@keystrokehq/cli 0.1.24 → 0.1.25

package/dist/skills-bundle/_AGENTS.md

@@ -63,7 +63,7 @@ A project is a single live runtime. A deploy replaces what's running on that pro
 
 To create a new project: `keystroke init my-app --yes`, then deploy.
 
-Look things up cheapest-first: `keystroke <command> --help` for the authoritative flags and usage of any command (local, always current); `keystroke docs search`/`query` for documentation and examples; and `/cli` for the full reference when you need broad discovery.
+Look things up cheapest-first: `keystroke <command> --help` for the authoritative flags and usage of any command (local, always current); `keystroke docs search`/`query` for documentation and examples; and `keystroke docs query "cat /cli.mdx"` for the full CLI reference.
 
 ### Building agents
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keystrokehq/cli",
-  "version": "0.1.24",
+  "version": "0.1.25",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/keystrokehq/keystroke.git",
@@ -42,8 +42,8 @@
     "vitest": "^4.1.7",
     "@keystrokehq/oxlint-config": "0.0.4",
     "@keystrokehq/tsconfig": "0.0.3",
-    "@keystrokehq/tsdown-config": "0.0.3",
-    "@keystrokehq/vitest-config": "0.0.6"
+    "@keystrokehq/vitest-config": "0.0.6",
+    "@keystrokehq/tsdown-config": "0.0.3"
   },
   "scripts": {
     "build": "tsx scripts/generate-catalog-versions.ts && tsdown && node scripts/copy-templates.mjs && node scripts/copy-skills-bundle.mjs",

package/dist/skills-bundle/skills/keystroke-actions/SKILL.md

@@ -1,160 +0,0 @@
----
-name: keystroke-actions
-description: Define keystroke actions — workflow steps and agent tools. Custom API actions use a credential (defineCredential) or an app wrapper (app.action); catalog integrations import from npm packages. Use when authoring src/actions/ or wiring integrations.
-metadata:
-  keystroke-domain: actions
----
-
-# Actions
-
-One **executable unit** used everywhere: workflow steps, agent tools, and codemode host calls.
-
-Anything that calls an external API needs a **credential**. Two paths: declare a standalone `defineCredential` on a `defineAction` (simplest), or use an **app** wrapper (`app.action()`) when several actions share one connection or you've synced a catalog/custom app into `src/apps/`. See [apps skill](.agents/skills/keystroke-apps/SKILL.md).
-
-## Actions are leaf units — never call an action from an action
-
-An action's `run` must **not** call another action (yours or an integration action like `slackSendMessage`). Composition belongs in a **workflow**; an integration action is used directly as a workflow step or agent tool — not wrapped in a custom action.
-
-```ts
-// ❌ Don't: an action that calls another action
-import { slackSendMessage } from "@keystrokehq/slack/actions";
-export const notify = defineAction({ slug: "notify",
-  run: async (input) => slackSendMessage.run({ channel: input.channel, markdown_text: input.text }),
-});
-
-// ✅ Do: use the integration action directly as a workflow step
-async run(input) {
-  return slackSendMessage.run({ channel: input.channel, markdown_text: buildText(input) });
-}
-```
-
-This is enforced at runtime (calling an action inside an action throws) and by lint (`no-restricted-imports` blocks importing `@keystrokehq/*/actions` inside `src/actions/`). An action **may** call an agent — see below.
-
-## Custom API actions (standalone credential)
-
-The simplest custom integration: declare a `defineCredential` and consume it from a plain `defineAction`. No app needed.
-
-```ts
-import { defineAction } from "@keystrokehq/keystroke/action";
-import { defineCredential } from "@keystrokehq/keystroke/credentials";
-import { z } from "zod";
-
-const acme = defineCredential({ key: "acme", fields: { apiKey: z.string() } });
-
-export const createAcmeTicket = defineAction({
-  slug: "create-acme-ticket",
-  input: z.object({ title: z.string() }),
-  output: z.object({ id: z.string() }),
-  credentials: [acme] as const,
-  async run(input, credentials) {
-    return createTicket({ apiKey: credentials.acme.apiKey, title: input.title });
-  },
-});
-```
-
-Connect it with `keystroke credentials set acme --set apiKey=@env:ACME_API_KEY --scope org`.
-
-## App-backed actions (shared connection / synced apps)
-
-Reach for an app when several actions share one connection, or when you've synced a catalog/custom app:
-
-1. **App first** — create in the dashboard or `keystroke app create`, then `keystroke app sync <slug>` → `src/apps/<name>/app.ts`
-2. **Connect** — `keystroke connect <slug>` (see [apps skill](.agents/skills/keystroke-apps/SKILL.md))
-3. **Action** — `app.action()` in `src/actions/`, reading `credentials[app.slug]` in `run`
-
-```ts
-import { z } from "zod";
-import { kwatch } from "../apps/kwatch/app";
-
-export const kwatchListAlerts = kwatch.action({
-  slug: "kwatch-list-alerts",
-  input: z.object({}),
-  output: z.object({ ok: z.boolean(), alertCount: z.number() }),
-  async run(_input, credentials) {
-    const { apiKey } = credentials["keystroke/kwatch"];
-    return { ok: true, alertCount: 0 };
-  },
-});
-```
-
-Use an app wrapper (over a standalone credential) when a family of actions should share one connection definition.
-
-## Pure actions (no credential)
-
-Use `defineAction` with no `credentials` when the step needs no connection at all (pure logic, local transforms):
-
-```ts
-import { defineAction } from "@keystrokehq/keystroke/action";
-import { z } from "zod";
-
-export const triage = defineAction({
-  slug: "triage",
-  name: "Triage",
-  description: "Classify an inbound message",
-  input: z.object({ message: z.string(), sender: z.string() }),
-  output: z.object({ priority: z.enum(["low", "normal", "high", "urgent"]) }),
-  run: async (input) => ({ priority: "normal" }),
-});
-```
-
-## Catalog integration actions
-
-Official integrations ship as npm packages with pre-built actions. Discover with `keystroke app search`, connect with `keystroke connect <slug>`, then import in workflows or agent tools — not in `src/actions/`:
-
-```ts
-import { exaSearch } from "@keystrokehq/exa/actions";
-import { slackSendMessage } from "@keystrokehq/slack/actions";
-```
-
-Detail: [catalog-and-imports.md](references/catalog-and-imports.md).
-
-## Call an agent from an action (allowed)
-
-Agents — not other actions — are the one thing an action may invoke:
-
-```ts
-import signupResearcher from "../agents/signup-researcher";
-
-export const researchSignup = defineAction({
-  slug: "research-signup",
-  run: async (input) => {
-    const result = await signupResearcher.prompt({ message: "…" });
-    return { brief: "…" };
-  },
-});
-```
-
-## Credential scope & resolution
-
-When a credential's scope isn't pinned, the runtime resolves it **project default first, then org default**. Pin a scope per-use with `.scope()` (the authoring-side counterpart to the CLI `--scope` flag) — it returns a fresh action that still binds like any other step/tool:
-
-```ts
-await myAction.scope("user").run(input);   // workflow step
-tools: [myAction.scope("user")];            // agent tool
-```
-
-When several instances exist for one app + scope and none is the default, pin an exact instance to the consuming step/tool from the CLI: `keystroke credentials assignments assign --workflow <slug> --credential <app>/<slug> --consumer step:<slug>#0` (see [apps skill](.agents/skills/keystroke-apps/SKILL.md)).
-
-## Long-running actions: honor the abort signal
-
-`run` receives a third `ctx` argument with an `AbortSignal`. Thread it into fetches/SDK calls so the framework can cancel work cleanly:
-
-```ts
-async run(input, credentials, ctx) {
-  const res = await fetch(url, { signal: ctx?.signal });
-  return res.json();
-}
-```
-
-## Where actions run
-
-| Consumer | Usage                                           |
-| -------- | ----------------------------------------------- |
-| Workflow | `await myAction.run(input)` in `defineWorkflow` |
-| Agent    | `tools: [myAction, exaSearch]` on `defineAgent` |
-
-## Next references
-
-- [catalog-and-imports.md](references/catalog-and-imports.md) — catalog discovery, npm imports
-
-Related: [apps](.agents/skills/keystroke-apps/SKILL.md), [workflows](.agents/skills/keystroke-workflows/SKILL.md), [agents](.agents/skills/keystroke-agents/SKILL.md).

package/dist/skills-bundle/skills/keystroke-actions/references/catalog-and-imports.md

@@ -1,71 +0,0 @@
-# Integration actions
-
-## Official catalog integrations
-
-1. Discover: `keystroke app search <query>` → `app show <slug>` → `app actions <slug>`
-2. Connect: `keystroke connect <slug>`
-3. Add npm package (e.g. `@keystrokehq/exa`, `@keystrokehq/googlesuper`, `@keystrokehq/slack`)
-4. Import in `src/workflows/` or on `defineAgent` `tools` — not in `src/actions/`:
-
-```ts
-import { exaSearch, exaAnswer } from "@keystrokehq/exa/actions";
-import { slackSendMessage } from "@keystrokehq/slack/actions";
-import { googlesuperSendEmail } from "@keystrokehq/googlesuper/actions";
-```
-
-Catalog packages ship a pre-built app + actions — you do not author `src/apps/` for these.
-
-## Custom integrations
-
-Two supported paths. Pick based on whether actions share a connection.
-
-### Standalone credential (simplest)
-
-Declare a `defineCredential` and consume it from a plain `defineAction`:
-
-```ts
-import { defineAction } from "@keystrokehq/keystroke/action";
-import { defineCredential } from "@keystrokehq/keystroke/credentials";
-import { z } from "zod";
-
-const acme = defineCredential({ key: "acme", fields: { apiKey: z.string() } });
-
-export const fetchStatus = defineAction({
-  slug: "fetch-status",
-  input: z.object({}),
-  output: z.object({ ok: z.boolean() }),
-  credentials: [acme] as const,
-  async run(_input, credentials) {
-    const { apiKey } = credentials.acme;
-    return { ok: true };
-  },
-});
-```
-
-Connect it with `keystroke credentials set acme --set apiKey=@env:ACME_API_KEY --scope org`.
-
-### App wrapper (shared connection / synced apps)
-
-Use an app when several actions share one connection, or when you've synced a custom/catalog app:
-
-1. Create the app (dashboard or `keystroke app create --name ... --field ...`)
-2. Sync: `keystroke app sync <slug>` → `src/apps/<name>/app.ts`
-3. Connect: `keystroke connect <slug>`
-4. Author actions in `src/actions/` with `app.action()`:
-
-```ts
-import { z } from "zod";
-import { internalApi } from "../apps/internal-api/app";
-
-export const fetchStatus = internalApi.action({
-  slug: "fetch-status",
-  input: z.object({}),
-  output: z.object({ ok: z.boolean() }),
-  async run(_input, credentials) {
-    const { apiKey } = credentials["acme/internal-api"];
-    return { ok: true };
-  },
-});
-```
-
-Re-run `keystroke app sync <slug>` after template changes on the platform. Full app lifecycle: [apps skill](../../keystroke-apps/SKILL.md).

package/dist/skills-bundle/skills/keystroke-agents/SKILL.md

@@ -1,115 +0,0 @@
----
-name: keystroke-agents
-description: Build keystroke agents with defineAgent — models, integration tools (Exa, Google, Slack), skills, files, and sandbox. Use when authoring src/agents/ or debugging agent sessions.
-metadata:
-  keystroke-domain: agents
----
-
-# Agents
-
-Agents are **autonomous LLM runs** with a sandbox, optional skills/files, and **tools** (your actions + integration actions).
-
-## Typical patterns
-
-**Integration tools** — import actions from an integration package:
-
-```ts
-import { defineAgent } from "@keystrokehq/keystroke/agent";
-import { exaSearch, exaAnswer } from "@keystrokehq/exa/actions";
-
-export default defineAgent({
-  slug: "signup-researcher",
-  systemPrompt: "Research signups with Exa. Stay concise; cite sources.",
-  model: "anthropic/claude-sonnet-4.6",
-  tools: [exaSearch, exaAnswer],
-});
-```
-
-**Skills + files** — static playbooks and docs in the workspace:
-
-```ts
-import { defineAgent } from "@keystrokehq/keystroke/agent";
-import { defineSandbox } from "@keystrokehq/keystroke/sandbox";
-
-defineAgent({
-  slug: "support",
-  systemPrompt: "Read /workspace/agent/product-guide.md before answering.",
-  skills: ["support"],
-  sandbox: defineSandbox({ files: true }),
-});
-```
-
-Import actions from `@keystrokehq/<integration>/actions` (e.g. `@keystrokehq/exa/actions`, `@keystrokehq/googlesuper/actions`).
-
-## Built-in capabilities (on by default)
-
-Two capabilities are enabled automatically — you don't add them to `tools`:
-
-- **Memory** — agents persist memory across sessions by default. Disable with `memory: false`.
-- **Web** — built-in `web_search` / `web_fetch` host tools are available by default. Disable with `web: false`.
-
-```ts
-defineAgent({
-  slug: "researcher",
-  systemPrompt: "…",
-  model: "anthropic/claude-sonnet-4.6",
-  memory: false, // opt out of persistent memory
-  web: false,    // opt out of built-in web tools
-});
-```
-
-Delegate to other agents with subagents, or trigger multi-step work with workflows — import them directly into `tools` — see [tools-mcp-codemode.md](references/tools-mcp-codemode.md).
-
-## Structured output (`outputSchema`)
-
-`outputSchema` is a **per-prompt** option, not a `defineAgent` field — the same agent can return free text on one call and a schema-validated object on the next. Pass a Zod schema to `prompt(...)` and read the parsed result from `result.output` (typed from the schema):
-
-```ts
-import { z } from "zod";
-import researcher from "../agents/signup-researcher";
-
-const Summary = z.object({ company: z.string(), summary: z.string() });
-
-const result = await researcher.prompt({
-  message: "Research Acme Corp",
-  outputSchema: Summary,
-});
-if (result.error) throw new Error(result.error);
-
-const { company, summary } = result.output!; // typed { company: string; summary: string }
-```
-
-Without `outputSchema`, `result.output` is `undefined` and you read the reply from `result.messages`. This is an in-process TypeScript API (workflows, actions, scripts) — structured output is **not** exposed over the HTTP route or `keystroke agent prompt`.
-
-## Run & audit
-
-```bash
-keystroke agent prompt signup-researcher --message "Research Acme Corp"
-keystroke agent sessions list signup-researcher
-keystroke agent sessions get signup-researcher <session-id> --include messages,trace
-```
-
-Follow up in the same session: `--session-id <id>`.
-
-## How agents get invoked
-
-| From            | How                                                       |
-| --------------- | --------------------------------------------------------- |
-| CLI             | `keystroke agent prompt {slug} --message "…"`             |
-| Workflow action | `await myAgent.prompt({ message })` inside `defineAction` |
-| Channel         | Slack message to a bound agent (see channels skill)      |
-
-The agent's identity field is `slug` — it's also the route id (`POST /agents/{slug}`) and the CLI `<agentId>` argument.
-
-## Workspace
-
-- Skills → `/workspace/agent/skills/{skill-name}/` (the skill's folder name)
-- Files from `src/files/{slug}/` → `/workspace/agent/` (`{slug}` is the agent slug when `files: true`)
-
-## Next references
-
-- [models.md](references/models.md) — model ids, platform LLM proxy
-- [tools-mcp-codemode.md](references/tools-mcp-codemode.md) — actions as tools, MCP, codemode
-- [workflows-and-testing.md](references/workflows-and-testing.md) — sessions, workflow handoff
-
-Related: [actions](.agents/skills/keystroke-actions/SKILL.md), [workflows](.agents/skills/keystroke-workflows/SKILL.md), [files](.agents/skills/keystroke-files/SKILL.md), [apps](.agents/skills/keystroke-apps/SKILL.md).

package/dist/skills-bundle/skills/keystroke-agents/references/models.md

@@ -1,23 +0,0 @@
-# Models
-
-```ts
-model: "google/gemini-2.5-flash"; // vendor/model-id — any pi-ai or gateway catalog id
-thinkingLevel: "high"; // optional — defaults to "medium"; use "none" to disable reasoning
-```
-
-`thinkingLevel` accepts `off`, `minimal`, `low`, `medium`, `high`, `xhigh` (`off` disables reasoning).
-
-Per-prompt override via API: `{ "message": "...", "thinkingLevel": "low" }`.
-
-Set `model` to any `vendor/model-id` and deploy — the platform routes agents through its managed LLM proxy automatically, so there are **no provider keys to configure**.
-
-| Vendor    | Example id                    |
-| --------- | ----------------------------- |
-| Anthropic | `anthropic/claude-sonnet-4.5` |
-| OpenAI    | `openai/gpt-5.5`              |
-| Google    | `google/gemini-3.5-flash`     |
-| DeepSeek  | `deepseek/deepseek-v3`        |
-| Moonshot  | `moonshotai/kimi-k2.5`        |
-| Zhipu GLM | `zai/glm-4.5`                 |
-
-After changing model, smoke-test: `keystroke agent prompt <key> --message "Hi"`.

package/dist/skills-bundle/skills/keystroke-agents/references/tools-mcp-codemode.md

@@ -1,85 +0,0 @@
-# Tools, MCP, and codemode
-
-## Integration actions as tools
-
-Most agents use imported integration actions:
-
-```ts
-import { exaSearch, exaAnswer } from "@keystrokehq/exa/actions";
-import { googlesuperFetchEmails, googlesuperSendEmail } from "@keystrokehq/googlesuper/actions";
-
-tools: [exaSearch, exaAnswer, googlesuperFetchEmails, googlesuperSendEmail],
-```
-
-See each integration package's `actions` export for available tools.
-
-## Your own actions as tools
-
-```ts
-import { triage } from "../actions/triage";
-tools: [triage],
-```
-
-Same action works in workflows and on agents.
-
-## Subagents (delegate to another agent)
-
-Import another agent into `tools` and the parent delegates a scoped task to the child agent:
-
-```ts
-import { defineAgent } from "@keystrokehq/keystroke/agent";
-import researcher from "./researcher";
-
-export default defineAgent({
-  slug: "planner",
-  systemPrompt: "Plan work. Delegate research to the researcher subagent.",
-  model: "anthropic/claude-sonnet-4.6",
-  tools: [researcher],
-});
-```
-
-The tool name is the subagent's `slug`. The tool expects a `message` string parameter.
-
-## Workflows as tools
-
-Import a workflow into `tools` when the agent should trigger a fixed multi-step sequence as one durable tool call:
-
-```ts
-import { defineAgent } from "@keystrokehq/keystroke/agent";
-import refundOrder from "../workflows/refund-order";
-
-export default defineAgent({
-  slug: "support",
-  systemPrompt: "Help customers. To issue a refund, call the refund-order tool.",
-  model: "anthropic/claude-sonnet-4.6",
-  tools: [refundOrder],
-});
-```
-
-The tool name is the workflow's `slug`; parameters come from the workflow's `input` schema (must be a Zod object). The workflow runs inline as a tool — it cannot use `ctx.sleep()` or `ctx.hook()`. To run a workflow as its own tracked run instead, call it over HTTP or from a trigger; to reuse it inside another workflow, import it and call `await otherWorkflow.run(input)`.
-
-## MCP
-
-Point an agent at an MCP server with `defineMcp` (from `@keystrokehq/keystroke/agent`) and add the definition to `tools` alongside actions. Each tool the server lists becomes available, prefixed with the server `key` (e.g. `mcp__deepwiki__ask_question`).
-
-```ts
-import { defineAgent, defineMcp } from "@keystrokehq/keystroke/agent";
-
-const deepwiki = defineMcp({
-  key: "deepwiki",
-  transport: { type: "http", url: "https://mcp.deepwiki.com/mcp" },
-});
-
-export default defineAgent({
-  slug: "researcher",
-  systemPrompt: "Use the DeepWiki tools to answer questions about repos.",
-  model: "anthropic/claude-sonnet-4.6",
-  tools: [deepwiki],
-});
-```
-
-For servers that require auth, declare credentials on the definition.
-
-## Codemode (advanced)
-
-Default sandbox has bash. For batch tool calls, agents can run js-exec scripts that call `await tools['action-slug'](args)` (the tool name is the action's slug; MCP tools keep their `mcp__<key>__<tool>` prefix). Optional VM runtime via `sandbox: defineSandbox({ mode: "vm" })` (from `@keystrokehq/keystroke/sandbox`).

package/dist/skills-bundle/skills/keystroke-agents/references/workflows-and-testing.md

@@ -1,26 +0,0 @@
-# Sessions and workflow handoff
-
-## Multi-turn CLI
-
-```bash
-keystroke agent prompt support --message "What is the refund policy?"
-keystroke agent sessions list support
-keystroke agent prompt support --message "Summarize that" --session-id <id>
-```
-
-## Inspect a session
-
-```bash
-keystroke agent sessions get support <session-id> --include messages,trace
-```
-
-Use this when an agent misbehaves or a channel reply looks wrong.
-
-## Agent called from a workflow
-
-Actions invoke agents with `.prompt()` inside `defineAction`. Audit the workflow run, not just the agent session:
-
-```bash
-keystroke workflow runs list signup-pipeline
-keystroke workflow runs get signup-pipeline <run-id> --include steps,trace
-```

package/dist/skills-bundle/skills/keystroke-apps/SKILL.md

@@ -1,151 +0,0 @@
----
-name: keystroke-apps
-description: Connectable apps — defineApp, app.action, catalog discovery via keystroke app search, custom app create/sync, and connect. Use when wiring integrations, OAuth, API keys, or a deployed run fails because an app is not connected.
-metadata:
-  keystroke-domain: apps
----
-
-# Apps
-
-An **app** is a connectable integration: a slug, an auth kind, and (for custom apps) a field template. **Connected** = secrets for that app have been uploaded via the connect flow.
-
-Secrets never live in source or `.env`. `keystroke deploy` uploads code only, not connections — connect the apps your project needs with the connect flow.
-
-Custom actions that call external APIs need a **credential**. The simplest path is a standalone `defineCredential` declared on a `defineAction`. Reach for an **app** (`defineApp` + `app.action()`) when several actions share one connection, or when you've synced a catalog/custom app into `src/apps/`. See [actions skill](.agents/skills/keystroke-actions/SKILL.md).
-
-## Two sources of apps
-
-| Source | How you get it | Author in code |
-| ------ | -------------- | -------------- |
-| **Catalog** | ~1000 Composio integrations + first-party (`exa`, `slack`, `googlesuper`) | npm package `@keystrokehq/<slug>` — discover via CLI |
-| **Custom** | Dashboard UI or `keystroke app create`, then `keystroke app sync <slug>` | `src/apps/<name>/app.ts` from sync |
-
-## Discover catalog integrations
-
-```bash
-keystroke auth login
-keystroke app search github              # live Composio catalog
-keystroke app show github
-keystroke app actions github --search issue
-keystroke app action GITHUB_CREATE_ISSUE
-keystroke app list                       # apps registered in your org
-```
-
-Discovery is read-only — there is no `app install` yet. To connect an app, its slug must be in your org registry (`app list`).
-
-## Create and sync custom apps
-
-Create in the dashboard or CLI, then pull the template into your project:
-
-```bash
-# Manual custom app (api_key fields)
-keystroke app create \
-  --name "Internal API" \
-  --description "Our internal service" \
-  --field apiKey:secret
-
-# Auto-detect from URL (same as dashboard Create custom app)
-keystroke app create --mcp https://mcp.example.com/mcp --preview
-keystroke app create --openapi https://example.com/openapi.yaml --name "Example API"
-
-keystroke app sync acme/internal-api     # writes src/apps/internal-api/app.ts
-```
-
-Re-run `sync` after template changes on the platform. Then author actions with `app.action()` in `src/actions/`.
-
-## Author with defineApp
-
-Synced apps land as `defineApp` in `src/apps/<name>/app.ts`:
-
-```ts
-import { defineApp } from "@keystrokehq/keystroke/app";
-import { z } from "zod";
-
-export const kwatch = defineApp({
-  slug: "keystroke/kwatch",
-  auth: "api_key",
-  credential: { apiKey: z.string() },
-});
-```
-
-Actions use `app.action()` — the app binding is automatic:
-
-```ts
-import { kwatch } from "../apps/kwatch/app";
-
-export const kwatchListAlerts = kwatch.action({
-  slug: "kwatch-list-alerts",
-  input: z.object({}),
-  output: z.object({ ok: z.boolean(), alertCount: z.number() }),
-  async run(_input, credentials) {
-    const { apiKey } = credentials["keystroke/kwatch"];
-    return { ok: true, alertCount: 0 };
-  },
-});
-```
-
-Auth kinds: `keystroke` (MCP/Composio catalog apps), `api_key` (custom fields), `oauth` (token resolved at runtime). In `run`, read connected fields as `credentials[app.slug]`.
-
-## Connect an app
-
-`keystroke connect <slug>` opens the web app connect flow (OAuth or API-key form, depending on the app). This is how secrets get attached to an app — not via `.env`.
-
-**Official integrations** — the cleanest path:
-
-```bash
-keystroke connect google
-keystroke connect slack
-keystroke connect exa
-```
-
-**Custom apps** — sync the template first, then connect:
-
-```bash
-keystroke app sync acme/internal-api
-keystroke connect acme/internal-api
-```
-
-The web app **Apps** page offers the same flow.
-
-Field names in the connect form match the app's synced template. You pick the scope (project / org / user) in the web connect flow — `keystroke connect` has no `--scope` flag. See [cli-and-catalog.md](references/cli-and-catalog.md).
-
-## Connect what your project needs
-
-A new project starts with **no connected apps**. After deploy, connect the apps it uses:
-
-```bash
-keystroke deploy --project <id>
-keystroke connect google
-keystroke connect exa
-keystroke app list
-```
-
-A runtime error about a missing connection almost always means the app hasn't been connected for this project.
-
-## Manage & bind credentials
-
-`keystroke credentials list / get / update --default / rotate-key / delete` manage instances. When several instances share a scope and none is the default, a run can't auto-resolve — set a default, or **bind** an exact instance to one step/tool:
-
-```bash
-keystroke credentials consumers list --workflow sync                                   # step:<slug>#<n>
-keystroke credentials assignments assign --workflow sync --credential org/work --consumer step:fetch-gmail#0
-keystroke credentials assignments assign --agent support --credential vault-prod --consumer vault-lookup   # tool slug
-```
-
-An assignment is the explicit selection at the top of the resolution order, so it overrides scope defaults. Full surface: [cli-and-catalog.md](references/cli-and-catalog.md).
-
-## Audit
-
-```bash
-keystroke app list                       # org-registered apps
-keystroke credentials list               # connected instances + scope + default
-keystroke credentials assignments list --workflow <slug>   # which instance is pinned where
-```
-
-Failed integration call → confirm the app is connected for your project, the action uses the right slug, and (if multiple instances) a default or assignment resolves the right one.
-
-## Next references
-
-- [cli-and-catalog.md](references/cli-and-catalog.md) — `keystroke app` commands, connect, scopes, credential management & binding
-
-Related: [cli](.agents/skills/keystroke-cli/SKILL.md), [actions](.agents/skills/keystroke-actions/SKILL.md), [channels](.agents/skills/keystroke-channels/SKILL.md).