@superglue/cli 1.0.0 → 1.1.1

package/dist/cli.js

@@ -1751,6 +1751,7 @@ var require_types = __commonJS({
     exports2.isRequestConfig = isRequestConfig;
     exports2.isTransformConfig = isTransformConfig;
     exports2.getToolSystemIds = getToolSystemIds;
+    exports2.isProductionSystem = isProductionSystem;
     var UserRole;
     (function(UserRole2) {
       UserRole2["ADMIN"] = "admin";
@@ -1849,15 +1850,16 @@ var require_types = __commonJS({
       RunStatus2["FAILED"] = "FAILED";
       RunStatus2["ABORTED"] = "ABORTED";
     })(RunStatus || (exports2.RunStatus = RunStatus = {}));
-    var RequestSource;
-    (function(RequestSource2) {
-      RequestSource2["API"] = "api";
-      RequestSource2["FRONTEND"] = "frontend";
-      RequestSource2["SCHEDULER"] = "scheduler";
-      RequestSource2["MCP"] = "mcp";
-      RequestSource2["TOOL_CHAIN"] = "tool-chain";
-      RequestSource2["WEBHOOK"] = "webhook";
-    })(RequestSource || (exports2.RequestSource = RequestSource = {}));
+    var RequestSource3;
+    (function(RequestSource4) {
+      RequestSource4["API"] = "api";
+      RequestSource4["FRONTEND"] = "frontend";
+      RequestSource4["SCHEDULER"] = "scheduler";
+      RequestSource4["MCP"] = "mcp";
+      RequestSource4["TOOL_CHAIN"] = "tool-chain";
+      RequestSource4["WEBHOOK"] = "webhook";
+      RequestSource4["CLI"] = "cli";
+    })(RequestSource3 || (exports2.RequestSource = RequestSource3 = {}));
     var FilterTarget;
     (function(FilterTarget2) {
       FilterTarget2["KEYS"] = "KEYS";
@@ -1893,6 +1895,9 @@ var require_types = __commonJS({
       }
       return Array.from(ids);
     }
+    function isProductionSystem(system) {
+      return system.environment !== "dev";
+    }
     var DiscoveryRunStatus;
     (function(DiscoveryRunStatus2) {
       DiscoveryRunStatus2["PENDING"] = "PENDING";
@@ -8813,8 +8818,8 @@ var require_luxon = __commonJS({
         let current = null, currentFull = "", bracketed = false;
         const splits = [];
         for (let i = 0; i < fmt.length; i++) {
-          const c2 = fmt.charAt(i);
-          if (c2 === "'") {
+          const c3 = fmt.charAt(i);
+          if (c3 === "'") {
             if (currentFull.length > 0 || bracketed) {
               splits.push({
                 literal: bracketed || /^\s+$/.test(currentFull),
@@ -8825,9 +8830,9 @@ var require_luxon = __commonJS({
             currentFull = "";
             bracketed = !bracketed;
           } else if (bracketed) {
-            currentFull += c2;
-          } else if (c2 === current) {
-            currentFull += c2;
+            currentFull += c3;
+          } else if (c3 === current) {
+            currentFull += c3;
           } else {
             if (currentFull.length > 0) {
               splits.push({
@@ -8835,8 +8840,8 @@ var require_luxon = __commonJS({
                 val: currentFull
               });
             }
-            currentFull = c2;
-            current = c2;
+            currentFull = c3;
+            current = c3;
           }
         }
         if (currentFull.length > 0) {
@@ -11518,7 +11523,7 @@ var require_luxon = __commonJS({
       return fixOffset(objToLocalTS(obj), offset2, zone);
     }
     function adjustTime(inst, dur) {
-      const oPre = inst.o, year = inst.c.year + Math.trunc(dur.years), month = inst.c.month + Math.trunc(dur.months) + Math.trunc(dur.quarters) * 3, c2 = {
+      const oPre = inst.o, year = inst.c.year + Math.trunc(dur.years), month = inst.c.month + Math.trunc(dur.months) + Math.trunc(dur.quarters) * 3, c3 = {
         ...inst.c,
         year,
         month,
@@ -11533,7 +11538,7 @@ var require_luxon = __commonJS({
         minutes: dur.minutes,
         seconds: dur.seconds,
         milliseconds: dur.milliseconds
-      }).as("milliseconds"), localTS = objToLocalTS(c2);
+      }).as("milliseconds"), localTS = objToLocalTS(c3);
       let [ts, o] = fixOffset(localTS, oPre, inst.zone);
       if (millisToAdd !== 0) {
         ts += millisToAdd;
@@ -11568,72 +11573,72 @@ var require_luxon = __commonJS({
     }
     function toISODate(o, extended, precision) {
       const longFormat = o.c.year > 9999 || o.c.year < 0;
-      let c2 = "";
-      if (longFormat && o.c.year >= 0) c2 += "+";
-      c2 += padStart(o.c.year, longFormat ? 6 : 4);
-      if (precision === "year") return c2;
+      let c3 = "";
+      if (longFormat && o.c.year >= 0) c3 += "+";
+      c3 += padStart(o.c.year, longFormat ? 6 : 4);
+      if (precision === "year") return c3;
       if (extended) {
-        c2 += "-";
-        c2 += padStart(o.c.month);
-        if (precision === "month") return c2;
-        c2 += "-";
+        c3 += "-";
+        c3 += padStart(o.c.month);
+        if (precision === "month") return c3;
+        c3 += "-";
       } else {
-        c2 += padStart(o.c.month);
-        if (precision === "month") return c2;
+        c3 += padStart(o.c.month);
+        if (precision === "month") return c3;
       }
-      c2 += padStart(o.c.day);
-      return c2;
+      c3 += padStart(o.c.day);
+      return c3;
     }
     function toISOTime(o, extended, suppressSeconds, suppressMilliseconds, includeOffset, extendedZone, precision) {
-      let showSeconds = !suppressSeconds || o.c.millisecond !== 0 || o.c.second !== 0, c2 = "";
+      let showSeconds = !suppressSeconds || o.c.millisecond !== 0 || o.c.second !== 0, c3 = "";
       switch (precision) {
         case "day":
         case "month":
         case "year":
           break;
         default:
-          c2 += padStart(o.c.hour);
+          c3 += padStart(o.c.hour);
           if (precision === "hour") break;
           if (extended) {
-            c2 += ":";
-            c2 += padStart(o.c.minute);
+            c3 += ":";
+            c3 += padStart(o.c.minute);
             if (precision === "minute") break;
             if (showSeconds) {
-              c2 += ":";
-              c2 += padStart(o.c.second);
+              c3 += ":";
+              c3 += padStart(o.c.second);
             }
           } else {
-            c2 += padStart(o.c.minute);
+            c3 += padStart(o.c.minute);
             if (precision === "minute") break;
             if (showSeconds) {
-              c2 += padStart(o.c.second);
+              c3 += padStart(o.c.second);
             }
           }
           if (precision === "second") break;
           if (showSeconds && (!suppressMilliseconds || o.c.millisecond !== 0)) {
-            c2 += ".";
-            c2 += padStart(o.c.millisecond, 3);
+            c3 += ".";
+            c3 += padStart(o.c.millisecond, 3);
           }
       }
       if (includeOffset) {
         if (o.isOffsetFixed && o.offset === 0 && !extendedZone) {
-          c2 += "Z";
+          c3 += "Z";
         } else if (o.o < 0) {
-          c2 += "-";
-          c2 += padStart(Math.trunc(-o.o / 60));
-          c2 += ":";
-          c2 += padStart(Math.trunc(-o.o % 60));
+          c3 += "-";
+          c3 += padStart(Math.trunc(-o.o / 60));
+          c3 += ":";
+          c3 += padStart(Math.trunc(-o.o % 60));
         } else {
-          c2 += "+";
-          c2 += padStart(Math.trunc(o.o / 60));
-          c2 += ":";
-          c2 += padStart(Math.trunc(o.o % 60));
+          c3 += "+";
+          c3 += padStart(Math.trunc(o.o / 60));
+          c3 += ":";
+          c3 += padStart(Math.trunc(o.o % 60));
         }
       }
       if (extendedZone) {
-        c2 += "[" + o.zone.ianaName + "]";
+        c3 += "[" + o.zone.ianaName + "]";
       }
-      return c2;
+      return c3;
     }
     var defaultUnitValues = {
       month: 1,
@@ -11751,10 +11756,10 @@ var require_luxon = __commonJS({
       });
     }
     function diffRelative(start, end, opts) {
-      const round = isUndefined(opts.round) ? true : opts.round, rounding = isUndefined(opts.rounding) ? "trunc" : opts.rounding, format = (c2, unit) => {
-        c2 = roundTo(c2, round || opts.calendary ? 0 : 2, opts.calendary ? "round" : rounding);
+      const round = isUndefined(opts.round) ? true : opts.round, rounding = isUndefined(opts.rounding) ? "trunc" : opts.rounding, format = (c3, unit) => {
+        c3 = roundTo(c3, round || opts.calendary ? 0 : 2, opts.calendary ? "round" : rounding);
         const formatter = end.loc.clone(opts).relFormatter(opts);
-        return formatter.format(c2, unit);
+        return formatter.format(c3, unit);
       }, differ = (unit) => {
         if (opts.calendary) {
           if (!end.hasSame(start, unit)) {
@@ -11795,16 +11800,16 @@ var require_luxon = __commonJS({
         const zone = config.zone || Settings.defaultZone;
         let invalid = config.invalid || (Number.isNaN(config.ts) ? new Invalid("invalid input") : null) || (!zone.isValid ? unsupportedZone(zone) : null);
         this.ts = isUndefined(config.ts) ? Settings.now() : config.ts;
-        let c2 = null, o = null;
+        let c3 = null, o = null;
         if (!invalid) {
           const unchanged = config.old && config.old.ts === this.ts && config.old.zone.equals(zone);
           if (unchanged) {
-            [c2, o] = [config.old.c, config.old.o];
+            [c3, o] = [config.old.c, config.old.o];
           } else {
             const ot = isNumber(config.o) && !config.old ? config.o : zone.offset(this.ts);
-            c2 = tsToObj(this.ts, ot);
-            invalid = Number.isNaN(c2.year) ? new Invalid("invalid input") : null;
-            c2 = invalid ? null : c2;
+            c3 = tsToObj(this.ts, ot);
+            invalid = Number.isNaN(c3.year) ? new Invalid("invalid input") : null;
+            c3 = invalid ? null : c3;
             o = invalid ? null : ot;
           }
         }
@@ -11813,7 +11818,7 @@ var require_luxon = __commonJS({
         this.invalid = invalid;
         this.weekData = null;
         this.localWeekData = null;
-        this.c = c2;
+        this.c = c3;
         this.o = o;
         this.isLuxonDateTime = true;
       }
@@ -12572,8 +12577,8 @@ var require_luxon = __commonJS({
         const ts1 = localTS - o1 * minuteMs;
         const ts2 = localTS - o2 * minuteMs;
         const c1 = tsToObj(ts1, o1);
-        const c2 = tsToObj(ts2, o2);
-        if (c1.hour === c2.hour && c1.minute === c2.minute && c1.second === c2.second && c1.millisecond === c2.millisecond) {
+        const c22 = tsToObj(ts2, o2);
+        if (c1.hour === c22.hour && c1.minute === c22.minute && c1.second === c22.second && c1.millisecond === c22.millisecond) {
           return [clone2(this, {
             ts: ts1
           }), clone2(this, {
@@ -12971,10 +12976,10 @@ var require_luxon = __commonJS({
         }
         precision = normalizeUnit(precision);
         const ext = format === "extended";
-        let c2 = toISODate(this, ext, precision);
-        if (orderedUnits.indexOf(precision) >= 3) c2 += "T";
-        c2 += toISOTime(this, ext, suppressSeconds, suppressMilliseconds, includeOffset, extendedZone, precision);
-        return c2;
+        let c3 = toISODate(this, ext, precision);
+        if (orderedUnits.indexOf(precision) >= 3) c3 += "T";
+        c3 += toISOTime(this, ext, suppressSeconds, suppressMilliseconds, includeOffset, extendedZone, precision);
+        return c3;
       }
       /**
        * Returns an ISO 8601-compliant string representation of this DateTime's date component
@@ -13033,8 +13038,8 @@ var require_luxon = __commonJS({
           return null;
         }
         precision = normalizeUnit(precision);
-        let c2 = includePrefix && orderedUnits.indexOf(precision) >= 3 ? "T" : "";
-        return c2 + toISOTime(this, format === "extended", suppressSeconds, suppressMilliseconds, includeOffset, extendedZone, precision);
+        let c3 = includePrefix && orderedUnits.indexOf(precision) >= 3 ? "T" : "";
+        return c3 + toISOTime(this, format === "extended", suppressSeconds, suppressMilliseconds, includeOffset, extendedZone, precision);
       }
       /**
        * Returns an RFC 2822-compatible string representation of this DateTime
@@ -17619,7 +17624,7 @@ attempted value: ${formattedValue}
           type: next.type,
           oneOf: next._whitelist.describe(),
           notOneOf: next._blacklist.describe(),
-          tests: next.tests.filter((n, idx, list) => list.findIndex((c2) => c2.OPTIONS.name === n.OPTIONS.name) === idx).map((fn) => {
+          tests: next.tests.filter((n, idx, list) => list.findIndex((c3) => c3.OPTIONS.name === n.OPTIONS.name) === idx).map((fn) => {
             const params = fn.OPTIONS.params && options ? resolveParams(Object.assign({}, fn.OPTIONS.params), options) : fn.OPTIONS.params;
             return {
               name: fn.OPTIONS.name,
@@ -19867,6 +19872,7 @@ var require_utils = __commonJS({
     exports2.ALLOWED_PATCH_SYSTEM_FIELDS = exports2.getSystemAuthStatus = exports2.detectSystemAuthType = exports2.maskSystemCredentials = exports2.isSensitiveCredentialKey = exports2.ALLOWED_FILE_EXTENSIONS = exports2.getConnectionProtocol = void 0;
     exports2.validateExternalUrl = validateExternalUrl;
     exports2.flattenAndNamespaceCredentials = flattenAndNamespaceCredentials;
+    exports2.flattenAndNamespaceSystemUrls = flattenAndNamespaceSystemUrls;
     exports2.generateUniqueId = generateUniqueId;
     exports2.waitForSystemProcessing = waitForSystemProcessing;
     exports2.inferJsonSchema = inferJsonSchema;
@@ -20067,6 +20073,14 @@ var require_utils = __commonJS({
         return acc;
       }, {});
     }
+    function flattenAndNamespaceSystemUrls(systems2) {
+      return systems2.reduce((acc, sys) => {
+        if (sys.url) {
+          acc[`${sys.id}_url`] = sys.url;
+        }
+        return acc;
+      }, {});
+    }
     async function generateUniqueId({ baseId, exists }) {
       if (!await exists(baseId)) {
         return baseId;
@@ -20448,6 +20462,7 @@ var require_utils = __commonJS({
       "multiTenancyMode",
       "documentationFiles",
       "tunnel"
+      // Note: "environment" is NOT patchable because it's part of the composite primary key
     ];
     var SAMPLEABLE_KEYS = /* @__PURE__ */ new Set([
       "data",
@@ -21096,9 +21111,9 @@ var require_superglue_client = __commonJS({
     var types_js_1 = require_types();
     var sse_log_subscription_js_1 = require_sse_log_subscription();
     var SuperglueClient3 = class {
-      constructor({ endpoint, apiKey, apiEndpoint, onInfrastructureError }) {
+      constructor({ apiKey, apiEndpoint, onInfrastructureError }) {
         this.apiKey = apiKey;
-        this.apiEndpoint = apiEndpoint ?? endpoint ?? "https://api.superglue.cloud";
+        this.apiEndpoint = apiEndpoint ?? "https://api.superglue.cloud";
         this.sseManager = new sse_log_subscription_js_1.SSELogSubscriptionManager(this.apiEndpoint, this.apiKey);
         this.onInfrastructureError = onInfrastructureError;
       }
@@ -21218,14 +21233,15 @@ var require_superglue_client = __commonJS({
        * Execute a single step without creating a run in the database.
        * Used for individual step testing in the playground.
        */
-      async executeStep({ step, payload, previousResults, credentials, options, runId }) {
+      async executeStep({ step, payload, previousResults, credentials, options, runId, mode }) {
         return this.restRequest("POST", "/v1/tools/step/run", {
           step,
           payload,
           previousResults,
           credentials,
           options,
-          runId
+          runId,
+          mode
         });
       }
       /**
@@ -21400,11 +21416,14 @@ var require_superglue_client = __commonJS({
           newId
         });
       }
-      async listSystems(limit = 10, page = 1) {
+      async listSystems(limit = 10, page = 1, options) {
         const params = new URLSearchParams({
           limit: String(limit),
           page: String(page)
         });
+        if (options?.mode) {
+          params.set("mode", options.mode);
+        }
         const response = await this.restRequest("GET", `/v1/systems?${params.toString()}`);
         return { items: response.data, total: response.total };
       }
@@ -21413,20 +21432,23 @@ var require_superglue_client = __commonJS({
         const response = await this.restRequest("GET", `/v1/tools/search${params}`);
         return response.data;
       }
-      async getSystem(id) {
-        const response = await this.restRequest("GET", `/v1/systems/${encodeURIComponent(id)}`);
+      async getSystem(id, options) {
+        const queryParams = options?.environment ? `?env=${options.environment}` : "";
+        const response = await this.restRequest("GET", `/v1/systems/${encodeURIComponent(id)}${queryParams}`);
         return response.data;
       }
       async createSystem(input) {
         const response = await this.restRequest("POST", "/v1/systems", input);
         return response.data;
       }
-      async updateSystem(id, input) {
-        const response = await this.restRequest("PATCH", `/v1/systems/${encodeURIComponent(id)}`, input);
+      async updateSystem(id, input, options) {
+        const queryParams = options?.environment ? `?env=${options.environment}` : "";
+        const response = await this.restRequest("PATCH", `/v1/systems/${encodeURIComponent(id)}${queryParams}`, input);
         return response.data;
       }
-      async deleteSystem(id) {
-        await this.restRequest("DELETE", `/v1/systems/${encodeURIComponent(id)}`);
+      async deleteSystem(id, options) {
+        const queryParams = options?.environment ? `?env=${options.environment}` : "";
+        await this.restRequest("DELETE", `/v1/systems/${encodeURIComponent(id)}${queryParams}`);
         return true;
       }
       async cacheOAuthSecret(args) {
@@ -21584,18 +21606,14 @@ var require_dist2 = __commonJS({
 });
 
 // src/cli.ts
-var import_commander = require("commander");
+var import_commander5 = require("commander");
 
 // src/config.ts
 var fs = __toESM(require("fs"));
 var os = __toESM(require("os"));
 var path = __toESM(require("path"));
 var DEFAULT_CONFIG = {
-  output: { mode: "stdout", directory: ".superglue/output" },
-  policies: {
-    callSystem: "ask_every_time",
-    editTool: "confirm"
-  }
+  output: { mode: "stdout", directory: ".superglue/output" }
 };
 function getConfigDir(preferLocal) {
   const localDir = path.join(process.cwd(), ".superglue");
@@ -21638,14 +21656,15 @@ function resolveConfig(flags) {
     apiKey,
     endpoint,
     webEndpoint,
-    output: { ...DEFAULT_CONFIG.output, ...file.output },
-    policies: { ...DEFAULT_CONFIG.policies, ...file.policies }
+    output: { ...DEFAULT_CONFIG.output, ...file.output }
   };
 }
 function writeConfig(config, preferLocal) {
   const dir = getConfigDir(preferLocal);
   if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-  fs.writeFileSync(path.join(dir, "config.json"), JSON.stringify(config, null, 2) + "\n");
+  fs.writeFileSync(path.join(dir, "config.json"), JSON.stringify(config, null, 2) + "\n", {
+    mode: 384
+  });
 }
 function ensureConfigDirs(config, preferLocal) {
   const draftsDir = path.join(getConfigDir(preferLocal), "drafts");
@@ -21677,6 +21696,126 @@ var import_shared2 = __toESM(require_dist2());
 
 // src/output.ts
 var readline = __toESM(require("readline"));
+
+// src/version.ts
+var import_node_child_process = require("child_process");
+var import_node_util = require("util");
+
+// package.json
+var package_default = {
+  name: "@superglue/cli",
+  version: "1.1.0",
+  bin: {
+    sg: "./dist/cli.js"
+  },
+  files: [
+    ".claude-plugin/",
+    "dist/",
+    "skills/",
+    "LICENSE"
+  ],
+  dependencies: {
+    commander: "^13.0.0",
+    "fast-json-patch": "^3.1.1"
+  },
+  devDependencies: {
+    "@superglue/shared": "file:../shared",
+    "@types/node": "^20.0.0",
+    tsup: "^8.0.0",
+    typescript: "^5.0.0"
+  },
+  scripts: {
+    build: "tsup && (cp -r skills dist/ 2>/dev/null || true)",
+    dev: "tsup --watch",
+    "type-check": "tsc --noEmit",
+    prepublishOnly: "npm run build"
+  },
+  publishConfig: {
+    access: "public"
+  }
+};
+
+// src/version.ts
+var execAsync = (0, import_node_util.promisify)(import_node_child_process.exec);
+var CLI_VERSION = package_default.version;
+function parseVersionPart(part) {
+  const match = part.match(/^(\d+)(?:-(.+))?$/);
+  if (match) {
+    return { numeric: parseInt(match[1], 10), prerelease: match[2] || null };
+  }
+  return { numeric: 0, prerelease: part };
+}
+function compareVersions(a, b) {
+  const partsA = a.split(".");
+  const partsB = b.split(".");
+  const maxLen = Math.max(partsA.length, partsB.length);
+  for (let i = 0; i < maxLen; i++) {
+    const parsedA = parseVersionPart(partsA[i] || "0");
+    const parsedB = parseVersionPart(partsB[i] || "0");
+    if (parsedA.numeric < parsedB.numeric) return -1;
+    if (parsedA.numeric > parsedB.numeric) return 1;
+    if (parsedA.prerelease === null && parsedB.prerelease !== null) return 1;
+    if (parsedA.prerelease !== null && parsedB.prerelease === null) return -1;
+    if (parsedA.prerelease !== null && parsedB.prerelease !== null) {
+      if (parsedA.prerelease < parsedB.prerelease) return -1;
+      if (parsedA.prerelease > parsedB.prerelease) return 1;
+    }
+  }
+  return 0;
+}
+async function checkVersionCompatibility(endpoint) {
+  try {
+    const healthUrl = `${endpoint.replace(/\/$/, "")}/v1/health`;
+    const response = await fetch(healthUrl, { signal: AbortSignal.timeout(3e3) });
+    if (!response.ok) return;
+    const health = await response.json();
+    if (!health.minCliVersion) return;
+    if (compareVersions(CLI_VERSION, health.minCliVersion) < 0) {
+      console.error("");
+      console.error(`${c.yellow}${c.bold}\u26A0 CLI version ${CLI_VERSION} is outdated.${c.reset}`);
+      console.error(
+        `${c.yellow}  Server requires at least v${health.minCliVersion}. Run: ${c.bold}sg update${c.reset}`
+      );
+      console.error("");
+    }
+  } catch {
+  }
+}
+async function getLatestNpmVersion() {
+  try {
+    const response = await fetch("https://registry.npmjs.org/@superglue/cli/latest", {
+      signal: AbortSignal.timeout(5e3)
+    });
+    if (!response.ok) return null;
+    const data = await response.json();
+    return data.version || null;
+  } catch {
+    return null;
+  }
+}
+async function updateCli() {
+  const latestVersion = await getLatestNpmVersion();
+  if (!latestVersion) {
+    return { success: false, message: "Could not fetch latest version from npm" };
+  }
+  if (compareVersions(CLI_VERSION, latestVersion) >= 0) {
+    return { success: true, message: `Already on latest version (${CLI_VERSION})` };
+  }
+  try {
+    await execAsync("npm install -g @superglue/cli@latest");
+    return {
+      success: true,
+      message: `Updated from ${CLI_VERSION} to ${latestVersion}`
+    };
+  } catch (err) {
+    return {
+      success: false,
+      message: `Update failed: ${err.message}. Try manually: npm install -g @superglue/cli@latest`
+    };
+  }
+}
+
+// src/output.ts
 var isJsonMode = () => process.argv.includes("--json") || !process.stdout.isTTY;
 var c = {
   reset: "\x1B[0m",
@@ -21699,6 +21838,10 @@ var c = {
   bgMagenta: "\x1B[45m",
   bgCyan: "\x1B[46m"
 };
+function link(url, label) {
+  const text = label || url;
+  return `\x1B]8;;${url}\x07${c.underline}${c.cyan}${text}${c.reset}\x1B]8;;\x07`;
+}
 function banner() {
   if (isJsonMode()) return;
   const rst = c.reset;
@@ -21729,26 +21872,34 @@ function banner() {
     const after = line.slice(last + 1);
     console.log(`  ${before}${inv}${inside}${rst}${after}`);
   });
-  console.log(`  ${d}  CLI v0.1.0${rst}`);
+  console.log(`  ${d}  CLI v${CLI_VERSION}${rst}`);
   console.log("");
 }
 function spinner(message) {
   if (isJsonMode()) return { stop: () => {
   }, update: () => {
+  }, log: () => {
   } };
   const frames = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
   let i = 0;
   let currentMsg = message;
-  const interval = setInterval(() => {
+  const clearLine = () => process.stdout.write(`\r\x1B[2K`);
+  const drawSpinner = () => {
     process.stdout.write(`\r  ${c.cyan}${frames[i++ % frames.length]}${c.reset} ${currentMsg}`);
-  }, 80);
+  };
+  const interval = setInterval(drawSpinner, 80);
   return {
     update: (msg) => {
       currentMsg = msg;
     },
+    log: (line) => {
+      clearLine();
+      console.log(`  ${c.dim}\u2502${c.reset} ${line}`);
+      drawSpinner();
+    },
     stop: (finalMsg) => {
       clearInterval(interval);
-      process.stdout.write(`\r${"".padEnd(currentMsg.length + 10)}\r`);
+      clearLine();
       if (finalMsg) console.log(`  ${finalMsg}`);
     }
   };
@@ -21782,6 +21933,11 @@ function error(message, details) {
     if (details) prettyPrint(details, 4);
   }
 }
+function warn(message) {
+  if (!isJsonMode()) {
+    console.log(`  ${c.yellow}\u26A0${c.reset} ${message}`);
+  }
+}
 function info(message) {
   if (!isJsonMode()) {
     console.log(`  ${c.dim}${message}${c.reset}`);
@@ -21944,16 +22100,6 @@ function renderDiffs(diffs) {
     return `  ${color}${icon} ${c.bold}[${d.op}]${c.reset} ${c.dim}${d.path}${c.reset}${valueStr}`;
   }).join("\n");
 }
-async function confirm(message) {
-  if (process.argv.includes("--yes") || process.argv.includes("-y")) return true;
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve4) => {
-    rl.question(`  ${message} ${c.dim}[y/N]${c.reset} `, (answer) => {
-      rl.close();
-      resolve4(answer.toLowerCase() === "y" || answer.toLowerCase() === "yes");
-    });
-  });
-}
 async function prompt(message, defaultValue) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   const suffix = defaultValue ? ` ${c.dim}[${defaultValue}]${c.reset}` : "";
@@ -21966,47 +22112,97 @@ async function prompt(message, defaultValue) {
 }
 async function promptHidden(message) {
   return new Promise((resolve4) => {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    process.stdout.write(`  ${message}: `);
-    if (process.stdin.isTTY) {
-      process.stdin.setRawMode(true);
+    process.stdout.write(`${message}: `);
+    if (!process.stdin.isTTY) {
+      const rl = readline.createInterface({ input: process.stdin });
+      rl.once("line", (line) => {
+        rl.close();
+        resolve4(line.trim());
+      });
+      return;
     }
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
     let input = "";
     const onData = (ch) => {
       const s = ch.toString();
-      if (s === "\n" || s === "\r") {
-        if (process.stdin.isTTY) process.stdin.setRawMode(false);
-        process.stdin.removeListener("data", onData);
-        process.stdout.write("\n");
-        rl.close();
-        resolve4(input);
-      } else if (s === "") {
-        process.exit(0);
-      } else if (s === "\x7F" || s === "\b") {
-        if (input.length > 0) {
-          input = input.slice(0, -1);
-          process.stdout.write("\b \b");
+      for (const char of s) {
+        if (char === "\n" || char === "\r") {
+          process.stdin.setRawMode(false);
+          process.stdin.removeListener("data", onData);
+          process.stdin.pause();
+          process.stdout.write("\n");
+          resolve4(input);
+          return;
+        } else if (char === "") {
+          process.stdin.setRawMode(false);
+          process.exit(130);
+        } else if (char === "\x7F" || char === "\b") {
+          if (input.length > 0) {
+            input = input.slice(0, -1);
+            process.stdout.write("\b \b");
+          }
+        } else {
+          input += char;
+          process.stdout.write(`${c.dim}\u2022${c.reset}`);
         }
-      } else {
-        input += s;
-        process.stdout.write(`${c.dim}\u2022${c.reset}`);
       }
     };
     process.stdin.on("data", onData);
-    process.stdin.resume();
   });
 }
 async function choose(message, options, defaultIndex = 0) {
   if (!process.stdout.isTTY) return defaultIndex;
-  console.log("");
-  for (let i = 0; i < options.length; i++) {
-    const marker = i === defaultIndex ? `${c.cyan}\u276F${c.reset}` : " ";
-    const label = i === defaultIndex ? `${c.bold}${options[i]}${c.reset}` : `${c.dim}${options[i]}${c.reset}`;
-    console.log(`    ${marker} ${c.dim}(${i + 1})${c.reset} ${label}`);
-  }
-  const answer = await prompt(`  ${message}`, String(defaultIndex + 1));
-  const idx = parseInt(answer, 10) - 1;
-  return idx >= 0 && idx < options.length ? idx : defaultIndex;
+  let selected = defaultIndex;
+  const render = () => {
+    for (let i = 0; i < options.length; i++) {
+      const marker = i === selected ? `${c.cyan}\u276F${c.reset}` : " ";
+      const label = i === selected ? `${c.bold}${options[i]}${c.reset}` : `${c.dim}${options[i]}${c.reset}`;
+      console.log(`    ${marker} ${label}`);
+    }
+  };
+  const moveUp = () => {
+    process.stdout.write(`\x1B[${options.length}A\r`);
+    for (let i = 0; i < options.length; i++) {
+      process.stdout.write(`\x1B[2K`);
+      if (i < options.length - 1) process.stdout.write(`
+`);
+    }
+    process.stdout.write(`\x1B[${options.length - 1}A\r`);
+  };
+  console.log(
+    `
+  ${c.bold}${message}${c.reset} ${c.dim}(\u2191/\u2193 to select, enter to confirm)${c.reset}`
+  );
+  render();
+  return new Promise((resolve4) => {
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    const onData = (ch) => {
+      const s = ch.toString();
+      if (s === "\r" || s === "\n") {
+        process.stdin.setRawMode(false);
+        process.stdin.removeListener("data", onData);
+        process.stdin.pause();
+        resolve4(selected);
+        return;
+      }
+      if (s === "") {
+        process.stdin.setRawMode(false);
+        process.exit(130);
+      }
+      if (s === "\x1B[A" || s === "k") {
+        selected = (selected - 1 + options.length) % options.length;
+      } else if (s === "\x1B[B" || s === "j") {
+        selected = (selected + 1) % options.length;
+      } else {
+        return;
+      }
+      moveUp();
+      render();
+    };
+    process.stdin.on("data", onData);
+  });
 }
 
 // src/commands/init.ts
@@ -22017,6 +22213,10 @@ function registerInitCommand(program2) {
     console.log(`  ${c.dim}Let's get you connected in a few steps.${c.reset}
 `);
     heading("Authentication");
+    console.log(
+      `  ${c.dim}Get your API key at${c.reset} ${link("https://app.superglue.cloud/admin?view=api-keys")}`
+    );
+    console.log("");
     const apiKey = await promptHidden("  API Key");
     if (!apiKey) {
       error("API key is required");
@@ -22049,25 +22249,6 @@ function registerInitCommand(program2) {
     if (outputMode === "stdout+file") {
       outputDir = await prompt("  Output directory", ".superglue/output");
     }
-    heading("Execution Policies");
-    console.log(`  ${c.dim}These control when the CLI asks for confirmation.${c.reset}
-`);
-    const callPolicyIdx = await choose(
-      "API call confirmation",
-      ["Ask every time", "Auto-run GET requests only", "Auto-run everything"],
-      0
-    );
-    const callPolicies = [
-      "ask_every_time",
-      "run_gets_only",
-      "run_everything"
-    ];
-    const editPolicyIdx = await choose(
-      "Tool edit confirmation",
-      ["Show diff and ask to confirm", "Auto-accept all changes"],
-      0
-    );
-    const editPolicies = ["confirm", "auto_accept"];
     heading("Config Location");
     const homeDir = os2.homedir();
     const localPath = path2.join(process.cwd(), ".superglue");
@@ -22085,11 +22266,7 @@ function registerInitCommand(program2) {
       apiKey,
       endpoint,
       webEndpoint,
-      output: { mode: outputMode, directory: outputDir },
-      policies: {
-        callSystem: callPolicies[callPolicyIdx],
-        editTool: editPolicies[editPolicyIdx]
-      }
+      output: { mode: outputMode, directory: outputDir }
     };
     writeConfig(config, preferLocal);
     ensureConfigDirs(config, preferLocal);
@@ -22151,9 +22328,11 @@ var path3 = __toESM(require("path"));
 function getDraftsDir() {
   return path3.join(getConfigDir(), "drafts");
 }
+function encodeDraftId(draftId) {
+  return Buffer.from(draftId, "utf-8").toString("base64url");
+}
 function getDraftPath(draftId) {
-  const safeName = draftId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return path3.join(getDraftsDir(), `${safeName}.json`);
+  return path3.join(getDraftsDir(), `${encodeDraftId(draftId)}.json`);
 }
 function writeDraft(draft) {
   const dir = getDraftsDir();
@@ -22318,8 +22497,10 @@ function registerBuildCommand(parent, getContext2) {
 // src/commands/tool/run.ts
 var fs6 = __toESM(require("fs"));
 var path5 = __toESM(require("path"));
+var crypto2 = __toESM(require("crypto"));
+var import_shared4 = __toESM(require_dist2());
 function registerRunCommand(parent, getContext2) {
-  parent.command("run").description("Execute a draft or saved tool").option("--draft <id>", "Draft ID from build").option("--tool <id>", "Saved tool ID").option("--payload <json>", "JSON payload").option("--payload-file <path>", "JSON payload file").option(
+  parent.command("run").description("Execute a draft, saved tool, or inline tool config").option("--draft <id>", "Draft ID from build").option("--tool <id>", "Saved tool ID").option("--config <json>", "Inline tool config JSON").option("--config-file <path>", "Tool config JSON file").option("--payload <json>", "JSON payload").option("--payload-file <path>", "JSON payload file").option(
     "--file <key=path...>",
     "File references",
     (v, arr) => {
@@ -22329,8 +22510,13 @@ function registerRunCommand(parent, getContext2) {
     []
   ).option("--include-step-results", "Include raw step results").option("--include-config", "Include full tool config").action(async (opts) => {
     const { config, client } = getContext2();
-    if (!opts.draft && !opts.tool) {
-      error("Provide --draft or --tool");
+    const selectors = [opts.tool, opts.draft, opts.config, opts.configFile].filter(Boolean);
+    if (selectors.length === 0) {
+      error("Provide one of --tool, --draft, --config, or --config-file");
+      process.exit(1);
+    }
+    if (selectors.length > 1) {
+      error("Only one of --tool, --draft, --config, or --config-file can be used");
       process.exit(1);
     }
     const filePayloads = await parseFileFlags(opts.file, client);
@@ -22344,32 +22530,67 @@ function registerRunCommand(parent, getContext2) {
       payload = fileResult.resolved;
     }
     let result;
-    const toolLabel = opts.tool || opts.draft;
+    const toolLabel = opts.tool || opts.draft || "inline-config";
+    const traceId = crypto2.randomUUID();
     const spin = spinner(`Running ${c.bold}${toolLabel}${c.reset}...`);
-    if (opts.tool) {
+    const logSub = await client.subscribeToLogsSSE({
+      traceId,
+      onLog: (log) => spin.log(`${c.dim}${log.message}${c.reset}`)
+    }).catch(() => ({ unsubscribe: () => {
+    } }));
+    const runToolConfig = async (toolConfig) => {
       try {
-        result = await client.runTool({ toolId: opts.tool, payload });
+        const res = await client.runToolConfig({
+          tool: toolConfig,
+          payload,
+          options: { requestSource: import_shared4.RequestSource.CLI },
+          traceId
+        });
+        logSub.unsubscribe();
         spin.stop();
+        return res;
       } catch (err) {
+        logSub.unsubscribe();
         spin.stop();
         error(err.message);
         process.exit(1);
       }
-    } else {
-      const draft = readDraft(opts.draft);
-      if (!draft) {
+    };
+    if (opts.tool) {
+      try {
+        result = await client.runTool({
+          toolId: opts.tool,
+          payload,
+          options: { requestSource: import_shared4.RequestSource.CLI, traceId }
+        });
+        logSub.unsubscribe();
         spin.stop();
-        error(`Draft not found: ${opts.draft}`);
+      } catch (err) {
+        logSub.unsubscribe();
+        spin.stop();
+        error(err.message);
         process.exit(1);
       }
+    } else if (opts.config || opts.configFile) {
+      let toolConfig;
       try {
-        result = await client.runToolConfig({ tool: draft.config, payload });
-        spin.stop();
+        toolConfig = opts.configFile ? JSON.parse(fs6.readFileSync(opts.configFile, "utf-8")) : JSON.parse(opts.config);
       } catch (err) {
+        logSub.unsubscribe();
         spin.stop();
-        error(err.message);
+        error(`Invalid tool config JSON: ${err.message}`);
         process.exit(1);
       }
+      result = await runToolConfig(toolConfig);
+    } else {
+      const draft = readDraft(opts.draft);
+      if (!draft) {
+        logSub.unsubscribe();
+        spin.stop();
+        error(`Draft not found: ${opts.draft}`);
+        process.exit(1);
+      }
+      result = await runToolConfig(draft.config);
     }
     const out = {
       success: result.success,
@@ -22382,7 +22603,7 @@ function registerRunCommand(parent, getContext2) {
     if (config.output.mode === "stdout+file") {
       const outDir = path5.resolve(config.output.directory);
       if (!fs6.existsSync(outDir)) fs6.mkdirSync(outDir, { recursive: true });
-      const rawId = opts.tool || opts.draft;
+      const rawId = opts.tool || opts.draft || "inline-config";
       const safeId = path5.basename(rawId).replace(/[^a-zA-Z0-9_-]/g, "_");
       const filename = `${safeId}-${Date.now()}.json`;
       fs6.writeFileSync(path5.join(outDir, filename), JSON.stringify(out, null, 2));
@@ -22393,11 +22614,13 @@ function registerRunCommand(parent, getContext2) {
 
 // src/commands/tool/edit.ts
 var fs7 = __toESM(require("fs"));
-var import_shared4 = __toESM(require_dist2());
+var crypto3 = __toESM(require("crypto"));
+var import_shared5 = __toESM(require_dist2());
+var import_shared6 = __toESM(require_dist2());
 var jsonpatch = __toESM(require("fast-json-patch"));
 function registerEditCommand(parent, getContext2) {
   parent.command("edit").description("Edit a tool using JSON Patch operations").option("--draft <id>", "Draft ID to edit").option("--tool <id>", "Saved tool ID to edit").option("--patches <json-or-file>", "JSON Patch array (inline JSON or file path)").option("--payload <json>", "Test payload JSON").option("--test", "Run the patched tool after accepting").action(async (opts) => {
-    const { config, client } = getContext2();
+    const { client } = getContext2();
     if (!opts.draft && !opts.tool) {
       error("Provide --draft or --tool");
       process.exit(1);
@@ -22443,7 +22666,7 @@ function registerEditCommand(parent, getContext2) {
     try {
       const copy = JSON.parse(JSON.stringify(originalConfig));
       const result = jsonpatch.applyPatch(copy, patches, true, true);
-      patchedConfig = (0, import_shared4.normalizeToolSchemas)(result.newDocument || copy);
+      patchedConfig = (0, import_shared6.normalizeToolSchemas)(result.newDocument || copy);
     } catch (err) {
       error(`Patch failed: ${err.message}`);
       process.exit(1);
@@ -22459,23 +22682,15 @@ function registerEditCommand(parent, getContext2) {
       console.log(renderDiffs(diffs));
       console.log("");
     }
-    const autoAccept = process.argv.includes("--yes") || process.argv.includes("-y") || config.policies.editTool === "auto_accept";
-    if (!autoAccept) {
-      const accepted = await confirm("Accept changes?");
-      if (!accepted) {
-        output({ success: false, rejected: true, message: "Changes rejected" });
-        process.exit(1);
-      }
-    }
     const draft = {
       draftId: workingDraftId,
       config: {
         ...patchedConfig,
-        instruction: originalConfig.instruction || patchedConfig.instruction,
+        instruction: patchedConfig.instruction ?? originalConfig.instruction,
         updatedAt: (/* @__PURE__ */ new Date()).toISOString()
       },
       systemIds: patchedConfig.systemIds || [],
-      instruction: patchedConfig.instruction || "",
+      instruction: patchedConfig.instruction ?? "",
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     writeDraft(draft);
@@ -22487,9 +22702,21 @@ function registerEditCommand(parent, getContext2) {
         error(`Invalid --payload JSON: ${err.message}`);
         process.exit(1);
       }
+      const traceId = crypto3.randomUUID();
       const spin = spinner("Running test...");
+      const logSub = await client.subscribeToLogsSSE({
+        traceId,
+        onLog: (log) => spin.log(`${c.dim}${log.message}${c.reset}`)
+      }).catch(() => ({ unsubscribe: () => {
+      } }));
       try {
-        const testResult = await client.runToolConfig({ tool: draft.config, payload });
+        const testResult = await client.runToolConfig({
+          tool: draft.config,
+          payload,
+          options: { requestSource: import_shared5.RequestSource.CLI },
+          traceId
+        });
+        logSub.unsubscribe();
         spin.stop();
         if (testResult.success) {
           success("Test passed");
@@ -22511,6 +22738,7 @@ function registerEditCommand(parent, getContext2) {
           output(testResult.data);
         }
       } catch (err) {
+        logSub.unsubscribe();
         spin.stop();
         error(`Test error: ${err.message}`);
         output({
@@ -22541,8 +22769,8 @@ function registerSaveCommand(parent, getContext2) {
       process.exit(1);
     }
     const toolId = opts.id || draft.config.id;
+    const spin = spinner(`Saving tool ${c.bold}${toolId}${c.reset}...`);
     try {
-      const spin = spinner(`Saving tool ${c.bold}${toolId}${c.reset}...`);
       const saved = await client.upsertWorkflow(toolId, {
         ...draft.config,
         id: toolId,
@@ -22564,6 +22792,7 @@ function registerSaveCommand(parent, getContext2) {
         console.log("");
       }
     } catch (err) {
+      spin.stop();
       error(err.message);
       process.exit(1);
     }
@@ -22602,7 +22831,7 @@ function registerFindCommand(parent, getContext2) {
         output({ success: true, tool });
         return;
       }
-      const searchQuery = query || "*";
+      const searchQuery = (query || "").trim() || "*";
       if (searchQuery === "*") {
         const { items } = await client.listWorkflows(100);
         const tools = items.filter((t) => !t.archived).map((t) => ({
@@ -22641,7 +22870,8 @@ function registerToolCommands(program2, getContext2) {
 
 // src/commands/system/create.ts
 var fs8 = __toESM(require("fs"));
-var import_shared5 = __toESM(require_dist2());
+var import_commander = require("commander");
+var import_shared7 = __toESM(require_dist2());
 async function collectSensitiveCredentials(fields) {
   const creds = {};
   for (const field of fields) {
@@ -22659,12 +22889,21 @@ async function collectSensitiveCredentials(fields) {
   return creds;
 }
 function registerCreateCommand(parent, getContext2) {
-  parent.command("create").description("Create a new system").option("--config <file>", "JSON config file").option("--id <id>", "System ID").option("--name <name>", "Human-readable name").option("--url <url>", "API URL").option("--template <id>", "Template ID").option("--instructions <text>", "Specific instructions").option("--credentials <json>", "Non-sensitive credentials JSON").option("--sensitive-credentials <fields>", "Comma-separated sensitive credential field names").option("--docs-url <url>", "Documentation URL to scrape").option("--openapi-url <url>", "OpenAPI spec URL").action(async (opts) => {
+  parent.command("create").description("Create a new system").option("--config <file>", "JSON config file").option("--id <id>", "System ID").option("--name <name>", "Human-readable name").option("--url <url>", "API URL").option("--template <id>", "Template ID").option("--instructions <text>", "Specific instructions").option("--credentials <json>", "Non-sensitive credentials JSON").option("--sensitive-credentials <fields>", "Comma-separated sensitive credential field names").option("--docs-url <url>", "Documentation URL to scrape").option("--openapi-url <url>", "OpenAPI spec URL").addOption(
+    new import_commander.Option("--env <environment>", "Environment: dev or prod (default: prod)").choices([
+      "dev",
+      "prod"
+    ])
+  ).action(async (opts) => {
     const { client } = getContext2();
     let systemInput;
     if (opts.config) {
       try {
-        systemInput = JSON.parse(fs8.readFileSync(opts.config, "utf-8"));
+        const parsed = JSON.parse(fs8.readFileSync(opts.config, "utf-8"));
+        if (opts.env === "dev" || opts.env === "prod") {
+          parsed.environment = opts.env;
+        }
+        systemInput = parsed;
       } catch (err) {
         error(`Invalid config file: ${err.message}`);
         process.exit(1);
@@ -22684,14 +22923,15 @@ function registerCreateCommand(parent, getContext2) {
         name: opts.name,
         url: opts.url,
         specificInstructions: opts.instructions,
-        credentials
+        credentials,
+        environment: opts.env === "dev" || opts.env === "prod" ? opts.env : void 0
       };
     }
     if (opts.template) {
-      const template = import_shared5.systems[opts.template];
+      const template = import_shared7.systems[opts.template];
       if (!template) {
         error(
-          `Template not found: ${opts.template}. Available: ${Object.keys(import_shared5.systems).join(", ")}`
+          `Template not found: ${opts.template}. Available: ${Object.keys(import_shared7.systems).join(", ")}`
         );
         process.exit(1);
       }
@@ -22703,10 +22943,10 @@ function registerCreateCommand(parent, getContext2) {
         if (template.oauth.client_id) oauthCreds.client_id = template.oauth.client_id;
       }
       systemInput = {
+        ...systemInput,
         name: systemInput.name || template.name,
-        url: template.apiUrl,
+        url: systemInput.url || template.apiUrl,
         templateName: opts.template,
-        ...systemInput,
         credentials: { ...oauthCreds, ...systemInput.credentials }
       };
     }
@@ -22754,8 +22994,11 @@ function registerCreateCommand(parent, getContext2) {
 }
 
 // src/commands/system/edit.ts
+var import_commander2 = require("commander");
 function registerEditCommand2(parent, getContext2) {
-  parent.command("edit").description("Edit an existing system").requiredOption("--id <id>", "System ID").option("--name <name>", "New name").option("--url <url>", "New URL").option("--instructions <text>", "New specific instructions").option("--credentials <json>", "Non-sensitive credentials JSON to merge").option("--sensitive-credentials <fields>", "Comma-separated sensitive credential field names").option("--scrape-url <url>", "Documentation URL to scrape").option("--scrape-keywords <keywords>", "Space-separated scrape keywords").action(async (opts) => {
+  parent.command("edit").description("Edit an existing system").requiredOption("--id <id>", "System ID").option("--name <name>", "New name").option("--url <url>", "New URL").option("--instructions <text>", "New specific instructions").option("--credentials <json>", "Non-sensitive credentials JSON to merge").option("--sensitive-credentials <fields>", "Comma-separated sensitive credential field names").option("--scrape-url <url>", "Documentation URL to scrape").option("--scrape-keywords <keywords>", "Space-separated scrape keywords").addOption(
+    new import_commander2.Option("--env <environment>", "Environment: dev or prod").choices(["dev", "prod"])
+  ).action(async (opts) => {
     const { client } = getContext2();
     const patchPayload = { id: opts.id };
     if (opts.name) patchPayload.name = opts.name;
@@ -22787,8 +23030,9 @@ function registerEditCommand2(parent, getContext2) {
       patchPayload.credentials = { ...patchPayload.credentials, ...creds };
     }
     try {
+      const envOption = opts.env === "dev" || opts.env === "prod" ? { environment: opts.env } : void 0;
       const spin = spinner(`Updating system ${c.bold}${opts.id}${c.reset}...`);
-      const existing = await client.getSystem(opts.id);
+      const existing = await client.getSystem(opts.id, envOption);
       if (!existing) {
         spin.stop();
         error(`System not found: ${opts.id}`);
@@ -22797,7 +23041,7 @@ function registerEditCommand2(parent, getContext2) {
       if (patchPayload.credentials && existing.credentials) {
         patchPayload.credentials = { ...existing.credentials, ...patchPayload.credentials };
       }
-      const result = await client.updateSystem(opts.id, patchPayload);
+      const result = await client.updateSystem(opts.id, patchPayload, envOption);
       if (opts.scrapeUrl) {
         try {
           const keywords = opts.scrapeKeywords?.split(" ").filter(Boolean);
@@ -22805,7 +23049,9 @@ function registerEditCommand2(parent, getContext2) {
             url: opts.scrapeUrl,
             keywords
           });
-        } catch {
+        } catch (scrapeErr) {
+          const errMsg = scrapeErr instanceof Error ? scrapeErr.message : String(scrapeErr || "Unknown error");
+          warn(`Documentation scrape failed for ${opts.scrapeUrl}: ${errMsg}`);
         }
       }
       spin.stop();
@@ -22822,45 +23068,52 @@ function registerEditCommand2(parent, getContext2) {
 }
 
 // src/commands/system/find.ts
-var import_shared6 = __toESM(require_dist2());
+var import_commander3 = require("commander");
+var import_shared8 = __toESM(require_dist2());
 function filterSystemFields(system) {
   const credentialKeys = Object.keys(system.credentials || {});
   return {
     id: system.id,
     name: system.name,
     url: system.url,
+    environment: system.environment,
     specificInstructions: system.specificInstructions,
     credentialPlaceholders: credentialKeys.map((k) => `<<${system.id}_${k}>>`)
   };
 }
 function registerFindCommand2(parent, getContext2) {
-  parent.command("list").description("List all systems").action(async () => {
+  parent.command("list").description("List all systems").option("--mode <mode>", "Filter by environment: dev, prod, or all (default: all)").action(async (opts) => {
     const { client } = getContext2();
     try {
-      const { items } = await client.listSystems(100);
+      const mode = opts.mode === "dev" || opts.mode === "prod" ? opts.mode : "all";
+      const { items } = await client.listSystems(100, 1, { mode });
       table(
         items.map((s) => ({
           id: s.id,
           name: s.name || "",
+          env: s.environment || "prod",
           url: (s.url || "").slice(0, 50)
         })),
-        ["id", "name", "url"]
+        ["id", "name", "env", "url"]
       );
     } catch (err) {
       error(err.message);
       process.exit(1);
     }
   });
-  parent.command("find [query]").description("Find systems by query or exact ID").option("--id <exactId>", "Exact system ID lookup").action(async (query, opts) => {
+  parent.command("find [query]").description("Find systems by query or exact ID").option("--id <exactId>", "Exact system ID lookup").addOption(
+    new import_commander3.Option("--env <environment>", "Environment: dev or prod").choices(["dev", "prod"])
+  ).action(async (query, opts) => {
     const { client } = getContext2();
     try {
       if (opts.id) {
-        const system = await client.getSystem(opts.id);
+        const envOption = opts.env === "dev" || opts.env === "prod" ? { environment: opts.env } : void 0;
+        const system = await client.getSystem(opts.id, envOption);
         if (!system) {
           error(`System not found: ${opts.id}`);
           process.exit(1);
         }
-        const templateMatch = (0, import_shared6.findTemplateForSystem)(system);
+        const templateMatch = (0, import_shared8.findTemplateForSystem)(system);
         output({
           success: true,
           system: filterSystemFields(system),
@@ -22868,8 +23121,9 @@ function registerFindCommand2(parent, getContext2) {
         });
         return;
       }
+      const listMode = opts.env ? { mode: opts.env } : void 0;
       const rawQuery = (query || "*").trim();
-      const { items } = await client.listSystems(100);
+      const { items } = await client.listSystems(100, 1, listMode);
       if (rawQuery === "*") {
         output({
           success: true,
@@ -22894,16 +23148,8 @@ function registerFindCommand2(parent, getContext2) {
 }
 
 // src/commands/system/call.ts
-var import_shared7 = __toESM(require_dist2());
-function shouldAutoExecute(policy, method, url) {
-  if (policy === "run_everything") return true;
-  if (policy === "ask_every_time") return false;
-  if (policy === "run_gets_only") {
-    const protocol = (0, import_shared7.getConnectionProtocol)(url);
-    return protocol === "http" && method.toUpperCase() === "GET";
-  }
-  return false;
-}
+var import_commander4 = require("commander");
+var import_shared9 = __toESM(require_dist2());
 function registerCallCommand(parent, getContext2) {
   parent.command("call").description("Call a system (API, database, file server)").requiredOption("--url <url>", "Full URL including protocol").option("--system-id <id>", "System ID for credential injection").option("--method <method>", "HTTP method", "GET").option("--headers <json>", "HTTP headers JSON").option("--body <string>", "Request body").option(
     "--file <key=path...>",
@@ -22913,47 +23159,39 @@ function registerCallCommand(parent, getContext2) {
       return arr;
     },
     []
+  ).addOption(
+    new import_commander4.Option("--env <environment>", "Environment: dev or prod").choices(["dev", "prod"])
   ).action(async (opts) => {
-    const { config, client } = getContext2();
+    const { client } = getContext2();
     const method = opts.method || "GET";
     const filePayloads = await parseFileFlags(opts.file, client);
     let body = opts.body;
     if (body && Object.keys(filePayloads).length > 0) {
       try {
         let parsed = JSON.parse(body);
-        for (const [k, v] of Object.entries(parsed)) {
-          if (typeof v === "string" && v.startsWith("file::")) {
-            const key = v.slice(6);
-            if (key in filePayloads) parsed[k] = filePayloads[key];
+        const resolveFileRefs = (obj) => {
+          if (typeof obj === "string" && obj.startsWith("file::")) {
+            const key = obj.slice(6);
+            if (key in filePayloads) return filePayloads[key];
+            error(
+              `Unresolved file reference: file::${key}. Available: ${Object.keys(filePayloads).join(", ") || "(none)"}`
+            );
+            process.exit(1);
           }
-        }
+          if (Array.isArray(obj)) return obj.map(resolveFileRefs);
+          if (obj && typeof obj === "object") {
+            const result = {};
+            for (const [k, v] of Object.entries(obj)) {
+              result[k] = resolveFileRefs(v);
+            }
+            return result;
+          }
+          return obj;
+        };
+        parsed = resolveFileRefs(parsed);
         body = JSON.stringify(parsed);
-      } catch {
-      }
-    }
-    const autoExec = process.argv.includes("--yes") || process.argv.includes("-y") || shouldAutoExecute(config.policies.callSystem, method, opts.url);
-    if (!autoExec) {
-      const methodColors = {
-        GET: c.green,
-        POST: c.yellow,
-        PUT: c.blue,
-        PATCH: c.magenta,
-        DELETE: c.red
-      };
-      const mc = methodColors[method.toUpperCase()] || c.white;
-      console.log("");
-      console.log(`  ${mc}${c.bold}${method.toUpperCase()}${c.reset} ${opts.url}`);
-      if (opts.systemId) console.log(`  ${c.dim}system:${c.reset} ${opts.systemId}`);
-      if (opts.headers) console.log(`  ${c.dim}headers:${c.reset} ${opts.headers}`);
-      if (body) {
-        const preview = body.length > 200 ? body.slice(0, 200) + `${c.dim}...${c.reset}` : body;
-        console.log(`  ${c.dim}body:${c.reset} ${preview}`);
-      }
-      console.log("");
-      const accepted = await confirm("Execute this request?");
-      if (!accepted) {
-        output({ success: false, cancelled: true, message: "Request cancelled" });
-        process.exit(0);
+      } catch (err) {
+        if (err.message?.startsWith("Unresolved file reference")) throw err;
       }
     }
     let headers;
@@ -22977,11 +23215,12 @@ function registerCallCommand(parent, getContext2) {
       }
     };
     try {
-      const result = await client.executeStep({ step, payload: {} });
+      const mode = opts.env === "dev" || opts.env === "prod" ? opts.env : void 0;
+      const result = await client.executeStep({ step, payload: {}, mode });
       const responseData = result.data?.data !== void 0 ? result.data.data : result.data;
       output({
         success: result.success,
-        protocol: (0, import_shared7.getConnectionProtocol)(opts.url),
+        protocol: (0, import_shared9.getConnectionProtocol)(opts.url),
         data: responseData,
         ...result.error ? { error: result.error } : {}
       });
@@ -22995,7 +23234,7 @@ function registerCallCommand(parent, getContext2) {
 
 // src/commands/system/docs.ts
 function registerDocsCommand(parent, getContext2) {
-  parent.command("docs").description("Search system documentation").requiredOption("--system-id <id>", "System ID").requiredOption("--keywords <keywords>", "Search keywords").action(async (opts) => {
+  parent.command("search-docs").description("Search system documentation by keywords").requiredOption("--system-id <id>", "System ID").requiredOption("-k, --keywords <keywords>", "Search keywords").action(async (opts) => {
     const { client } = getContext2();
     try {
       const result = await client.searchSystemDocumentation(opts.systemId, opts.keywords);
@@ -23041,13 +23280,13 @@ function registerDocsCommand(parent, getContext2) {
 }
 
 // src/commands/system/oauth.ts
-var import_node_child_process = require("child_process");
-var import_shared8 = __toESM(require_dist2());
+var import_node_child_process2 = require("child_process");
+var import_shared10 = __toESM(require_dist2());
 function openBrowser(url) {
   const platform = process.platform;
   const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
   const args = platform === "win32" ? ["/c", "start", "", url] : [url];
-  (0, import_node_child_process.spawn)(cmd, args, { detached: true, stdio: "ignore" }).unref();
+  (0, import_node_child_process2.spawn)(cmd, args, { detached: true, stdio: "ignore" }).unref();
 }
 async function pollForTokens(client, systemId, originalToken, timeoutMs = 3e5, intervalMs = 2e3) {
   const start = Date.now();
@@ -23078,7 +23317,7 @@ function registerOAuthCommand(parent, getContext2) {
       error(err.message);
       process.exit(1);
     }
-    const templateMatch = (0, import_shared8.findTemplateForSystem)(system);
+    const templateMatch = (0, import_shared10.findTemplateForSystem)(system);
     const templateOAuth = templateMatch?.template?.oauth;
     const clientId = system.credentials?.client_id ?? templateOAuth?.client_id;
     const authUrl = opts.authUrl ?? system.credentials?.auth_url ?? templateOAuth?.authUrl;
@@ -23156,7 +23395,7 @@ function registerOAuthCommand(parent, getContext2) {
       error(`Failed to get OAuth encryption secret: ${err.message}`);
       process.exit(1);
     }
-    const encryptedApiKey = (0, import_shared8.encryptCliApiKey)(config.apiKey, opts.systemId, encryptionSecret);
+    const encryptedApiKey = (0, import_shared10.encryptCliApiKey)(config.apiKey, opts.systemId, encryptionSecret);
     const redirectUri = `${config.webEndpoint.replace(/\/$/, "")}/api/auth/callback`;
     const state = {
       systemId: opts.systemId,
@@ -23207,12 +23446,12 @@ function registerSystemCommands(program2, getContext2) {
 
 // src/commands/run/list.ts
 function registerListCommand(parent, getContext2) {
-  parent.command("list").description("List recent runs").option("--tool <id>", "Filter by tool ID").option("--status <status>", "Filter by status (running, success, failed, aborted)").option("--source <sources>", "Comma-separated request sources").option("--user <userId>", "Filter by user ID").option("--system-id <id>", "Filter by system ID").option("--limit <n>", "Max results", "10").option("--offset <n>", "Skip first N results", "0").option("--search <text>", "Full-text search").action(async (opts) => {
+  parent.command("list").description("List recent runs").option("--tool <id>", "Filter by tool ID").option("--status <status>", "Filter by status (running, success, failed, aborted)").option("--source <sources>", "Comma-separated request sources").option("--user <userId>", "Filter by user ID").option("--system-id <id>", "Filter by system ID").option("--limit <n>", "Max results", "10").option("--offset <n>", "Skip first N results", "0").action(async (opts) => {
     const { client } = getContext2();
     try {
       const limit = Math.min(parseInt(opts.limit, 10) || 10, 50);
       const offset = parseInt(opts.offset, 10) || 0;
-      const page = Math.floor(offset / limit) + 1;
+      const page = Math.ceil((offset + 1) / limit);
       const requestSources = opts.source?.split(",").filter(Boolean);
       const result = await client.listRuns({
         toolId: opts.tool,
@@ -23295,109 +23534,6 @@ function registerRunCommands(program2, getContext2) {
   registerGetCommand(run, getContext2);
 }
 
-// src/version.ts
-var import_node_child_process2 = require("child_process");
-var import_node_util = require("util");
-
-// package.json
-var package_default = {
-  name: "@superglue/cli",
-  version: "1.0.0",
-  bin: {
-    sg: "./dist/cli.js"
-  },
-  files: [
-    "dist/",
-    "skills/",
-    "skills.md"
-  ],
-  dependencies: {
-    commander: "^13.0.0",
-    "fast-json-patch": "^3.1.1"
-  },
-  devDependencies: {
-    "@superglue/shared": "file:../shared",
-    "@types/node": "^20.0.0",
-    tsup: "^8.0.0",
-    typescript: "^5.0.0"
-  },
-  scripts: {
-    build: "tsup && cp -r skills dist/ 2>/dev/null || true",
-    dev: "tsup --watch",
-    "type-check": "tsc --noEmit",
-    prepublishOnly: "npm run build"
-  },
-  publishConfig: {
-    access: "public"
-  }
-};
-
-// src/version.ts
-var execAsync = (0, import_node_util.promisify)(import_node_child_process2.exec);
-var CLI_VERSION = package_default.version;
-function compareVersions(a, b) {
-  const partsA = a.split(".").map(Number);
-  const partsB = b.split(".").map(Number);
-  for (let i = 0; i < Math.max(partsA.length, partsB.length); i++) {
-    const numA = partsA[i] || 0;
-    const numB = partsB[i] || 0;
-    if (numA < numB) return -1;
-    if (numA > numB) return 1;
-  }
-  return 0;
-}
-async function checkVersionCompatibility(endpoint) {
-  try {
-    const healthUrl = `${endpoint.replace(/\/$/, "")}/v1/health`;
-    const response = await fetch(healthUrl, { signal: AbortSignal.timeout(3e3) });
-    if (!response.ok) return;
-    const health = await response.json();
-    if (!health.minCliVersion) return;
-    if (compareVersions(CLI_VERSION, health.minCliVersion) < 0) {
-      console.error("");
-      console.error(`${c.yellow}${c.bold}\u26A0 CLI version ${CLI_VERSION} is outdated.${c.reset}`);
-      console.error(
-        `${c.yellow}  Server requires at least v${health.minCliVersion}. Run: ${c.bold}sg update${c.reset}`
-      );
-      console.error("");
-    }
-  } catch {
-  }
-}
-async function getLatestNpmVersion() {
-  try {
-    const response = await fetch("https://registry.npmjs.org/@superglue/cli/latest", {
-      signal: AbortSignal.timeout(5e3)
-    });
-    if (!response.ok) return null;
-    const data = await response.json();
-    return data.version || null;
-  } catch {
-    return null;
-  }
-}
-async function updateCli() {
-  const latestVersion = await getLatestNpmVersion();
-  if (!latestVersion) {
-    return { success: false, message: "Could not fetch latest version from npm" };
-  }
-  if (compareVersions(CLI_VERSION, latestVersion) >= 0) {
-    return { success: true, message: `Already on latest version (${CLI_VERSION})` };
-  }
-  try {
-    await execAsync("npm install -g @superglue/cli@latest");
-    return {
-      success: true,
-      message: `Updated from ${CLI_VERSION} to ${latestVersion}`
-    };
-  } catch (err) {
-    return {
-      success: false,
-      message: `Update failed: ${err.message}. Try manually: npm install -g @superglue/cli@latest`
-    };
-  }
-}
-
 // src/commands/update.ts
 function registerUpdateCommand(program2) {
   program2.command("update").description("Update the superglue CLI to the latest version").option("--check", "Only check for updates, don't install").action(async (opts) => {
@@ -23435,45 +23571,44 @@ function registerUpdateCommand(program2) {
 }
 
 // src/cli.ts
-var program = new import_commander.Command();
-program.name("sg").description("superglue CLI \u2014 build, run, and manage integration tools").version(CLI_VERSION).option("--api-key <key>", "superglue API key").option("--endpoint <url>", "superglue API endpoint").option("--json", "force JSON output").option("-y, --yes", "auto-accept all confirmations").addHelpText(
+var program = new import_commander5.Command();
+program.name("sg").description("superglue CLI \u2014 build, run, and manage integration tools").version(CLI_VERSION).option("--api-key <key>", "superglue API key").option("--endpoint <url>", "superglue API endpoint").option("--json", "force JSON output").addHelpText(
   "after",
   `
 All Commands:
-  sg init                                     Set up CLI configuration
+  sg init                                        Set up CLI configuration
 
-  sg tool build --config <file>               Build a tool from a JSON config file
-  sg tool build --id <id> --instruction <t>   Build a tool from flags (requires --steps <file>)
-  sg tool run --draft <id> [--payload <json>] Run a draft tool
-  sg tool run --tool <id> [--payload <json>]  Run a saved tool
-  sg tool edit --tool <id> --patches <json>   Edit a tool via JSON Patch operations
-  sg tool edit --draft <id> --patches <json>  Edit a draft via JSON Patch operations
-  sg tool save <id>                           Save a draft tool to the server
-  sg tool list                                List all saved tools (IDs + instructions)
-  sg tool find [query]                        Search tools by keyword
-  sg tool find --id <id>                      Get full config of a specific tool
+  sg tool build --config <file>                  Build a tool from a JSON config
+  sg tool build --id <id> --instruction <text>   Build a tool from flags (requires --steps)
+  sg tool run --tool <id> [--payload <json>]     Run a saved tool
+  sg tool run --draft <id> [--payload <json>]    Run a draft tool
+  sg tool edit --tool <id> --patches <json>      Edit a tool via JSON Patch
+  sg tool edit --draft <id> --patches <json>     Edit a draft via JSON Patch
+  sg tool save --draft <id>                     Save a draft to the server
+  sg tool list                                   List all saved tools
+  sg tool find [query]                           Search tools by keyword
+  sg tool find --id <id>                         Get full config of a tool
 
-  sg system create --config <file>            Create a system from a JSON config file
-  sg system create --id <id> --url <url>      Create a system from flags
-  sg system edit <id>                         Edit a system's configuration
-  sg system list                              List all systems
-  sg system find [query]                      Search systems by keyword
-  sg system find --id <id>                    Get full config of a specific system
-  sg system call --url <url> [--method GET]   Call an API/DB/file server with credential injection
-  sg system docs <id>                         View system documentation
-  sg system oauth <id>                        Authenticate a system via OAuth
+  sg system create --config <file>               Create a system from JSON config
+  sg system create --id <id> --url <url>         Create a system from flags
+  sg system edit --id <id>                       Edit a system's configuration
+  sg system list                                 List all systems
+  sg system find [query]                         Search systems by keyword
+  sg system find --id <id>                       Get full config of a system
+  sg system call --url <url> [--method GET]      Call an API, database, or file server
+  sg system search-docs --system-id <id> -k <kw> Search system documentation
+  sg system oauth --system-id <id> --scopes <s>  Authenticate a system via OAuth
 
-  sg run list [toolId]                        List execution runs, optionally filtered by tool
-  sg run get <runId>                          Get details of a specific run
+  sg run list [toolId]                           List runs, optionally filtered by tool
+  sg run get <runId>                             Get details of a specific run
 
-  sg update                                   Update CLI to latest version
-  sg update --check                           Check for available updates
+  sg update                                      Update CLI to latest version
+  sg update --check                              Check for available updates
 
 Global Flags:
-  --api-key <key>   Override API key from config
-  --endpoint <url>  Override API endpoint from config
-  --json            Force JSON output (default in non-TTY)
-  -y, --yes         Auto-accept all confirmations
+  --api-key <key>    Override API key from config
+  --endpoint <url>   Override API endpoint from config
+  --json             Force JSON output (default in non-TTY)
 `
 );
 var getContext = () => {
@@ -23489,7 +23624,7 @@ registerSystemCommands(program, getContext);
 registerRunCommands(program, getContext);
 var commandsRequiringServer = ["tool", "system", "run"];
 var globalFlagsWithValues = ["--api-key", "--endpoint"];
-var globalFlagsNoValue = ["--json", "-y", "--yes", "-h", "--help", "-V", "--version"];
+var globalFlagsNoValue = ["--json", "-h", "--help", "-V", "--version"];
 function findSubcommand(argv) {
   let i = 2;
   while (i < argv.length) {
@@ -23506,12 +23641,22 @@ function findSubcommand(argv) {
   }
   return void 0;
 }
+function extractFlagValue(argv, flag) {
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg.startsWith(`${flag}=`)) {
+      return arg.slice(flag.length + 1);
+    }
+    if (arg === flag && i + 1 < argv.length) {
+      return argv[i + 1];
+    }
+  }
+  return void 0;
+}
 var subcommand = findSubcommand(process.argv);
 if (subcommand && commandsRequiringServer.includes(subcommand)) {
-  const apiKeyIdx = process.argv.indexOf("--api-key");
-  const endpointIdx = process.argv.indexOf("--endpoint");
-  const cliApiKey = apiKeyIdx !== -1 ? process.argv[apiKeyIdx + 1] : void 0;
-  const cliEndpoint = endpointIdx !== -1 ? process.argv[endpointIdx + 1] : void 0;
+  const cliApiKey = extractFlagValue(process.argv, "--api-key");
+  const cliEndpoint = extractFlagValue(process.argv, "--endpoint");
   const config = resolveConfig({ apiKey: cliApiKey, endpoint: cliEndpoint });
   if (config.apiKey) {
     checkVersionCompatibility(config.endpoint).then(() => program.parse());