@kodycodes/cli 1.17.0 → 1.19.0

package/dist/cli.js

@@ -5,9 +5,10 @@ import { deleteStoredApiToken, loadStoredApiToken, } from './api-token-store.js'
 import { authBootstrap, authBootstrapWithScopes, bootstrapMintLifetimeFields, cliCredentialBootstrapOperationId, parseCliLifetimeSecondsFlag, parseCliScopesFlag, resolveCliTokenLifetime, } from './auth-bootstrap.js';
 import { parseCredentialFlags, } from './credential-call-map.js';
 import { defaultApiUrl, defaultMcpUrl, modernMcpProtocolVersion } from './defaults.js';
-import { usage } from './help.js';
+import { buildUsage } from './help.js';
+import { orgSlugFromFlag, resolveOrgSlug } from './org-resolve.js';
 import { refreshGitCredentialHelperPinIfNeeded } from './setup-git.js';
-import { deleteCredentials, loadCredentials } from './store.js';
+import { deleteCredentials, listStoredOrgs, loadCredentials } from './store.js';
 import { formatToolResult } from './tool-result.js';
 import { resolveLocalExecuteBearer } from './local-execute-auth.js';
 import { assertLocalExecuteNodeEngine } from './node-engine.js';
@@ -16,6 +17,16 @@ import { redactError } from './redact.js';
 export { readApiToken, requireApiToken as resolveApiToken, resolveScopedApiToken, } from './api-token.js';
 export { resolveLocalExecuteBearer } from './local-execute-auth.js';
 export { authBootstrap, authBootstrapWithScopes, bootstrapRedeemRequestBody, cliTokenLifetimeAliases, cliTokenLifetimeMissingError, cliTokenLifetimePolicy, parseCliLifetimeSecondsFlag, parseCliScopesFlag, redeemBootstrapCode, resolveCliTokenLifetime, } from './auth-bootstrap.js';
+const orgScopedCommands = new Set([
+    'login',
+    'logout',
+    'whoami',
+    'search',
+    'api',
+    'execute',
+    'dev',
+    'auth',
+]);
 function mcpUrlFrom(values) {
     return values.mcpUrl || process.env.KODY_MCP_URL || defaultMcpUrl;
 }
@@ -52,6 +63,12 @@ function parseKnown(args) {
             project: { type: 'boolean' },
             'no-browser': { type: 'boolean' },
             org: { type: 'string' },
+            target: { type: 'string' },
+            'reset-storage': { type: 'boolean' },
+            port: { type: 'string' },
+            'app-base-path': { type: 'string' },
+            method: { type: 'string' },
+            body: { type: 'string' },
             clients: { type: 'string' },
             yes: { type: 'boolean', short: 'y' },
         },
@@ -71,6 +88,7 @@ export function resolveCommand(argv) {
     switch (raw) {
         case 'login':
         case 'logout':
+        case 'org':
         case 'status':
         case 'auth':
         case 'git-credential':
@@ -78,6 +96,7 @@ export function resolveCommand(argv) {
         case 'search':
         case 'api':
         case 'execute':
+        case 'dev':
         case 'install':
         case 'skill':
         case 'help':
@@ -112,8 +131,13 @@ export async function runCli(argv = process.argv.slice(2), io = {}) {
     }
     try {
         const parsed = resolveCommand(argv);
+        const helpMcpUrl = mcpUrlFrom({
+            mcpUrl: typeof parsed.values['mcp-url'] === 'string'
+                ? parsed.values['mcp-url']
+                : undefined,
+        });
         if (parsed.values.help && parsed.command !== 'help') {
-            write(usage);
+            write(buildUsage({ mcpUrl: helpMcpUrl }));
             return 0;
         }
         return await dispatch(parsed, write, writeErr);
@@ -129,37 +153,47 @@ async function dispatch(parsed, write, writeErr) {
     });
     const json = parsed.values.json === true;
     if (parsed.values['allow-private-network'] === true &&
+        parsed.command !== 'dev' &&
         (parsed.command !== 'execute' || parsed.values.local !== true)) {
-        throw new Error('--allow-private-network can only be used with execute --local.');
+        throw new Error('--allow-private-network can only be used with execute --local or kody dev.');
     }
-    if (parsed.values.org !== undefined && parsed.command !== 'login') {
-        throw new Error('`--org` can only be used with `kody login`.');
+    if (parsed.values['reset-storage'] === true &&
+        parsed.command !== 'dev' &&
+        parsed.command !== 'execute' &&
+        parsed.command !== 'search') {
+        throw new Error('`--reset-storage` is only used with --target mock on execute, search, or dev.');
     }
+    const orgFlag = typeof parsed.values.org === 'string' ? parsed.values.org : undefined;
+    if (orgFlag !== undefined && !orgScopedCommands.has(parsed.command)) {
+        throw new Error(`\`--org\` is not used with \`kody ${parsed.command}\`. Use it with login, logout, whoami, search, api, execute, or auth.`);
+    }
+    // Login/logout honor `--org` only — not KODY_ORG (that env is for one-shot
+    // org-scoped commands and must not bind browser login or change logout).
+    const orgFlagOnly = orgFlag !== undefined ? orgSlugFromFlag(orgFlag) : undefined;
+    const org = resolveOrgSlug({ flag: orgFlag });
     switch (parsed.command) {
         case 'help':
-            write(usage);
+            write(buildUsage({ mcpUrl }));
             return 0;
         case 'version':
             write(`${readPackageVersion()}\n`);
             return 0;
         case 'login': {
-            const [{ login }, { orgSlugFromFlag }] = await Promise.all([
-                import('./auth.js'),
-                import('./oauth-provider.js'),
-            ]);
-            const org = typeof parsed.values.org === 'string'
-                ? orgSlugFromFlag(parsed.values.org)
-                : undefined;
+            const { login } = await import('./auth.js');
             write('Opening the Kody login page in your browser…\n');
             const result = await login({
                 mcpUrl,
-                ...(org ? { org } : {}),
+                ...(orgFlagOnly ? { org: orgFlagOnly } : {}),
                 openBrowser: parsed.values['no-browser'] !== true,
                 onAuthorizationUrl: (url) => {
                     write(`If the browser does not open, visit:\n${url.href}\n`);
                 },
             });
-            const orgLabel = result.org ? ` as org ${result.org}` : '';
+            const orgLabel = result.org
+                ? ` as org ${result.org}`
+                : result.credentials.org
+                    ? ` as org ${result.credentials.org}`
+                    : '';
             const accountLabel = result.account?.email
                 ? ` (${result.account.email})`
                 : result.account?.displayName
@@ -180,38 +214,74 @@ async function dispatch(parsed, write, writeErr) {
                     ? parsed.values['api-url']
                     : undefined,
             });
-            const oauth = deleteCredentials(mcpUrl);
-            const apiToken = deleteStoredApiToken(apiUrl);
+            const oauth = deleteCredentials(mcpUrl, undefined, undefined, orgFlagOnly ? { org: orgFlagOnly } : undefined);
+            // Clear the bootstrap/API token only when removing the last org login
+            // or when not targeting a specific remaining multi-org set.
+            const clearApiToken = !orgFlagOnly || oauth.remaining === 0;
+            const apiToken = clearApiToken
+                ? deleteStoredApiToken(apiUrl)
+                : { deleted: false };
             if (!oauth.deleted && !apiToken.deleted) {
-                write('No stored credentials.\n');
+                write(orgFlagOnly
+                    ? `No stored login for org "${orgFlagOnly}".\n`
+                    : 'No stored credentials.\n');
                 return 0;
             }
             const parts = [];
-            if (oauth.deleted)
-                parts.push('Logged out of kody login.');
+            if (oauth.deleted) {
+                parts.push(orgFlagOnly
+                    ? `Logged out of org ${orgFlagOnly}.`
+                    : 'Logged out of the active org (kody login).');
+            }
             if (apiToken.deleted)
                 parts.push('Cleared stored bootstrap/API token.');
             write(`${parts.join(' ')}\n`);
             return 0;
         }
+        case 'org': {
+            const { chooseOrgInteractively, formatOrgListHuman, formatOrgListJson, useOrg, } = await import('./org.js');
+            const { listStoredOrgs } = await import('./store.js');
+            const action = parsed.positionals[0];
+            if (action === 'list') {
+                const orgs = listStoredOrgs(mcpUrl);
+                write(json ? formatOrgListJson(orgs) : formatOrgListHuman(orgs));
+                return orgs.length === 0 ? 1 : 0;
+            }
+            if (action === 'use') {
+                const slugArg = parsed.positionals[1];
+                if (slugArg) {
+                    const next = useOrg(slugArg, mcpUrl);
+                    write(`Active org is now ${next.activeOrg}.\n`);
+                    return 0;
+                }
+                const orgs = listStoredOrgs(mcpUrl);
+                const chosen = await chooseOrgInteractively({ orgs });
+                const next = useOrg(chosen, mcpUrl);
+                write(`Active org is now ${next.activeOrg}.\n`);
+                return 0;
+            }
+            throw new Error('Usage: kody org list [--json] | kody org use [<slug>]');
+        }
         case 'status': {
             const apiUrl = apiUrlFrom({
                 apiUrl: typeof parsed.values['api-url'] === 'string'
                     ? parsed.values['api-url']
                     : undefined,
             });
+            // Status always reports the active (or pending) login — not KODY_ORG.
             const credentials = loadCredentials(mcpUrl);
+            const orgs = listStoredOrgs(mcpUrl);
             const storedApi = loadStoredApiToken(apiUrl);
-            if (!credentials && !storedApi) {
+            if (!credentials && orgs.length === 0 && !storedApi) {
                 write('Not logged in.\n');
                 return 1;
             }
             const lines = [];
-            if (credentials) {
-                const expires = credentials.expiresAt
+            if (credentials || orgs.length > 0) {
+                const expires = credentials?.expiresAt
                     ? new Date(credentials.expiresAt).toISOString()
                     : 'unknown';
-                lines.push(`mcp: ${credentials.mcpUrl}`, `logged in: yes`, `access token expires: ${expires}`, `refresh token: ${credentials.refreshToken ? 'yes' : 'no'}`, `scope: ${credentials.scope ?? 'unknown'}`);
+                lines.push(`mcp: ${credentials?.mcpUrl ?? mcpUrl}`, `logged in: yes`, `active org: ${credentials?.org ?? orgs.find((row) => row.active)?.slug ?? '(pending)'}`, `orgs: ${orgs.map((row) => (row.active ? `${row.slug}*` : row.slug)).join(', ') || '(pending)'}`, `access token expires: ${expires}`, `refresh token: ${credentials?.refreshToken ? 'yes' : 'no'}`, `scope: ${credentials?.scope ?? 'unknown'}`);
             }
             else {
                 lines.push(`mcp: ${mcpUrl}`, `logged in: no`);
@@ -234,6 +304,7 @@ async function dispatch(parsed, write, writeErr) {
                     values: parsed.values,
                     mcpUrl,
                     write,
+                    ...(org ? { org } : {}),
                 });
             }
             if (action === 'remove-git') {
@@ -281,6 +352,7 @@ async function dispatch(parsed, write, writeErr) {
                         mcpUrl,
                         apiUrl,
                         tokenValues: tokenFlagValues(parsed.values),
+                        ...(org ? { org } : {}),
                     }),
                 })
                 : await authBootstrap({
@@ -337,11 +409,13 @@ async function dispatch(parsed, write, writeErr) {
                 mcpUrl,
                 apiUrl,
                 allowEnvWithoutLogin: true,
+                ...(org ? { org } : {}),
             })) {
                 const { whoamiWithApiToken } = await import('./open-api-client.js');
                 const identity = await whoamiWithApiToken({
                     token: requireApiToken(tokenValues, process.env, 'whoami', { apiUrl }),
                     apiUrl,
+                    ...(org ? { org } : {}),
                 });
                 if (json) {
                     write(`${JSON.stringify(identity, null, 2)}\n`);
@@ -365,71 +439,127 @@ async function dispatch(parsed, write, writeErr) {
                 import('./auth.js'),
                 import('./mcp.js'),
             ]);
-            const credentials = await ensureFreshCredentials({ mcpUrl });
-            const tools = await listKodyTools({ mcpUrl });
+            const credentials = await ensureFreshCredentials({ mcpUrl, org });
+            const tools = await listKodyTools({ mcpUrl, org });
             if (json) {
                 write(`${JSON.stringify({
                     mcpUrl: credentials.mcpUrl,
+                    org: credentials.org ?? null,
                     protocol: modernMcpProtocolVersion,
                     scope: credentials.scope ?? null,
                     tools: tools.map((tool) => tool.name),
                 }, null, 2)}\n`);
                 return 0;
             }
-            write(`Connected to ${credentials.mcpUrl} (${modernMcpProtocolVersion})\nTools: ${tools.map((tool) => tool.name).join(', ') || '(none)'}\n`);
+            const orgLine = credentials.org ? `\norg: ${credentials.org}` : '';
+            write(`Connected to ${credentials.mcpUrl} (${modernMcpProtocolVersion})${orgLine}\nTools: ${tools.map((tool) => tool.name).join(', ') || '(none)'}\n`);
             return 0;
         }
         case 'search': {
+            const { resolveTarget } = await import('./target.js');
+            const target = resolveTarget({
+                command: 'search',
+                flag: typeof parsed.values.target === 'string' ? parsed.values.target : undefined,
+            });
             const query = parsed.positionals.join(' ').trim();
             const tokenValues = tokenFlagValues(parsed.values);
-            const apiUrl = apiUrlFrom({
+            let apiUrl = apiUrlFrom({
                 apiUrl: typeof parsed.values['api-url'] === 'string'
                     ? parsed.values['api-url']
                     : undefined,
             });
-            if (shouldUseApiToken({
-                tokenValues,
-                mcpUrl,
-                apiUrl,
-                allowEnvWithoutLogin: true,
-            })) {
-                const { searchWithApiToken } = await import('./open-api-client.js');
-                const result = await searchWithApiToken({
-                    token: requireApiToken(tokenValues, process.env, 'search', { apiUrl }),
+            let closeMock;
+            try {
+                if (target === 'mock') {
+                    const { ensureMockTarget } = await import('./mock/mock-server.js');
+                    const mock = await ensureMockTarget({
+                        resetStorage: parsed.values['reset-storage'] === true,
+                    });
+                    apiUrl = mock.apiUrl;
+                    closeMock = mock.started ? () => mock.server.close() : undefined;
+                    const { searchWithApiToken } = await import('./open-api-client.js');
+                    const result = await searchWithApiToken({
+                        token: mock.token,
+                        apiUrl,
+                        query: query || undefined,
+                        entity: typeof parsed.values.entity === 'string'
+                            ? parsed.values.entity
+                            : undefined,
+                        domain: typeof parsed.values.domain === 'string'
+                            ? parsed.values.domain
+                            : undefined,
+                        limit: typeof parsed.values.limit === 'string'
+                            ? Number(parsed.values.limit)
+                            : undefined,
+                    });
+                    write(formatToolResult(result, json));
+                    return result.isError ? 1 : 0;
+                }
+                if (shouldUseApiToken({
+                    tokenValues,
+                    mcpUrl,
                     apiUrl,
-                    query: query || undefined,
-                    entity: typeof parsed.values.entity === 'string' ? parsed.values.entity : undefined,
-                    domain: typeof parsed.values.domain === 'string' ? parsed.values.domain : undefined,
-                    limit: typeof parsed.values.limit === 'string'
-                        ? Number(parsed.values.limit)
-                        : undefined,
+                    allowEnvWithoutLogin: true,
+                    ...(org ? { org } : {}),
+                })) {
+                    const { searchWithApiToken } = await import('./open-api-client.js');
+                    const result = await searchWithApiToken({
+                        token: requireApiToken(tokenValues, process.env, 'search', { apiUrl }),
+                        apiUrl,
+                        ...(org ? { org } : {}),
+                        query: query || undefined,
+                        entity: typeof parsed.values.entity === 'string'
+                            ? parsed.values.entity
+                            : undefined,
+                        domain: typeof parsed.values.domain === 'string'
+                            ? parsed.values.domain
+                            : undefined,
+                        limit: typeof parsed.values.limit === 'string'
+                            ? Number(parsed.values.limit)
+                            : undefined,
+                    });
+                    write(formatToolResult(result, json));
+                    return result.isError ? 1 : 0;
+                }
+                const args = {};
+                if (query)
+                    args.query = query;
+                if (typeof parsed.values.entity === 'string')
+                    args.entity = parsed.values.entity;
+                if (typeof parsed.values.domain === 'string')
+                    args.domain = parsed.values.domain;
+                if (typeof parsed.values.limit === 'string')
+                    args.limit = Number(parsed.values.limit);
+                const { callKodyTool } = await import('./mcp.js');
+                const result = await callKodyTool({
+                    name: 'search',
+                    args,
+                    mcpUrl,
+                    ...(org ? { org } : {}),
                 });
                 write(formatToolResult(result, json));
                 return result.isError ? 1 : 0;
             }
-            const args = {};
-            if (query)
-                args.query = query;
-            if (typeof parsed.values.entity === 'string')
-                args.entity = parsed.values.entity;
-            if (typeof parsed.values.domain === 'string')
-                args.domain = parsed.values.domain;
-            if (typeof parsed.values.limit === 'string')
-                args.limit = Number(parsed.values.limit);
-            const { callKodyTool } = await import('./mcp.js');
-            const result = await callKodyTool({ name: 'search', args, mcpUrl });
-            write(formatToolResult(result, json));
-            return result.isError ? 1 : 0;
+            finally {
+                await closeMock?.();
+            }
         }
         case 'execute': {
+            const { resolveTarget } = await import('./target.js');
+            const target = resolveTarget({
+                command: 'execute',
+                flag: typeof parsed.values.target === 'string' ? parsed.values.target : undefined,
+            });
             const invoke = typeof parsed.values.invoke === 'string' ? parsed.values.invoke : undefined;
             const hasCodeFlag = typeof parsed.values.code === 'string';
             const hasFileFlag = typeof parsed.values.file === 'string';
             const positionalModule = parsed.positionals.join('\n').trim();
-            const local = parsed.values.local === true;
+            // --target mock always runs locally against the CLI mock (no cloud sandbox).
+            const local = parsed.values.local === true || target === 'mock';
             const tokenValues = tokenFlagValues(parsed.values);
-            if (local && invoke !== undefined) {
-                throw new Error('--invoke runs a saved package export in Kody; --local runs a module you provide (--code, --file, or a module string).');
+            const localPackageInvoke = invoke !== undefined ? await tryResolveLocalPackageInvoke(invoke) : null;
+            if (local && invoke !== undefined && !localPackageInvoke) {
+                throw new Error('--invoke runs a saved package export in Kody; --local runs a module you provide (--code, --file, or a module string). To test an unpublished package export, pass an export key from package.json#exports (e.g. `--invoke ./on-user-deleted`) from the package directory, or use --file.');
             }
             if (executeSourcesConflict({ invoke, hasCodeFlag, hasFileFlag, positionalModule })) {
                 throw new Error('--invoke cannot be combined with --code, --file, or a module string.');
@@ -438,23 +568,26 @@ async function dispatch(parsed, write, writeErr) {
                 assertLocalExecuteNodeEngine();
             const fileArg = hasFileFlag ? parsed.values.file : undefined;
             // `--code` wins over `--file`. Only attribute the path when the file is the source.
-            const modulePath = !hasCodeFlag && fileArg !== undefined && fileArg !== '-' ? fileArg : undefined;
-            const code = invoke !== undefined
+            const modulePath = localPackageInvoke?.modulePath ??
+                (!hasCodeFlag && fileArg !== undefined && fileArg !== '-' ? fileArg : undefined);
+            const code = invoke !== undefined && !localPackageInvoke
                 ? undefined
                 : hasCodeFlag
                     ? parsed.values.code
-                    : modulePath !== undefined
+                    : modulePath !== undefined && !localPackageInvoke
                         ? await readFile(modulePath, 'utf8')
-                        : fileArg === '-'
-                            ? await readStdin()
-                            : positionalModule || undefined;
+                        : localPackageInvoke
+                            ? await readFile(localPackageInvoke.modulePath, 'utf8')
+                            : fileArg === '-'
+                                ? await readStdin()
+                                : positionalModule || undefined;
             const credentials = parseCredentialFlags(Array.isArray(parsed.values.credential)
                 ? parsed.values.credential.filter((value) => typeof value === 'string')
                 : typeof parsed.values.credential === 'string'
                     ? [parsed.values.credential]
                     : undefined);
             const args = buildExecuteToolArgs({
-                invoke,
+                invoke: localPackageInvoke ? undefined : invoke,
                 code: typeof code === 'string' ? code : undefined,
                 paramsJson: typeof parsed.values.params === 'string' ? parsed.values.params : undefined,
                 conversationId: typeof parsed.values['conversation-id'] === 'string'
@@ -462,48 +595,215 @@ async function dispatch(parsed, write, writeErr) {
                     : undefined,
                 credentials,
             });
-            const apiUrl = apiUrlFrom({
+            let apiUrl = apiUrlFrom({
                 apiUrl: typeof parsed.values['api-url'] === 'string'
                     ? parsed.values['api-url']
                     : undefined,
             });
-            const useToken = local ||
-                shouldUseApiToken({
-                    tokenValues,
-                    mcpUrl,
-                    apiUrl,
-                    allowEnvWithoutLogin: true,
-                });
-            const result = local
-                ? await (await import('./local-execute.js')).runLocalExecute({
-                    code: args.code,
-                    ...(modulePath !== undefined ? { modulePath } : {}),
-                    params: args.params,
-                    conversationId: args.conversationId,
-                    ...(credentials !== undefined ? { credentials } : {}),
-                    token: await resolveLocalExecuteBearer({
+            let closeMock;
+            let mockToken;
+            try {
+                if (target === 'mock') {
+                    const { ensureMockTarget } = await import('./mock/mock-server.js');
+                    const mock = await ensureMockTarget({
+                        resetStorage: parsed.values['reset-storage'] === true,
+                        packageId: localPackageInvoke
+                            ? `local:${localPackageInvoke.kodyId}`
+                            : undefined,
+                    });
+                    apiUrl = mock.apiUrl;
+                    mockToken = mock.token;
+                    closeMock = mock.started ? () => mock.server.close() : undefined;
+                }
+                if (localPackageInvoke) {
+                    const { buildLocalPackageContext, runLocalPackageModule } = await import('./local-package-run.js');
+                    const result = await runLocalPackageModule({
+                        modulePath: localPackageInvoke.modulePath,
+                        params: args.params,
+                        token: mockToken ??
+                            (await resolveLocalExecuteBearer({
+                                tokenValues,
+                                mcpUrl,
+                                apiUrl,
+                                purpose: 'execute local package export',
+                                ...(org ? { org } : {}),
+                            })),
+                        apiUrl,
+                        target,
+                        packageContext: buildLocalPackageContext({
+                            kodyId: localPackageInvoke.kodyId,
+                            hostedUrl: 'http://127.0.0.1:0',
+                        }),
+                        allowPrivateNetwork: parsed.values['allow-private-network'] === true,
+                        onStatus: (message) => writeErr(`${message}\n`),
+                    });
+                    write(formatToolResult(result, json));
+                    return result.isError ? 1 : 0;
+                }
+                const useToken = local ||
+                    shouldUseApiToken({
                         tokenValues,
                         mcpUrl,
                         apiUrl,
-                        purpose: 'execute --local',
-                    }),
-                    apiUrl,
-                    allowPrivateNetwork: parsed.values['allow-private-network'] === true,
-                    onStatus: (message) => writeErr(`${message}\n`),
-                })
-                : useToken
-                    ? await (await import('./remote-execute.js')).runRemoteExecuteWithToken({
-                        code: typeof args.code === 'string' ? args.code : undefined,
-                        invoke,
+                        allowEnvWithoutLogin: true,
+                        ...(org ? { org } : {}),
+                    });
+                const result = local
+                    ? await (await import('./local-execute.js')).runLocalExecute({
+                        code: args.code,
+                        ...(modulePath !== undefined ? { modulePath } : {}),
                         params: args.params,
                         conversationId: args.conversationId,
                         ...(credentials !== undefined ? { credentials } : {}),
-                        token: requireApiToken(tokenValues, process.env, 'execute with an API token', { apiUrl }),
+                        token: mockToken ??
+                            (await resolveLocalExecuteBearer({
+                                tokenValues,
+                                mcpUrl,
+                                apiUrl,
+                                purpose: 'execute --local',
+                                ...(org ? { org } : {}),
+                            })),
                         apiUrl,
+                        ...(org ? { org } : {}),
+                        allowPrivateNetwork: parsed.values['allow-private-network'] === true,
+                        onStatus: (message) => writeErr(`${message}\n`),
                     })
-                    : await (await import('./mcp.js')).callKodyTool({ name: 'execute', args, mcpUrl });
-            write(formatToolResult(result, json));
-            return result.isError ? 1 : 0;
+                    : useToken
+                        ? await (await import('./remote-execute.js')).runRemoteExecuteWithToken({
+                            code: typeof args.code === 'string' ? args.code : undefined,
+                            invoke,
+                            params: args.params,
+                            conversationId: args.conversationId,
+                            ...(credentials !== undefined ? { credentials } : {}),
+                            token: requireApiToken(tokenValues, process.env, 'execute with an API token', { apiUrl }),
+                            apiUrl,
+                            ...(org ? { org } : {}),
+                        })
+                        : await (await import('./mcp.js')).callKodyTool({
+                            name: 'execute',
+                            args,
+                            mcpUrl,
+                            ...(org ? { org } : {}),
+                        });
+                write(formatToolResult(result, json));
+                return result.isError ? 1 : 0;
+            }
+            finally {
+                await closeMock?.();
+            }
+        }
+        case 'dev': {
+            const { resolveTarget } = await import('./target.js');
+            const { parseDevSubcommand, resolveDevAuth, runDevCheck, runDevEmit, runDevFetch, runDevJob, runDevServe, runDevWebhook, } = await import('./dev-command.js');
+            const target = resolveTarget({
+                command: 'dev',
+                flag: typeof parsed.values.target === 'string' ? parsed.values.target : undefined,
+            });
+            const { subcommand, rest } = parseDevSubcommand(parsed.positionals);
+            const tokenValues = tokenFlagValues(parsed.values);
+            const prodApiUrl = apiUrlFrom({
+                apiUrl: typeof parsed.values['api-url'] === 'string'
+                    ? parsed.values['api-url']
+                    : undefined,
+            });
+            const io = { stdout: write, stderr: writeErr };
+            const bodyPath = typeof parsed.values.body === 'string' ? parsed.values.body : undefined;
+            // `check` only bundles + validates the package tree; it never talks to
+            // mock/prod, so skip auth (and the mock server) to avoid leaking a listen
+            // handle that would keep the process alive after printing results.
+            if (subcommand === 'check') {
+                return await runDevCheck({ target, json, io });
+            }
+            const token = target === 'prod'
+                ? await resolveLocalExecuteBearer({
+                    tokenValues,
+                    mcpUrl,
+                    apiUrl: prodApiUrl,
+                    purpose: 'kody dev',
+                    ...(org ? { org } : {}),
+                })
+                : 'mock';
+            const auth = await resolveDevAuth({
+                target,
+                token,
+                apiUrl: prodApiUrl,
+                resetStorage: parsed.values['reset-storage'] === true,
+            });
+            const port = typeof parsed.values.port === 'string' ? Number(parsed.values.port) : undefined;
+            const appBasePath = typeof parsed.values['app-base-path'] === 'string'
+                ? parsed.values['app-base-path']
+                : undefined;
+            switch (subcommand) {
+                case 'serve':
+                    return await runDevServe({
+                        target,
+                        auth,
+                        port,
+                        appBasePath,
+                        allowPrivateNetwork: parsed.values['allow-private-network'] === true,
+                        io,
+                    });
+                case 'fetch': {
+                    const path = rest[0];
+                    if (!path) {
+                        throw new Error('Usage: kody dev fetch <path> [--method GET] [--body file.json]');
+                    }
+                    let body;
+                    if (bodyPath)
+                        body = await readFile(bodyPath, 'utf8');
+                    return await runDevFetch({
+                        target,
+                        auth,
+                        path,
+                        method: typeof parsed.values.method === 'string'
+                            ? parsed.values.method
+                            : undefined,
+                        body,
+                        port,
+                        appBasePath,
+                        json,
+                        io,
+                    });
+                }
+                case 'job': {
+                    const jobName = rest[0];
+                    if (!jobName)
+                        throw new Error('Usage: kody dev job <name>');
+                    return await runDevJob({ target, auth, jobName, json, io });
+                }
+                case 'webhook': {
+                    const webhookName = rest[0];
+                    if (!webhookName || !bodyPath) {
+                        throw new Error('Usage: kody dev webhook <name> --body file.json');
+                    }
+                    return await runDevWebhook({
+                        target,
+                        auth,
+                        webhookName,
+                        bodyPath,
+                        json,
+                        io,
+                    });
+                }
+                case 'emit': {
+                    const event = rest[0];
+                    if (!event || !bodyPath) {
+                        throw new Error('Usage: kody dev emit <event> --body event.json');
+                    }
+                    return await runDevEmit({
+                        target,
+                        auth,
+                        event,
+                        bodyPath,
+                        json,
+                        io,
+                    });
+                }
+                default: {
+                    const exhaustive = subcommand;
+                    throw new Error(`Unhandled kody dev subcommand: ${String(exhaustive)}`);
+                }
+            }
         }
         case 'api': {
             const operationId = parsed.positionals[0]?.trim() ?? '';
@@ -523,6 +823,7 @@ async function dispatch(parsed, write, writeErr) {
                 params,
                 token: requireApiToken(tokenValues, process.env, 'api', { apiUrl }),
                 apiUrl,
+                ...(org ? { org } : {}),
             });
             // Always JSON: mirrors MCP `api` structured results for agents/scripts.
             write(`${JSON.stringify(result, null, 2)}\n`);
@@ -562,6 +863,20 @@ async function readStdin() {
     }
     return Buffer.concat(chunks).toString('utf8');
 }
+async function tryResolveLocalPackageInvoke(invoke) {
+    const trimmed = invoke.trim();
+    if (!trimmed || trimmed.startsWith('kody:@'))
+        return null;
+    try {
+        const { loadPackageManifest, resolveExportModulePath } = await import('./package-manifest.js');
+        const manifest = await loadPackageManifest(process.cwd());
+        const modulePath = resolveExportModulePath(manifest, trimmed);
+        return { modulePath, kodyId: manifest.kodyId };
+    }
+    catch {
+        return null;
+    }
+}
 /** True when --invoke is set alongside any code source (--code, --file, or positional). */
 export function executeSourcesConflict(input) {
     return (input.invoke !== undefined &&
@@ -621,7 +936,9 @@ async function runAuthSetupGit(input) {
     });
     const tokenValues = tokenFlagValues(input.values);
     const mintScopes = scopes ?? setupGitDefaultScopes;
-    const hasLoginSession = loadCredentials(input.mcpUrl) != null;
+    const hasLoginSession = loadCredentials(input.mcpUrl, undefined, undefined, {
+        org: input.org,
+    }) != null;
     const result = await authSetupGit({
         apiUrl,
         mcpUrl: input.mcpUrl,
@@ -635,6 +952,7 @@ async function runAuthSetupGit(input) {
             mcpUrl: input.mcpUrl,
             apiUrl,
             tokenValues,
+            ...(input.org ? { org: input.org } : {}),
         }),
     });
     input.write([
@@ -685,6 +1003,7 @@ function bootstrapMinter(input) {
             mcpUrl: input.mcpUrl,
             apiUrl: input.apiUrl,
             allowEnvWithoutLogin: true,
+            ...(input.org ? { org: input.org } : {}),
         })) {
             const token = requireApiToken(input.tokenValues, process.env, 'auth bootstrap --scopes', {
                 apiUrl: input.apiUrl,
@@ -696,6 +1015,7 @@ function bootstrapMinter(input) {
                     apiUrl: input.apiUrl,
                     operationId: cliCredentialBootstrapOperationId,
                     params,
+                    ...(input.org ? { org: input.org } : {}),
                 });
             }
             catch (error) {
@@ -705,11 +1025,14 @@ function bootstrapMinter(input) {
                 throw error;
             }
         }
-        if (loadCredentials(input.mcpUrl)) {
+        if (loadCredentials(input.mcpUrl, undefined, undefined, {
+            org: input.org,
+        })) {
             return (await import('./mcp.js')).callKodyApiOperation({
                 operationId: cliCredentialBootstrapOperationId,
                 params,
                 mcpUrl: input.mcpUrl,
+                ...(input.org ? { org: input.org } : {}),
             });
         }
         throw new Error(`auth bootstrap --scopes mints with your current Kody credential, and none was found. Run \`kody login\` and retry, or from Kody MCP call \`${cliBootstrapMintCall(input.scopes, bootstrapMintLifetimeFields(input.lifetime))}\` and run the returned cli_command.`);
@@ -756,7 +1079,10 @@ export function shouldUseApiToken(input) {
     })) {
         return false;
     }
-    const loggedIn = input.hasSession ?? loadCredentials(input.mcpUrl) != null;
+    const loggedIn = input.hasSession ??
+        loadCredentials(input.mcpUrl, undefined, undefined, {
+            org: input.org,
+        }) != null;
     return !loggedIn;
 }
 //# sourceMappingURL=cli.js.map