@keystrokehq/cli 0.0.1 → 0.0.3

package/AGENTS-blurb.md

@@ -23,7 +23,7 @@ Triggers, tasks, and agent conversations are different entry models:
 
 Keystroke also has one shared unit-of-work primitive: `Operation`.
 
-- `Operation`, `Step`, and `Tool` are aliases for the same class from `@keystroke/workflow-core`.
+- `Operation`, `Step`, and `Tool` are aliases for the same class from `@keystrokehq/core`.
 - Use the `Step` name when teaching workflow-side usage.
 - Use the `Tool` name when teaching agent-side usage.
 - Use the `Operation` name when describing shared infrastructure, integrations, or a reusable unit that can be used in both places.

package/LICENSE

@@ -19,24 +19,3 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
-MIT License
-
-Copyright (c) Keystroke
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/README.md

@@ -66,7 +66,7 @@ For automation, you can provide credentials through environment variables or roo
 
 ```bash
 KEYSTROKE_API_KEY=sk_... keystroke deploy
-keystroke --api-key sk_... --base-url https://api.example.com workflows list
+keystroke --api-key sk_... --server-url https://api.example.com workflows list
 ```
 
 ## Common Commands
@@ -129,12 +129,20 @@ keystroke test tool <tool-name> --agent <agent-id-or-name> --input-file ./input.
 
 ## Configuration
 
-The CLI reads configuration from, in order:
+`keystroke auth` works out of the box against the hosted Keystroke service:
 
-1. Command-line flags such as `--api-key`, `--base-url`, `--org`, and command-specific options.
-2. Environment variables such as `KEYSTROKE_API_KEY`, `SERVER_URL`, `WEB_URL`, and `KEYSTROKE_ORG_ID`.
-3. Credentials saved by `keystroke auth`.
-4. Project configuration in `keystroke.config.ts`.
+- Web URL: `https://keystroke.ai`
+- API URL: `https://api.kestroke.ai`
+
+Use `WEB_URL` / `SERVER_URL` or the `--web-url` / `--server-url` flags when pointing the CLI at a local, staging, or preview environment.
+
+The relevant configuration sources are:
+
+- Command-line flags such as `--api-key`, `--server-url`, `--org`, and command-specific options.
+- Environment variables such as `KEYSTROKE_API_KEY`, `SERVER_URL`, `WEB_URL`, and `KEYSTROKE_ORG_ID`.
+- Credentials saved by `keystroke auth`.
+- Built-in hosted URL defaults for web/API endpoints.
+- Project configuration in `keystroke.config.ts`.
 
 Use `--debug` on any command to show diagnostic output.
 

package/dist/accept.handler-DFtM0IuO.mjs

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+
+import { t as ui } from "./keystroke.mjs";
+import { i as writeJson } from "./output-q4KljAhu.mjs";
+import { i as requireClient } from "./context-Y1f1hGYy.mjs";
+import { n as isIamJsonMode, t as handleIamError } from "./iam-command-utils-CNC8JfZ5.mjs";
+//#region src/commands/invites/accept.handler.ts
+async function handleInvitesAccept(options, ctx) {
+	const client = requireClient(ctx);
+	try {
+		const result = await client.users.invites.accept(options.inviteId);
+		if (isIamJsonMode(options, ctx)) {
+			writeJson(result);
+			return;
+		}
+		ui.success(`Joined organization ${result.membership.organizationId} as ${result.membership.role}`);
+	} catch (error) {
+		await handleIamError(error, ctx, "Failed to accept invite");
+	}
+}
+//#endregion
+export { handleInvitesAccept };

package/dist/admin-D_7tenRC.mjs

@@ -0,0 +1,208 @@
+#!/usr/bin/env node
+
+import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-q4KljAhu.mjs";
+import { t as createTypedCommand } from "./commander-DZ3F3CVq.mjs";
+import { t as OrgRoleSchema } from "./schema-_FQrHcIS.mjs";
+import { z } from "zod";
+//#region src/commands/admin/orgs.command.ts
+const AdminOrgsCreateOptionsSchema = JsonOptionSchema.extend({ name: z.string().min(1) });
+const CREATE_OPTIONS_CONFIG = {
+	...JSON_OPTION_CONFIG,
+	name: {
+		flag: "--name <name>",
+		description: "Organization name"
+	}
+};
+const AdminOrgsListOptionsSchema = JsonOptionSchema;
+const AdminOrgsGetOptionsSchema = JsonOptionSchema.extend({ orgId: z.string().min(1) });
+const GET_OPTIONS_CONFIG$1 = {
+	...JSON_OPTION_CONFIG,
+	orgId: {
+		flag: "",
+		description: ""
+	}
+};
+function createAdminOrgsCommand() {
+	return createTypedCommand({
+		name: "orgs",
+		description: "Manage organizations as a platform admin",
+		schema: AdminOrgsListOptionsSchema,
+		optionsConfig: { ...JSON_OPTION_CONFIG },
+		loadHandler: async () => (await import("./orgs.list.handler-D-ptz8It.mjs")).handleAdminOrgsList,
+		subcommands: [
+			createTypedCommand({
+				name: "create",
+				description: "Create an organization (requires system.create_org)",
+				schema: AdminOrgsCreateOptionsSchema,
+				optionsConfig: CREATE_OPTIONS_CONFIG,
+				loadHandler: async () => (await import("./orgs.create.handler-swGnT2ce.mjs")).handleAdminOrgsCreate
+			}),
+			createTypedCommand({
+				name: "list",
+				description: "List organizations (requires system.view_orgs)",
+				schema: AdminOrgsListOptionsSchema,
+				optionsConfig: { ...JSON_OPTION_CONFIG },
+				loadHandler: async () => (await import("./orgs.list.handler-D-ptz8It.mjs")).handleAdminOrgsList
+			}),
+			createTypedCommand({
+				name: "get",
+				description: "Get organization details (requires system.view_orgs)",
+				schema: AdminOrgsGetOptionsSchema,
+				optionsConfig: GET_OPTIONS_CONFIG$1,
+				argument: {
+					name: "org-id",
+					description: "Organization ID",
+					key: "orgId"
+				},
+				loadHandler: async () => (await import("./orgs.get.handler-ClAqYTH0.mjs")).handleAdminOrgsGet
+			})
+		]
+	});
+}
+const OrgActionSchema = z.enum([
+	"org.manage",
+	"org.manage_members",
+	"org.manage_billing",
+	"org.view_billing",
+	"org.create_project",
+	"org.create_user_group",
+	"org.manage_api_keys",
+	"user_group.edit",
+	"user_group.delete",
+	"user_group.manage_members"
+]);
+const ResourceTypeSchema = z.enum([
+	"workflow",
+	"agent",
+	"trigger",
+	"credential_set",
+	"project"
+]);
+z.enum([
+	"user",
+	"user_group",
+	"public"
+]);
+const GrantPermissionSchema = z.enum([
+	"view",
+	"execute",
+	"edit",
+	"admin"
+]);
+const UserRoleSchema = z.enum(["user", "admin"]);
+const UserBaseSchema = z.object({
+	email: z.email(),
+	name: z.string().min(2).max(255),
+	role: UserRoleSchema.default("user")
+});
+UserBaseSchema.extend({
+	id: z.uuid(),
+	createdAt: z.date()
+});
+/**
+* Direct resource grant the signed-in user has on a specific resource. Used
+* by `GET /api/v1/users/me` to surface per-resource access alongside roles.
+*/
+const UserResourceGrantSchema = z.object({
+	resourceType: ResourceTypeSchema,
+	resourceId: z.string(),
+	permission: GrantPermissionSchema,
+	organizationId: z.uuid()
+});
+UserBaseSchema.extend({
+	id: z.uuid(),
+	createdAt: z.iso.datetime(),
+	organizations: z.array(z.object({
+		id: z.string(),
+		name: z.string(),
+		role: OrgRoleSchema,
+		actionGrants: z.array(OrgActionSchema).optional()
+	})),
+	resourceGrants: z.array(UserResourceGrantSchema).optional()
+});
+//#endregion
+//#region src/commands/admin/users.command.ts
+const AdminUsersListOptionsSchema = JsonOptionSchema;
+const AdminUsersGetOptionsSchema = JsonOptionSchema.extend({ userId: z.string().min(1) });
+const GET_OPTIONS_CONFIG = {
+	...JSON_OPTION_CONFIG,
+	userId: {
+		flag: "",
+		description: ""
+	}
+};
+const AdminUsersSetRoleOptionsSchema = JsonOptionSchema.extend({
+	userId: z.string().min(1),
+	role: UserRoleSchema,
+	confirm: z.boolean().optional()
+});
+const SET_ROLE_OPTIONS_CONFIG = {
+	...JSON_OPTION_CONFIG,
+	userId: {
+		flag: "",
+		description: ""
+	},
+	role: {
+		flag: "--role <role>",
+		description: "System role: user or admin"
+	},
+	confirm: {
+		flag: "--confirm",
+		description: "Confirm system-role change"
+	}
+};
+function createAdminUsersCommand() {
+	return createTypedCommand({
+		name: "users",
+		description: "Manage platform users",
+		schema: AdminUsersListOptionsSchema,
+		optionsConfig: { ...JSON_OPTION_CONFIG },
+		loadHandler: async () => (await import("./users.list.handler-DXAsO8Yk.mjs")).handleAdminUsersList,
+		subcommands: [
+			createTypedCommand({
+				name: "list",
+				description: "List platform users",
+				schema: AdminUsersListOptionsSchema,
+				optionsConfig: { ...JSON_OPTION_CONFIG },
+				loadHandler: async () => (await import("./users.list.handler-DXAsO8Yk.mjs")).handleAdminUsersList
+			}),
+			createTypedCommand({
+				name: "get",
+				description: "Get platform user details",
+				schema: AdminUsersGetOptionsSchema,
+				optionsConfig: GET_OPTIONS_CONFIG,
+				argument: {
+					name: "user-id",
+					description: "User ID",
+					key: "userId"
+				},
+				loadHandler: async () => (await import("./users.get.handler-C_d2GWKX.mjs")).handleAdminUsersGet
+			}),
+			createTypedCommand({
+				name: "set-role",
+				description: "Set a platform system role",
+				schema: AdminUsersSetRoleOptionsSchema,
+				optionsConfig: SET_ROLE_OPTIONS_CONFIG,
+				argument: {
+					name: "user-id",
+					description: "User ID",
+					key: "userId"
+				},
+				loadHandler: async () => (await import("./users.set-role.handler-Bn_yV4RI.mjs")).handleAdminUsersSetRole
+			})
+		]
+	});
+}
+//#endregion
+//#region src/commands/admin/admin.command.ts
+function createAdminCommand() {
+	return createTypedCommand({
+		name: "admin",
+		description: "Platform administration commands",
+		schema: z.object({}),
+		optionsConfig: {},
+		subcommands: [createAdminOrgsCommand(), createAdminUsersCommand()]
+	});
+}
+//#endregion
+export { createAdminCommand };

package/dist/{agent-manifest-CDnbkR2f.mjs → agent-manifest-Bfa3DBgc.mjs}

@@ -101,9 +101,9 @@ const AgentRuntimeSchema = z.object({
 	placement: AgentRuntimePlacementSchema
 });
 /**
-* Mirrors `SandboxFileSourceSchema` from `@keystroke/workflow-core` so this
-* package stays free of a runtime dependency on workflow-core. Keep in sync
-* with `packages/workflow-core/src/sandbox/schemas.ts`.
+* Mirrors `SandboxFileSourceSchema` from `@keystrokehq/core` so this
+* package stays free of a runtime dependency on core. Keep in sync
+* with `packages/core/src/sandbox/schemas.ts`.
 */
 const AgentSandboxFileSourceSchema = z.discriminatedUnion("type", [z.object({
 	type: z.literal("git"),
@@ -119,7 +119,7 @@ const AgentSandboxFileSourceSchema = z.discriminatedUnion("type", [z.object({
 	target: z.string().optional()
 })]);
 /**
-* `workdir` here mirrors the workflow-core constraint: must be `/workspace`
+* `workdir` here mirrors the core constraint: must be `/workspace`
 * or a subdirectory so it lands inside the persistent bind mount.
 */
 const AgentSandboxWorkdirSchema = z.string().trim().min(1).refine((value) => value === "/workspace" || value.startsWith("/workspace/"), { error: "workdir must be \"/workspace\" or a subdirectory of \"/workspace\"" });

package/dist/{agents-CZJGxVqV.mjs → agents-DMEo-6QB.mjs}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 
 import { D as throwReportedCliExit, h as toErrorMessage, o as ANSI, s as style, t as ui } from "./keystroke.mjs";
-import { d as trackProject } from "./dist-CUK7yBM0.mjs";
-import { i as writeJson, n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-DM4b7KgY.mjs";
-import { t as createTypedCommand } from "./commander-DfTVqQ-3.mjs";
-import { i as readAgentManifestsFromOutDir } from "./dist-BkJUoBiG.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-DDJ29sCF.mjs";
-import { t as createSpinnerProgress } from "./spinner-progress-DMVwgqO9.mjs";
-import { a as runWorkflowBuild, n as renderBuildFailure } from "./workflow-build-DBQaBfnn.mjs";
-import { i as resolveTypeHint } from "./schema-display-CgmeKigW.mjs";
+import { d as trackProject } from "./dist-BF6r1hfv.mjs";
+import { i as writeJson, n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-q4KljAhu.mjs";
+import { t as createTypedCommand } from "./commander-DZ3F3CVq.mjs";
+import { i as readAgentManifestsFromOutDir } from "./dist-C2Dq_nx3.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-DgfftdPm.mjs";
+import { t as createSpinnerProgress } from "./spinner-progress-bvKd1jXc.mjs";
+import { a as runWorkflowBuild, n as renderBuildFailure } from "./workflow-build-BcaIdRR6.mjs";
+import { i as resolveTypeHint } from "./schema-display-D4A1gQEM.mjs";
 import { z } from "zod";
 //#region src/commands/agents/inspect-display.ts
 function renderAgentManifestInspect(manifest, options = {}) {

package/dist/api-keys-BThGvtdn.mjs

@@ -0,0 +1,58 @@
+#!/usr/bin/env node
+
+import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-q4KljAhu.mjs";
+import { t as createTypedCommand } from "./commander-DZ3F3CVq.mjs";
+import { z } from "zod";
+//#region src/commands/api-keys/api-keys.command.ts
+const ApiKeysCreateOptionsSchema = JsonOptionSchema.extend({ name: z.string().optional() });
+const CREATE_OPTIONS_CONFIG = {
+	...JSON_OPTION_CONFIG,
+	name: {
+		flag: "--name <name>",
+		description: "Optional API key name"
+	}
+};
+const ApiKeysDeleteOptionsSchema = z.object({ apiKeyId: z.string() });
+const DELETE_OPTIONS_CONFIG = { apiKeyId: {
+	flag: "",
+	description: ""
+} };
+function createApiKeysCommand() {
+	return createTypedCommand({
+		name: "api-keys",
+		description: "Manage API keys for your organization",
+		schema: JsonOptionSchema,
+		optionsConfig: { ...JSON_OPTION_CONFIG },
+		loadHandler: async () => (await import("./list.handler-20v4uRMk.mjs")).handleApiKeysList,
+		subcommands: [
+			createTypedCommand({
+				name: "list",
+				description: "List all API keys for your organization",
+				schema: JsonOptionSchema,
+				optionsConfig: { ...JSON_OPTION_CONFIG },
+				loadHandler: async () => (await import("./list.handler-20v4uRMk.mjs")).handleApiKeysList
+			}),
+			createTypedCommand({
+				name: "create",
+				description: "Create a new API key (raw key shown once)",
+				schema: ApiKeysCreateOptionsSchema,
+				optionsConfig: CREATE_OPTIONS_CONFIG,
+				loadHandler: async () => (await import("./create.handler-uNG3I4wS.mjs")).handleApiKeysCreate
+			}),
+			createTypedCommand({
+				name: "delete",
+				description: "Delete an API key by ID",
+				schema: ApiKeysDeleteOptionsSchema,
+				optionsConfig: DELETE_OPTIONS_CONFIG,
+				argument: {
+					name: "api-key-id",
+					description: "API key ID to delete",
+					key: "apiKeyId"
+				},
+				loadHandler: async () => (await import("./delete.handler-CJTHVZaz.mjs")).handleApiKeysDelete
+			})
+		]
+	});
+}
+//#endregion
+export { createApiKeysCommand };

package/dist/{auth-DN2VusyU.mjs → auth-CY0Gg9sN.mjs}

@@ -1,22 +1,18 @@
 #!/usr/bin/env node
 
+import { n as DEFAULT_CLI_WEB_URL } from "./default-urls-BS4twrsS.mjs";
 import { g as AUTH_TIMEOUT_SECONDS } from "./keystroke.mjs";
-import { t as createTypedCommand } from "./commander-DfTVqQ-3.mjs";
+import { t as createTypedCommand } from "./commander-DZ3F3CVq.mjs";
 import { z } from "zod";
 //#region src/commands/auth/auth.command.ts
 const AuthOptionsSchema = z.object({
 	webUrl: z.url().optional().describe("Keystroke web URL"),
-	serverUrl: z.url().optional().describe("Keystroke API URL"),
 	timeout: z.coerce.number().int().min(AUTH_TIMEOUT_SECONDS.min).max(AUTH_TIMEOUT_SECONDS.max).default(AUTH_TIMEOUT_SECONDS.default).describe("Timeout in seconds")
 });
 const AUTH_OPTIONS_CONFIG = {
 	webUrl: {
 		flag: "--web-url <url>",
-		description: "Keystroke web URL (default: WEB_URL env)"
-	},
-	serverUrl: {
-		flag: "--server-url <url>",
-		description: "Keystroke API URL (default: SERVER_URL env)"
+		description: `Keystroke web URL (default: saved credentials, WEB_URL env, or ${DEFAULT_CLI_WEB_URL})`
 	},
 	timeout: {
 		flag: "--timeout <seconds>",
@@ -29,28 +25,28 @@ function createAuthCommand() {
 		description: "Authenticate Keystroke CLI via device flow",
 		schema: AuthOptionsSchema,
 		optionsConfig: AUTH_OPTIONS_CONFIG,
-		loadHandler: async () => (await import("./auth.handler-CT1BQUvu.mjs")).handleAuth,
+		loadHandler: async () => (await import("./auth.handler-CbhiLOG1.mjs")).handleAuth,
 		subcommands: [
 			createTypedCommand({
 				name: "clear",
 				description: "Revoke the saved API key and remove local credentials",
 				schema: z.object({}),
 				optionsConfig: {},
-				loadHandler: async () => (await import("./clear.handler-BTIXXPTJ.mjs")).handleAuthClear
+				loadHandler: async () => (await import("./clear.handler-YS8gPriq.mjs")).handleAuthClear
 			}),
 			createTypedCommand({
 				name: "test",
 				description: "Verify that the saved API key is valid",
 				schema: z.object({}),
 				optionsConfig: {},
-				loadHandler: async () => (await import("./test.handler-BcPQ8b74.mjs")).handleAuthTest
+				loadHandler: async () => (await import("./test.handler-D25kziPi.mjs")).handleAuthTest
 			}),
 			createTypedCommand({
 				name: "status",
 				description: "Show the current signed-in identity and organization context",
 				schema: z.object({}),
 				optionsConfig: {},
-				loadHandler: async () => (await import("./status.handler-BO4nwvWn.mjs")).handleAuthStatus
+				loadHandler: async () => (await import("./status.handler-D9GBEmao.mjs")).handleAuthStatus
 			})
 		]
 	});

package/dist/{auth.handler-CT1BQUvu.mjs → auth.handler-CbhiLOG1.mjs}

@@ -1,11 +1,13 @@
 #!/usr/bin/env node
 
-import { _ as AUTH_URL_PATH, b as CALLBACK_PATH, h as toErrorMessage, i as logger, t as ui, v as CALLBACK_LOOPBACK_HOST, x as CLI_AUTH_COMMAND, y as CALLBACK_LOOPBACK_ORIGIN } from "./keystroke.mjs";
-import { f as upsertOrgCredentials, i as getCredentialsFilePath } from "./dist-CUK7yBM0.mjs";
-import { a as resolveCliWebUrl, i as resolveCliServerUrl } from "./env-91KwMKov.mjs";
-import { t as openBrowser } from "./browser-qwFrUH82.mjs";
+import { n as DEFAULT_CLI_WEB_URL, t as DEFAULT_CLI_SERVER_URL } from "./default-urls-BS4twrsS.mjs";
+import { C as CliExitError, _ as AUTH_URL_PATH, b as CALLBACK_PATH, h as toErrorMessage, i as logger, t as ui, v as CALLBACK_LOOPBACK_HOST, x as CLI_AUTH_COMMAND, y as CALLBACK_LOOPBACK_ORIGIN } from "./keystroke.mjs";
+import { f as upsertOrgCredentials, i as getCredentialsFilePath } from "./dist-BF6r1hfv.mjs";
+import { a as resolveCliWebUrl, i as resolveCliServerUrl } from "./env-YTZGKGIu.mjs";
+import { t as openBrowser } from "./browser-gddMccBQ.mjs";
 import { hostname } from "node:os";
 import { z } from "zod";
+import { confirm, isCancel } from "@clack/prompts";
 import { randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 //#region src/commands/auth/device-auth.ts
@@ -237,6 +239,74 @@ async function createDeviceCallbackListener(expectedState, timeoutMs) {
 }
 //#endregion
 //#region src/commands/auth/auth.handler.ts
+const LOOPBACK_HOSTNAMES = new Set([
+	"localhost",
+	"127.0.0.1",
+	"::1"
+]);
+function isLoopbackUrl(rawUrl) {
+	try {
+		const parsed = new URL(rawUrl);
+		const host = parsed.hostname.startsWith("[") ? parsed.hostname.slice(1, -1) : parsed.hostname;
+		return LOOPBACK_HOSTNAMES.has(host);
+	} catch {
+		return false;
+	}
+}
+function resolveAuthHosts(options, ctx) {
+	const savedWeb = ctx.storedCredentials?.webUrl;
+	const savedServer = ctx.storedCredentials?.serverUrl;
+	const webUrl = resolveCliWebUrl(options.webUrl, savedWeb);
+	const serverUrl = resolveCliServerUrl(ctx.baseUrl);
+	return {
+		webUrl,
+		serverUrl,
+		webFromFlag: typeof options.webUrl === "string" && options.webUrl.length > 0,
+		webMatchesSaved: savedWeb === webUrl,
+		serverMatchesSaved: savedServer === serverUrl
+	};
+}
+function shouldConfirmLoopback(hosts) {
+	if (isLoopbackUrl("https://keystroke.ai") && isLoopbackUrl("https://api.kestroke.ai")) return false;
+	const webNeedsConfirm = !hosts.webFromFlag && isLoopbackUrl(hosts.webUrl);
+	const serverNeedsConfirm = isLoopbackUrl(hosts.serverUrl);
+	return webNeedsConfirm || serverNeedsConfirm;
+}
+function describeHostSource(matchesSaved, fromFlag = false) {
+	if (fromFlag) return "flag";
+	if (matchesSaved) return "saved credentials";
+	return "env or default";
+}
+function printResolvedHosts(hosts) {
+	ui.hint(`Web URL: ${hosts.webUrl} (${describeHostSource(hosts.webMatchesSaved, hosts.webFromFlag)})`);
+	ui.hint(`API URL: ${hosts.serverUrl} (${describeHostSource(hosts.serverMatchesSaved)})`);
+}
+async function confirmLoopbackHostsOrExit(hosts) {
+	ui.br();
+	ui.warn("About to authenticate against a local development environment");
+	if (hosts.webMatchesSaved || hosts.serverMatchesSaved) ui.hint(`Saved at: ${getCredentialsFilePath()} (from a previous keystroke auth run)`);
+	else ui.hint("Resolved from your environment (WEB_URL / SERVER_URL).");
+	ui.hint(`CLI default is ${DEFAULT_CLI_WEB_URL} / ${DEFAULT_CLI_SERVER_URL}.`);
+	ui.hint("To switch hosts:");
+	ui.hint(`  - Reset and re-auth: ${CLI_AUTH_COMMAND} clear, then ${CLI_AUTH_COMMAND}`);
+	ui.hint(`  - Override once: ${CLI_AUTH_COMMAND} --web-url <url> --server-url <url>`);
+	ui.br();
+	if (process.stdin.isTTY !== true) {
+		ui.warn("Non-interactive shell detected — continuing with the local URLs.");
+		return;
+	}
+	const proceed = await confirm({
+		message: "Continue signing in against these local URLs?",
+		initialValue: false
+	});
+	if (isCancel(proceed) || proceed !== true) {
+		ui.hint("Cancelled. No credentials were changed.");
+		throw new CliExitError("Auth cancelled by user.", {
+			exitCode: 0,
+			reported: true
+		});
+	}
+}
 function getVerificationCode(state) {
 	return state.slice(0, 8).toUpperCase();
 }
@@ -266,17 +336,22 @@ async function warnIfAlreadyAuthenticated(ctx) {
 	} catch {
 		return;
 	}
-	const identity = ctx.storedCredentials?.user?.email ?? "unknown user";
+	const stored = ctx.storedCredentials;
+	const identity = stored?.user?.email ?? "unknown user";
+	const activeOrg = stored?.orgs.find((o) => o.organizationId === stored?.activeOrgId);
 	ui.br();
 	ui.warn("Already authenticated");
-	ui.hint(`Signed in as ${identity}`);
+	ui.hint(`Signed in as ${identity}${activeOrg ? ` (${activeOrg.organizationName})` : ""}`);
+	if (stored?.webUrl || stored?.serverUrl) ui.hint(`Saved hosts: web ${stored.webUrl ?? "(none)"} | api ${stored.serverUrl ?? "(none)"}`);
 	ui.hint("Continuing will add or replace credentials for the selected organization.");
 	ui.br();
 }
 async function handleAuth(options, ctx, overrides) {
 	await warnIfAlreadyAuthenticated(ctx);
-	const webUrl = resolveCliWebUrl(options.webUrl);
-	const serverUrl = resolveCliServerUrl(options.serverUrl);
+	const hosts = resolveAuthHosts(options, ctx);
+	printResolvedHosts(hosts);
+	if (shouldConfirmLoopback(hosts)) await confirmLoopbackHostsOrExit(hosts);
+	const { webUrl, serverUrl } = hosts;
 	const timeoutMs = options.timeout * 1e3;
 	const state = createDeviceAuthState();
 	logger.info("Starting auth flow", {

package/dist/{build-agents-BmM_AsSd-BGi9wtzt.mjs → build-agents-DfbiMZ_e-CRnzruSu.mjs}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 
-import { n as readOptionalJsonSchemaKeys, t as manifestToDeclaredCredentialRequirement } from "./_manifest-JSRE3H8k.mjs";
-import { t as AgentVersionManifestSchema } from "./agent-manifest-CDnbkR2f.mjs";
-import { i as createAgentSandboxPackage, n as AGENT_VM_PI_SKILLS_ROOT, r as AGENT_VM_TOOLS_RUNTIME_RELATIVE_PATH, t as AGENT_VM_HOST_CALL_RELATIVE_PATH } from "./agent-bundle-package-DWV6B_5q-BtV7Xycc.mjs";
-import { t as readCredentialKeysFromSchemaObject } from "./read-credential-keys-77a91T8M-KA0Iw0Z1.mjs";
-import { t as bundleSandboxAgentTarget } from "./workflow-bundler-BPiqVscj-X1PFFAuP.mjs";
+import { n as readOptionalJsonSchemaKeys, t as manifestToDeclaredCredentialRequirement } from "./declared-credential-requirements-Bwlb-KZE.mjs";
+import { t as AgentVersionManifestSchema } from "./agent-manifest-Bfa3DBgc.mjs";
+import { i as createAgentSandboxPackage, n as AGENT_VM_PI_SKILLS_ROOT, r as AGENT_VM_TOOLS_RUNTIME_RELATIVE_PATH, t as AGENT_VM_HOST_CALL_RELATIVE_PATH } from "./agent-bundle-package-DWV6B_5q-FPT0bJaA.mjs";
+import { t as readCredentialKeysFromSchemaObject } from "./read-credential-keys-77a91T8M-CAJLnMRi.mjs";
+import { t as bundleSandboxAgentTarget } from "./workflow-bundler-BzHk73PM-Cde7cKiU.mjs";
 import { builtinModules } from "node:module";
 import { lstat, readFile, readdir, realpath } from "node:fs/promises";
 import path from "node:path";
 import * as crypto from "node:crypto";
 import { createHash } from "node:crypto";
 import { performance } from "node:perf_hooks";
-//#region ../../packages/workflow-core/src/sandbox/host-call-stub-source.ts
+//#region ../../packages/core/src/sandbox/host-call-stub-source.ts
 const HOST_CALL_STUB_SOURCE = [
 	"const __pendingHostCalls = new Map();",
 	"let __hostCallCounter = 0;",
@@ -166,7 +166,7 @@ const HOST_CALL_STUB_SOURCE = [
 	"}"
 ].join("\n");
 //#endregion
-//#region ../../packages/workflow-builder/dist/build-agents-BmM_AsSd.mjs
+//#region ../../packages/workflow-builder/dist/build-agents-DfbiMZ_e.mjs
 const STAGED_LOCAL_SOURCES_PREFIX = ".keystroke/staged-local-sources";
 function normalizeRelativeSandboxPath(targetPath) {
 	const normalized = path.posix.normalize(targetPath);