@seclai/cli 1.1.1 → 1.2.0

package/README.md

@@ -42,10 +42,14 @@ npx add-mcp https://api.seclai.com/mcp --header "X-API-Key: $SECLAI_API_KEY" --n
 
 ## Documentation
 
-Command reference (latest): https://seclai.github.io/seclai-cli/1.1.1/
+Command reference (latest): https://seclai.github.io/seclai-cli/1.2.0/
 
 ## Authentication
 
+The CLI supports two authentication methods:
+
+### API Key
+
 Set the `SECLAI_API_KEY` environment variable, or pass `--api-key` per-command:
 
 ```bash
@@ -55,18 +59,61 @@ export SECLAI_API_KEY="sk-..."
 seclai --api-key "$SECLAI_API_KEY" agents list
 ```
 
+### SSO (OAuth2 Bearer Token)
+
+SSO works out of the box with built-in production defaults — no configuration needed:
+
+```bash
+# Authenticate via browser (Authorization Code + PKCE)
+seclai auth login
+
+# Check authentication status
+seclai auth status
+
+# Refresh tokens manually
+seclai auth refresh
+
+# Log out (clears cached tokens)
+seclai auth logout
+```
+
+For custom SSO settings (e.g. staging environment), use `seclai configure sso`
+or set environment variables:
+
+| Variable | Description | Default |
+|---|---|---|
+| `SECLAI_SSO_DOMAIN` | Cognito domain | `auth.seclai.com` |
+| `SECLAI_SSO_CLIENT_ID` | Cognito app client ID | `4bgf8v9qmc5puivbaqon9n5lmr` |
+| `SECLAI_SSO_REGION` | AWS region | `us-west-2` |
+
+Use a named profile with `--profile`:
+
+```bash
+seclai --profile staging agents list
+```
+
+Tokens are cached in `~/.seclai/sso/cache/` and auto-refreshed when expired.
+
 ## Environment Variables
 
 | Variable | Description |
 |---|---|
 | `SECLAI_API_KEY` | Default API key (alternative to `--api-key`) |
 | `SECLAI_API_URL` | Override API base URL (default: `https://api.seclai.com`) |
+| `SECLAI_PROFILE` | Default SSO profile name (default: `default`) |
+| `SECLAI_CONFIG_DIR` | Config directory path (default: `~/.seclai`) |
+| `SECLAI_SSO_DOMAIN` | Override SSO domain (default: `auth.seclai.com`) |
+| `SECLAI_SSO_CLIENT_ID` | Override SSO client ID (default: `4bgf8v9qmc5puivbaqon9n5lmr`) |
+| `SECLAI_SSO_REGION` | Override SSO region (default: `us-west-2`) |
 
 ## Global Options
 
 | Flag | Description |
 |---|---|
 | `--api-key <key>` | Seclai API key |
+| `--profile <name>` | SSO profile name |
+| `--account-id <id>` | Account ID (`X-Account-Id` header) |
+| `--config-dir <path>` | Config directory path |
 | `--compact` | Output compact (single-line) JSON |
 | `-V, --version` | Print version |
 

package/dist/cli.js

@@ -72,6 +72,9 @@ function getCliVersion() {
 function createClient(opts) {
   const seclaiOpts = {};
   if (opts.apiKey !== void 0) seclaiOpts.apiKey = opts.apiKey;
+  if (opts.profile !== void 0) seclaiOpts.profile = opts.profile;
+  if (opts.configDir !== void 0) seclaiOpts.configDir = opts.configDir;
+  if (opts.accountId !== void 0) seclaiOpts.accountId = opts.accountId;
   const envUrl = process2.env.SECLAI_API_URL;
   seclaiOpts.baseUrl = envUrl && envUrl.length > 0 ? envUrl : "https://api.seclai.com";
   return new Seclai(seclaiOpts);
@@ -302,8 +305,8 @@ function register(program, rt) {
   agents.command("upload-input").description("Upload a file as agent input.").argument("<agentId>", "Agent ID.").requiredOption("--file <path>", "File to upload.").option("--file-name <name>", "Override filename.").option("--mime-type <type>", "MIME type.").action(async (agentId, opts) => {
     await run(rt, async () => {
       const client = createClient(program.opts());
-      const { readFile: readFile3 } = await import("fs/promises");
-      const bytes = new Uint8Array(await readFile3(opts.file));
+      const { readFile: readFile5 } = await import("fs/promises");
+      const bytes = new Uint8Array(await readFile5(opts.file));
       const o = { file: bytes };
       if (opts.fileName) o.fileName = opts.fileName;
       if (opts.mimeType) o.mimeType = opts.mimeType;
@@ -362,9 +365,11 @@ function register2(program, rt) {
   const sources = program.command("sources").alias("source").description("Manage content sources.");
   sources.command("list").description("List sources.").option("--page <n>", "Page number.", (v) => Number(v)).option("--limit <n>", "Page size.", (v) => Number(v)).option("--sort <field>", "Sort field.").option("--order <asc|desc>", "Sort direction.").option("--account-id <id>", "Filter by account ID.").action(async (opts) => {
     await run(rt, async () => {
-      const client = createClient(program.opts());
+      const globalOpts = program.opts();
+      const client = createClient(globalOpts);
       const o = listOpts(opts);
-      if (opts.accountId) o.accountId = opts.accountId;
+      const acctId = opts.accountId || globalOpts.accountId;
+      if (acctId) o.accountId = acctId;
       printJson(rt, await client.listSources(o));
     });
   });
@@ -2165,6 +2170,453 @@ function register15(program, rt) {
   });
 }
 
+// src/commands/auth.ts
+import { randomBytes, createHash } from "crypto";
+import { createServer } from "http";
+import { readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
+import { join as join3 } from "path";
+import { URL as URL2, URLSearchParams } from "url";
+import process3 from "process";
+import {
+  loadSsoProfile,
+  readSsoCache,
+  writeSsoCache,
+  deleteSsoCache,
+  isTokenValid
+} from "@seclai/sdk";
+function generateCodeVerifier() {
+  return randomBytes(32).toString("base64url");
+}
+function computeCodeChallenge(verifier) {
+  return createHash("sha256").update(verifier).digest("base64url");
+}
+function waitForAuthCode(port, state) {
+  return new Promise((resolve, reject) => {
+    const server = createServer((req, res) => {
+      const url = new URL2(req.url ?? "/", `http://localhost:${port}`);
+      if (url.pathname !== "/callback") {
+        res.writeHead(404);
+        res.end();
+        return;
+      }
+      const code = url.searchParams.get("code");
+      const returnedState = url.searchParams.get("state");
+      const error = url.searchParams.get("error");
+      if (error) {
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end("<html><body><h2>Authentication failed</h2><p>You can close this tab.</p></body></html>");
+        reject(new Error(`OAuth error: ${error}`));
+        server.close();
+        return;
+      }
+      if (!code || returnedState !== state) {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end("<html><body><h2>Invalid callback</h2></body></html>");
+        reject(new Error("Invalid callback: missing code or state mismatch"));
+        server.close();
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html" });
+      res.end("<html><body><h2>Authenticated successfully!</h2><p>You can close this tab.</p></body></html>");
+      resolve({
+        code,
+        cleanup: () => server.close()
+      });
+    });
+    server.listen(port, "127.0.0.1");
+    server.on("error", reject);
+  });
+}
+async function exchangeCodeForTokens(profile, code, codeVerifier, redirectUri) {
+  const tokenUrl = `https://${profile.ssoDomain}/oauth2/token`;
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: profile.ssoClientId,
+    code,
+    redirect_uri: redirectUri,
+    code_verifier: codeVerifier
+  });
+  const resp = await fetch(tokenUrl, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: body.toString()
+  });
+  if (!resp.ok) {
+    const text = await resp.text();
+    throw new Error(`Token exchange failed (HTTP ${resp.status}): ${text}`);
+  }
+  const data = await resp.json();
+  const expiresAt = new Date(Date.now() + data.expires_in * 1e3).toISOString();
+  const entry = {
+    accessToken: data.access_token,
+    expiresAt,
+    clientId: profile.ssoClientId,
+    region: profile.ssoRegion,
+    cognitoDomain: profile.ssoDomain
+  };
+  if (data.refresh_token) entry.refreshToken = data.refresh_token;
+  if (data.id_token) entry.idToken = data.id_token;
+  return entry;
+}
+var DEFAULT_CALLBACK_PORT = 9876;
+function resolveBaseUrl() {
+  const envUrl = process3.env.SECLAI_API_URL;
+  return envUrl && envUrl.length > 0 ? envUrl : "https://api.seclai.com";
+}
+async function fetchAccountId(accessToken) {
+  const baseUrl = resolveBaseUrl();
+  const resp = await fetch(`${baseUrl}/me`, {
+    headers: { authorization: `Bearer ${accessToken}` }
+  });
+  if (!resp.ok) {
+    const text = await resp.text();
+    throw new Error(`Failed to resolve account ID from /me (HTTP ${resp.status}): ${text}`);
+  }
+  const data = await resp.json();
+  return data.account_id;
+}
+async function updateConfigKey(configDir, profileName, key, value) {
+  const configPath = join3(configDir, "config");
+  let content = "";
+  try {
+    content = await readFile3(configPath, "utf-8");
+  } catch {
+  }
+  const sectionHeader = profileName === "default" ? "[default]" : `[profile ${profileName}]`;
+  const sectionIdx = content.indexOf(sectionHeader);
+  if (sectionIdx === -1) {
+    if (content.length > 0 && !content.endsWith("\n")) {
+      content += "\n";
+    }
+    content += `
+${sectionHeader}
+${key} = ${value}
+`;
+  } else {
+    const afterHeader = sectionIdx + sectionHeader.length;
+    const nextSectionMatch = content.slice(afterHeader).match(/\n\[/);
+    const sectionEnd = nextSectionMatch ? afterHeader + nextSectionMatch.index : content.length;
+    const sectionBody = content.slice(afterHeader, sectionEnd);
+    const keyRegex = new RegExp(`^${key}\\s*=.*$`, "m");
+    let newSectionBody;
+    if (keyRegex.test(sectionBody)) {
+      newSectionBody = sectionBody.replace(keyRegex, `${key} = ${value}`);
+    } else {
+      const trimmed = sectionBody.trimEnd();
+      newSectionBody = `${trimmed}
+${key} = ${value}
+`;
+    }
+    content = content.slice(0, afterHeader) + newSectionBody + content.slice(sectionEnd);
+  }
+  const { mkdir: mkdir4 } = await import("fs/promises");
+  await mkdir4(configDir, { recursive: true });
+  await writeFile3(configPath, content, { mode: 384 });
+}
+function resolveProfile(opts) {
+  const profileName = opts.profile || process3.env.SECLAI_PROFILE || "default";
+  let configDir = opts.configDir || process3.env.SECLAI_CONFIG_DIR;
+  if (!configDir) {
+    const home = process3.env.HOME ?? process3.env.USERPROFILE;
+    if (home && home.trim() !== "") {
+      configDir = join3(home, ".seclai");
+    } else {
+      configDir = join3(process3.cwd(), ".seclai");
+    }
+  }
+  return { profileName, configDir };
+}
+async function loadProfile(rt, opts) {
+  const { profileName, configDir } = resolveProfile(opts);
+  const profile = await loadSsoProfile(configDir, profileName);
+  return { profile, profileName, configDir };
+}
+function register16(program, rt) {
+  const group = program.command("auth").description("SSO authentication (login/logout/status/refresh).");
+  group.command("login").description("Authenticate via SSO using Authorization Code + PKCE flow.").option("--port <port>", "Local callback port", String(DEFAULT_CALLBACK_PORT)).option("--no-browser", "Print the URL instead of opening a browser").action(async (opts) => {
+    await run(rt, async () => {
+      const globalOpts = program.opts();
+      const { profile, profileName, configDir } = await loadProfile(rt, globalOpts);
+      const port = parseInt(opts.port ?? String(DEFAULT_CALLBACK_PORT), 10);
+      if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error(`Invalid port: ${opts.port}. Must be an integer between 1 and 65535.`);
+      }
+      const redirectUri = `http://localhost:${port}/callback`;
+      const codeVerifier = generateCodeVerifier();
+      const codeChallenge = computeCodeChallenge(codeVerifier);
+      const state = randomBytes(16).toString("hex");
+      const authUrl = new URL2(`https://${profile.ssoDomain}/oauth2/authorize`);
+      authUrl.searchParams.set("response_type", "code");
+      authUrl.searchParams.set("client_id", profile.ssoClientId);
+      authUrl.searchParams.set("redirect_uri", redirectUri);
+      authUrl.searchParams.set("scope", "openid profile email");
+      authUrl.searchParams.set("state", state);
+      authUrl.searchParams.set("code_challenge", codeChallenge);
+      authUrl.searchParams.set("code_challenge_method", "S256");
+      const authUrlStr = authUrl.toString();
+      const codePromise = waitForAuthCode(port, state);
+      if (opts.browser !== false) {
+        const { spawn } = await import("child_process");
+        const openCmd = process3.platform === "darwin" ? { cmd: "open", args: [authUrlStr] } : process3.platform === "win32" ? { cmd: "cmd", args: ["/c", "start", "", authUrlStr] } : { cmd: "xdg-open", args: [authUrlStr] };
+        spawn(openCmd.cmd, openCmd.args, { stdio: "ignore", detached: true }).unref();
+        rt.writeErr(`Opening browser for authentication...
+`);
+      } else {
+        rt.writeErr(`Open this URL in your browser:
+
+${authUrlStr}
+
+`);
+      }
+      rt.writeErr("Waiting for authentication callback...\n");
+      const { code, cleanup } = await codePromise;
+      let tokens;
+      try {
+        rt.writeErr("Exchanging code for tokens...\n");
+        tokens = await exchangeCodeForTokens(profile, code, codeVerifier, redirectUri);
+        await writeSsoCache(configDir, profile, tokens);
+      } finally {
+        cleanup();
+      }
+      let accountId = profile.ssoAccountId;
+      try {
+        rt.writeErr("Resolving account ID...\n");
+        accountId = await fetchAccountId(tokens.accessToken);
+        await updateConfigKey(configDir, profileName, "sso_account_id", accountId);
+      } catch {
+        rt.writeErr("Warning: Could not resolve account ID from /me. You can set it manually with `seclai configure sso`.\n");
+      }
+      rt.writeErr("Successfully authenticated!\n");
+      const loginResult = {
+        status: "authenticated",
+        profile: profileName,
+        expiresAt: tokens.expiresAt
+      };
+      if (accountId) loginResult.accountId = accountId;
+      printJson(rt, loginResult);
+    });
+  });
+  group.command("logout").description("Remove cached SSO tokens for the current profile.").action(async () => {
+    await run(rt, async () => {
+      const globalOpts = program.opts();
+      const { profile, profileName, configDir } = await loadProfile(rt, globalOpts);
+      await deleteSsoCache(configDir, profile);
+      rt.writeErr("Logged out successfully.\n");
+      printJson(rt, { status: "logged_out", profile: profileName });
+    });
+  });
+  group.command("status").description("Show current authentication status for the active profile.").action(async () => {
+    await run(rt, async () => {
+      const globalOpts = program.opts();
+      const { profile: profileLoaded, profileName, configDir } = await loadProfile(rt, globalOpts);
+      const cached = await readSsoCache(configDir, profileLoaded);
+      if (!cached) {
+        const notAuthResult = {
+          profile: profileName,
+          status: "not_authenticated"
+        };
+        if (profileLoaded.ssoAccountId) notAuthResult.accountId = profileLoaded.ssoAccountId;
+        printJson(rt, notAuthResult);
+        return;
+      }
+      const valid = isTokenValid(cached);
+      const statusResult = {
+        profile: profileName,
+        status: valid ? "authenticated" : "expired",
+        expiresAt: cached.expiresAt,
+        hasRefreshToken: Boolean(cached.refreshToken)
+      };
+      if (profileLoaded.ssoAccountId) statusResult.accountId = profileLoaded.ssoAccountId;
+      printJson(rt, statusResult);
+    });
+  });
+  group.command("refresh").description("Manually refresh the SSO token for the current profile.").action(async () => {
+    await run(rt, async () => {
+      const globalOpts = program.opts();
+      const { profile, profileName, configDir } = await loadProfile(rt, globalOpts);
+      const cached = await readSsoCache(configDir, profile);
+      if (!cached?.refreshToken) {
+        throw new Error("No cached token with refresh token. Run `seclai auth login` first.");
+      }
+      const tokenUrl = `https://${profile.ssoDomain}/oauth2/token`;
+      const body = new URLSearchParams({
+        grant_type: "refresh_token",
+        client_id: profile.ssoClientId,
+        refresh_token: cached.refreshToken
+      });
+      const resp = await fetch(tokenUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString()
+      });
+      if (!resp.ok) {
+        const text = await resp.text();
+        throw new Error(`Token refresh failed (HTTP ${resp.status}): ${text}`);
+      }
+      const data = await resp.json();
+      const refreshed = {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token ?? cached.refreshToken,
+        expiresAt: new Date(Date.now() + data.expires_in * 1e3).toISOString(),
+        clientId: profile.ssoClientId,
+        region: profile.ssoRegion,
+        cognitoDomain: profile.ssoDomain
+      };
+      if (data.id_token) refreshed.idToken = data.id_token;
+      await writeSsoCache(configDir, profile, refreshed);
+      rt.writeErr("Token refreshed successfully.\n");
+      printJson(rt, {
+        status: "refreshed",
+        profile: profileName,
+        expiresAt: refreshed.expiresAt
+      });
+    });
+  });
+}
+
+// src/commands/configure.ts
+import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile4 } from "fs/promises";
+import { join as join4 } from "path";
+import process4 from "process";
+import { createInterface } from "readline";
+import { DEFAULT_SSO_DOMAIN, DEFAULT_SSO_CLIENT_ID, DEFAULT_SSO_REGION } from "@seclai/sdk";
+function prompt(rt, question, defaultValue) {
+  return new Promise((resolve) => {
+    const rl = createInterface({
+      input: rt.stdin,
+      output: { write: (s) => {
+        rt.writeErr(s);
+        return true;
+      } },
+      terminal: false
+    });
+    const display = defaultValue ? `${question} [${defaultValue}]: ` : `${question}: `;
+    rt.writeErr(display);
+    rl.once("line", (answer) => {
+      rl.close();
+      resolve(answer.trim() || defaultValue || "");
+    });
+  });
+}
+function resolveConfigDir(opts) {
+  if (opts.configDir) return opts.configDir;
+  const env = process4.env.SECLAI_CONFIG_DIR;
+  if (env) return env;
+  const home = process4.env.HOME ?? process4.env.USERPROFILE ?? "";
+  return join4(home, ".seclai");
+}
+function register17(program, rt) {
+  const group = program.command("configure").description("Configure CLI profiles and settings.");
+  group.command("sso").description("Configure an SSO profile with optional overrides. Defaults to production Seclai SSO.").option("--profile-name <name>", "Profile name to configure (default: from --profile flag)").action(async (opts) => {
+    await run(rt, async () => {
+      const globalOpts = program.opts();
+      const profileName = opts.profileName || globalOpts.profile || "default";
+      const configDir = resolveConfigDir(globalOpts);
+      const configPath = join4(configDir, "config");
+      rt.writeErr(`
+Configuring SSO profile "${profileName}".
+`);
+      rt.writeErr(`Defaults: domain=${DEFAULT_SSO_DOMAIN}, region=${DEFAULT_SSO_REGION}
+`);
+      rt.writeErr(`Press Enter to accept defaults.
+
+`);
+      const domain = await prompt(rt, "SSO domain", DEFAULT_SSO_DOMAIN);
+      const clientId = await prompt(rt, "SSO client ID", DEFAULT_SSO_CLIENT_ID);
+      const region = await prompt(rt, "SSO region", DEFAULT_SSO_REGION);
+      const accountId = await prompt(rt, "Account ID (optional, resolved after login)");
+      const isDefault = domain === DEFAULT_SSO_DOMAIN && clientId === DEFAULT_SSO_CLIENT_ID && region === DEFAULT_SSO_REGION && !accountId;
+      if (isDefault && profileName === "default") {
+        rt.writeErr(`
+Using built-in defaults \u2014 no config file needed.
+`);
+        rt.writeErr(`Run \`seclai auth login\` to authenticate.
+`);
+        printJson(rt, {
+          profile: profileName,
+          sso_domain: domain,
+          sso_client_id: clientId,
+          sso_region: region,
+          note: "using built-in defaults"
+        });
+        return;
+      }
+      let content = "";
+      try {
+        content = await readFile4(configPath, "utf-8");
+      } catch {
+      }
+      const sectionHeader = profileName === "default" ? "[default]" : `[profile ${profileName}]`;
+      const lines = [];
+      if (domain !== DEFAULT_SSO_DOMAIN) lines.push(`sso_domain = ${domain}`);
+      if (clientId !== DEFAULT_SSO_CLIENT_ID) lines.push(`sso_client_id = ${clientId}`);
+      if (region !== DEFAULT_SSO_REGION) lines.push(`sso_region = ${region}`);
+      if (accountId) lines.push(`sso_account_id = ${accountId}`);
+      const sectionBody = lines.join("\n");
+      const sectionRegex = profileName === "default" ? /^\[default\][^\[]*(?=\[|$(?![\s\S]))/m : new RegExp(`^\\[profile ${escapeRegExp(profileName)}\\][^\\[]*(?=\\[|$(?![\\s\\S]))`, "m");
+      if (sectionRegex.test(content)) {
+        content = content.replace(sectionRegex, `${sectionHeader}
+${sectionBody}
+`);
+      } else {
+        if (content.length > 0 && !content.endsWith("\n")) {
+          content += "\n";
+        }
+        content += `
+${sectionHeader}
+${sectionBody}
+`;
+      }
+      await mkdir3(configDir, { recursive: true });
+      await writeFile4(configPath, content, { mode: 384 });
+      rt.writeErr(`
+Profile "${profileName}" saved to ${configPath}
+`);
+      rt.writeErr(`Run \`seclai auth login --profile ${profileName}\` to authenticate.
+`);
+      const result = {
+        profile: profileName,
+        configFile: configPath,
+        sso_domain: domain,
+        sso_client_id: clientId,
+        sso_region: region
+      };
+      if (accountId) result.sso_account_id = accountId;
+      printJson(rt, result);
+    });
+  });
+  group.command("list").description("List all configured profiles.").action(async () => {
+    await run(rt, async () => {
+      const globalOpts = program.opts();
+      const configDir = resolveConfigDir(globalOpts);
+      const configPath = join4(configDir, "config");
+      let content;
+      try {
+        content = await readFile4(configPath, "utf-8");
+      } catch {
+        printJson(rt, { profiles: [], configFile: configPath });
+        return;
+      }
+      const profiles = [];
+      for (const line of content.split("\n")) {
+        const trimmed = line.trim();
+        if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
+          const raw = trimmed.slice(1, -1).trim();
+          if (raw.startsWith("profile ")) {
+            profiles.push(raw.slice("profile ".length).trim());
+          } else {
+            profiles.push(raw);
+          }
+        }
+      }
+      printJson(rt, { profiles, configFile: configPath });
+    });
+  });
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
 // src/cli.ts
 function createProgram(rt = defaultRuntime()) {
   const program = new Command();
@@ -2178,6 +2630,15 @@ All commands return JSON to stdout, making it easy to pipe into jq or other tool
   ).version(cliVersion, "-V, --version", "output the version").option(
     "--api-key <key>",
     "Seclai API key (defaults to SECLAI_API_KEY)."
+  ).option(
+    "--profile <name>",
+    "SSO profile name (defaults to SECLAI_PROFILE, then 'default')."
+  ).option(
+    "--account-id <id>",
+    "Account ID for multi-org targeting (X-Account-Id header)."
+  ).option(
+    "--config-dir <path>",
+    "Config directory (defaults to SECLAI_CONFIG_DIR, then ~/.seclai)."
   ).option(
     "--compact",
     "Output compact JSON (no indentation)."
@@ -2186,16 +2647,19 @@ All commands return JSON to stdout, making it easy to pipe into jq or other tool
     "after",
     `
 Environment:
-  SECLAI_API_KEY   Default API key (alternative to --api-key)
-  SECLAI_API_URL   Override API base URL (default: https://api.seclai.com)
+  SECLAI_API_KEY      Default API key (alternative to --api-key)
+  SECLAI_API_URL      Override API base URL (default: https://api.seclai.com)
+  SECLAI_PROFILE      Default SSO profile (alternative to --profile)
+  SECLAI_CONFIG_DIR   Config directory (alternative to --config-dir)
 
 Examples:
   seclai agents list
   seclai agents run <agentId> --json '{"input":"Hello"}'
   seclai agents run <agentId> --json '{"input":"Hi"}' --events
-  seclai sources list
-  seclai kb list
-  seclai search --query "deployment guide"
+  seclai configure sso
+  seclai auth login
+  seclai auth status
+  seclai sources list --profile dev
   npx @seclai/cli agents list
 `
   );
@@ -2223,6 +2687,8 @@ Examples:
   register13(program, rt);
   register14(program, rt);
   register15(program, rt);
+  register16(program, rt);
+  register17(program, rt);
   return program;
 }
 async function runCli(argv, rt = defaultRuntime()) {