@lanonasis/cli 3.9.13 → 3.9.14

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog - @lanonasis/cli
 
+## [3.9.14] - 2026-04-03
+
+### 🐛 Bug Fixes
+
+- **Platform key project commands now hit the live auth-gateway contract**: `api-keys projects create/list` now use `/api/v1/projects` and route to `auth.lanonasis.com`, matching the current auth-gateway surface instead of the stale `/api/v1/auth/api-keys/projects` path.
+- **Auth-gateway management calls no longer drift to the MCP/API host**: The CLI transport now treats `/api/v1/auth/api-keys/*` and `/api/v1/projects/*` as auth-gateway management endpoints, so token-authenticated key management requests consistently reach the auth service with the expected project scope header.
+- **Stale MCP and analytics subcommands now fail honestly**: Deprecated `api-keys mcp *` and `api-keys analytics *` commands no longer call nonexistent gateway routes. They now exit immediately with explicit guidance toward the supported dashboard and service-scoping paths.
+
+### ✨ Improvements
+
+- **`key_context` is now exposed in CLI key management**: `api-keys create` accepts `--key-context personal|team|enterprise`, and `api-keys list/get` now display the stored key context so context-bound platform keys are visible and intentional at the CLI layer.
+
 ## [3.9.13] - 2026-04-02
 
 ### 🐛 Bug Fixes

package/dist/commands/api-keys.js

@@ -16,7 +16,9 @@ const colors = {
     highlight: chalk.white.bold
 };
 const AUTH_API_KEYS_BASE = '/api/v1/auth/api-keys';
+const PROJECTS_API_BASE = '/api/v1/projects';
 const VALID_ACCESS_LEVELS = ['public', 'authenticated', 'team', 'admin', 'enterprise'];
+const VALID_KEY_CONTEXTS = ['personal', 'team', 'enterprise'];
 function unwrapApiResponse(response) {
     if (response && typeof response === 'object' && 'data' in response) {
         return response.data ?? response;
@@ -33,6 +35,26 @@ function parseScopes(scopes) {
         .filter(Boolean);
     return parsed.length > 0 ? parsed : undefined;
 }
+function parseKeyContext(keyContext) {
+    if (!keyContext) {
+        return undefined;
+    }
+    const normalized = keyContext.trim().toLowerCase();
+    if (!normalized) {
+        return undefined;
+    }
+    if (VALID_KEY_CONTEXTS.includes(normalized)) {
+        return normalized;
+    }
+    throw new Error('Invalid key context. Allowed: personal, team, enterprise');
+}
+function exitUnsupported(feature, guidance) {
+    console.error(colors.error(`✖ ${feature} is not exposed by the current auth-gateway API.`));
+    for (const line of guidance) {
+        console.error(colors.muted(`  • ${line}`));
+    }
+    process.exit(1);
+}
 const apiKeysCommand = new Command('api-keys')
     .alias('keys')
     .description(colors.info('🔐 Manage API keys securely with enterprise-grade encryption'));
@@ -83,7 +105,7 @@ projectsCommand
             ]);
             projectData = { ...projectData, ...answers };
         }
-        const projectRes = await apiClient.post(`${AUTH_API_KEYS_BASE}/projects`, projectData);
+        const projectRes = await apiClient.post(PROJECTS_API_BASE, projectData);
         const project = unwrapApiResponse(projectRes);
         console.log(chalk.green('✅ Project created successfully!'));
         console.log(chalk.blue(`Project ID: ${project.id}`));
@@ -104,7 +126,7 @@ projectsCommand
     .option('--json', 'Output as JSON')
     .action(async (options) => {
     try {
-        const projects = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/projects`));
+        const projects = unwrapApiResponse(await apiClient.get(PROJECTS_API_BASE));
         if (options.json) {
             console.log(JSON.stringify(projects, null, 2));
             return;
@@ -143,12 +165,14 @@ apiKeysCommand
     .option('-n, --name <name>', 'API key name')
     .option('-d, --description <description>', 'API key description (optional)')
     .option('--access-level <level>', 'Access level (public, authenticated, team, admin, enterprise)', 'team')
+    .option('--key-context <context>', 'Optional memory context (personal, team, enterprise)')
     .option('--expires-in-days <days>', 'Expiration in days (default: 365)', '365')
     .option('--scopes <scopes>', 'Comma-separated scopes (optional)')
     .option('--interactive', 'Interactive mode')
     .action(async (options) => {
     try {
         const accessLevel = (options.accessLevel || 'team').toLowerCase();
+        const keyContext = parseKeyContext(options.keyContext);
         const expiresInDays = parseInt(options.expiresInDays, 10);
         if (!VALID_ACCESS_LEVELS.includes(accessLevel)) {
             throw new Error('Invalid access level. Allowed: public, authenticated, team, admin, enterprise');
@@ -159,6 +183,7 @@ apiKeysCommand
         let keyData = {
             name: options.name,
             access_level: accessLevel,
+            key_context: keyContext,
             expires_in_days: expiresInDays,
             description: options.description?.trim() || undefined,
             scopes: parseScopes(options.scopes)
@@ -185,6 +210,16 @@ apiKeysCommand
                     choices: VALID_ACCESS_LEVELS,
                     default: keyData.access_level
                 },
+                {
+                    type: 'select',
+                    name: 'key_context',
+                    message: 'Memory context:',
+                    choices: [
+                        { name: 'legacy / unbounded (default)', value: '' },
+                        ...VALID_KEY_CONTEXTS.map((context) => ({ name: context, value: context })),
+                    ],
+                    default: keyData.key_context || ''
+                },
                 {
                     type: 'number',
                     name: 'expires_in_days',
@@ -202,6 +237,7 @@ apiKeysCommand
             keyData = {
                 ...keyData,
                 ...answers,
+                key_context: parseKeyContext(typeof answers.key_context === 'string' ? answers.key_context : undefined) ?? keyData.key_context,
                 description: typeof answers.description === 'string'
                     ? answers.description.trim() || undefined
                     : keyData.description,
@@ -214,6 +250,7 @@ apiKeysCommand
         console.log(`${colors.highlight('Key ID:')} ${colors.primary(apiKey.id)}`);
         console.log(`${colors.highlight('Name:')} ${colors.accent(apiKey.name)}`);
         console.log(`${colors.highlight('Access Level:')} ${colors.info(apiKey.access_level || keyData.access_level)}`);
+        console.log(`${colors.highlight('Key Context:')} ${colors.info(apiKey.key_context || keyData.key_context || 'legacy')}`);
         console.log(`${colors.highlight('Permissions:')} ${colors.muted((apiKey.permissions || keyData.scopes || []).join(', ') || 'legacy:full_access')}`);
         if (apiKey.expires_at) {
             console.log(`${colors.highlight('Expires At:')} ${colors.warning(formatDate(apiKey.expires_at))}`);
@@ -258,7 +295,7 @@ apiKeysCommand
         console.log(colors.primary('🔐 API Key Management'));
         console.log(colors.info('═'.repeat(80)));
         const table = new Table({
-            head: ['ID', 'Name', 'Access', 'Permissions', 'Service', 'Status', 'Expires'].map(h => colors.accent(h)),
+            head: ['ID', 'Name', 'Access', 'Context', 'Permissions', 'Service', 'Status', 'Expires'].map(h => colors.accent(h)),
             style: { head: [], border: [] }
         });
         apiKeys.forEach((key) => {
@@ -267,6 +304,7 @@ apiKeysCommand
                 truncateText(key.id, 20),
                 key.name,
                 key.access_level,
+                key.key_context || 'legacy',
                 truncateText((key.permissions || []).join(', ') || 'legacy:full_access', 28),
                 key.service || 'all',
                 statusColor(key.is_active ? 'active' : 'inactive'),
@@ -303,6 +341,7 @@ apiKeysCommand
             console.log(`${colors.highlight('Description:')} ${colors.muted(apiKey.description)}`);
         }
         console.log(`${colors.highlight('Access Level:')} ${colors.warning(apiKey.access_level)}`);
+        console.log(`${colors.highlight('Key Context:')} ${colors.info(apiKey.key_context || 'legacy')}`);
         console.log(`${colors.highlight('Permissions:')} ${colors.muted((apiKey.permissions || []).join(', ') || 'legacy:full_access')}`);
         console.log(`${colors.highlight('Service Scope:')} ${colors.info(apiKey.service || 'all')}`);
         const statusColor = apiKey.is_active ? colors.success : colors.error;
@@ -496,164 +535,23 @@ mcpCommand
     .option('--risk-level <level>', 'Risk level (low, medium, high, critical)', 'medium')
     .option('--interactive', 'Interactive mode')
     .action(async (options) => {
-    try {
-        let toolData = {
-            toolId: options.toolId,
-            toolName: options.toolName,
-            organizationId: options.organizationId,
-            permissions: {
-                keys: options.keys ? options.keys.split(',').map((k) => k.trim()) : [],
-                environments: options.environments ? options.environments.split(',').map((e) => e.trim()) : ['development'],
-                maxConcurrentSessions: parseInt(options.maxSessions),
-                maxSessionDuration: parseInt(options.maxDuration)
-            },
-            webhookUrl: options.webhookUrl,
-            autoApprove: options.autoApprove || false,
-            riskLevel: options.riskLevel
-        };
-        if (options.interactive || !toolData.toolId || !toolData.toolName || !toolData.organizationId) {
-            const answers = await inquirer.prompt([
-                {
-                    type: 'input',
-                    name: 'toolId',
-                    message: 'Tool ID:',
-                    when: !toolData.toolId,
-                    validate: (input) => input.length > 0 || 'Tool ID is required'
-                },
-                {
-                    type: 'input',
-                    name: 'toolName',
-                    message: 'Tool name:',
-                    when: !toolData.toolName,
-                    validate: (input) => input.length > 0 || 'Tool name is required'
-                },
-                {
-                    type: 'input',
-                    name: 'organizationId',
-                    message: 'Organization ID:',
-                    when: !toolData.organizationId,
-                    validate: (input) => {
-                        const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-                        return uuidRegex.test(input) || 'Please enter a valid UUID';
-                    }
-                },
-                {
-                    type: 'input',
-                    name: 'keys',
-                    message: 'Accessible key names (comma-separated):',
-                    filter: (input) => input.split(',').map((k) => k.trim()),
-                    when: toolData.permissions.keys.length === 0
-                },
-                {
-                    type: 'checkbox',
-                    name: 'environments',
-                    message: 'Accessible environments:',
-                    choices: ['development', 'staging', 'production'],
-                    default: ['development']
-                },
-                {
-                    type: 'number',
-                    name: 'maxConcurrentSessions',
-                    message: 'Maximum concurrent sessions:',
-                    default: 3,
-                    validate: (input) => input > 0 && input <= 10 || 'Must be between 1 and 10'
-                },
-                {
-                    type: 'number',
-                    name: 'maxSessionDuration',
-                    message: 'Maximum session duration (seconds):',
-                    default: 900,
-                    validate: (input) => input >= 60 && input <= 3600 || 'Must be between 60 and 3600 seconds'
-                },
-                {
-                    type: 'input',
-                    name: 'webhookUrl',
-                    message: 'Webhook URL (optional):'
-                },
-                {
-                    type: 'confirm',
-                    name: 'autoApprove',
-                    message: 'Enable auto-approval?',
-                    default: false
-                },
-                {
-                    type: 'select',
-                    name: 'riskLevel',
-                    message: 'Risk level:',
-                    choices: ['low', 'medium', 'high', 'critical'],
-                    default: 'medium'
-                }
-            ]);
-            if (answers.keys)
-                toolData.permissions.keys = answers.keys;
-            if (answers.environments)
-                toolData.permissions.environments = answers.environments;
-            if (answers.maxConcurrentSessions)
-                toolData.permissions.maxConcurrentSessions = answers.maxConcurrentSessions;
-            if (answers.maxSessionDuration)
-                toolData.permissions.maxSessionDuration = answers.maxSessionDuration;
-            toolData = { ...toolData, ...answers };
-            delete toolData.keys;
-            delete toolData.environments;
-            delete toolData.maxConcurrentSessions;
-            delete toolData.maxSessionDuration;
-        }
-        const tool = unwrapApiResponse(await apiClient.post(`${AUTH_API_KEYS_BASE}/mcp/tools`, toolData));
-        console.log(colors.success('🤖 MCP tool registered successfully!'));
-        console.log(colors.info('━'.repeat(50)));
-        console.log(`${colors.highlight('Tool ID:')} ${colors.primary(tool.toolId)}`);
-        console.log(`${colors.highlight('Name:')} ${colors.accent(tool.toolName)}`);
-        console.log(`${colors.highlight('Risk Level:')} ${colors.warning(tool.riskLevel)}`);
-        console.log(`${colors.highlight('Auto Approve:')} ${tool.autoApprove ? colors.success('Yes') : colors.error('No')}`);
-        console.log(colors.info('━'.repeat(50)));
-    }
-    catch (error) {
-        console.error(colors.error('✖ Failed to register MCP tool:'), colors.muted(error.message));
-        process.exit(1);
-    }
+    void options;
+    exitUnsupported('MCP tool registration', [
+        'No /api/v1/auth/api-keys/mcp/* routes exist on the current auth-gateway.',
+        'Use API key service scoping instead: lanonasis api-keys create or update plus /service-scopes support on the gateway.',
+        'Manage MCP-specific workflows from the dashboard until dedicated routes are exposed.',
+    ]);
 });
 mcpCommand
     .command('list-tools')
     .description('List registered MCP tools')
     .option('--json', 'Output as JSON')
     .action(async (options) => {
-    try {
-        const tools = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/mcp/tools`));
-        if (options.json) {
-            console.log(JSON.stringify(tools, null, 2));
-            return;
-        }
-        if (!Array.isArray(tools) || tools.length === 0) {
-            console.log(colors.warning('⚠️  No MCP tools found'));
-            console.log(colors.muted('Run: lanonasis api-keys mcp register-tool'));
-            return;
-        }
-        console.log(colors.primary('🤖 Registered MCP Tools'));
-        console.log(colors.info('═'.repeat(80)));
-        const table = new Table({
-            head: ['Tool ID', 'Name', 'Risk Level', 'Status', 'Auto Approve', 'Created'].map(h => colors.accent(h)),
-            style: { head: [], border: [] }
-        });
-        tools.forEach((tool) => {
-            const statusColor = tool.status === 'active' ? colors.success :
-                tool.status === 'suspended' ? colors.error : colors.warning;
-            table.push([
-                tool.toolId,
-                tool.toolName,
-                tool.riskLevel,
-                statusColor(tool.status),
-                tool.autoApprove ? colors.success('Yes') : colors.error('No'),
-                formatDate(tool.createdAt)
-            ]);
-        });
-        console.log(table.toString());
-        console.log(colors.info('═'.repeat(80)));
-        console.log(colors.muted(`🤖 Total: ${colors.highlight(tools.length)} MCP tools`));
-    }
-    catch (error) {
-        console.error(colors.error('✖ Failed to list MCP tools:'), colors.muted(error.message));
-        process.exit(1);
-    }
+    void options;
+    exitUnsupported('MCP tool listing', [
+        'No /api/v1/auth/api-keys/mcp/* routes exist on the current auth-gateway.',
+        'The current gateway exposes configured external services at /api/v1/auth/api-keys/services/configured.',
+    ]);
 });
 mcpCommand
     .command('request-access')
@@ -666,82 +564,11 @@ mcpCommand
     .option('--duration <seconds>', 'Estimated duration in seconds', '900')
     .option('--interactive', 'Interactive mode')
     .action(async (options) => {
-    try {
-        let requestData = {
-            toolId: options.toolId,
-            organizationId: options.organizationId,
-            keyNames: options.keys ? options.keys.split(',').map((k) => k.trim()) : [],
-            environment: options.environment,
-            justification: options.justification,
-            estimatedDuration: parseInt(options.duration),
-            context: {}
-        };
-        if (options.interactive || !requestData.toolId || !requestData.organizationId ||
-            requestData.keyNames.length === 0 || !requestData.environment || !requestData.justification) {
-            const mcpTools = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/mcp/tools`));
-            const tools = Array.isArray(mcpTools) ? mcpTools : [];
-            const answers = await inquirer.prompt([
-                {
-                    type: 'select',
-                    name: 'toolId',
-                    message: 'Select MCP tool:',
-                    when: !requestData.toolId && tools.length > 0,
-                    choices: tools.map((t) => ({ name: `${t.toolName} (${t.toolId})`, value: t.toolId }))
-                },
-                {
-                    type: 'input',
-                    name: 'organizationId',
-                    message: 'Organization ID:',
-                    when: !requestData.organizationId,
-                    validate: (input) => {
-                        const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-                        return uuidRegex.test(input) || 'Please enter a valid UUID';
-                    }
-                },
-                {
-                    type: 'input',
-                    name: 'keyNames',
-                    message: 'Key names to access (comma-separated):',
-                    when: requestData.keyNames.length === 0,
-                    filter: (input) => input.split(',').map((k) => k.trim()),
-                    validate: (input) => input.length > 0 || 'At least one key name is required'
-                },
-                {
-                    type: 'select',
-                    name: 'environment',
-                    message: 'Environment:',
-                    when: !requestData.environment,
-                    choices: ['development', 'staging', 'production']
-                },
-                {
-                    type: 'input',
-                    name: 'justification',
-                    message: 'Justification for access:',
-                    when: !requestData.justification,
-                    validate: (input) => input.length > 0 || 'Justification is required'
-                },
-                {
-                    type: 'number',
-                    name: 'estimatedDuration',
-                    message: 'Estimated duration (seconds):',
-                    default: 900,
-                    validate: (input) => input >= 60 && input <= 3600 || 'Must be between 60 and 3600 seconds'
-                }
-            ]);
-            requestData = { ...requestData, ...answers };
-        }
-        const response = unwrapApiResponse(await apiClient.post(`${AUTH_API_KEYS_BASE}/mcp/request-access`, requestData));
-        console.log(colors.success('🔐 Access request created successfully!'));
-        console.log(colors.info('━'.repeat(50)));
-        console.log(`${colors.highlight('Request ID:')} ${colors.primary(response.requestId)}`);
-        console.log(`${colors.highlight('Status:')} ${colors.accent(response.status)}`);
-        console.log(colors.info('━'.repeat(50)));
-        console.log(colors.warning('💡 Check the status with: lanonasis api-keys analytics usage'));
-    }
-    catch (error) {
-        console.error(colors.error('✖ Failed to create access request:'), colors.muted(error.message));
-        process.exit(1);
-    }
+    void options;
+    exitUnsupported('MCP access requests', [
+        'No /api/v1/auth/api-keys/mcp/* routes exist on the current auth-gateway.',
+        'Use platform API keys plus service scoping for current gateway-backed access control.',
+    ]);
 });
 // ============================================================================
 // ANALYTICS COMMANDS
@@ -755,48 +582,11 @@ analyticsCommand
     .option('--days <days>', 'Number of days to look back', '30')
     .option('--json', 'Output as JSON')
     .action(async (options) => {
-    try {
-        let url = `${AUTH_API_KEYS_BASE}/analytics/usage`;
-        const params = new URLSearchParams();
-        if (options.keyId)
-            params.append('keyId', options.keyId);
-        if (options.days)
-            params.append('days', options.days);
-        if (params.toString()) {
-            url += `?${params.toString()}`;
-        }
-        const analytics = unwrapApiResponse(await apiClient.get(url));
-        if (options.json) {
-            console.log(JSON.stringify(analytics, null, 2));
-            return;
-        }
-        if (!Array.isArray(analytics) || analytics.length === 0) {
-            console.log(chalk.yellow('No usage data found'));
-            return;
-        }
-        const table = new Table({
-            head: ['Key ID', 'Operation', 'Tool ID', 'Success', 'Timestamp'].map(h => chalk.cyan(h)),
-            style: { head: [], border: [] }
-        });
-        analytics.forEach((entry) => {
-            const successColor = entry.success ? colors.success('✓') : colors.error('✗');
-            table.push([
-                truncateText(entry.keyId || '-', 20),
-                entry.operation,
-                truncateText(entry.toolId || '-', 15),
-                successColor,
-                formatDate(entry.timestamp)
-            ]);
-        });
-        console.log(table.toString());
-        console.log(colors.info('═'.repeat(80)));
-        console.log(colors.muted(`📈 Total: ${colors.highlight(analytics.length)} events`));
-    }
-    catch (error) {
-        const errorMessage = error instanceof Error ? error.message : String(error);
-        console.error(colors.error('✖ Failed to get usage analytics:'), colors.muted(errorMessage));
-        process.exit(1);
-    }
+    void options;
+    exitUnsupported('API key usage analytics', [
+        'No /api/v1/auth/api-keys/analytics/* routes exist on the current auth-gateway.',
+        'Use dashboard reporting or direct platform logs until analytics endpoints are exposed.',
+    ]);
 });
 analyticsCommand
     .command('security-events')
@@ -804,47 +594,11 @@ analyticsCommand
     .option('--severity <level>', 'Filter by severity (low, medium, high, critical)')
     .option('--json', 'Output as JSON')
     .action(async (options) => {
-    try {
-        let url = `${AUTH_API_KEYS_BASE}/analytics/security-events`;
-        if (options.severity) {
-            url += `?severity=${options.severity}`;
-        }
-        const events = unwrapApiResponse(await apiClient.get(url));
-        if (options.json) {
-            console.log(JSON.stringify(events, null, 2));
-            return;
-        }
-        if (!Array.isArray(events) || events.length === 0) {
-            console.log(colors.success('✅ No security events found'));
-            return;
-        }
-        console.log(colors.primary('🛡️  Security Events Monitor'));
-        console.log(colors.info('═'.repeat(80)));
-        const table = new Table({
-            head: ['Event Type', 'Severity', 'Description', 'Resolved', 'Timestamp'].map(h => colors.accent(h)),
-            style: { head: [], border: [] }
-        });
-        events.forEach((event) => {
-            const severityColor = event.severity === 'critical' ? colors.error :
-                event.severity === 'high' ? colors.accent :
-                    event.severity === 'medium' ? colors.warning : colors.success;
-            table.push([
-                event.eventType,
-                severityColor(event.severity.toUpperCase()),
-                truncateText(event.description, 40),
-                event.resolved ? colors.success('✓') : colors.warning('Pending'),
-                formatDate(event.timestamp)
-            ]);
-        });
-        console.log(table.toString());
-        console.log(colors.info('═'.repeat(80)));
-        console.log(colors.muted(`🛡️  Total: ${colors.highlight(events.length)} security events`));
-    }
-    catch (error) {
-        const errorMessage = error instanceof Error ? error.message : String(error);
-        console.error(colors.error('✖ Failed to get security events:'), colors.muted(errorMessage));
-        process.exit(1);
-    }
+    void options;
+    exitUnsupported('API key security event analytics', [
+        'No /api/v1/auth/api-keys/analytics/* routes exist on the current auth-gateway.',
+        'Use dashboard security reporting until gateway analytics endpoints are exposed.',
+    ]);
 });
 // Add subcommands
 apiKeysCommand.addCommand(projectsCommand);

package/dist/commands/auth.js

@@ -662,8 +662,31 @@ async function handleOAuthFlow(config) {
         }
     ]);
     if (!openBrowser) {
-        console.log(chalk.yellow('⚠️  Authentication cancelled'));
-        return;
+        // Fallback: manual token paste for headless/remote environments
+        console.log();
+        console.log(chalk.cyan('📋 Manual Token Authentication'));
+        console.log(chalk.gray('Open this URL in any browser to authenticate:'));
+        const authBase = config.getDiscoveredApiUrl();
+        console.log(chalk.white(`  ${authBase}/auth/cli-login`));
+        console.log();
+        console.log(chalk.gray('After logging in, expand "Headless/Remote?" to copy the token, then paste it below.'));
+        console.log();
+        const { token } = await inquirer.prompt([
+            {
+                type: 'password',
+                name: 'token',
+                message: 'Paste token:',
+                mask: '*',
+                validate: (input) => input.trim().length > 0 || 'Token is required',
+            }
+        ]);
+        const trimmed = token.trim();
+        await config.setToken(trimmed);
+        await config.set('authMethod', 'jwt');
+        console.log();
+        console.log(chalk.green('✓ Token saved successfully'));
+        console.log(colors.info('You can now use all Lanonasis services'));
+        process.exit(0);
     }
     try {
         // Generate PKCE challenge

package/dist/utils/api.js

@@ -280,6 +280,9 @@ export class APIClient {
             await this.config.discoverServices();
             // Use appropriate base URL based on endpoint and auth method
             const isAuthEndpoint = config.url?.includes('/auth/') || config.url?.includes('/login') || config.url?.includes('/register') || config.url?.includes('/oauth/');
+            const isAuthGatewayManagementEndpoint = typeof config.url === 'string'
+                && (config.url.startsWith('/api/v1/auth/api-keys')
+                    || config.url.startsWith('/api/v1/projects'));
             const discoveredServices = this.config.get('discoveredServices');
             const authMethod = this.config.get('authMethod');
             const vendorKey = await this.config.getVendorKeyAsync();
@@ -322,7 +325,7 @@ export class APIClient {
             // - Other direct API calls -> api.lanonasis.com (vendor AI proxy)
             let apiBaseUrl;
             const useMcpServer = !forceDirectApi && !isAuthEndpoint && (prefersTokenAuth || useVendorKeyAuth || isMemoryEndpoint);
-            if (isAuthEndpoint) {
+            if (isAuthEndpoint || isAuthGatewayManagementEndpoint) {
                 apiBaseUrl = discoveredServices?.auth_base || 'https://auth.lanonasis.com';
             }
             else if (forceDirectApi) {
@@ -343,7 +346,7 @@ export class APIClient {
                 config.url = config.url.replace(/\/api\/v1\/memories/g, '/memory');
             }
             // Add project scope header for auth endpoints
-            if (isAuthEndpoint) {
+            if (isAuthEndpoint || isAuthGatewayManagementEndpoint) {
                 config.headers['X-Project-Scope'] = 'lanonasis-maas';
             }
             // Enhanced Authentication Support

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanonasis/cli",
-  "version": "3.9.13",
+  "version": "3.9.14",
   "description": "Professional CLI for LanOnasis Memory as a Service (MaaS) with MCP support, seamless inline editing, and enterprise-grade security",
   "keywords": [
     "lanonasis",