Invoke a Core command AS the developer. Returns Core's `message` payload on success
+   * (matching the meshLoopback/fetchAppAsset contract it replaces).
+   */
+  async function invoke(command, params = {}) {
+    if (!command || typeof command !== 'string') {
+      throw new Error('serviceApiClient.invoke: command (string) is required.');
+    }
+    const data = await client.invoke(command, params);
+    return data?.message ?? data;
+  }
+
+  return { client, invoke };
+}
+
+export default createServiceApiClient;

package/lib/wallet-environment.js

@@ -0,0 +1,49 @@
+/**
+ * THE ONE OWNER OF "which environment was this credential obtained against".
+ *
+ * WHY (measured 2026-08-29): wallet.json carries no environment field at all, so a DEV
+ * credential is byte-indistinguishable from a PROD one. Nothing downstream can tell a developer
+ * that the session in their workspace was minted somewhere other than where they are pointing.
+ *
+ * SCOPE — WRITE ONLY, DELIBERATELY. This module RECORDS the origin a wallet was obtained
+ * against. It does NOT refuse a mismatched wallet, and nothing here should grow into a check.
+ * Enforcement needs a migration story for every wallet already on disk WITHOUT this field
+ * (they are all of them, today), and shipping half an enforcement inside a publish is how a
+ * guard that fires on correct code gets born. Enforcement is a separate row.
+ *
+ * The environment NAME comes from `environment-report.js::environmentNameFor` — the one owner
+ * of that derivation, shared with the printed env line — so this file holds no second copy of
+ * either the origin table or the matching rule.
+ */
+// The origin -> env-name derivation used to live in this file. It now has ONE owner, consumed
+// here and by the printed env line, because two derivations of one fact is the mirror drift
+// this contract exists to end.
+import { environmentNameFor } from './environment-report.js';
+import { normalizeOrigin } from './origin.js';
+
+/**
+ * The environment stamp to persist alongside a freshly obtained credential.
+ *
+ * @param {string} apiUrl - the origin the credential was actually obtained against
+ *                          (i.e. `apiClient.baseUrl` at the moment of the exchange)
+ * @returns {{ apiUrl: string, environment: string }} `environment` is the ENV_MAP name whose
+ *          url matches (`dev` | `demo` | `prod`), or `'custom'` when the origin is a real one
+ *          that simply is not in the map — a self-hosted or port-forwarded gateway.
+ *
+ * @throws when called with no origin. There is no default: guessing which environment a
+ *         credential came from is exactly the misreport this contract exists to end, and every
+ *         caller has the origin in hand.
+ */
+export function walletEnvironmentStamp(apiUrl) {
+    if (!apiUrl || String(apiUrl).trim() === '') {
+        throw new Error(
+            'walletEnvironmentStamp: refusing to stamp a credential with no origin — ' +
+            'the environment a wallet was obtained against cannot be guessed.',
+        );
+    }
+
+    return {
+        apiUrl: normalizeOrigin(apiUrl),
+        environment: environmentNameFor(apiUrl),
+    };
+}

package/lib/wallet-file.js

@@ -37,7 +37,15 @@ export class WalletFileManager {
     try {
       const data = await fs.readFile(walletPath, 'utf-8');
       const walletData = JSON.parse(data);
-      
+
+      // WS-HEADLESS-MVP-A1 §2.5 (parent plan §10.4) — API_KEY is the vocabulary-aligned
+      // ALIAS of the wallet signature (the durable headless bearer credential). Alias-only
+      // (CEO §7 Q4): `signature` stays canonical on disk; a file authored with only
+      // API_KEY is normalized on read.
+      if (walletData && walletData.API_KEY && !walletData.signature) {
+        walletData.signature = walletData.API_KEY;
+      }
+
       if (this.validateWalletFile(walletData)) {
         return walletData;
       } else {
@@ -66,13 +74,19 @@ export class WalletFileManager {
         throw new Error('Invalid wallet data structure');
       }
 
+      // WS-HEADLESS-MVP-A1 §2.5 — keep the API_KEY alias mirrored to the canonical
+      // signature so the on-disk file self-documents the alias (alias-only rename).
+      if (walletData.signature) {
+        walletData.API_KEY = walletData.signature;
+      }
+
       // Ensure directory exists
       const dir = path.dirname(walletPath);
       await fs.mkdir(dir, { recursive: true });
 
       // Write file with restricted permissions (600)
       await fs.writeFile(walletPath, JSON.stringify(walletData, null, 2), { mode: 0o600 });
-      
+
       return true;
     } catch (error) {
       console.error(`[WalletFile] Error saving wallet file: ${error.message}`);

package/lib/wizard/setup.js

@@ -22,6 +22,7 @@ import chalk from 'chalk';
 import ora from 'ora';
 import inquirer from 'inquirer';
 import { DeSciXApiClient } from '../api-client.js';
+import { ENV_ORIGINS } from '@descix/app-sdk/dev';
 import { requireAuth, isAuthenticated } from '../auth-guard.js';
 import * as authCommands from '../commands/auth.js';
 import * as fs from 'fs/promises';
@@ -116,7 +117,7 @@ async function generateRulesFile(workspacePath, entitlements, primaryCommunity)
     // Customize with workspace-specific values
     const customized = template
       .replace(/\{\{SDK_ASSETS_PATH\}\}/g, '.descix/sdk-assets')
-      .replace(/\{\{PRIMARY_COMMUNITY\}\}/g, primaryCommunity || 'descix')
+      .replace(/\{\{PRIMARY_COMMUNITY\}\}/g, primaryCommunity || 'daita')
       .replace(/\{\{ENTITLEMENTS_JSON\}\}/g, JSON.stringify(entitlementsSummary, null, 2))
       .replace(/\{\{SDK_VERSION\}\}/g, SDK_VERSION)
       .replace(/\{\{WORKSPACE_PATH\}\}/g, workspacePath);
@@ -148,7 +149,7 @@ async function autoRegisterSdkService(apiClient) {
     // Vectorize for tell_me_how discovery
     await apiClient.invoke('vectorize_service_readme', {
       service_name: 'sdk',
-      community_id: 'descix',
+      community_id: 'daita',
       app_id: 'docs',
       readme_content: readmeContent
     });
@@ -216,7 +217,7 @@ export async function runSetupWizard(options = {}) {
           name: 'environment',
           message: 'Which environment are you connecting to?',
           choices: [
-            { name: 'Production (app.descix.net)', value: 'production' },
+            { name: `Production (${ENV_ORIGINS.prod})`, value: 'production' },
             { name: 'Local Development (localhost:4000)', value: 'local' },
             { name: 'Custom URL', value: 'custom' }
           ],
@@ -225,7 +226,7 @@ export async function runSetupWizard(options = {}) {
       ]);
       
       if (environment === 'production') {
-        apiUrl = 'https://descix.net';
+        apiUrl = ENV_ORIGINS.prod;
       } else if (environment === 'local') {
         apiUrl = 'https://localhost:4000';
       } else {
@@ -348,9 +349,9 @@ export async function runSetupWizard(options = {}) {
     }
 
     // Derive primary community from entitlements
-    let primaryCommunity = 'descix';
+    let primaryCommunity = 'daita';
     if (entitlements.communities.length > 0) {
-      primaryCommunity = entitlements.communities[0].community_id || entitlements.communities[0].id || 'descix';
+      primaryCommunity = entitlements.communities[0].community_id || entitlements.communities[0].id || 'daita';
     }
 
     // Step 4: MCP Configuration
@@ -443,7 +444,7 @@ export async function runSetupWizard(options = {}) {
       additionalContexts: [],
       defaultContext: {
         communityId: primaryCommunity,
-        appId: 'agent',
+        appId: 'daita',
         kbId: 'General'
       },
       apiUrl: apiUrl,
@@ -490,8 +491,8 @@ export async function runSetupWizard(options = {}) {
     console.log(chalk.white('If MCP fails, use CLI directly:'));
     console.log(chalk.gray('  descix purchases              # View your entitlements'));
     console.log(chalk.gray('  descix tell-me-how "question" # Discover tools'));
-    console.log(chalk.gray('  descix sync assets -c X -a Y  # Sync app assets'));
-    console.log(chalk.gray('  descix sync kb -c X -a Y      # Sync knowledge base\n'));
+    console.log(chalk.gray('  descix app sync-assets -a Y   # Sync app assets'));
+    console.log(chalk.gray('  descix kb corpus sync -a Y    # Sync knowledge base\n'));
 
   } catch (error) {
     spinner.fail('Setup failed');