@superglue/cli 1.1.0 → 1.1.2

package/dist/cli.js

@@ -1751,6 +1751,7 @@ var require_types = __commonJS({
     exports2.isRequestConfig = isRequestConfig;
     exports2.isTransformConfig = isTransformConfig;
     exports2.getToolSystemIds = getToolSystemIds;
+    exports2.isProductionSystem = isProductionSystem;
     var UserRole;
     (function(UserRole2) {
       UserRole2["ADMIN"] = "admin";
@@ -1849,15 +1850,16 @@ var require_types = __commonJS({
       RunStatus2["FAILED"] = "FAILED";
       RunStatus2["ABORTED"] = "ABORTED";
     })(RunStatus || (exports2.RunStatus = RunStatus = {}));
-    var RequestSource;
-    (function(RequestSource2) {
-      RequestSource2["API"] = "api";
-      RequestSource2["FRONTEND"] = "frontend";
-      RequestSource2["SCHEDULER"] = "scheduler";
-      RequestSource2["MCP"] = "mcp";
-      RequestSource2["TOOL_CHAIN"] = "tool-chain";
-      RequestSource2["WEBHOOK"] = "webhook";
-    })(RequestSource || (exports2.RequestSource = RequestSource = {}));
+    var RequestSource2;
+    (function(RequestSource3) {
+      RequestSource3["API"] = "api";
+      RequestSource3["FRONTEND"] = "frontend";
+      RequestSource3["SCHEDULER"] = "scheduler";
+      RequestSource3["MCP"] = "mcp";
+      RequestSource3["TOOL_CHAIN"] = "tool-chain";
+      RequestSource3["WEBHOOK"] = "webhook";
+      RequestSource3["CLI"] = "cli";
+    })(RequestSource2 || (exports2.RequestSource = RequestSource2 = {}));
     var FilterTarget;
     (function(FilterTarget2) {
       FilterTarget2["KEYS"] = "KEYS";
@@ -1893,6 +1895,9 @@ var require_types = __commonJS({
       }
       return Array.from(ids);
     }
+    function isProductionSystem(system) {
+      return system.environment !== "dev";
+    }
     var DiscoveryRunStatus;
     (function(DiscoveryRunStatus2) {
       DiscoveryRunStatus2["PENDING"] = "PENDING";
@@ -2981,10 +2986,15 @@ If the user has or creates an OAuth app in their Google Cloud project:
 4. After system creation, use authenticate_oauth - user completes Google sign-in in popup
 5. Superglue auto-refreshes tokens - no manual token management needed
 
-OPTION 2: Service Account Token (Manual refresh required)
-If the user has a service account JSON file:
-- Superglue does NOT support JWT token generation from service account JSON (on roadmap)
-- User must generate an access token on their machine using gcloud CLI:
+OPTION 2: Service Account JWT (Advanced)
+If the user has a service account JSON file, you can generate JWTs dynamically using a transform step:
+- Extract private_key and client_email from the service account JSON
+- Build the JWT header and claims, then sign with crypto.sign('sha256', data, privateKey, 'base64url')
+- Exchange the JWT for an access token via POST to https://oauth2.googleapis.com/token
+
+OPTION 3: Service Account Token via CLI (Manual refresh required)
+If the user prefers to generate tokens externally:
+- User generates an access token on their machine using gcloud CLI:
   1. Activate the service account: gcloud auth activate-service-account --key-file=/path/to/service-account.json
   2. Print the token: gcloud auth print-access-token
 - The token is valid for 1 hour only
@@ -8813,8 +8823,8 @@ var require_luxon = __commonJS({
         let current = null, currentFull = "", bracketed = false;
         const splits = [];
         for (let i = 0; i < fmt.length; i++) {
-          const c2 = fmt.charAt(i);
-          if (c2 === "'") {
+          const c3 = fmt.charAt(i);
+          if (c3 === "'") {
             if (currentFull.length > 0 || bracketed) {
               splits.push({
                 literal: bracketed || /^\s+$/.test(currentFull),
@@ -8825,9 +8835,9 @@ var require_luxon = __commonJS({
             currentFull = "";
             bracketed = !bracketed;
           } else if (bracketed) {
-            currentFull += c2;
-          } else if (c2 === current) {
-            currentFull += c2;
+            currentFull += c3;
+          } else if (c3 === current) {
+            currentFull += c3;
           } else {
             if (currentFull.length > 0) {
               splits.push({
@@ -8835,8 +8845,8 @@ var require_luxon = __commonJS({
                 val: currentFull
               });
             }
-            currentFull = c2;
-            current = c2;
+            currentFull = c3;
+            current = c3;
           }
         }
         if (currentFull.length > 0) {
@@ -11518,7 +11528,7 @@ var require_luxon = __commonJS({
       return fixOffset(objToLocalTS(obj), offset2, zone);
     }
     function adjustTime(inst, dur) {
-      const oPre = inst.o, year = inst.c.year + Math.trunc(dur.years), month = inst.c.month + Math.trunc(dur.months) + Math.trunc(dur.quarters) * 3, c2 = {
+      const oPre = inst.o, year = inst.c.year + Math.trunc(dur.years), month = inst.c.month + Math.trunc(dur.months) + Math.trunc(dur.quarters) * 3, c3 = {
         ...inst.c,
         year,
         month,
@@ -11533,7 +11543,7 @@ var require_luxon = __commonJS({
         minutes: dur.minutes,
         seconds: dur.seconds,
         milliseconds: dur.milliseconds
-      }).as("milliseconds"), localTS = objToLocalTS(c2);
+      }).as("milliseconds"), localTS = objToLocalTS(c3);
       let [ts, o] = fixOffset(localTS, oPre, inst.zone);
       if (millisToAdd !== 0) {
         ts += millisToAdd;
@@ -11568,72 +11578,72 @@ var require_luxon = __commonJS({
     }
     function toISODate(o, extended, precision) {
       const longFormat = o.c.year > 9999 || o.c.year < 0;
-      let c2 = "";
-      if (longFormat && o.c.year >= 0) c2 += "+";
-      c2 += padStart(o.c.year, longFormat ? 6 : 4);
-      if (precision === "year") return c2;
+      let c3 = "";
+      if (longFormat && o.c.year >= 0) c3 += "+";
+      c3 += padStart(o.c.year, longFormat ? 6 : 4);
+      if (precision === "year") return c3;
       if (extended) {
-        c2 += "-";
-        c2 += padStart(o.c.month);
-        if (precision === "month") return c2;
-        c2 += "-";
+        c3 += "-";
+        c3 += padStart(o.c.month);
+        if (precision === "month") return c3;
+        c3 += "-";
       } else {
-        c2 += padStart(o.c.month);
-        if (precision === "month") return c2;
+        c3 += padStart(o.c.month);
+        if (precision === "month") return c3;
       }
-      c2 += padStart(o.c.day);
-      return c2;
+      c3 += padStart(o.c.day);
+      return c3;
     }
     function toISOTime(o, extended, suppressSeconds, suppressMilliseconds, includeOffset, extendedZone, precision) {
-      let showSeconds = !suppressSeconds || o.c.millisecond !== 0 || o.c.second !== 0, c2 = "";
+      let showSeconds = !suppressSeconds || o.c.millisecond !== 0 || o.c.second !== 0, c3 = "";
       switch (precision) {
         case "day":
         case "month":
         case "year":
           break;
         default:
-          c2 += padStart(o.c.hour);
+          c3 += padStart(o.c.hour);
           if (precision === "hour") break;
           if (extended) {
-            c2 += ":";
-            c2 += padStart(o.c.minute);
+            c3 += ":";
+            c3 += padStart(o.c.minute);
             if (precision === "minute") break;
             if (showSeconds) {
-              c2 += ":";
-              c2 += padStart(o.c.second);
+              c3 += ":";
+              c3 += padStart(o.c.second);
             }
           } else {
-            c2 += padStart(o.c.minute);
+            c3 += padStart(o.c.minute);
             if (precision === "minute") break;
             if (showSeconds) {
-              c2 += padStart(o.c.second);
+              c3 += padStart(o.c.second);
             }
           }
           if (precision === "second") break;
           if (showSeconds && (!suppressMilliseconds || o.c.millisecond !== 0)) {
-            c2 += ".";
-            c2 += padStart(o.c.millisecond, 3);
+            c3 += ".";
+            c3 += padStart(o.c.millisecond, 3);
           }
       }
       if (includeOffset) {
         if (o.isOffsetFixed && o.offset === 0 && !extendedZone) {
-          c2 += "Z";
+          c3 += "Z";
         } else if (o.o < 0) {
-          c2 += "-";
-          c2 += padStart(Math.trunc(-o.o / 60));
-          c2 += ":";
-          c2 += padStart(Math.trunc(-o.o % 60));
+          c3 += "-";
+          c3 += padStart(Math.trunc(-o.o / 60));
+          c3 += ":";
+          c3 += padStart(Math.trunc(-o.o % 60));
         } else {
-          c2 += "+";
-          c2 += padStart(Math.trunc(o.o / 60));
-          c2 += ":";
-          c2 += padStart(Math.trunc(o.o % 60));
+          c3 += "+";
+          c3 += padStart(Math.trunc(o.o / 60));
+          c3 += ":";
+          c3 += padStart(Math.trunc(o.o % 60));
         }
       }
       if (extendedZone) {
-        c2 += "[" + o.zone.ianaName + "]";
+        c3 += "[" + o.zone.ianaName + "]";
       }
-      return c2;
+      return c3;
     }
     var defaultUnitValues = {
       month: 1,
@@ -11751,10 +11761,10 @@ var require_luxon = __commonJS({
       });
     }
     function diffRelative(start, end, opts) {
-      const round = isUndefined(opts.round) ? true : opts.round, rounding = isUndefined(opts.rounding) ? "trunc" : opts.rounding, format = (c2, unit) => {
-        c2 = roundTo(c2, round || opts.calendary ? 0 : 2, opts.calendary ? "round" : rounding);
+      const round = isUndefined(opts.round) ? true : opts.round, rounding = isUndefined(opts.rounding) ? "trunc" : opts.rounding, format = (c3, unit) => {
+        c3 = roundTo(c3, round || opts.calendary ? 0 : 2, opts.calendary ? "round" : rounding);
         const formatter = end.loc.clone(opts).relFormatter(opts);
-        return formatter.format(c2, unit);
+        return formatter.format(c3, unit);
       }, differ = (unit) => {
         if (opts.calendary) {
           if (!end.hasSame(start, unit)) {
@@ -11795,16 +11805,16 @@ var require_luxon = __commonJS({
         const zone = config.zone || Settings.defaultZone;
         let invalid = config.invalid || (Number.isNaN(config.ts) ? new Invalid("invalid input") : null) || (!zone.isValid ? unsupportedZone(zone) : null);
         this.ts = isUndefined(config.ts) ? Settings.now() : config.ts;
-        let c2 = null, o = null;
+        let c3 = null, o = null;
         if (!invalid) {
           const unchanged = config.old && config.old.ts === this.ts && config.old.zone.equals(zone);
           if (unchanged) {
-            [c2, o] = [config.old.c, config.old.o];
+            [c3, o] = [config.old.c, config.old.o];
           } else {
             const ot = isNumber(config.o) && !config.old ? config.o : zone.offset(this.ts);
-            c2 = tsToObj(this.ts, ot);
-            invalid = Number.isNaN(c2.year) ? new Invalid("invalid input") : null;
-            c2 = invalid ? null : c2;
+            c3 = tsToObj(this.ts, ot);
+            invalid = Number.isNaN(c3.year) ? new Invalid("invalid input") : null;
+            c3 = invalid ? null : c3;
             o = invalid ? null : ot;
           }
         }
@@ -11813,7 +11823,7 @@ var require_luxon = __commonJS({
         this.invalid = invalid;
         this.weekData = null;
         this.localWeekData = null;
-        this.c = c2;
+        this.c = c3;
         this.o = o;
         this.isLuxonDateTime = true;
       }
@@ -12572,8 +12582,8 @@ var require_luxon = __commonJS({
         const ts1 = localTS - o1 * minuteMs;
         const ts2 = localTS - o2 * minuteMs;
         const c1 = tsToObj(ts1, o1);
-        const c2 = tsToObj(ts2, o2);
-        if (c1.hour === c2.hour && c1.minute === c2.minute && c1.second === c2.second && c1.millisecond === c2.millisecond) {
+        const c22 = tsToObj(ts2, o2);
+        if (c1.hour === c22.hour && c1.minute === c22.minute && c1.second === c22.second && c1.millisecond === c22.millisecond) {
           return [clone2(this, {
             ts: ts1
           }), clone2(this, {
@@ -12971,10 +12981,10 @@ var require_luxon = __commonJS({
         }
         precision = normalizeUnit(precision);
         const ext = format === "extended";
-        let c2 = toISODate(this, ext, precision);
-        if (orderedUnits.indexOf(precision) >= 3) c2 += "T";
-        c2 += toISOTime(this, ext, suppressSeconds, suppressMilliseconds, includeOffset, extendedZone, precision);
-        return c2;
+        let c3 = toISODate(this, ext, precision);
+        if (orderedUnits.indexOf(precision) >= 3) c3 += "T";
+        c3 += toISOTime(this, ext, suppressSeconds, suppressMilliseconds, includeOffset, extendedZone, precision);
+        return c3;
       }
       /**
        * Returns an ISO 8601-compliant string representation of this DateTime's date component
@@ -13033,8 +13043,8 @@ var require_luxon = __commonJS({
           return null;
         }
         precision = normalizeUnit(precision);
-        let c2 = includePrefix && orderedUnits.indexOf(precision) >= 3 ? "T" : "";
-        return c2 + toISOTime(this, format === "extended", suppressSeconds, suppressMilliseconds, includeOffset, extendedZone, precision);
+        let c3 = includePrefix && orderedUnits.indexOf(precision) >= 3 ? "T" : "";
+        return c3 + toISOTime(this, format === "extended", suppressSeconds, suppressMilliseconds, includeOffset, extendedZone, precision);
       }
       /**
        * Returns an RFC 2822-compatible string representation of this DateTime
@@ -17619,7 +17629,7 @@ attempted value: ${formattedValue}
           type: next.type,
           oneOf: next._whitelist.describe(),
           notOneOf: next._blacklist.describe(),
-          tests: next.tests.filter((n, idx, list) => list.findIndex((c2) => c2.OPTIONS.name === n.OPTIONS.name) === idx).map((fn) => {
+          tests: next.tests.filter((n, idx, list) => list.findIndex((c3) => c3.OPTIONS.name === n.OPTIONS.name) === idx).map((fn) => {
             const params = fn.OPTIONS.params && options ? resolveParams(Object.assign({}, fn.OPTIONS.params), options) : fn.OPTIONS.params;
             return {
               name: fn.OPTIONS.name,
@@ -19867,6 +19877,7 @@ var require_utils = __commonJS({
     exports2.ALLOWED_PATCH_SYSTEM_FIELDS = exports2.getSystemAuthStatus = exports2.detectSystemAuthType = exports2.maskSystemCredentials = exports2.isSensitiveCredentialKey = exports2.ALLOWED_FILE_EXTENSIONS = exports2.getConnectionProtocol = void 0;
     exports2.validateExternalUrl = validateExternalUrl;
     exports2.flattenAndNamespaceCredentials = flattenAndNamespaceCredentials;
+    exports2.flattenAndNamespaceSystemUrls = flattenAndNamespaceSystemUrls;
     exports2.generateUniqueId = generateUniqueId;
     exports2.waitForSystemProcessing = waitForSystemProcessing;
     exports2.inferJsonSchema = inferJsonSchema;
@@ -20067,6 +20078,14 @@ var require_utils = __commonJS({
         return acc;
       }, {});
     }
+    function flattenAndNamespaceSystemUrls(systems2) {
+      return systems2.reduce((acc, sys) => {
+        if (sys.url) {
+          acc[`${sys.id}_url`] = sys.url;
+        }
+        return acc;
+      }, {});
+    }
     async function generateUniqueId({ baseId, exists }) {
       if (!await exists(baseId)) {
         return baseId;
@@ -20448,6 +20467,7 @@ var require_utils = __commonJS({
       "multiTenancyMode",
       "documentationFiles",
       "tunnel"
+      // Note: "environment" is NOT patchable because it's part of the composite primary key
     ];
     var SAMPLEABLE_KEYS = /* @__PURE__ */ new Set([
       "data",
@@ -21096,9 +21116,9 @@ var require_superglue_client = __commonJS({
     var types_js_1 = require_types();
     var sse_log_subscription_js_1 = require_sse_log_subscription();
     var SuperglueClient3 = class {
-      constructor({ endpoint, apiKey, apiEndpoint, onInfrastructureError }) {
+      constructor({ apiKey, apiEndpoint, onInfrastructureError }) {
         this.apiKey = apiKey;
-        this.apiEndpoint = apiEndpoint ?? endpoint ?? "https://api.superglue.cloud";
+        this.apiEndpoint = apiEndpoint ?? "https://api.superglue.cloud";
         this.sseManager = new sse_log_subscription_js_1.SSELogSubscriptionManager(this.apiEndpoint, this.apiKey);
         this.onInfrastructureError = onInfrastructureError;
       }
@@ -21218,14 +21238,16 @@ var require_superglue_client = __commonJS({
        * Execute a single step without creating a run in the database.
        * Used for individual step testing in the playground.
        */
-      async executeStep({ step, payload, previousResults, credentials, options, runId }) {
+      async executeStep({ step, payload, previousResults, credentials, options, runId, mode, systemIds }) {
         return this.restRequest("POST", "/v1/tools/step/run", {
           step,
           payload,
           previousResults,
           credentials,
           options,
-          runId
+          runId,
+          mode,
+          systemIds
         });
       }
       /**
@@ -21400,11 +21422,14 @@ var require_superglue_client = __commonJS({
           newId
         });
       }
-      async listSystems(limit = 10, page = 1) {
+      async listSystems(limit = 10, page = 1, options) {
         const params = new URLSearchParams({
           limit: String(limit),
           page: String(page)
         });
+        if (options?.mode) {
+          params.set("mode", options.mode);
+        }
         const response = await this.restRequest("GET", `/v1/systems?${params.toString()}`);
         return { items: response.data, total: response.total };
       }
@@ -21413,20 +21438,23 @@ var require_superglue_client = __commonJS({
         const response = await this.restRequest("GET", `/v1/tools/search${params}`);
         return response.data;
       }
-      async getSystem(id) {
-        const response = await this.restRequest("GET", `/v1/systems/${encodeURIComponent(id)}`);
+      async getSystem(id, options) {
+        const queryParams = options?.environment ? `?env=${options.environment}` : "";
+        const response = await this.restRequest("GET", `/v1/systems/${encodeURIComponent(id)}${queryParams}`);
         return response.data;
       }
       async createSystem(input) {
         const response = await this.restRequest("POST", "/v1/systems", input);
         return response.data;
       }
-      async updateSystem(id, input) {
-        const response = await this.restRequest("PATCH", `/v1/systems/${encodeURIComponent(id)}`, input);
+      async updateSystem(id, input, options) {
+        const queryParams = options?.environment ? `?env=${options.environment}` : "";
+        const response = await this.restRequest("PATCH", `/v1/systems/${encodeURIComponent(id)}${queryParams}`, input);
         return response.data;
       }
-      async deleteSystem(id) {
-        await this.restRequest("DELETE", `/v1/systems/${encodeURIComponent(id)}`);
+      async deleteSystem(id, options) {
+        const queryParams = options?.environment ? `?env=${options.environment}` : "";
+        await this.restRequest("DELETE", `/v1/systems/${encodeURIComponent(id)}${queryParams}`);
         return true;
       }
       async cacheOAuthSecret(args) {
@@ -21584,18 +21612,14 @@ var require_dist2 = __commonJS({
 });
 
 // src/cli.ts
-var import_commander = require("commander");
+var import_commander5 = require("commander");
 
 // src/config.ts
 var fs = __toESM(require("fs"));
 var os = __toESM(require("os"));
 var path = __toESM(require("path"));
 var DEFAULT_CONFIG = {
-  output: { mode: "stdout", directory: ".superglue/output" },
-  policies: {
-    callSystem: "ask_every_time",
-    editTool: "confirm"
-  }
+  output: { mode: "stdout", directory: ".superglue/output" }
 };
 function getConfigDir(preferLocal) {
   const localDir = path.join(process.cwd(), ".superglue");
@@ -21638,8 +21662,7 @@ function resolveConfig(flags) {
     apiKey,
     endpoint,
     webEndpoint,
-    output: { ...DEFAULT_CONFIG.output, ...file.output },
-    policies: { ...DEFAULT_CONFIG.policies, ...file.policies }
+    output: { ...DEFAULT_CONFIG.output, ...file.output }
   };
 }
 function writeConfig(config, preferLocal) {
@@ -21692,9 +21715,10 @@ var package_default = {
     sg: "./dist/cli.js"
   },
   files: [
+    ".claude-plugin/",
     "dist/",
     "skills/",
-    "skills.md"
+    "LICENSE"
   ],
   dependencies: {
     commander: "^13.0.0",
@@ -21820,6 +21844,10 @@ var c = {
   bgMagenta: "\x1B[45m",
   bgCyan: "\x1B[46m"
 };
+function link(url, label) {
+  const text = label || url;
+  return `\x1B]8;;${url}\x07${c.underline}${c.cyan}${text}${c.reset}\x1B]8;;\x07`;
+}
 function banner() {
   if (isJsonMode()) return;
   const rst = c.reset;
@@ -21856,20 +21884,28 @@ function banner() {
 function spinner(message) {
   if (isJsonMode()) return { stop: () => {
   }, update: () => {
+  }, log: () => {
   } };
   const frames = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
   let i = 0;
   let currentMsg = message;
-  const interval = setInterval(() => {
+  const clearLine = () => process.stdout.write(`\r\x1B[2K`);
+  const drawSpinner = () => {
     process.stdout.write(`\r  ${c.cyan}${frames[i++ % frames.length]}${c.reset} ${currentMsg}`);
-  }, 80);
+  };
+  const interval = setInterval(drawSpinner, 80);
   return {
     update: (msg) => {
       currentMsg = msg;
     },
+    log: (line) => {
+      clearLine();
+      console.log(`  ${c.dim}\u2502${c.reset} ${line}`);
+      drawSpinner();
+    },
     stop: (finalMsg) => {
       clearInterval(interval);
-      process.stdout.write(`\r${"".padEnd(currentMsg.length + 10)}\r`);
+      clearLine();
       if (finalMsg) console.log(`  ${finalMsg}`);
     }
   };
@@ -22070,16 +22106,6 @@ function renderDiffs(diffs) {
     return `  ${color}${icon} ${c.bold}[${d.op}]${c.reset} ${c.dim}${d.path}${c.reset}${valueStr}`;
   }).join("\n");
 }
-async function confirm(message) {
-  if (process.argv.includes("--yes") || process.argv.includes("-y")) return true;
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve4) => {
-    rl.question(`  ${message} ${c.dim}[y/N]${c.reset} `, (answer) => {
-      rl.close();
-      resolve4(answer.toLowerCase() === "y" || answer.toLowerCase() === "yes");
-    });
-  });
-}
 async function prompt(message, defaultValue) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   const suffix = defaultValue ? ` ${c.dim}[${defaultValue}]${c.reset}` : "";
@@ -22092,23 +22118,30 @@ async function prompt(message, defaultValue) {
 }
 async function promptHidden(message) {
   return new Promise((resolve4) => {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    process.stdout.write(`  ${message}: `);
-    if (process.stdin.isTTY) {
-      process.stdin.setRawMode(true);
+    process.stdout.write(`${message}: `);
+    if (!process.stdin.isTTY) {
+      const rl = readline.createInterface({ input: process.stdin });
+      rl.once("line", (line) => {
+        rl.close();
+        resolve4(line.trim());
+      });
+      return;
     }
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
     let input = "";
     const onData = (ch) => {
       const s = ch.toString();
       for (const char of s) {
         if (char === "\n" || char === "\r") {
-          if (process.stdin.isTTY) process.stdin.setRawMode(false);
+          process.stdin.setRawMode(false);
           process.stdin.removeListener("data", onData);
+          process.stdin.pause();
           process.stdout.write("\n");
-          rl.close();
           resolve4(input);
           return;
         } else if (char === "") {
+          process.stdin.setRawMode(false);
           process.exit(130);
         } else if (char === "\x7F" || char === "\b") {
           if (input.length > 0) {
@@ -22122,20 +22155,60 @@ async function promptHidden(message) {
       }
     };
     process.stdin.on("data", onData);
-    process.stdin.resume();
   });
 }
 async function choose(message, options, defaultIndex = 0) {
   if (!process.stdout.isTTY) return defaultIndex;
-  console.log("");
-  for (let i = 0; i < options.length; i++) {
-    const marker = i === defaultIndex ? `${c.cyan}\u276F${c.reset}` : " ";
-    const label = i === defaultIndex ? `${c.bold}${options[i]}${c.reset}` : `${c.dim}${options[i]}${c.reset}`;
-    console.log(`    ${marker} ${c.dim}(${i + 1})${c.reset} ${label}`);
-  }
-  const answer = await prompt(`  ${message}`, String(defaultIndex + 1));
-  const idx = parseInt(answer, 10) - 1;
-  return idx >= 0 && idx < options.length ? idx : defaultIndex;
+  let selected = defaultIndex;
+  const render = () => {
+    for (let i = 0; i < options.length; i++) {
+      const marker = i === selected ? `${c.cyan}\u276F${c.reset}` : " ";
+      const label = i === selected ? `${c.bold}${options[i]}${c.reset}` : `${c.dim}${options[i]}${c.reset}`;
+      console.log(`    ${marker} ${label}`);
+    }
+  };
+  const moveUp = () => {
+    process.stdout.write(`\x1B[${options.length}A\r`);
+    for (let i = 0; i < options.length; i++) {
+      process.stdout.write(`\x1B[2K`);
+      if (i < options.length - 1) process.stdout.write(`
+`);
+    }
+    process.stdout.write(`\x1B[${options.length - 1}A\r`);
+  };
+  console.log(
+    `
+  ${c.bold}${message}${c.reset} ${c.dim}(\u2191/\u2193 to select, enter to confirm)${c.reset}`
+  );
+  render();
+  return new Promise((resolve4) => {
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    const onData = (ch) => {
+      const s = ch.toString();
+      if (s === "\r" || s === "\n") {
+        process.stdin.setRawMode(false);
+        process.stdin.removeListener("data", onData);
+        process.stdin.pause();
+        resolve4(selected);
+        return;
+      }
+      if (s === "") {
+        process.stdin.setRawMode(false);
+        process.exit(130);
+      }
+      if (s === "\x1B[A" || s === "k") {
+        selected = (selected - 1 + options.length) % options.length;
+      } else if (s === "\x1B[B" || s === "j") {
+        selected = (selected + 1) % options.length;
+      } else {
+        return;
+      }
+      moveUp();
+      render();
+    };
+    process.stdin.on("data", onData);
+  });
 }
 
 // src/commands/init.ts
@@ -22146,6 +22219,10 @@ function registerInitCommand(program2) {
     console.log(`  ${c.dim}Let's get you connected in a few steps.${c.reset}
 `);
     heading("Authentication");
+    console.log(
+      `  ${c.dim}Get your API key at${c.reset} ${link("https://app.superglue.cloud/admin?view=api-keys")}`
+    );
+    console.log("");
     const apiKey = await promptHidden("  API Key");
     if (!apiKey) {
       error("API key is required");
@@ -22178,25 +22255,6 @@ function registerInitCommand(program2) {
     if (outputMode === "stdout+file") {
       outputDir = await prompt("  Output directory", ".superglue/output");
     }
-    heading("Execution Policies");
-    console.log(`  ${c.dim}These control when the CLI asks for confirmation.${c.reset}
-`);
-    const callPolicyIdx = await choose(
-      "API call confirmation",
-      ["Ask every time", "Auto-run GET requests only", "Auto-run everything"],
-      0
-    );
-    const callPolicies = [
-      "ask_every_time",
-      "run_gets_only",
-      "run_everything"
-    ];
-    const editPolicyIdx = await choose(
-      "Tool edit confirmation",
-      ["Show diff and ask to confirm", "Auto-accept all changes"],
-      0
-    );
-    const editPolicies = ["confirm", "auto_accept"];
     heading("Config Location");
     const homeDir = os2.homedir();
     const localPath = path2.join(process.cwd(), ".superglue");
@@ -22214,11 +22272,7 @@ function registerInitCommand(program2) {
       apiKey,
       endpoint,
       webEndpoint,
-      output: { mode: outputMode, directory: outputDir },
-      policies: {
-        callSystem: callPolicies[callPolicyIdx],
-        editTool: editPolicies[editPolicyIdx]
-      }
+      output: { mode: outputMode, directory: outputDir }
     };
     writeConfig(config, preferLocal);
     ensureConfigDirs(config, preferLocal);
@@ -22449,8 +22503,10 @@ function registerBuildCommand(parent, getContext2) {
 // src/commands/tool/run.ts
 var fs6 = __toESM(require("fs"));
 var path5 = __toESM(require("path"));
+var crypto2 = __toESM(require("crypto"));
+var import_shared4 = __toESM(require_dist2());
 function registerRunCommand(parent, getContext2) {
-  parent.command("run").description("Execute a draft or saved tool").option("--draft <id>", "Draft ID from build").option("--tool <id>", "Saved tool ID").option("--payload <json>", "JSON payload").option("--payload-file <path>", "JSON payload file").option(
+  parent.command("run").description("Execute a draft, saved tool, or inline tool config").option("--draft <id>", "Draft ID from build").option("--tool <id>", "Saved tool ID").option("--config <json>", "Inline tool config JSON").option("--config-file <path>", "Tool config JSON file").option("--payload <json>", "JSON payload").option("--payload-file <path>", "JSON payload file").option(
     "--file <key=path...>",
     "File references",
     (v, arr) => {
@@ -22460,8 +22516,13 @@ function registerRunCommand(parent, getContext2) {
     []
   ).option("--include-step-results", "Include raw step results").option("--include-config", "Include full tool config").action(async (opts) => {
     const { config, client } = getContext2();
-    if (!opts.draft && !opts.tool) {
-      error("Provide --draft or --tool");
+    const selectors = [opts.tool, opts.draft, opts.config, opts.configFile].filter(Boolean);
+    if (selectors.length === 0) {
+      error("Provide one of --tool, --draft, --config, or --config-file");
+      process.exit(1);
+    }
+    if (selectors.length > 1) {
+      error("Only one of --tool, --draft, --config, or --config-file can be used");
       process.exit(1);
     }
     const filePayloads = await parseFileFlags(opts.file, client);
@@ -22475,32 +22536,67 @@ function registerRunCommand(parent, getContext2) {
       payload = fileResult.resolved;
     }
     let result;
-    const toolLabel = opts.tool || opts.draft;
+    const toolLabel = opts.tool || opts.draft || "inline-config";
+    const traceId = crypto2.randomUUID();
     const spin = spinner(`Running ${c.bold}${toolLabel}${c.reset}...`);
-    if (opts.tool) {
+    const logSub = await client.subscribeToLogsSSE({
+      traceId,
+      onLog: (log) => spin.log(`${c.dim}${log.message}${c.reset}`)
+    }).catch(() => ({ unsubscribe: () => {
+    } }));
+    const runToolConfig = async (toolConfig) => {
       try {
-        result = await client.runTool({ toolId: opts.tool, payload });
+        const res = await client.runToolConfig({
+          tool: toolConfig,
+          payload,
+          options: { requestSource: import_shared4.RequestSource.CLI },
+          traceId
+        });
+        logSub.unsubscribe();
         spin.stop();
+        return res;
       } catch (err) {
+        logSub.unsubscribe();
         spin.stop();
         error(err.message);
         process.exit(1);
       }
-    } else {
-      const draft = readDraft(opts.draft);
-      if (!draft) {
+    };
+    if (opts.tool) {
+      try {
+        result = await client.runTool({
+          toolId: opts.tool,
+          payload,
+          options: { requestSource: import_shared4.RequestSource.CLI, traceId }
+        });
+        logSub.unsubscribe();
         spin.stop();
-        error(`Draft not found: ${opts.draft}`);
+      } catch (err) {
+        logSub.unsubscribe();
+        spin.stop();
+        error(err.message);
         process.exit(1);
       }
+    } else if (opts.config || opts.configFile) {
+      let toolConfig;
       try {
-        result = await client.runToolConfig({ tool: draft.config, payload });
-        spin.stop();
+        toolConfig = opts.configFile ? JSON.parse(fs6.readFileSync(opts.configFile, "utf-8")) : JSON.parse(opts.config);
       } catch (err) {
+        logSub.unsubscribe();
         spin.stop();
-        error(err.message);
+        error(`Invalid tool config JSON: ${err.message}`);
+        process.exit(1);
+      }
+      result = await runToolConfig(toolConfig);
+    } else {
+      const draft = readDraft(opts.draft);
+      if (!draft) {
+        logSub.unsubscribe();
+        spin.stop();
+        error(`Draft not found: ${opts.draft}`);
         process.exit(1);
       }
+      result = await runToolConfig(draft.config);
     }
     const out = {
       success: result.success,
@@ -22513,7 +22609,7 @@ function registerRunCommand(parent, getContext2) {
     if (config.output.mode === "stdout+file") {
       const outDir = path5.resolve(config.output.directory);
       if (!fs6.existsSync(outDir)) fs6.mkdirSync(outDir, { recursive: true });
-      const rawId = opts.tool || opts.draft;
+      const rawId = opts.tool || opts.draft || "inline-config";
       const safeId = path5.basename(rawId).replace(/[^a-zA-Z0-9_-]/g, "_");
       const filename = `${safeId}-${Date.now()}.json`;
       fs6.writeFileSync(path5.join(outDir, filename), JSON.stringify(out, null, 2));
@@ -22524,11 +22620,11 @@ function registerRunCommand(parent, getContext2) {
 
 // src/commands/tool/edit.ts
 var fs7 = __toESM(require("fs"));
-var import_shared4 = __toESM(require_dist2());
+var import_shared5 = __toESM(require_dist2());
 var jsonpatch = __toESM(require("fast-json-patch"));
 function registerEditCommand(parent, getContext2) {
-  parent.command("edit").description("Edit a tool using JSON Patch operations").option("--draft <id>", "Draft ID to edit").option("--tool <id>", "Saved tool ID to edit").option("--patches <json-or-file>", "JSON Patch array (inline JSON or file path)").option("--payload <json>", "Test payload JSON").option("--test", "Run the patched tool after accepting").action(async (opts) => {
-    const { config, client } = getContext2();
+  parent.command("edit").description("Edit a tool using JSON Patch operations").option("--draft <id>", "Draft ID to edit").option("--tool <id>", "Saved tool ID to edit").option("--patches <json-or-file>", "JSON Patch array (inline JSON or file path)").action(async (opts) => {
+    const { client } = getContext2();
     if (!opts.draft && !opts.tool) {
       error("Provide --draft or --tool");
       process.exit(1);
@@ -22574,7 +22670,7 @@ function registerEditCommand(parent, getContext2) {
     try {
       const copy = JSON.parse(JSON.stringify(originalConfig));
       const result = jsonpatch.applyPatch(copy, patches, true, true);
-      patchedConfig = (0, import_shared4.normalizeToolSchemas)(result.newDocument || copy);
+      patchedConfig = (0, import_shared5.normalizeToolSchemas)(result.newDocument || copy);
     } catch (err) {
       error(`Patch failed: ${err.message}`);
       process.exit(1);
@@ -22590,14 +22686,6 @@ function registerEditCommand(parent, getContext2) {
       console.log(renderDiffs(diffs));
       console.log("");
     }
-    const autoAccept = process.argv.includes("--yes") || process.argv.includes("-y") || config.policies.editTool === "auto_accept";
-    if (!autoAccept) {
-      const accepted = await confirm("Accept changes?");
-      if (!accepted) {
-        output({ success: false, rejected: true, message: "Changes rejected" });
-        process.exit(1);
-      }
-    }
     const draft = {
       draftId: workingDraftId,
       config: {
@@ -22610,54 +22698,11 @@ function registerEditCommand(parent, getContext2) {
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     writeDraft(draft);
-    if (opts.test) {
-      let payload;
-      try {
-        payload = opts.payload ? JSON.parse(opts.payload) : {};
-      } catch (err) {
-        error(`Invalid --payload JSON: ${err.message}`);
-        process.exit(1);
-      }
-      const spin = spinner("Running test...");
-      try {
-        const testResult = await client.runToolConfig({ tool: draft.config, payload });
-        spin.stop();
-        if (testResult.success) {
-          success("Test passed");
-        } else {
-          error(`Test failed: ${testResult.error || "Unknown error"}`);
-        }
-        if (process.argv.includes("--json") || !process.stdout.isTTY) {
-          output({
-            success: true,
-            draftId: workingDraftId,
-            diffs,
-            testResult: {
-              success: testResult.success,
-              data: testResult.data,
-              error: testResult.error
-            }
-          });
-        } else {
-          output(testResult.data);
-        }
-      } catch (err) {
-        spin.stop();
-        error(`Test error: ${err.message}`);
-        output({
-          success: true,
-          draftId: workingDraftId,
-          diffs,
-          testResult: { success: false, error: err.message }
-        });
-      }
+    if (process.argv.includes("--json") || !process.stdout.isTTY) {
+      output({ success: true, draftId: workingDraftId, diffs });
     } else {
-      if (process.argv.includes("--json") || !process.stdout.isTTY) {
-        output({ success: true, draftId: workingDraftId, diffs });
-      } else {
-        success(`Draft updated: ${c.bold}${workingDraftId}${c.reset}`);
-        console.log("");
-      }
+      success(`Draft updated: ${c.bold}${workingDraftId}${c.reset}`);
+      console.log("");
     }
   });
 }
@@ -22773,7 +22818,8 @@ function registerToolCommands(program2, getContext2) {
 
 // src/commands/system/create.ts
 var fs8 = __toESM(require("fs"));
-var import_shared5 = __toESM(require_dist2());
+var import_commander = require("commander");
+var import_shared6 = __toESM(require_dist2());
 async function collectSensitiveCredentials(fields) {
   const creds = {};
   for (const field of fields) {
@@ -22791,12 +22837,21 @@ async function collectSensitiveCredentials(fields) {
   return creds;
 }
 function registerCreateCommand(parent, getContext2) {
-  parent.command("create").description("Create a new system").option("--config <file>", "JSON config file").option("--id <id>", "System ID").option("--name <name>", "Human-readable name").option("--url <url>", "API URL").option("--template <id>", "Template ID").option("--instructions <text>", "Specific instructions").option("--credentials <json>", "Non-sensitive credentials JSON").option("--sensitive-credentials <fields>", "Comma-separated sensitive credential field names").option("--docs-url <url>", "Documentation URL to scrape").option("--openapi-url <url>", "OpenAPI spec URL").action(async (opts) => {
+  parent.command("create").description("Create a new system").option("--config <file>", "JSON config file").option("--id <id>", "System ID").option("--name <name>", "Human-readable name").option("--url <url>", "API URL").option("--template <id>", "Template ID").option("--instructions <text>", "Specific instructions").option("--credentials <json>", "Non-sensitive credentials JSON").option("--sensitive-credentials <fields>", "Comma-separated sensitive credential field names").option("--docs-url <url>", "Documentation URL to scrape").option("--openapi-url <url>", "OpenAPI spec URL").addOption(
+    new import_commander.Option("--env <environment>", "Environment: dev or prod (default: prod)").choices([
+      "dev",
+      "prod"
+    ])
+  ).action(async (opts) => {
     const { client } = getContext2();
     let systemInput;
     if (opts.config) {
       try {
-        systemInput = JSON.parse(fs8.readFileSync(opts.config, "utf-8"));
+        const parsed = JSON.parse(fs8.readFileSync(opts.config, "utf-8"));
+        if (opts.env === "dev" || opts.env === "prod") {
+          parsed.environment = opts.env;
+        }
+        systemInput = parsed;
       } catch (err) {
         error(`Invalid config file: ${err.message}`);
         process.exit(1);
@@ -22816,14 +22871,15 @@ function registerCreateCommand(parent, getContext2) {
         name: opts.name,
         url: opts.url,
         specificInstructions: opts.instructions,
-        credentials
+        credentials,
+        environment: opts.env === "dev" || opts.env === "prod" ? opts.env : void 0
       };
     }
     if (opts.template) {
-      const template = import_shared5.systems[opts.template];
+      const template = import_shared6.systems[opts.template];
       if (!template) {
         error(
-          `Template not found: ${opts.template}. Available: ${Object.keys(import_shared5.systems).join(", ")}`
+          `Template not found: ${opts.template}. Available: ${Object.keys(import_shared6.systems).join(", ")}`
         );
         process.exit(1);
       }
@@ -22886,8 +22942,11 @@ function registerCreateCommand(parent, getContext2) {
 }
 
 // src/commands/system/edit.ts
+var import_commander2 = require("commander");
 function registerEditCommand2(parent, getContext2) {
-  parent.command("edit").description("Edit an existing system").requiredOption("--id <id>", "System ID").option("--name <name>", "New name").option("--url <url>", "New URL").option("--instructions <text>", "New specific instructions").option("--credentials <json>", "Non-sensitive credentials JSON to merge").option("--sensitive-credentials <fields>", "Comma-separated sensitive credential field names").option("--scrape-url <url>", "Documentation URL to scrape").option("--scrape-keywords <keywords>", "Space-separated scrape keywords").action(async (opts) => {
+  parent.command("edit").description("Edit an existing system").requiredOption("--id <id>", "System ID").option("--name <name>", "New name").option("--url <url>", "New URL").option("--instructions <text>", "New specific instructions").option("--credentials <json>", "Non-sensitive credentials JSON to merge").option("--sensitive-credentials <fields>", "Comma-separated sensitive credential field names").option("--scrape-url <url>", "Documentation URL to scrape").option("--scrape-keywords <keywords>", "Space-separated scrape keywords").addOption(
+    new import_commander2.Option("--env <environment>", "Environment: dev or prod").choices(["dev", "prod"])
+  ).action(async (opts) => {
     const { client } = getContext2();
     const patchPayload = { id: opts.id };
     if (opts.name) patchPayload.name = opts.name;
@@ -22919,8 +22978,9 @@ function registerEditCommand2(parent, getContext2) {
       patchPayload.credentials = { ...patchPayload.credentials, ...creds };
     }
     try {
+      const envOption = opts.env === "dev" || opts.env === "prod" ? { environment: opts.env } : void 0;
       const spin = spinner(`Updating system ${c.bold}${opts.id}${c.reset}...`);
-      const existing = await client.getSystem(opts.id);
+      const existing = await client.getSystem(opts.id, envOption);
       if (!existing) {
         spin.stop();
         error(`System not found: ${opts.id}`);
@@ -22929,7 +22989,7 @@ function registerEditCommand2(parent, getContext2) {
       if (patchPayload.credentials && existing.credentials) {
         patchPayload.credentials = { ...existing.credentials, ...patchPayload.credentials };
       }
-      const result = await client.updateSystem(opts.id, patchPayload);
+      const result = await client.updateSystem(opts.id, patchPayload, envOption);
       if (opts.scrapeUrl) {
         try {
           const keywords = opts.scrapeKeywords?.split(" ").filter(Boolean);
@@ -22956,45 +23016,52 @@ function registerEditCommand2(parent, getContext2) {
 }
 
 // src/commands/system/find.ts
-var import_shared6 = __toESM(require_dist2());
+var import_commander3 = require("commander");
+var import_shared7 = __toESM(require_dist2());
 function filterSystemFields(system) {
   const credentialKeys = Object.keys(system.credentials || {});
   return {
     id: system.id,
     name: system.name,
     url: system.url,
+    environment: system.environment,
     specificInstructions: system.specificInstructions,
     credentialPlaceholders: credentialKeys.map((k) => `<<${system.id}_${k}>>`)
   };
 }
 function registerFindCommand2(parent, getContext2) {
-  parent.command("list").description("List all systems").action(async () => {
+  parent.command("list").description("List all systems").option("--mode <mode>", "Filter by environment: dev, prod, or all (default: all)").action(async (opts) => {
     const { client } = getContext2();
     try {
-      const { items } = await client.listSystems(100);
+      const mode = opts.mode === "dev" || opts.mode === "prod" ? opts.mode : "all";
+      const { items } = await client.listSystems(100, 1, { mode });
       table(
         items.map((s) => ({
           id: s.id,
           name: s.name || "",
+          env: s.environment || "prod",
           url: (s.url || "").slice(0, 50)
         })),
-        ["id", "name", "url"]
+        ["id", "name", "env", "url"]
       );
     } catch (err) {
       error(err.message);
       process.exit(1);
     }
   });
-  parent.command("find [query]").description("Find systems by query or exact ID").option("--id <exactId>", "Exact system ID lookup").action(async (query, opts) => {
+  parent.command("find [query]").description("Find systems by query or exact ID").option("--id <exactId>", "Exact system ID lookup").addOption(
+    new import_commander3.Option("--env <environment>", "Environment: dev or prod").choices(["dev", "prod"])
+  ).action(async (query, opts) => {
     const { client } = getContext2();
     try {
       if (opts.id) {
-        const system = await client.getSystem(opts.id);
+        const envOption = opts.env === "dev" || opts.env === "prod" ? { environment: opts.env } : void 0;
+        const system = await client.getSystem(opts.id, envOption);
         if (!system) {
           error(`System not found: ${opts.id}`);
           process.exit(1);
         }
-        const templateMatch = (0, import_shared6.findTemplateForSystem)(system);
+        const templateMatch = (0, import_shared7.findTemplateForSystem)(system);
         output({
           success: true,
           system: filterSystemFields(system),
@@ -23002,8 +23069,9 @@ function registerFindCommand2(parent, getContext2) {
         });
         return;
       }
+      const listMode = opts.env ? { mode: opts.env } : void 0;
       const rawQuery = (query || "*").trim();
-      const { items } = await client.listSystems(100);
+      const { items } = await client.listSystems(100, 1, listMode);
       if (rawQuery === "*") {
         output({
           success: true,
@@ -23028,16 +23096,8 @@ function registerFindCommand2(parent, getContext2) {
 }
 
 // src/commands/system/call.ts
-var import_shared7 = __toESM(require_dist2());
-function shouldAutoExecute(policy, method, url) {
-  if (policy === "run_everything") return true;
-  if (policy === "ask_every_time") return false;
-  if (policy === "run_gets_only") {
-    const protocol = (0, import_shared7.getConnectionProtocol)(url);
-    return protocol === "http" && method.toUpperCase() === "GET";
-  }
-  return false;
-}
+var import_commander4 = require("commander");
+var import_shared8 = __toESM(require_dist2());
 function registerCallCommand(parent, getContext2) {
   parent.command("call").description("Call a system (API, database, file server)").requiredOption("--url <url>", "Full URL including protocol").option("--system-id <id>", "System ID for credential injection").option("--method <method>", "HTTP method", "GET").option("--headers <json>", "HTTP headers JSON").option("--body <string>", "Request body").option(
     "--file <key=path...>",
@@ -23047,8 +23107,10 @@ function registerCallCommand(parent, getContext2) {
       return arr;
     },
     []
+  ).addOption(
+    new import_commander4.Option("--env <environment>", "Environment: dev or prod").choices(["dev", "prod"])
   ).action(async (opts) => {
-    const { config, client } = getContext2();
+    const { client } = getContext2();
     const method = opts.method || "GET";
     const filePayloads = await parseFileFlags(opts.file, client);
     let body = opts.body;
@@ -23080,31 +23142,6 @@ function registerCallCommand(parent, getContext2) {
         if (err.message?.startsWith("Unresolved file reference")) throw err;
       }
     }
-    const autoExec = process.argv.includes("--yes") || process.argv.includes("-y") || shouldAutoExecute(config.policies.callSystem, method, opts.url);
-    if (!autoExec) {
-      const methodColors = {
-        GET: c.green,
-        POST: c.yellow,
-        PUT: c.blue,
-        PATCH: c.magenta,
-        DELETE: c.red
-      };
-      const mc = methodColors[method.toUpperCase()] || c.white;
-      console.log("");
-      console.log(`  ${mc}${c.bold}${method.toUpperCase()}${c.reset} ${opts.url}`);
-      if (opts.systemId) console.log(`  ${c.dim}system:${c.reset} ${opts.systemId}`);
-      if (opts.headers) console.log(`  ${c.dim}headers:${c.reset} ${opts.headers}`);
-      if (body) {
-        const preview = body.length > 200 ? body.slice(0, 200) + `${c.dim}...${c.reset}` : body;
-        console.log(`  ${c.dim}body:${c.reset} ${preview}`);
-      }
-      console.log("");
-      const accepted = await confirm("Execute this request?");
-      if (!accepted) {
-        output({ success: false, cancelled: true, message: "Request cancelled" });
-        process.exit(0);
-      }
-    }
     let headers;
     if (opts.headers) {
       try {
@@ -23126,11 +23163,12 @@ function registerCallCommand(parent, getContext2) {
       }
     };
     try {
-      const result = await client.executeStep({ step, payload: {} });
+      const mode = opts.env === "dev" || opts.env === "prod" ? opts.env : void 0;
+      const result = await client.executeStep({ step, payload: {}, mode });
       const responseData = result.data?.data !== void 0 ? result.data.data : result.data;
       output({
         success: result.success,
-        protocol: (0, import_shared7.getConnectionProtocol)(opts.url),
+        protocol: (0, import_shared8.getConnectionProtocol)(opts.url),
         data: responseData,
         ...result.error ? { error: result.error } : {}
       });
@@ -23144,7 +23182,7 @@ function registerCallCommand(parent, getContext2) {
 
 // src/commands/system/docs.ts
 function registerDocsCommand(parent, getContext2) {
-  parent.command("docs").description("Search system documentation").requiredOption("--system-id <id>", "System ID").requiredOption("--keywords <keywords>", "Search keywords").action(async (opts) => {
+  parent.command("search-docs").description("Search system documentation by keywords").requiredOption("--system-id <id>", "System ID").requiredOption("-k, --keywords <keywords>", "Search keywords").action(async (opts) => {
     const { client } = getContext2();
     try {
       const result = await client.searchSystemDocumentation(opts.systemId, opts.keywords);
@@ -23191,7 +23229,7 @@ function registerDocsCommand(parent, getContext2) {
 
 // src/commands/system/oauth.ts
 var import_node_child_process2 = require("child_process");
-var import_shared8 = __toESM(require_dist2());
+var import_shared9 = __toESM(require_dist2());
 function openBrowser(url) {
   const platform = process.platform;
   const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
@@ -23227,7 +23265,7 @@ function registerOAuthCommand(parent, getContext2) {
       error(err.message);
       process.exit(1);
     }
-    const templateMatch = (0, import_shared8.findTemplateForSystem)(system);
+    const templateMatch = (0, import_shared9.findTemplateForSystem)(system);
     const templateOAuth = templateMatch?.template?.oauth;
     const clientId = system.credentials?.client_id ?? templateOAuth?.client_id;
     const authUrl = opts.authUrl ?? system.credentials?.auth_url ?? templateOAuth?.authUrl;
@@ -23305,7 +23343,7 @@ function registerOAuthCommand(parent, getContext2) {
       error(`Failed to get OAuth encryption secret: ${err.message}`);
       process.exit(1);
     }
-    const encryptedApiKey = (0, import_shared8.encryptCliApiKey)(config.apiKey, opts.systemId, encryptionSecret);
+    const encryptedApiKey = (0, import_shared9.encryptCliApiKey)(config.apiKey, opts.systemId, encryptionSecret);
     const redirectUri = `${config.webEndpoint.replace(/\/$/, "")}/api/auth/callback`;
     const state = {
       systemId: opts.systemId,
@@ -23481,45 +23519,44 @@ function registerUpdateCommand(program2) {
 }
 
 // src/cli.ts
-var program = new import_commander.Command();
-program.name("sg").description("superglue CLI \u2014 build, run, and manage integration tools").version(CLI_VERSION).option("--api-key <key>", "superglue API key").option("--endpoint <url>", "superglue API endpoint").option("--json", "force JSON output").option("-y, --yes", "auto-accept all confirmations").addHelpText(
+var program = new import_commander5.Command();
+program.name("sg").description("superglue CLI \u2014 build, run, and manage integration tools").version(CLI_VERSION).option("--api-key <key>", "superglue API key").option("--endpoint <url>", "superglue API endpoint").option("--json", "force JSON output").addHelpText(
   "after",
   `
 All Commands:
-  sg init                                     Set up CLI configuration
+  sg init                                        Set up CLI configuration
 
-  sg tool build --config <file>               Build a tool from a JSON config file
-  sg tool build --id <id> --instruction <t>   Build a tool from flags (requires --steps <file>)
-  sg tool run --draft <id> [--payload <json>] Run a draft tool
-  sg tool run --tool <id> [--payload <json>]  Run a saved tool
-  sg tool edit --tool <id> --patches <json>   Edit a tool via JSON Patch operations
-  sg tool edit --draft <id> --patches <json>  Edit a draft via JSON Patch operations
-  sg tool save <id>                           Save a draft tool to the server
-  sg tool list                                List all saved tools (IDs + instructions)
-  sg tool find [query]                        Search tools by keyword
-  sg tool find --id <id>                      Get full config of a specific tool
+  sg tool build --config <file>                  Build a tool from a JSON config
+  sg tool build --id <id> --instruction <text>   Build a tool from flags (requires --steps)
+  sg tool run --tool <id> [--payload <json>]     Run a saved tool
+  sg tool run --draft <id> [--payload <json>]    Run a draft tool
+  sg tool edit --tool <id> --patches <json>      Edit a tool via JSON Patch
+  sg tool edit --draft <id> --patches <json>     Edit a draft via JSON Patch
+  sg tool save --draft <id>                     Save a draft to the server
+  sg tool list                                   List all saved tools
+  sg tool find [query]                           Search tools by keyword
+  sg tool find --id <id>                         Get full config of a tool
 
-  sg system create --config <file>            Create a system from a JSON config file
-  sg system create --id <id> --url <url>      Create a system from flags
-  sg system edit <id>                         Edit a system's configuration
-  sg system list                              List all systems
-  sg system find [query]                      Search systems by keyword
-  sg system find --id <id>                    Get full config of a specific system
-  sg system call --url <url> [--method GET]   Call an API/DB/file server with credential injection
-  sg system docs <id>                         View system documentation
-  sg system oauth <id>                        Authenticate a system via OAuth
+  sg system create --config <file>               Create a system from JSON config
+  sg system create --id <id> --url <url>         Create a system from flags
+  sg system edit --id <id>                       Edit a system's configuration
+  sg system list                                 List all systems
+  sg system find [query]                         Search systems by keyword
+  sg system find --id <id>                       Get full config of a system
+  sg system call --url <url> [--method GET]      Call an API, database, or file server
+  sg system search-docs --system-id <id> -k <kw> Search system documentation
+  sg system oauth --system-id <id> --scopes <s>  Authenticate a system via OAuth
 
-  sg run list [toolId]                        List execution runs, optionally filtered by tool
-  sg run get <runId>                          Get details of a specific run
+  sg run list [toolId]                           List runs, optionally filtered by tool
+  sg run get <runId>                             Get details of a specific run
 
-  sg update                                   Update CLI to latest version
-  sg update --check                           Check for available updates
+  sg update                                      Update CLI to latest version
+  sg update --check                              Check for available updates
 
 Global Flags:
-  --api-key <key>   Override API key from config
-  --endpoint <url>  Override API endpoint from config
-  --json            Force JSON output (default in non-TTY)
-  -y, --yes         Auto-accept all confirmations
+  --api-key <key>    Override API key from config
+  --endpoint <url>   Override API endpoint from config
+  --json             Force JSON output (default in non-TTY)
 `
 );
 var getContext = () => {
@@ -23535,7 +23572,7 @@ registerSystemCommands(program, getContext);
 registerRunCommands(program, getContext);
 var commandsRequiringServer = ["tool", "system", "run"];
 var globalFlagsWithValues = ["--api-key", "--endpoint"];
-var globalFlagsNoValue = ["--json", "-y", "--yes", "-h", "--help", "-V", "--version"];
+var globalFlagsNoValue = ["--json", "-h", "--help", "-V", "--version"];
 function findSubcommand(argv) {
   let i = 2;
   while (i < argv.length) {