@seclai/cli 1.1.0 → 1.2.0

package/dist/cli.js

@@ -72,6 +72,9 @@ function getCliVersion() {
 function createClient(opts) {
   const seclaiOpts = {};
   if (opts.apiKey !== void 0) seclaiOpts.apiKey = opts.apiKey;
+  if (opts.profile !== void 0) seclaiOpts.profile = opts.profile;
+  if (opts.configDir !== void 0) seclaiOpts.configDir = opts.configDir;
+  if (opts.accountId !== void 0) seclaiOpts.accountId = opts.accountId;
   const envUrl = process2.env.SECLAI_API_URL;
   seclaiOpts.baseUrl = envUrl && envUrl.length > 0 ? envUrl : "https://api.seclai.com";
   return new Seclai(seclaiOpts);
@@ -302,8 +305,8 @@ function register(program, rt) {
   agents.command("upload-input").description("Upload a file as agent input.").argument("<agentId>", "Agent ID.").requiredOption("--file <path>", "File to upload.").option("--file-name <name>", "Override filename.").option("--mime-type <type>", "MIME type.").action(async (agentId, opts) => {
     await run(rt, async () => {
       const client = createClient(program.opts());
-      const { readFile: readFile2 } = await import("fs/promises");
-      const bytes = new Uint8Array(await readFile2(opts.file));
+      const { readFile: readFile5 } = await import("fs/promises");
+      const bytes = new Uint8Array(await readFile5(opts.file));
       const o = { file: bytes };
       if (opts.fileName) o.fileName = opts.fileName;
       if (opts.mimeType) o.mimeType = opts.mimeType;
@@ -362,9 +365,11 @@ function register2(program, rt) {
   const sources = program.command("sources").alias("source").description("Manage content sources.");
   sources.command("list").description("List sources.").option("--page <n>", "Page number.", (v) => Number(v)).option("--limit <n>", "Page size.", (v) => Number(v)).option("--sort <field>", "Sort field.").option("--order <asc|desc>", "Sort direction.").option("--account-id <id>", "Filter by account ID.").action(async (opts) => {
     await run(rt, async () => {
-      const client = createClient(program.opts());
+      const globalOpts = program.opts();
+      const client = createClient(globalOpts);
       const o = listOpts(opts);
-      if (opts.accountId) o.accountId = opts.accountId;
+      const acctId = opts.accountId || globalOpts.accountId;
+      if (acctId) o.accountId = acctId;
       printJson(rt, await client.listSources(o));
     });
   });
@@ -1172,35 +1177,42 @@ The Seclai CLI (\`seclai\` / \`npx @seclai/cli\`) manages agents, knowledge base
 
 All commands output JSON to stdout. Pipe into \`jq\` for filtering.
 
+## Quick start
+
+\`\`\`bash
+# authenticate
+export SECLAI_API_KEY="sk-..."
+
+# create an agent
+seclai agents create --json '{"name":"My Agent","description":"QA chatbot"}'
+
+# configure steps via AI assistant
+seclai agents ai gen-steps <agentId> --user-input "Build a QA chatbot that uses a knowledge base"
+
+# accept the generated plan
+seclai agents ai mark <agentId> <conversationId> --json '{"accepted":true}'
+
+# run the agent
+seclai agents run <agentId> --json '{"input":"How do I reset my password?"}' --stream
+
+# list runs
+seclai agents runs list <agentId>
+\`\`\`
+
 ## Authentication
 
 Set \`SECLAI_API_KEY\` env var or pass \`--api-key <key>\`.
 Override the API URL with \`SECLAI_API_URL\` (default: https://api.seclai.com).
 
-## Quick Reference
-
-| Domain | Command | Description |
-|--------|---------|-------------|
-| Agents | \`seclai agents list/create/get/update/delete\` | Manage agents |
-| Agent Runs | \`seclai agents run <id> --json '...'\` | Run an agent |
-| Agent Runs | \`seclai agents runs list/get/delete/cancel/search\` | Manage runs |
-| Agent Def | \`seclai agents def get/update\` | Agent step definitions |
-| Sources | \`seclai sources list/create/get/update/delete/upload/upload-text\` | Content sources |
-| Source Exports | \`seclai sources exports list/create/get/cancel/delete/download/estimate\` | Export management |
-| Contents | \`seclai contents get/delete/upload/replace-text/embeddings\` | Indexed content |
-| Knowledge Bases | \`seclai kb list/create/get/update/delete\` | Knowledge bases |
-| Memory Banks | \`seclai memory list/create/get/update/delete/stats/agents/compact/templates\` | Memory banks |
-| Evaluations | \`seclai evals criteria list/create/get/update/delete/summary\` | Eval criteria |
-| Evaluations | \`seclai evals results list/create\` | Eval results |
-| Solutions | \`seclai solutions list/create/get/update/delete/link/unlink\` | Solutions |
-| Governance | \`seclai governance ai generate/list/accept/decline\` | Governance AI |
-| Alerts | \`seclai alerts list/get/status/comment/subscribe/unsubscribe\` | Alerts |
-| Alert Config | \`seclai alerts configs list/create/get/update/delete\` | Alert configs |
-| Models | \`seclai models alerts list/mark-read/mark-all-read/unread-count\` | Model alerts |
-| Search | \`seclai search --query "text"\` | Global search |
-| AI Assistant | \`seclai ai feedback/kb/source/solution/memory/accept/decline/memory-accept\` | AI assistant |
-
-## Common Patterns
+## Global options
+
+\`\`\`bash
+--api-key <key>    # Seclai API key (or set SECLAI_API_KEY)
+--compact          # Output compact single-line JSON
+-V, --version      # Print version
+\`\`\`
+
+## Common patterns
 
 ### JSON input
 Most create/update commands accept \`--json '{"key":"value"}'\` or \`--json-file path.json\`.
@@ -1208,76 +1220,45 @@ Use \`--json -\` or \`--json-file -\` to read from stdin.
 
 ### AI assistant shorthand
 AI generation commands accept \`--user-input <text>\` as shorthand for \`--json '{"user_input":"<text>"}'\`.
-\`\`\`bash
-seclai agents ai gen-steps <id> --user-input "Build a QA chatbot"
-seclai ai kb --user-input "Create a support knowledge base"
-\`\`\`
-
-### Compact output
-Use \`--compact\` for single-line JSON output (useful for scripting):
-\`\`\`bash
-seclai agents list --compact | jq -c '.[]'
-\`\`\`
 
 ### Pagination
 List commands support \`--page <n>\` and \`--limit <n>\`. Some also support \`--sort <field>\` and \`--order asc|desc\`.
 
-### Streaming agent runs
-\`\`\`bash
-# Wait for completion via SSE, print final result
-seclai agents run <id> --json '{"input":"Hello"}' --stream
-
-# Stream individual SSE events as NDJSON
-seclai agents run <id> --json '{"input":"Hello"}' --events
-
-# Filter event types
-seclai agents run <id> --json '{"input":"Hello"}' --events --event-filter "status,data"
-
-# Poll-based waiting
-seclai agents run <id> --json '{"input":"Hello"}' --poll --poll-interval-ms 2000
-\`\`\`
-
 ### File uploads
-\`\`\`bash
-seclai sources upload <sourceId> --file ./doc.pdf --title "My Doc" --metadata '{"category":"docs"}'
-seclai contents upload <contentVersionId> --file ./updated.pdf
-\`\`\`
+Upload commands accept \`--file <path>\` (required), plus optional \`--title\`, \`--metadata '{"k":"v"}'\`, \`--metadata-file path.json\`, \`--file-name\`, \`--mime-type\`.
 
-## Detailed References
+## Commands
 
-- [Agents](references/agents.md) \u2014 CRUD, runs, definitions, AI assistant
-- [Sources](references/sources.md) \u2014 content sources, uploads, exports, migrations
-- [Knowledge Bases & Memory Banks](references/kb-memory.md) \u2014 KB CRUD, memory banks, compaction
-- [Evaluations & Solutions](references/evals-solutions.md) \u2014 criteria, results, solutions, links
-- [Alerts, Governance & More](references/alerts-governance.md) \u2014 alerts, governance, models, search, AI
-`;
-var AGENTS_SKILL = `# Seclai CLI \u2014 Agents
+### Agents
 
-## CRUD
 \`\`\`bash
 seclai agents list [--page N] [--limit N]
-seclai agents create --json '{"name":"My Agent",...}'
+seclai agents create --json '{"name":"My Agent","description":"..."}'
 seclai agents get <agentId>
-seclai agents update <agentId> --json '{"name":"Updated"}'
+seclai agents update <agentId> --json '{"name":"Renamed"}'
 seclai agents delete <agentId>
 \`\`\`
 
-## Running Agents
+### Running agents
+
 \`\`\`bash
-# Simple run
+# simple run \u2014 returns the final result
 seclai agents run <agentId> --json '{"input":"Hello"}'
 
-# Stream (wait for final result via SSE)
+# stream \u2014 wait for completion via SSE, print final result
 seclai agents run <agentId> --json '{"input":"Hello"}' --stream [--timeout-ms 60000]
 
-# Stream individual events as NDJSON
-seclai agents run <agentId> --json '{"input":"Hello"}' --events [--event-filter "status,data"] [--output full|data|status]
+# events \u2014 stream individual SSE events as NDJSON lines
+# --output: full (entire event), data (event data only), status (status events only)
+# --event-filter: comma-separated event types to include, e.g. "status,data"
+seclai agents run <agentId> --json '{"input":"Hello"}' --events [--output full|data|status] [--event-filter "status,data"]
 
-# Poll-based
+# poll \u2014 poll for completion
 seclai agents run <agentId> --json '{"input":"Hello"}' --poll [--poll-interval-ms 2000] [--include-step-outputs]
 \`\`\`
 
-## Runs Management
+### Agent runs
+
 \`\`\`bash
 seclai agents runs list <agentId> [--page N] [--limit N] [--status <status>]
 seclai agents runs get <runId> [--include-step-outputs]
@@ -1287,185 +1268,202 @@ seclai agents runs search --json '{"query":"..."}'
 seclai agents runs eval-results <agentId> <runId> [--page N] [--limit N]
 \`\`\`
 
-## Agent Definition
+### Agent definitions
+
 \`\`\`bash
 seclai agents def get <agentId>
-seclai agents def update <agentId> --json '{"steps":[...]}'
+seclai agents def update <agentId> --json '{"steps":[{"step_type":"llm","config":{...}}]}'
 \`\`\`
 
-## Input Uploads
+### Agent input uploads
+
 \`\`\`bash
 seclai agents upload-input <agentId> --file ./input.pdf [--file-name name] [--mime-type type]
 seclai agents input-status <agentId> <uploadId>
 \`\`\`
 
-## AI Assistant
+### Agent AI assistant
+
 \`\`\`bash
-seclai agents ai gen-steps <agentId> --user-input "Build a chat agent"
-seclai agents ai step-config <agentId> --json '{"step_type":"...",}'
+seclai agents ai gen-steps <agentId> --user-input "Build a QA chatbot"
+seclai agents ai step-config <agentId> --json '{"step_type":"llm","user_input":"Configure the LLM step"}'
 seclai agents ai history <agentId>
 seclai agents ai mark <agentId> <conversationId> --json '{"accepted":true}'
 \`\`\`
-`;
-var SOURCES_SKILL = `# Seclai CLI \u2014 Sources
 
-## CRUD
+### Sources
+
 \`\`\`bash
 seclai sources list [--page N] [--limit N] [--sort field] [--order asc|desc] [--account-id id]
-seclai sources create --json '{"name":"My Source",...}'
+seclai sources create --json '{"name":"Docs","description":"Product documentation"}'
 seclai sources get <sourceId>
-seclai sources update <sourceId> --json '{"name":"Updated"}'
+seclai sources update <sourceId> --json '{"name":"Updated Docs"}'
 seclai sources delete <sourceId>
 \`\`\`
 
-## File Upload
+### Source uploads
+
 \`\`\`bash
-seclai sources upload <sourceId> --file ./doc.pdf [--title "Title"] [--metadata '{"k":"v"}'] [--file-name name] [--mime-type type]
-seclai sources upload-text <sourceId> --json '{"text":"...","title":"..."}'
+seclai sources upload <sourceId> --file ./doc.pdf [--title "My Doc"] [--metadata '{"category":"docs"}'] [--file-name name] [--mime-type type]
+seclai sources upload-text <sourceId> --json '{"text":"Article content here...","title":"My Article"}'
 \`\`\`
 
-## Exports
+### Source exports
+
 \`\`\`bash
 seclai sources exports list <sourceId> [--page N] [--limit N]
-seclai sources exports create <sourceId> --json '{"format":"..."}'
+seclai sources exports create <sourceId> --json '{"format":"jsonl"}'
 seclai sources exports get <sourceId> <exportId>
 seclai sources exports cancel <sourceId> <exportId>
 seclai sources exports delete <sourceId> <exportId>
 seclai sources exports download <sourceId> <exportId>
-seclai sources exports estimate <sourceId> --json '{"format":"..."}'
+seclai sources exports estimate <sourceId> --json '{"format":"jsonl"}'
 \`\`\`
 
-## Embedding Migration
+### Embedding migration
+
 \`\`\`bash
 seclai sources migration get <sourceId>
-seclai sources migration start <sourceId> --json '{"target_model":"..."}'
+seclai sources migration start <sourceId> --json '{"target_model":"text-embedding-3-large"}'
 seclai sources migration cancel <sourceId>
 \`\`\`
-`;
-var KB_MEMORY_SKILL = `# Seclai CLI \u2014 Knowledge Bases & Memory Banks
 
-## Knowledge Bases
+### Contents (indexed content)
+
+\`\`\`bash
+seclai contents get <contentVersionId> [--start N] [--end N]
+seclai contents delete <contentVersionId>
+seclai contents upload <contentVersionId> --file ./updated.pdf [--title "Title"] [--file-name name] [--mime-type type]
+seclai contents replace-text <contentVersionId> --json '{"text":"Replacement text","title":"Updated"}'
+seclai contents embeddings <contentVersionId> [--page N] [--limit N]
+\`\`\`
+
+### Knowledge bases
+
 \`\`\`bash
 seclai kb list [--page N] [--limit N] [--sort field] [--order asc|desc]
-seclai kb create --json '{"name":"My KB",...}'
+seclai kb create --json '{"name":"Support KB","description":"Customer support articles"}'
 seclai kb get <kbId>
-seclai kb update <kbId> --json '{"name":"Updated"}'
+seclai kb update <kbId> --json '{"name":"Updated KB"}'
 seclai kb delete <kbId>
 \`\`\`
 
-## Memory Banks
+### Memory banks
+
 \`\`\`bash
 seclai memory list [--page N] [--limit N] [--sort field] [--order asc|desc]
-seclai memory create --json '{"name":"My Bank","type":"conversation"}'
+# type: "conversation" (chat history) or "general" (structured facts)
+seclai memory create --json '{"name":"Chat Memory","type":"conversation"}'
 seclai memory get <memoryBankId>
-seclai memory update <memoryBankId> --json '{"name":"Updated"}'
+seclai memory update <memoryBankId> --json '{"name":"Renamed"}'
 seclai memory delete <memoryBankId>
 \`\`\`
 
-## Memory Bank Utilities
+### Memory bank utilities
+
 \`\`\`bash
 seclai memory stats <memoryBankId>
 seclai memory agents <memoryBankId>
 seclai memory compact <memoryBankId>
 seclai memory delete-source <memoryBankId>
 seclai memory templates
-seclai memory test-compaction <memoryBankId> --json '{"prompt":"..."}'
-seclai memory test-compaction-standalone --json '{"prompt":"..."}'
+seclai memory test-compaction <memoryBankId> --json '{"prompt":"Summarize the conversation"}'
+seclai memory test-compaction-standalone --json '{"prompt":"Summarize the conversation"}'
 \`\`\`
 
-## Memory Bank AI
+### Memory bank AI
+
 \`\`\`bash
 seclai memory ai generate --user-input "Configure compaction for chat memory"
 seclai memory ai last
 seclai memory ai accept <conversationId> --json '{"accepted":true}'
 \`\`\`
-`;
-var EVALS_SOLUTIONS_SKILL = `# Seclai CLI \u2014 Evaluations & Solutions
 
-## Evaluation Criteria
+### Evaluations \u2014 criteria
+
 \`\`\`bash
 seclai evals criteria list <agentId> [--page N] [--limit N]
-seclai evals criteria create <agentId> --json '{"name":"Quality",...}'
+seclai evals criteria create <agentId> --json '{"name":"Response Quality","description":"...","eval_type":"llm_judge"}'
 seclai evals criteria get <criteriaId>
-seclai evals criteria update <criteriaId> --json '{"name":"Updated"}'
+seclai evals criteria update <criteriaId> --json '{"name":"Updated Criteria"}'
 seclai evals criteria delete <criteriaId>
 seclai evals criteria summary <criteriaId>
 \`\`\`
 
-## Evaluation Results
+### Evaluations \u2014 results & runs
+
 \`\`\`bash
 seclai evals results list <criteriaId> [--page N] [--limit N]
 seclai evals results create <criteriaId> --json '{"run_id":"...","score":0.9}'
-\`\`\`
-
-## Other Evaluation Commands
-\`\`\`bash
 seclai evals compatible-runs <criteriaId> [--page N] [--limit N]
-seclai evals test-draft <agentId> --json '{"criteria":{...},"run_id":"..."}'
+seclai evals test-draft <agentId> --json '{"criteria":{"name":"Test","eval_type":"llm_judge"},"run_id":"..."}'
 seclai evals agent-results <agentId> [--page N] [--limit N]
 seclai evals agent-runs <agentId> [--page N] [--limit N]
 seclai evals non-manual-summary <agentId>
 \`\`\`
 
-## Solutions
+### Solutions
+
 \`\`\`bash
 seclai solutions list [--page N] [--limit N] [--sort field] [--order asc|desc]
-seclai solutions create --json '{"name":"My Solution"}'
+seclai solutions create --json '{"name":"Customer Support Solution"}'
 seclai solutions get <solutionId>
 seclai solutions update <solutionId> --json '{"name":"Updated"}'
 seclai solutions delete <solutionId>
 \`\`\`
 
-## Solution Links
+### Solution links
+
 \`\`\`bash
-seclai solutions link <solutionId> --agents '["id1","id2"]' --kb '["id3"]' --sources '["id4"]'
-seclai solutions unlink <solutionId> --agents '["id1"]'
+# link resources \u2014 each flag takes a JSON array of IDs
+seclai solutions link <solutionId> --agents '["agentId1"]' --kb '["kbId1"]' --sources '["sourceId1"]'
+seclai solutions unlink <solutionId> --agents '["agentId1"]'
 \`\`\`
 
-## Solution Conversations
+### Solution conversations & AI
+
 \`\`\`bash
 seclai solutions convos list <solutionId>
-seclai solutions convos add <solutionId> --json '{"message":"..."}'
+seclai solutions convos add <solutionId> --json '{"message":"How should I structure this?"}'
 seclai solutions convos mark <solutionId> <conversationId> --json '{"accepted":true}'
-\`\`\`
 
-## Solution AI
-\`\`\`bash
 seclai solutions ai generate <solutionId> --user-input "Add an FAQ source"
-seclai solutions ai kb <solutionId> --user-input "Create a knowledge base"
-seclai solutions ai source <solutionId> --user-input "Create a file source"
+seclai solutions ai kb <solutionId> --user-input "Create a knowledge base for docs"
+seclai solutions ai source <solutionId> --user-input "Create a file source for PDFs"
 seclai solutions ai accept <solutionId> <conversationId> --json '{"accepted":true}'
 seclai solutions ai decline <solutionId> <conversationId>
 \`\`\`
-`;
-var ALERTS_GOVERNANCE_SKILL = `# Seclai CLI \u2014 Alerts, Governance, Models & Search
 
-## Alerts
+### Alerts
+
 \`\`\`bash
-seclai alerts list [--page N] [--limit N] [--status <s>] [--severity <s>]
+seclai alerts list [--page N] [--limit N] [--status <status>] [--severity <severity>]
 seclai alerts get <alertId>
 seclai alerts status <alertId> --json '{"status":"resolved"}'
-seclai alerts comment <alertId> --json '{"comment":"Fixed"}'
+seclai alerts comment <alertId> --json '{"comment":"Fixed the issue"}'
 seclai alerts subscribe <alertId>
 seclai alerts unsubscribe <alertId>
 \`\`\`
 
-## Alert Configurations
+### Alert configurations
+
 \`\`\`bash
 seclai alerts configs list [--page N] [--limit N]
-seclai alerts configs create --json '{"name":"My Config",...}'
+seclai alerts configs create --json '{"name":"Latency Alert","description":"...","threshold":5000}'
 seclai alerts configs get <configId>
-seclai alerts configs update <configId> --json '{"name":"Updated"}'
+seclai alerts configs update <configId> --json '{"threshold":3000}'
 seclai alerts configs delete <configId>
 \`\`\`
 
-## Alert Preferences
+### Alert preferences
+
 \`\`\`bash
 seclai alerts prefs list
-seclai alerts prefs update <orgId> <alertType> --json '{"enabled":true}'
+seclai alerts prefs update <organizationId> <alertType> --json '{"enabled":true}'
 \`\`\`
 
-## Governance AI
+### Governance AI
+
 \`\`\`bash
 seclai governance ai generate --user-input "Create a content safety policy"
 seclai governance ai list
@@ -1473,7 +1471,8 @@ seclai governance ai accept <conversationId>
 seclai governance ai decline <conversationId>
 \`\`\`
 
-## Model Alerts
+### Model alerts
+
 \`\`\`bash
 seclai models alerts list [--page N] [--limit N]
 seclai models alerts mark-read <alertId>
@@ -1482,14 +1481,16 @@ seclai models alerts unread-count
 seclai models recommendations <modelId>
 \`\`\`
 
-## Search
+### Search
+
 \`\`\`bash
 seclai search --query "deployment guide" [--limit N] [--entity-type <type>]
 \`\`\`
 
-## AI Assistant
+### AI assistant (global)
+
 \`\`\`bash
-seclai ai feedback --json '{"feedback":"..."}'
+seclai ai feedback --json '{"feedback":"The response was helpful"}'
 seclai ai kb --user-input "Create a support knowledge base"
 seclai ai source --user-input "Create a documentation source"
 seclai ai solution --user-input "Build a customer support solution"
@@ -1499,15 +1500,237 @@ seclai ai accept <conversationId> --json '{"accepted":true}'
 seclai ai decline <conversationId>
 seclai ai memory-accept <conversationId> --json '{"accepted":true}'
 \`\`\`
+
+### Skills
+
+\`\`\`bash
+# install skill files into AI coding tool directories (auto-detects or specify)
+seclai skills install [--tool copilot|claude|cursor|windsurf|codex|kiro|cline|roo|gemini|antigravity|all] [--dir .]
+\`\`\`
+
+### MCP server
+
+\`\`\`bash
+# configure MCP server access in AI coding tool config files
+seclai mcp configure --key <apiKey> [--target claude-code|cursor|claude-desktop|windsurf|all] [--dir .]
+
+# show the MCP config JSON snippet
+seclai mcp show [--key <apiKey>]
+\`\`\`
+
+## Example: Create a source and upload content
+
+\`\`\`bash
+seclai sources create --json '{"name":"Product Docs","description":"Product documentation source"}'
+# note the id from the output
+seclai sources upload <sourceId> --file ./docs.pdf --title "Product Manual" --metadata '{"version":"2.0"}'
+seclai sources get <sourceId>
+\`\`\`
+
+## Example: Set up a knowledge base with an agent
+
+\`\`\`bash
+seclai kb create --json '{"name":"Support KB","description":"Customer support articles"}'
+seclai agents create --json '{"name":"Support Bot","description":"Answers customer questions"}'
+seclai agents ai gen-steps <agentId> --user-input "Build a QA chatbot that searches the Support KB"
+seclai agents ai mark <agentId> <conversationId> --json '{"accepted":true}'
+seclai agents run <agentId> --json '{"input":"How do I reset my password?"}' --stream
+\`\`\`
+
+## Example: Evaluate agent quality
+
+\`\`\`bash
+# create eval criteria
+seclai evals criteria create <agentId> --json '{"name":"Answer Accuracy","eval_type":"llm_judge","description":"Does the answer correctly address the question?"}'
+# find compatible runs
+seclai evals compatible-runs <criteriaId> --limit 5
+# test the criteria against a run without persisting
+seclai evals test-draft <agentId> --json '{"criteria":{"name":"Answer Accuracy","eval_type":"llm_judge"},"run_id":"<runId>"}'
+# create a persisted result
+seclai evals results create <criteriaId> --json '{"run_id":"<runId>","score":0.95}'
+# view summary
+seclai evals criteria summary <criteriaId>
+\`\`\`
+
+## Example: Solution with linked resources
+
+\`\`\`bash
+seclai solutions create --json '{"name":"Customer Support"}'
+seclai solutions link <solutionId> --agents '["<agentId>"]' --kb '["<kbId>"]' --sources '["<sourceId>"]'
+seclai solutions get <solutionId>
+\`\`\`
+
+## Example: Memory-powered agent
+
+\`\`\`bash
+seclai memory create --json '{"name":"User Preferences","type":"general"}'
+seclai agents create --json '{"name":"Personal Assistant","description":"Remembers user preferences"}'
+seclai agents ai gen-steps <agentId> --user-input "Build a chat agent that remembers user preferences. Use general memory bank <memoryBankId>"
+seclai agents ai mark <agentId> <conversationId> --json '{"accepted":true}'
+\`\`\`
+
+## Example: Governance policy setup
+
+\`\`\`bash
+seclai governance ai generate --user-input "Create a content safety policy that blocks harmful outputs"
+seclai governance ai list
+seclai governance ai accept <conversationId>
+\`\`\`
+
+## Specific topics
+
+* **Streaming & event modes** [references/streaming.md](references/streaming.md)
+* **File uploads & content management** [references/uploads.md](references/uploads.md)
+* **Evaluations workflow** [references/evaluations.md](references/evaluations.md)
+`;
+var STREAMING_REF = `# Streaming Agent Runs
+
+## Modes
+
+### --stream
+Wait for the agent run to complete via SSE. Prints the final result as a single JSON object.
+Useful when you want to block until done.
+
+\`\`\`bash
+seclai agents run <agentId> --json '{"input":"Hello"}' --stream
+seclai agents run <agentId> --json '{"input":"Hello"}' --stream --timeout-ms 120000
+\`\`\`
+
+### --events
+Stream individual SSE events as NDJSON (one JSON object per line). Use for real-time processing.
+
+\`\`\`bash
+# all events, full event objects
+seclai agents run <agentId> --json '{"input":"Hello"}' --events
+
+# only data payloads (no event metadata)
+seclai agents run <agentId> --json '{"input":"Hello"}' --events --output data
+
+# only status events
+seclai agents run <agentId> --json '{"input":"Hello"}' --events --output status
+
+# filter specific event types
+seclai agents run <agentId> --json '{"input":"Hello"}' --events --event-filter "status,data"
+\`\`\`
+
+Output modes for --events:
+- \`full\`: entire SSE event object (default)
+- \`data\`: only the data payload of each event
+- \`status\`: only events with status information
+
+### --poll
+Poll the API at intervals for run completion. Does not use SSE.
+
+\`\`\`bash
+seclai agents run <agentId> --json '{"input":"Hello"}' --poll
+seclai agents run <agentId> --json '{"input":"Hello"}' --poll --poll-interval-ms 5000 --include-step-outputs
+\`\`\`
+
+### No flag
+Fire-and-forget: starts the run and immediately returns the run ID.
+
+\`\`\`bash
+seclai agents run <agentId> --json '{"input":"Hello"}'
+# returns: {"id":"run_...","status":"queued",...}
+# check later:
+seclai agents runs get <runId>
+\`\`\`
+`;
+var UPLOADS_REF = `# File Uploads & Content Management
+
+## Upload to a source
+\`\`\`bash
+seclai sources upload <sourceId> --file ./doc.pdf
+seclai sources upload <sourceId> --file ./doc.pdf --title "My Doc" --metadata '{"category":"docs"}' --file-name "custom-name.pdf" --mime-type "application/pdf"
+seclai sources upload <sourceId> --file ./doc.pdf --metadata-file ./meta.json
+\`\`\`
+
+## Upload text directly
+\`\`\`bash
+seclai sources upload-text <sourceId> --json '{"text":"Article content here...","title":"My Article"}'
+\`\`\`
+
+## Upload input for agent runs
+\`\`\`bash
+seclai agents upload-input <agentId> --file ./input.pdf
+seclai agents upload-input <agentId> --file ./data.csv --file-name "report.csv" --mime-type "text/csv"
+seclai agents input-status <agentId> <uploadId>
+\`\`\`
+
+## Replace content
+\`\`\`bash
+# replace with file
+seclai contents upload <contentVersionId> --file ./updated.pdf
+
+# replace with text
+seclai contents replace-text <contentVersionId> --json '{"text":"Updated content","title":"Revised Article"}'
+\`\`\`
+
+## Read content
+\`\`\`bash
+# full content
+seclai contents get <contentVersionId>
+
+# text slice (0-based offsets)
+seclai contents get <contentVersionId> --start 0 --end 1000
+
+# view embeddings
+seclai contents embeddings <contentVersionId> [--page N] [--limit N]
+\`\`\`
+`;
+var EVALUATIONS_REF = `# Evaluations Workflow
+
+## Step 1: Create evaluation criteria for an agent
+\`\`\`bash
+seclai evals criteria create <agentId> --json '{"name":"Answer Accuracy","description":"Does the answer correctly address the question?","eval_type":"llm_judge"}'
+\`\`\`
+
+## Step 2: Find runs to evaluate
+\`\`\`bash
+# list all runs for an agent
+seclai agents runs list <agentId> --limit 10
+
+# or find runs compatible with specific criteria
+seclai evals compatible-runs <criteriaId> --limit 10
+\`\`\`
+
+## Step 3: Test criteria before committing
+\`\`\`bash
+seclai evals test-draft <agentId> --json '{"criteria":{"name":"Answer Accuracy","eval_type":"llm_judge","description":"..."},"run_id":"<runId>"}'
+\`\`\`
+
+## Step 4: Create evaluation results
+\`\`\`bash
+seclai evals results create <criteriaId> --json '{"run_id":"<runId>","score":0.95}'
+\`\`\`
+
+## Step 5: Review summaries
+\`\`\`bash
+seclai evals criteria summary <criteriaId>
+seclai evals agent-results <agentId>
+seclai evals agent-runs <agentId> --limit 20
+seclai evals non-manual-summary <agentId>
+\`\`\`
+
+## Managing criteria
+\`\`\`bash
+seclai evals criteria list <agentId>
+seclai evals criteria get <criteriaId>
+seclai evals criteria update <criteriaId> --json '{"name":"Updated Name"}'
+seclai evals criteria delete <criteriaId>
+\`\`\`
+
+## Viewing results
+\`\`\`bash
+seclai evals results list <criteriaId> [--page N] [--limit N]
+\`\`\`
 `;
 function getToolConfig(tool, destDir) {
   const skillFiles = [
     { name: "SKILL.md", content: SKILL_MD },
-    { name: "references/agents.md", content: AGENTS_SKILL },
-    { name: "references/sources.md", content: SOURCES_SKILL },
-    { name: "references/kb-memory.md", content: KB_MEMORY_SKILL },
-    { name: "references/evals-solutions.md", content: EVALS_SOLUTIONS_SKILL },
-    { name: "references/alerts-governance.md", content: ALERTS_GOVERNANCE_SKILL }
+    { name: "references/streaming.md", content: STREAMING_REF },
+    { name: "references/uploads.md", content: UPLOADS_REF },
+    { name: "references/evaluations.md", content: EVALUATIONS_REF }
   ];
   switch (tool) {
     case "copilot":
@@ -1586,6 +1809,126 @@ function register13(program, rt) {
   });
 }
 
+// src/commands/mcp.ts
+import { existsSync as existsSync2 } from "fs";
+import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname2, join as join2 } from "path";
+import { homedir, platform } from "os";
+var MCP_URL = "https://api.seclai.com/mcp";
+function buildMcpEntry(apiKey) {
+  return {
+    type: "streamable-http",
+    url: MCP_URL,
+    headers: { "X-API-Key": apiKey }
+  };
+}
+function getTargets(destDir) {
+  const home = homedir();
+  const os = platform();
+  const targets = [
+    // Project-scoped configs
+    { name: "claude-code", path: join2(destDir, ".mcp.json"), scope: "project" },
+    { name: "cursor", path: join2(destDir, ".cursor", "mcp.json"), scope: "project" }
+  ];
+  if (os === "win32") {
+    targets.push({
+      name: "claude-desktop",
+      path: join2(process.env["APPDATA"] ?? join2(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json"),
+      scope: "global"
+    });
+  } else if (os === "darwin") {
+    targets.push({
+      name: "claude-desktop",
+      path: join2(home, "Library", "Application Support", "Claude", "claude_desktop_config.json"),
+      scope: "global"
+    });
+  }
+  targets.push({ name: "windsurf", path: join2(home, ".codeium", "windsurf", "mcp_config.json"), scope: "global" });
+  return targets;
+}
+async function mergeConfig(filePath, apiKey) {
+  let existing = {};
+  if (existsSync2(filePath)) {
+    try {
+      const parsed = JSON.parse(await readFile2(filePath, "utf8"));
+      if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return false;
+      existing = parsed;
+    } catch {
+      return false;
+    }
+  }
+  const raw = existing["mcpServers"];
+  const servers = typeof raw === "object" && raw !== null && !Array.isArray(raw) ? raw : {};
+  servers["seclai"] = buildMcpEntry(apiKey);
+  existing["mcpServers"] = servers;
+  await mkdir2(dirname2(filePath), { recursive: true });
+  await writeFile2(filePath, JSON.stringify(existing, null, 2) + "\n", "utf8");
+  return true;
+}
+function detectTargets(destDir) {
+  const all = getTargets(destDir);
+  return all.filter((t) => {
+    if (t.scope === "global") return existsSync2(dirname2(t.path));
+    if (t.name === "claude-code") return existsSync2(join2(destDir, ".claude")) || existsSync2(join2(destDir, "CLAUDE.md"));
+    if (t.name === "cursor") return existsSync2(join2(destDir, ".cursor"));
+    return false;
+  });
+}
+function register14(program, rt) {
+  const mcp = program.command("mcp").description("Configure the Seclai MCP server for AI coding tools.");
+  mcp.command("configure").description(
+    "Add the Seclai MCP server to AI coding tool config files.\n\nTargets: claude-code, cursor, claude-desktop, windsurf.\nUse --target to pick a specific tool, or 'all' for all known targets."
+  ).requiredOption("--key <key>", "Seclai API key to embed in the config.").option("--target <name>", "Target tool (claude-code|cursor|claude-desktop|windsurf|all). Auto-detects if omitted.").option("--dir <path>", "Project directory for project-scoped configs (default: current directory).", ".").action(async (opts) => {
+    await run(rt, async () => {
+      const destDir = opts.dir;
+      const apiKey = opts.key;
+      const allTargets = getTargets(destDir);
+      let targets;
+      if (opts.target === "all") {
+        targets = allTargets;
+      } else if (opts.target) {
+        const found = allTargets.find((t) => t.name === opts.target);
+        if (!found) {
+          rt.writeErr(`Unknown target "${opts.target}". Use: claude-code, cursor, claude-desktop, windsurf, or all.
+`);
+          rt.setExitCode(1);
+          return;
+        }
+        targets = [found];
+      } else {
+        targets = detectTargets(destDir);
+        if (targets.length === 0) {
+          targets = [allTargets[0]];
+          rt.writeErr("No MCP-compatible tool detected, defaulting to claude-code (.mcp.json).\n");
+        }
+      }
+      let configured = 0;
+      const failures = [];
+      for (const target of targets) {
+        const ok = await mergeConfig(target.path, apiKey);
+        if (ok) {
+          configured++;
+          rt.writeErr(`Configured seclai MCP for ${target.name} \u2192 ${target.path}
+`);
+        } else {
+          failures.push(target.name);
+          rt.writeErr(`Failed to parse existing config at ${target.path}, skipping.
+`);
+        }
+      }
+      const allOk = failures.length === 0;
+      printJson(rt, { ok: allOk, targets: targets.map((t) => t.name), filesWritten: configured, ...failures.length > 0 ? { failures } : {} });
+      if (!allOk) rt.setExitCode(1);
+    });
+  });
+  mcp.command("show").description("Show the Seclai MCP server JSON configuration snippet.").option("--key <key>", "API key to include (default: placeholder).").action(async (opts) => {
+    await run(rt, async () => {
+      const entry = buildMcpEntry(opts.key ?? "YOUR_API_KEY");
+      printJson(rt, { mcpServers: { seclai: entry } });
+    });
+  });
+}
+
 // src/commands/completion.ts
 var BASH = `#!/usr/bin/env bash
 # seclai bash completion \u2014 add to ~/.bashrc:
@@ -1597,7 +1940,7 @@ _seclai_completions() {
   prev="\${COMP_WORDS[COMP_CWORD-1]}"
 
   # Top-level commands
-  commands="agents sources contents kb memory evals solutions governance alerts models search ai skills completion help"
+  commands="agents sources contents kb memory evals solutions governance alerts models search ai skills mcp completion help"
 
   case "\${COMP_WORDS[1]}" in
     agents)
@@ -1650,6 +1993,7 @@ _seclai_completions() {
       esac ;;
     ai) COMPREPLY=( $(compgen -W "feedback kb source solution memory memory-history accept decline memory-accept" -- "$cur") ); return ;;
     skills) COMPREPLY=( $(compgen -W "install" -- "$cur") ); return ;;
+    mcp) COMPREPLY=( $(compgen -W "configure show" -- "$cur") ); return ;;
     completion) COMPREPLY=( $(compgen -W "bash zsh fish" -- "$cur") ); return ;;
   esac
 
@@ -1678,6 +2022,7 @@ _seclai() {
     'search:Search across Seclai resources'
     'ai:Top-level AI assistant'
     'skills:Install skill files for AI coding tools'
+    'mcp:Configure the Seclai MCP server'
     'completion:Generate shell completion scripts'
     'help:Display help for command'
   )
@@ -1730,6 +2075,9 @@ _seclai() {
         skills)
           local -a sub=(install)
           _describe 'subcommand' sub ;;
+        mcp)
+          local -a sub=(configure show)
+          _describe 'subcommand' sub ;;
         completion)
           local -a sub=(bash zsh fish)
           _describe 'shell' sub ;;
@@ -1742,7 +2090,7 @@ _seclai "$@"
 var FISH = `# seclai fish completion \u2014 save to ~/.config/fish/completions/seclai.fish
 #   seclai completion fish > ~/.config/fish/completions/seclai.fish
 
-set -l top agents sources contents kb memory evals solutions governance alerts models search ai skills completion help
+set -l top agents sources contents kb memory evals solutions governance alerts models search ai skills mcp completion help
 
 # Top-level
 complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "agents" -d "Manage agents"
@@ -1758,6 +2106,7 @@ complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "models" -d "
 complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "search" -d "Search resources"
 complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "ai" -d "AI assistant"
 complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "skills" -d "Skill files"
+complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "mcp" -d "MCP server config"
 complete -c seclai -n "not __fish_seen_subcommand_from $top" -f -a "completion" -d "Shell completions"
 
 # agents
@@ -1796,6 +2145,9 @@ complete -c seclai -n "__fish_seen_subcommand_from ai; and not __fish_seen_subco
 # skills
 complete -c seclai -n "__fish_seen_subcommand_from skills; and not __fish_seen_subcommand_from install" -f -a "install"
 
+# mcp
+complete -c seclai -n "__fish_seen_subcommand_from mcp; and not __fish_seen_subcommand_from configure show" -f -a "configure show"
+
 # completion
 complete -c seclai -n "__fish_seen_subcommand_from completion; and not __fish_seen_subcommand_from bash zsh fish" -f -a "bash zsh fish"
 
@@ -1805,7 +2157,7 @@ complete -c seclai -l compact -d "Output compact JSON"
 complete -c seclai -s V -l version -d "Output version"
 `;
 var SCRIPTS = { bash: BASH, zsh: ZSH, fish: FISH };
-function register14(program, rt) {
+function register15(program, rt) {
   const completion = program.command("completion").description("Generate shell completion scripts.").argument("<shell>", "Shell type: bash, zsh, or fish.").action(async (shell) => {
     const script = SCRIPTS[shell];
     if (!script) {
@@ -1818,6 +2170,453 @@ function register14(program, rt) {
   });
 }
 
+// src/commands/auth.ts
+import { randomBytes, createHash } from "crypto";
+import { createServer } from "http";
+import { readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
+import { join as join3 } from "path";
+import { URL as URL2, URLSearchParams } from "url";
+import process3 from "process";
+import {
+  loadSsoProfile,
+  readSsoCache,
+  writeSsoCache,
+  deleteSsoCache,
+  isTokenValid
+} from "@seclai/sdk";
+function generateCodeVerifier() {
+  return randomBytes(32).toString("base64url");
+}
+function computeCodeChallenge(verifier) {
+  return createHash("sha256").update(verifier).digest("base64url");
+}
+function waitForAuthCode(port, state) {
+  return new Promise((resolve, reject) => {
+    const server = createServer((req, res) => {
+      const url = new URL2(req.url ?? "/", `http://localhost:${port}`);
+      if (url.pathname !== "/callback") {
+        res.writeHead(404);
+        res.end();
+        return;
+      }
+      const code = url.searchParams.get("code");
+      const returnedState = url.searchParams.get("state");
+      const error = url.searchParams.get("error");
+      if (error) {
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end("<html><body><h2>Authentication failed</h2><p>You can close this tab.</p></body></html>");
+        reject(new Error(`OAuth error: ${error}`));
+        server.close();
+        return;
+      }
+      if (!code || returnedState !== state) {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end("<html><body><h2>Invalid callback</h2></body></html>");
+        reject(new Error("Invalid callback: missing code or state mismatch"));
+        server.close();
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html" });
+      res.end("<html><body><h2>Authenticated successfully!</h2><p>You can close this tab.</p></body></html>");
+      resolve({
+        code,
+        cleanup: () => server.close()
+      });
+    });
+    server.listen(port, "127.0.0.1");
+    server.on("error", reject);
+  });
+}
+async function exchangeCodeForTokens(profile, code, codeVerifier, redirectUri) {
+  const tokenUrl = `https://${profile.ssoDomain}/oauth2/token`;
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: profile.ssoClientId,
+    code,
+    redirect_uri: redirectUri,
+    code_verifier: codeVerifier
+  });
+  const resp = await fetch(tokenUrl, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: body.toString()
+  });
+  if (!resp.ok) {
+    const text = await resp.text();
+    throw new Error(`Token exchange failed (HTTP ${resp.status}): ${text}`);
+  }
+  const data = await resp.json();
+  const expiresAt = new Date(Date.now() + data.expires_in * 1e3).toISOString();
+  const entry = {
+    accessToken: data.access_token,
+    expiresAt,
+    clientId: profile.ssoClientId,
+    region: profile.ssoRegion,
+    cognitoDomain: profile.ssoDomain
+  };
+  if (data.refresh_token) entry.refreshToken = data.refresh_token;
+  if (data.id_token) entry.idToken = data.id_token;
+  return entry;
+}
+var DEFAULT_CALLBACK_PORT = 9876;
+function resolveBaseUrl() {
+  const envUrl = process3.env.SECLAI_API_URL;
+  return envUrl && envUrl.length > 0 ? envUrl : "https://api.seclai.com";
+}
+async function fetchAccountId(accessToken) {
+  const baseUrl = resolveBaseUrl();
+  const resp = await fetch(`${baseUrl}/me`, {
+    headers: { authorization: `Bearer ${accessToken}` }
+  });
+  if (!resp.ok) {
+    const text = await resp.text();
+    throw new Error(`Failed to resolve account ID from /me (HTTP ${resp.status}): ${text}`);
+  }
+  const data = await resp.json();
+  return data.account_id;
+}
+async function updateConfigKey(configDir, profileName, key, value) {
+  const configPath = join3(configDir, "config");
+  let content = "";
+  try {
+    content = await readFile3(configPath, "utf-8");
+  } catch {
+  }
+  const sectionHeader = profileName === "default" ? "[default]" : `[profile ${profileName}]`;
+  const sectionIdx = content.indexOf(sectionHeader);
+  if (sectionIdx === -1) {
+    if (content.length > 0 && !content.endsWith("\n")) {
+      content += "\n";
+    }
+    content += `
+${sectionHeader}
+${key} = ${value}
+`;
+  } else {
+    const afterHeader = sectionIdx + sectionHeader.length;
+    const nextSectionMatch = content.slice(afterHeader).match(/\n\[/);
+    const sectionEnd = nextSectionMatch ? afterHeader + nextSectionMatch.index : content.length;
+    const sectionBody = content.slice(afterHeader, sectionEnd);
+    const keyRegex = new RegExp(`^${key}\\s*=.*$`, "m");
+    let newSectionBody;
+    if (keyRegex.test(sectionBody)) {
+      newSectionBody = sectionBody.replace(keyRegex, `${key} = ${value}`);
+    } else {
+      const trimmed = sectionBody.trimEnd();
+      newSectionBody = `${trimmed}
+${key} = ${value}
+`;
+    }
+    content = content.slice(0, afterHeader) + newSectionBody + content.slice(sectionEnd);
+  }
+  const { mkdir: mkdir4 } = await import("fs/promises");
+  await mkdir4(configDir, { recursive: true });
+  await writeFile3(configPath, content, { mode: 384 });
+}
+function resolveProfile(opts) {
+  const profileName = opts.profile || process3.env.SECLAI_PROFILE || "default";
+  let configDir = opts.configDir || process3.env.SECLAI_CONFIG_DIR;
+  if (!configDir) {
+    const home = process3.env.HOME ?? process3.env.USERPROFILE;
+    if (home && home.trim() !== "") {
+      configDir = join3(home, ".seclai");
+    } else {
+      configDir = join3(process3.cwd(), ".seclai");
+    }
+  }
+  return { profileName, configDir };
+}
+async function loadProfile(rt, opts) {
+  const { profileName, configDir } = resolveProfile(opts);
+  const profile = await loadSsoProfile(configDir, profileName);
+  return { profile, profileName, configDir };
+}
+function register16(program, rt) {
+  const group = program.command("auth").description("SSO authentication (login/logout/status/refresh).");
+  group.command("login").description("Authenticate via SSO using Authorization Code + PKCE flow.").option("--port <port>", "Local callback port", String(DEFAULT_CALLBACK_PORT)).option("--no-browser", "Print the URL instead of opening a browser").action(async (opts) => {
+    await run(rt, async () => {
+      const globalOpts = program.opts();
+      const { profile, profileName, configDir } = await loadProfile(rt, globalOpts);
+      const port = parseInt(opts.port ?? String(DEFAULT_CALLBACK_PORT), 10);
+      if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error(`Invalid port: ${opts.port}. Must be an integer between 1 and 65535.`);
+      }
+      const redirectUri = `http://localhost:${port}/callback`;
+      const codeVerifier = generateCodeVerifier();
+      const codeChallenge = computeCodeChallenge(codeVerifier);
+      const state = randomBytes(16).toString("hex");
+      const authUrl = new URL2(`https://${profile.ssoDomain}/oauth2/authorize`);
+      authUrl.searchParams.set("response_type", "code");
+      authUrl.searchParams.set("client_id", profile.ssoClientId);
+      authUrl.searchParams.set("redirect_uri", redirectUri);
+      authUrl.searchParams.set("scope", "openid profile email");
+      authUrl.searchParams.set("state", state);
+      authUrl.searchParams.set("code_challenge", codeChallenge);
+      authUrl.searchParams.set("code_challenge_method", "S256");
+      const authUrlStr = authUrl.toString();
+      const codePromise = waitForAuthCode(port, state);
+      if (opts.browser !== false) {
+        const { spawn } = await import("child_process");
+        const openCmd = process3.platform === "darwin" ? { cmd: "open", args: [authUrlStr] } : process3.platform === "win32" ? { cmd: "cmd", args: ["/c", "start", "", authUrlStr] } : { cmd: "xdg-open", args: [authUrlStr] };
+        spawn(openCmd.cmd, openCmd.args, { stdio: "ignore", detached: true }).unref();
+        rt.writeErr(`Opening browser for authentication...
+`);
+      } else {
+        rt.writeErr(`Open this URL in your browser:
+
+${authUrlStr}
+
+`);
+      }
+      rt.writeErr("Waiting for authentication callback...\n");
+      const { code, cleanup } = await codePromise;
+      let tokens;
+      try {
+        rt.writeErr("Exchanging code for tokens...\n");
+        tokens = await exchangeCodeForTokens(profile, code, codeVerifier, redirectUri);
+        await writeSsoCache(configDir, profile, tokens);
+      } finally {
+        cleanup();
+      }
+      let accountId = profile.ssoAccountId;
+      try {
+        rt.writeErr("Resolving account ID...\n");
+        accountId = await fetchAccountId(tokens.accessToken);
+        await updateConfigKey(configDir, profileName, "sso_account_id", accountId);
+      } catch {
+        rt.writeErr("Warning: Could not resolve account ID from /me. You can set it manually with `seclai configure sso`.\n");
+      }
+      rt.writeErr("Successfully authenticated!\n");
+      const loginResult = {
+        status: "authenticated",
+        profile: profileName,
+        expiresAt: tokens.expiresAt
+      };
+      if (accountId) loginResult.accountId = accountId;
+      printJson(rt, loginResult);
+    });
+  });
+  group.command("logout").description("Remove cached SSO tokens for the current profile.").action(async () => {
+    await run(rt, async () => {
+      const globalOpts = program.opts();
+      const { profile, profileName, configDir } = await loadProfile(rt, globalOpts);
+      await deleteSsoCache(configDir, profile);
+      rt.writeErr("Logged out successfully.\n");
+      printJson(rt, { status: "logged_out", profile: profileName });
+    });
+  });
+  group.command("status").description("Show current authentication status for the active profile.").action(async () => {
+    await run(rt, async () => {
+      const globalOpts = program.opts();
+      const { profile: profileLoaded, profileName, configDir } = await loadProfile(rt, globalOpts);
+      const cached = await readSsoCache(configDir, profileLoaded);
+      if (!cached) {
+        const notAuthResult = {
+          profile: profileName,
+          status: "not_authenticated"
+        };
+        if (profileLoaded.ssoAccountId) notAuthResult.accountId = profileLoaded.ssoAccountId;
+        printJson(rt, notAuthResult);
+        return;
+      }
+      const valid = isTokenValid(cached);
+      const statusResult = {
+        profile: profileName,
+        status: valid ? "authenticated" : "expired",
+        expiresAt: cached.expiresAt,
+        hasRefreshToken: Boolean(cached.refreshToken)
+      };
+      if (profileLoaded.ssoAccountId) statusResult.accountId = profileLoaded.ssoAccountId;
+      printJson(rt, statusResult);
+    });
+  });
+  group.command("refresh").description("Manually refresh the SSO token for the current profile.").action(async () => {
+    await run(rt, async () => {
+      const globalOpts = program.opts();
+      const { profile, profileName, configDir } = await loadProfile(rt, globalOpts);
+      const cached = await readSsoCache(configDir, profile);
+      if (!cached?.refreshToken) {
+        throw new Error("No cached token with refresh token. Run `seclai auth login` first.");
+      }
+      const tokenUrl = `https://${profile.ssoDomain}/oauth2/token`;
+      const body = new URLSearchParams({
+        grant_type: "refresh_token",
+        client_id: profile.ssoClientId,
+        refresh_token: cached.refreshToken
+      });
+      const resp = await fetch(tokenUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString()
+      });
+      if (!resp.ok) {
+        const text = await resp.text();
+        throw new Error(`Token refresh failed (HTTP ${resp.status}): ${text}`);
+      }
+      const data = await resp.json();
+      const refreshed = {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token ?? cached.refreshToken,
+        expiresAt: new Date(Date.now() + data.expires_in * 1e3).toISOString(),
+        clientId: profile.ssoClientId,
+        region: profile.ssoRegion,
+        cognitoDomain: profile.ssoDomain
+      };
+      if (data.id_token) refreshed.idToken = data.id_token;
+      await writeSsoCache(configDir, profile, refreshed);
+      rt.writeErr("Token refreshed successfully.\n");
+      printJson(rt, {
+        status: "refreshed",
+        profile: profileName,
+        expiresAt: refreshed.expiresAt
+      });
+    });
+  });
+}
+
+// src/commands/configure.ts
+import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile4 } from "fs/promises";
+import { join as join4 } from "path";
+import process4 from "process";
+import { createInterface } from "readline";
+import { DEFAULT_SSO_DOMAIN, DEFAULT_SSO_CLIENT_ID, DEFAULT_SSO_REGION } from "@seclai/sdk";
+function prompt(rt, question, defaultValue) {
+  return new Promise((resolve) => {
+    const rl = createInterface({
+      input: rt.stdin,
+      output: { write: (s) => {
+        rt.writeErr(s);
+        return true;
+      } },
+      terminal: false
+    });
+    const display = defaultValue ? `${question} [${defaultValue}]: ` : `${question}: `;
+    rt.writeErr(display);
+    rl.once("line", (answer) => {
+      rl.close();
+      resolve(answer.trim() || defaultValue || "");
+    });
+  });
+}
+function resolveConfigDir(opts) {
+  if (opts.configDir) return opts.configDir;
+  const env = process4.env.SECLAI_CONFIG_DIR;
+  if (env) return env;
+  const home = process4.env.HOME ?? process4.env.USERPROFILE ?? "";
+  return join4(home, ".seclai");
+}
+function register17(program, rt) {
+  const group = program.command("configure").description("Configure CLI profiles and settings.");
+  group.command("sso").description("Configure an SSO profile with optional overrides. Defaults to production Seclai SSO.").option("--profile-name <name>", "Profile name to configure (default: from --profile flag)").action(async (opts) => {
+    await run(rt, async () => {
+      const globalOpts = program.opts();
+      const profileName = opts.profileName || globalOpts.profile || "default";
+      const configDir = resolveConfigDir(globalOpts);
+      const configPath = join4(configDir, "config");
+      rt.writeErr(`
+Configuring SSO profile "${profileName}".
+`);
+      rt.writeErr(`Defaults: domain=${DEFAULT_SSO_DOMAIN}, region=${DEFAULT_SSO_REGION}
+`);
+      rt.writeErr(`Press Enter to accept defaults.
+
+`);
+      const domain = await prompt(rt, "SSO domain", DEFAULT_SSO_DOMAIN);
+      const clientId = await prompt(rt, "SSO client ID", DEFAULT_SSO_CLIENT_ID);
+      const region = await prompt(rt, "SSO region", DEFAULT_SSO_REGION);
+      const accountId = await prompt(rt, "Account ID (optional, resolved after login)");
+      const isDefault = domain === DEFAULT_SSO_DOMAIN && clientId === DEFAULT_SSO_CLIENT_ID && region === DEFAULT_SSO_REGION && !accountId;
+      if (isDefault && profileName === "default") {
+        rt.writeErr(`
+Using built-in defaults \u2014 no config file needed.
+`);
+        rt.writeErr(`Run \`seclai auth login\` to authenticate.
+`);
+        printJson(rt, {
+          profile: profileName,
+          sso_domain: domain,
+          sso_client_id: clientId,
+          sso_region: region,
+          note: "using built-in defaults"
+        });
+        return;
+      }
+      let content = "";
+      try {
+        content = await readFile4(configPath, "utf-8");
+      } catch {
+      }
+      const sectionHeader = profileName === "default" ? "[default]" : `[profile ${profileName}]`;
+      const lines = [];
+      if (domain !== DEFAULT_SSO_DOMAIN) lines.push(`sso_domain = ${domain}`);
+      if (clientId !== DEFAULT_SSO_CLIENT_ID) lines.push(`sso_client_id = ${clientId}`);
+      if (region !== DEFAULT_SSO_REGION) lines.push(`sso_region = ${region}`);
+      if (accountId) lines.push(`sso_account_id = ${accountId}`);
+      const sectionBody = lines.join("\n");
+      const sectionRegex = profileName === "default" ? /^\[default\][^\[]*(?=\[|$(?![\s\S]))/m : new RegExp(`^\\[profile ${escapeRegExp(profileName)}\\][^\\[]*(?=\\[|$(?![\\s\\S]))`, "m");
+      if (sectionRegex.test(content)) {
+        content = content.replace(sectionRegex, `${sectionHeader}
+${sectionBody}
+`);
+      } else {
+        if (content.length > 0 && !content.endsWith("\n")) {
+          content += "\n";
+        }
+        content += `
+${sectionHeader}
+${sectionBody}
+`;
+      }
+      await mkdir3(configDir, { recursive: true });
+      await writeFile4(configPath, content, { mode: 384 });
+      rt.writeErr(`
+Profile "${profileName}" saved to ${configPath}
+`);
+      rt.writeErr(`Run \`seclai auth login --profile ${profileName}\` to authenticate.
+`);
+      const result = {
+        profile: profileName,
+        configFile: configPath,
+        sso_domain: domain,
+        sso_client_id: clientId,
+        sso_region: region
+      };
+      if (accountId) result.sso_account_id = accountId;
+      printJson(rt, result);
+    });
+  });
+  group.command("list").description("List all configured profiles.").action(async () => {
+    await run(rt, async () => {
+      const globalOpts = program.opts();
+      const configDir = resolveConfigDir(globalOpts);
+      const configPath = join4(configDir, "config");
+      let content;
+      try {
+        content = await readFile4(configPath, "utf-8");
+      } catch {
+        printJson(rt, { profiles: [], configFile: configPath });
+        return;
+      }
+      const profiles = [];
+      for (const line of content.split("\n")) {
+        const trimmed = line.trim();
+        if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
+          const raw = trimmed.slice(1, -1).trim();
+          if (raw.startsWith("profile ")) {
+            profiles.push(raw.slice("profile ".length).trim());
+          } else {
+            profiles.push(raw);
+          }
+        }
+      }
+      printJson(rt, { profiles, configFile: configPath });
+    });
+  });
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
 // src/cli.ts
 function createProgram(rt = defaultRuntime()) {
   const program = new Command();
@@ -1831,6 +2630,15 @@ All commands return JSON to stdout, making it easy to pipe into jq or other tool
   ).version(cliVersion, "-V, --version", "output the version").option(
     "--api-key <key>",
     "Seclai API key (defaults to SECLAI_API_KEY)."
+  ).option(
+    "--profile <name>",
+    "SSO profile name (defaults to SECLAI_PROFILE, then 'default')."
+  ).option(
+    "--account-id <id>",
+    "Account ID for multi-org targeting (X-Account-Id header)."
+  ).option(
+    "--config-dir <path>",
+    "Config directory (defaults to SECLAI_CONFIG_DIR, then ~/.seclai)."
   ).option(
     "--compact",
     "Output compact JSON (no indentation)."
@@ -1839,16 +2647,19 @@ All commands return JSON to stdout, making it easy to pipe into jq or other tool
     "after",
     `
 Environment:
-  SECLAI_API_KEY   Default API key (alternative to --api-key)
-  SECLAI_API_URL   Override API base URL (default: https://api.seclai.com)
+  SECLAI_API_KEY      Default API key (alternative to --api-key)
+  SECLAI_API_URL      Override API base URL (default: https://api.seclai.com)
+  SECLAI_PROFILE      Default SSO profile (alternative to --profile)
+  SECLAI_CONFIG_DIR   Config directory (alternative to --config-dir)
 
 Examples:
   seclai agents list
   seclai agents run <agentId> --json '{"input":"Hello"}'
   seclai agents run <agentId> --json '{"input":"Hi"}' --events
-  seclai sources list
-  seclai kb list
-  seclai search --query "deployment guide"
+  seclai configure sso
+  seclai auth login
+  seclai auth status
+  seclai sources list --profile dev
   npx @seclai/cli agents list
 `
   );
@@ -1875,6 +2686,9 @@ Examples:
   register12(program, rt);
   register13(program, rt);
   register14(program, rt);
+  register15(program, rt);
+  register16(program, rt);
+  register17(program, rt);
   return program;
 }
 async function runCli(argv, rt = defaultRuntime()) {