@zivis/cli 0.1.0-alpha.5 → 0.1.0-alpha.52

package/dist/commands/auth/init.d.ts

@@ -1,4 +1,6 @@
 export interface InitCmdOpts {
     session?: string;
+    skipMintKey?: boolean;
+    application?: string;
 }
 export declare function initCommand(opts: InitCmdOpts): Promise<void>;

package/dist/commands/auth/init.js

@@ -1,12 +1,23 @@
 import * as readline from "node:readline/promises";
-import { login, getStorageName, saveSessionEntry, loadTokens } from "@zivis/mcp/auth";
-import { DEFAULT_CONFIG } from "@zivis/mcp/types";
+import { login, getStorageName, saveSessionEntry } from "@zivis/mcp/auth";
+import { credentialStorageFromConfig, DEFAULT_CONFIG } from "@zivis/mcp/types";
+import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
 import { fetchUserOrgs, extractEmail } from "../../internal/orgs.js";
 import { ensureProjectBinding } from "../../internal/project-binding.js";
-/** Parse "received org_01XXX" out of the JWT mismatch error message. */
-function parseReceivedOrgId(msg) {
-    const m = msg.match(/received (org_\w+)/);
-    return m ? m[1] : null;
+import { ensureApplicationBinding } from "../../internal/application-binding.js";
+import { discardOauthAfterLogin, tryAutoMintBindingTokenAfterLogin, } from "../../internal/binding-token-mint.js";
+import { decodeJwtPayload } from "@zivis/mcp/auth/jwt";
+import { detectIdesInRepo, writeGuidance } from "../../internal/ide-setup.js";
+import { buildLinkagePrompt } from "../../internal/github-linkage-prompt.js";
+import { resolveExistingSessionAuth } from "../../internal/resolve-init-session.js";
+async function maybePromptGitHubLinkage(config) {
+    try {
+        const msg = await buildLinkagePrompt({ config });
+        if (msg)
+            console.log(msg);
+    }
+    catch {
+    }
 }
 async function prompt(question) {
     const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
@@ -17,119 +28,260 @@ async function prompt(question) {
         rl.close();
     }
 }
+async function offerGuidanceInstall(cwd) {
+    const detectedIdes = detectIdesInRepo(cwd);
+    const otherIdes = detectedIdes.filter((ide) => ide !== "claude-code-cli");
+    const targets = ["claude-code-cli", ...otherIdes];
+    const ideLabels = {
+        cursor: "Cursor",
+        "claude-code-cli": "Claude Code (CLAUDE.md) / Codex (AGENTS.md)",
+        "vscode-copilot": "VS Code (Copilot)",
+        "vscode-claude": "VS Code (Claude)",
+        cline: "Cline",
+        windsurf: "Windsurf",
+    };
+    const ideNames = targets.map((ide) => ideLabels[ide] ?? ide).join(", ");
+    console.log(`\nSet up AI agent guidance for: ${ideNames}`);
+    const ans = await prompt("Add ZIVIS guidance so your AI agent knows to run `zivis test` / `zivis threatmodel` when asked?\n" +
+        "(Adds a small managed block — your own content is preserved, remove anytime with `zivis mcp uninstall`.) [Y/n] ");
+    if (ans.toLowerCase() === "n" || ans.toLowerCase() === "no") {
+        console.log("  Skipped. Run 'zivis mcp install --client <ide> --with-guidance' anytime to add later.");
+        return;
+    }
+    const written = [];
+    for (const ide of targets) {
+        try {
+            const files = writeGuidance({ cwd, client: ide });
+            written.push(...files);
+        }
+        catch (err) {
+            console.warn(`  Warning: Could not write guidance for ${ide}: ${err instanceof Error ? err.message : err}`);
+        }
+    }
+    if (written.length > 0) {
+        console.log(`✓ Wrote guidance files:`);
+        for (const f of written)
+            console.log(`  ${f}`);
+    }
+}
 export async function initCommand(opts) {
-    const config = DEFAULT_CONFIG;
+    const config = {
+        ...DEFAULT_CONFIG,
+        ...resolveConfigFromBinding(process.cwd()),
+    };
     const session = opts.session || "default";
-    // Reuse a stored token if one exists — avoids an extra browser open
-    let bootstrapToken = null;
-    const stored = await loadTokens(session);
-    if (stored) {
-        bootstrapToken = stored.access_token;
-        const email = extractEmail(stored.id_token);
-        console.log(`Using existing session (${email}).`);
-        console.log(`To force re-login first: zivis auth logout && zivis auth init\n`);
+    const envLabel = config.apiBaseUrl.includes("staging") ? "staging" : "production";
+    console.log(`Environment: ${envLabel} (${config.apiBaseUrl})`);
+    console.log("");
+    let tokens;
+    let existingOrgId;
+    let existingEmail;
+    const existing = await resolveExistingSessionAuth(config, session, process.cwd());
+    if (existing) {
+        console.log("Existing session found — reusing stored credentials.");
+        console.log("(Run `zivis auth logout` first to switch accounts.)\n");
+        tokens = { access_token: existing.accessToken, id_token: existing.idToken };
+        existingOrgId = existing.organizationId;
+        existingEmail = existing.email;
     }
     else {
-        console.log("Step 1/2: Authenticate (browser will open)...");
+        console.log("Opening browser for authentication...");
+        console.log("Log into the org you want to bind this project to.\n");
         try {
-            const tokens = await login(config, session, undefined, { skipConfirm: true });
-            bootstrapToken = tokens.access_token;
-            const email = extractEmail(tokens.id_token);
-            console.log(`✓ Authenticated as ${email}`);
+            tokens = await login(config, session, undefined, { skipConfirm: true });
         }
         catch (err) {
             console.error("Login failed:", err instanceof Error ? err.message : err);
             process.exit(1);
         }
     }
-    // Fetch the user's orgs
-    let orgs;
-    try {
-        orgs = await fetchUserOrgs(config, bootstrapToken);
-    }
-    catch (err) {
-        console.error("Failed to fetch organizations:", err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-    if (orgs.length === 0) {
-        console.error("No organizations found for this account. Contact support.");
-        process.exit(1);
-    }
-    let selectedOrg = orgs[0];
-    if (orgs.length > 1) {
-        console.log("Your organizations:");
-        orgs.forEach((org, i) => console.log(`  ${i + 1}. ${org.name}`));
-        const answer = await prompt(`\nSelect org [1-${orgs.length}]: `);
-        const idx = parseInt(answer, 10) - 1;
-        if (isNaN(idx) || idx < 0 || idx >= orgs.length) {
-            console.error("Invalid selection.");
-            process.exit(1);
+    const email = existingEmail ?? extractEmail(tokens.id_token);
+    const claims = decodeJwtPayload(tokens.access_token);
+    const jwtOrgId = existingOrgId ?? claims?.org_id;
+    if (jwtOrgId) {
+        let orgName;
+        try {
+            const orgs = await fetchUserOrgs(config, tokens.access_token);
+            orgName = orgs.find((o) => o.workosOrgId === jwtOrgId)?.name;
+            if (!orgName && orgs.length > 0) {
+                console.log(`\n  ⚠  WorkOS org ${jwtOrgId} is not registered in ZIVIS.`);
+                console.log(`     Your ZIVIS orgs: ${orgs.map((o) => `${o.name} (${o.workosOrgId})`).join(", ")}`);
+                console.log(`     Try logging into ${config.apiBaseUrl} in your browser first, then re-run init.\n`);
+            }
+        }
+        catch (e) {
+            console.error(`  (note: org name lookup failed — ${e instanceof Error ? e.message : e})`);
+        }
+        const orgLabel = orgName ?? `unknown org (${jwtOrgId})`;
+        console.log(`\nAuthenticated as: ${email}`);
+        console.log(`Org:              ${orgLabel}`);
+        console.log(`Environment:      ${envLabel} (${config.apiBaseUrl})\n`);
+        const confirm = await prompt(`Bind this project to "${orgLabel}"? [Y/n] `);
+        if (confirm.toLowerCase() === "n" || confirm.toLowerCase() === "no") {
+            console.log("");
+            const retry = await prompt("Retry login in a private/incognito window? [Y/n] ");
+            if (retry.toLowerCase() !== "n" && retry.toLowerCase() !== "no") {
+                console.log("\nOpening a private/incognito window — log into the correct org...\n");
+                let retryTokens;
+                try {
+                    retryTokens = await login(config, session, undefined, { skipConfirm: true, incognito: true });
+                }
+                catch (err) {
+                    console.error("Login failed:", err instanceof Error ? err.message : err);
+                    process.exit(1);
+                }
+                tokens = retryTokens;
+                const retryClaims = decodeJwtPayload(retryTokens.access_token);
+                const retryOrgId = retryClaims?.org_id;
+                if (!retryOrgId) {
+                    console.error("JWT returned no org scope. Try `zivis auth logout` then `zivis auth init` again.");
+                    process.exit(1);
+                }
+                let retryOrgName;
+                try {
+                    const retryOrgs = await fetchUserOrgs(config, retryTokens.access_token);
+                    retryOrgName = retryOrgs.find((o) => o.workosOrgId === retryOrgId)?.name;
+                }
+                catch (e) {
+                    console.error(`  (note: org name lookup failed — ${e instanceof Error ? e.message : e})`);
+                }
+                const retryLabel = retryOrgName ?? retryOrgId;
+                const retryEmail = extractEmail(retryTokens.id_token);
+                console.log(`\nAuthenticated as: ${retryEmail}`);
+                console.log(`Org:              ${retryLabel}\n`);
+                const retryConfirm = await prompt(`Bind this project to "${retryLabel}"? [Y/n] `);
+                if (retryConfirm.toLowerCase() === "n" || retryConfirm.toLowerCase() === "no") {
+                    console.log("Aborted.");
+                    process.exit(0);
+                }
+                const storageName2 = getStorageName();
+                await saveSessionEntry(session, retryEmail, credentialStorageFromConfig(config));
+                console.log(`\n✓ Logged in as ${retryEmail} → ${retryLabel}`);
+                console.log(`✓ Credentials stored in ${storageName2}`);
+                await ensureProjectBinding({
+                    config, session, accessToken: retryTokens.access_token,
+                    organizationId: retryOrgId, cwd: process.cwd(), autoBind: true, skipBind: false, force: true,
+                });
+                await ensureApplicationBinding({ config, accessToken: retryTokens.access_token, cwd: process.cwd(), explicitApplication: opts.application });
+                await tryAutoMintBindingTokenAfterLogin({
+                    cwd: process.cwd(),
+                    sessionName: session,
+                    accessToken: retryTokens.access_token,
+                    skip: opts.skipMintKey === true,
+                    warnOnFailure: true,
+                });
+                await discardOauthAfterLogin({ session, config });
+                await offerGuidanceInstall(process.cwd());
+                await maybePromptGitHubLinkage(config);
+                process.exit(0);
+            }
+            console.log("\nAborted. Switch orgs in your browser then run `zivis auth logout && zivis auth init`.");
+            process.exit(0);
         }
-        selectedOrg = orgs[idx];
+        const storageName = getStorageName();
+        await saveSessionEntry(session, email, credentialStorageFromConfig(config));
+        console.log(`\n✓ Logged in as ${email} → ${orgLabel}`);
+        console.log(`✓ Credentials stored in ${storageName}`);
+        await ensureProjectBinding({
+            config,
+            session,
+            accessToken: tokens.access_token,
+            organizationId: jwtOrgId,
+            cwd: process.cwd(),
+            autoBind: true,
+            skipBind: false,
+            force: true,
+        });
+        await ensureApplicationBinding({ config, accessToken: tokens.access_token, cwd: process.cwd(), explicitApplication: opts.application });
+        await tryAutoMintBindingTokenAfterLogin({
+            cwd: process.cwd(),
+            sessionName: session,
+            accessToken: tokens.access_token,
+            skip: opts.skipMintKey === true,
+            warnOnFailure: true,
+        });
+        await discardOauthAfterLogin({ session, config });
+        await offerGuidanceInstall(process.cwd());
+        await maybePromptGitHubLinkage(config);
     }
     else {
-        console.log(`One org found: ${selectedOrg.name}`);
-    }
-    if (!selectedOrg.workosOrgId) {
-        console.error(`Org "${selectedOrg.name}" has no WorkOS organization ID — cannot scope login.`);
-        process.exit(1);
-    }
-    // Attempt org-scoped login, with graceful handling for browser-session mismatches
-    let scopedTokens;
-    let finalOrgId = selectedOrg.workosOrgId;
-    let finalOrgName = selectedOrg.name;
-    for (let attempt = 0; attempt < 2; attempt++) {
-        console.log(`\n${stored ? "Step 1/1" : "Step 2/2"}: Logging in to ${finalOrgName} (browser will open)...`);
+        console.log("\nYour account isn't scoped to a specific org yet.");
+        console.log("Fetching your organizations...\n");
+        let orgs;
         try {
-            scopedTokens = await login(config, session, finalOrgId, {
-                orgName: finalOrgName,
-                skipConfirm: true,
-            });
-            break; // success
+            orgs = await fetchUserOrgs(config, tokens.access_token);
         }
         catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            const receivedOrgId = parseReceivedOrgId(msg);
-            if (!receivedOrgId) {
-                console.error("Login failed:", msg);
+            console.error("Failed to fetch organizations:", err instanceof Error ? err.message : err);
+            process.exit(1);
+        }
+        if (orgs.length === 0) {
+            console.error("No organizations found. Contact support.");
+            process.exit(1);
+        }
+        if (orgs.length === 1) {
+            console.log(`One org found: ${orgs[0].name}. Re-authenticating scoped to that org...`);
+        }
+        else {
+            console.log("Your organizations:");
+            orgs.forEach((org, i) => console.log(`  ${i + 1}. ${org.name}`));
+            const answer = await prompt(`\nSelect org to bind this project to [1-${orgs.length}]: `);
+            const idx = parseInt(answer, 10) - 1;
+            if (isNaN(idx) || idx < 0 || idx >= orgs.length) {
+                console.error("Invalid selection.");
                 process.exit(1);
             }
-            // Browser authenticated to a different org than selected
-            const receivedOrg = orgs.find((o) => o.workosOrgId === receivedOrgId);
-            const receivedName = receivedOrg?.name ?? receivedOrgId;
-            console.error(`\n⚠  Browser authenticated to "${receivedName}" instead of "${finalOrgName}".`);
-            console.error(`   This happens when your browser's active session is for a different org.\n`);
-            if (attempt >= 1) {
-                console.error("Still mismatched after retry. Run `zivis auth init` again after switching orgs in your browser.");
+            const selected = orgs[idx];
+            if (!selected.workosOrgId) {
+                console.error(`Org "${selected.name}" has no WorkOS org ID.`);
                 process.exit(1);
             }
-            const choice = await prompt(`Use "${receivedName}" instead? [Y/n] `);
-            if (choice.toLowerCase() === "n" || choice.toLowerCase() === "no") {
-                console.log("Aborted. Log into the correct org in your browser then run `zivis auth init` again.");
-                process.exit(0);
+            console.log(`\nRe-opening browser scoped to ${selected.name}...`);
+            console.log("(Tip: if your browser logs into the wrong org, use option 2 to get a URL for a private/incognito window)\n");
+            try {
+                const scopedTokens = await login(config, session, selected.workosOrgId, {
+                    orgName: selected.name,
+                    skipConfirm: true,
+                });
+                const storageName2 = getStorageName();
+                await saveSessionEntry(session, email, credentialStorageFromConfig(config));
+                console.log(`\n✓ Logged in as ${email} → ${selected.name}`);
+                console.log(`✓ Credentials stored in ${storageName2}`);
+                await ensureProjectBinding({
+                    config,
+                    session,
+                    accessToken: scopedTokens.access_token,
+                    organizationId: selected.workosOrgId,
+                    cwd: process.cwd(),
+                    autoBind: true,
+                    skipBind: false,
+                    force: true,
+                });
+                await ensureApplicationBinding({ config, accessToken: scopedTokens.access_token, cwd: process.cwd(), explicitApplication: opts.application });
+                await tryAutoMintBindingTokenAfterLogin({
+                    cwd: process.cwd(),
+                    sessionName: session,
+                    accessToken: scopedTokens.access_token,
+                    skip: opts.skipMintKey === true,
+                    warnOnFailure: true,
+                });
+                await discardOauthAfterLogin({ session, config });
+                await offerGuidanceInstall(process.cwd());
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                const m = msg.match(/received (org_\w+)/);
+                if (m) {
+                    console.error(`\n⚠  Browser authenticated to a different org than selected.`);
+                    console.error(`   Your browser has an active session for a different org.\n`);
+                    console.error(`   To fix: run \`zivis auth init\` again and paste the URL into a private/incognito window.`);
+                }
+                else {
+                    console.error("Login failed:", msg);
+                }
+                process.exit(1);
             }
-            // Retry scoped to what the browser actually has
-            finalOrgId = receivedOrgId;
-            finalOrgName = receivedName;
         }
     }
-    if (!scopedTokens) {
-        process.exit(1);
-    }
-    const email = extractEmail(scopedTokens.id_token);
-    const storageName = getStorageName();
-    await saveSessionEntry(session, email);
-    console.log(`\n✓ Logged in as ${email} → ${finalOrgName}`);
-    console.log(`✓ Credentials stored in ${storageName}`);
-    await ensureProjectBinding({
-        config,
-        session,
-        accessToken: scopedTokens.access_token,
-        organizationId: finalOrgId,
-        cwd: process.cwd(),
-        autoBind: true,
-        skipBind: false,
-    });
     process.exit(0);
 }
-//# sourceMappingURL=init.js.map

package/dist/commands/auth/login.d.ts

@@ -4,5 +4,7 @@ export interface LoginCmdOpts {
     yes?: boolean;
     bind?: boolean;
     noBind?: boolean;
+    rebind?: boolean;
+    skipMintKey?: boolean;
 }
 export declare function loginCommand(opts: LoginCmdOpts): Promise<void>;

package/dist/commands/auth/login.js

@@ -1,60 +1,161 @@
+import * as readline from "node:readline/promises";
 import { login } from "@zivis/mcp/auth";
 import { getStorageName } from "@zivis/mcp/auth";
 import { saveSessionEntry } from "@zivis/mcp/auth";
-import { detectProjectBinding } from "@zivis/mcp/project-binding";
-import { DEFAULT_CONFIG } from "@zivis/mcp/types";
+import { detectProjectBinding, resolveConfigFromBinding } from "@zivis/mcp/project-binding";
+import { credentialStorageFromConfig, DEFAULT_CONFIG } from "@zivis/mcp/types";
 import { extractEmail } from "../../internal/orgs.js";
+import { pickOrg } from "../../internal/org-picker.js";
 import { ensureProjectBinding } from "../../internal/project-binding.js";
-import { setupVsCodeClaude, setupVsCodeCopilot, setupClaudeCodeCli, } from "../../internal/ide-setup.js";
+import { discardOauthAfterLogin, tryAutoMintBindingTokenAfterLogin, } from "../../internal/binding-token-mint.js";
+import { setupCursorWorkspace, setupVsCodeClaude, setupVsCodeCopilot, setupClaudeCodeCli, } from "../../internal/ide-setup.js";
+import { buildLinkagePrompt } from "../../internal/github-linkage-prompt.js";
+async function confirm(question) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        const answer = (await rl.question(question)).trim().toLowerCase();
+        return answer !== "n" && answer !== "no";
+    }
+    finally {
+        rl.close();
+    }
+}
 export async function loginCommand(opts) {
-    const config = DEFAULT_CONFIG;
+    const config = {
+        ...DEFAULT_CONFIG,
+        ...resolveConfigFromBinding(process.cwd()),
+    };
     const detected = detectProjectBinding(process.cwd());
     const session = opts.session || detected?.binding.session || config.session;
-    let organizationId = opts.org;
-    if (!organizationId && detected?.binding.workosOrgId) {
+    const sessionName = session || "default";
+    let organizationId;
+    let orgName;
+    let writeMode = "no-write";
+    if (opts.org) {
+        organizationId = opts.org;
+        orgName = detected?.binding.orgName && detected.binding.workosOrgId === opts.org
+            ? detected.binding.orgName
+            : undefined;
+        if (opts.rebind) {
+            writeMode = "replace";
+        }
+    }
+    else if (opts.rebind) {
+        const picked = await runIdentityThenPicker(config, sessionName, {
+            currentOrgId: detected?.binding.workosOrgId ?? undefined,
+            header: detected?.binding.workosOrgId
+                ? "Switch this project to which org?"
+                : "Your organizations:",
+        });
+        if (detected?.binding.workosOrgId && detected.binding.workosOrgId === picked.workosOrgId) {
+            console.log(`Project is already bound to ${picked.name}. Nothing to change.`);
+            process.exit(0);
+        }
+        if (detected?.binding.workosOrgId) {
+            const fromLabel = detected.binding.orgName
+                ? `${detected.binding.orgName} (${detected.binding.workosOrgId})`
+                : detected.binding.workosOrgId;
+            const toLabel = `${picked.name} (${picked.workosOrgId})`;
+            if (!opts.yes) {
+                const ok = await confirm(`Change project binding from "${fromLabel}" to "${toLabel}"? [Y/n] `);
+                if (!ok) {
+                    console.log("Aborted.");
+                    process.exit(0);
+                }
+            }
+            writeMode = "replace";
+        }
+        else {
+            writeMode = "create";
+        }
+        organizationId = picked.workosOrgId;
+        orgName = picked.name;
+    }
+    else if (detected?.binding.workosOrgId) {
         organizationId = detected.binding.workosOrgId;
-        console.log(`Using org from project binding: ${organizationId}${detected.binding.orgName ? ` (${detected.binding.orgName})` : ""}`);
+        orgName = detected.binding.orgName;
+        console.log(`Using org from project binding: ${organizationId}${orgName ? ` (${orgName})` : ""}`);
+    }
+    else {
+        const picked = await runIdentityThenPicker(config, sessionName, {
+            header: "Your organizations:",
+        });
+        organizationId = picked.workosOrgId;
+        orgName = picked.name;
+        writeMode = "create";
+    }
+    if (!organizationId) {
+        console.error("Internal error: no organization resolved for login.");
+        process.exit(1);
     }
     if (detected?.binding.session && !opts.session) {
         console.log(`Using session from project binding: ${session}`);
     }
     try {
         const tokens = await login(config, session, organizationId, {
-            orgName: detected?.binding.orgName,
-            skipConfirm: opts.yes === true,
+            orgName,
+            skipConfirm: opts.yes === true || writeMode !== "no-write",
         });
         const storageName = getStorageName();
         const email = extractEmail(tokens.id_token);
-        const sessionName = session || "default";
-        await saveSessionEntry(sessionName, email);
+        await saveSessionEntry(sessionName, email, credentialStorageFromConfig(config));
         const sessionLabel = session ? ` (session: ${session})` : "";
         console.log(`✓ Logged in as ${email}${sessionLabel}`);
         console.log(`✓ Credentials stored in ${storageName}`);
-        if (organizationId) {
-            console.log(`✓ JWT scoped to organization: ${organizationId}`);
+        console.log(`✓ JWT scoped to organization: ${organizationId}${orgName ? ` (${orgName})` : ""}`);
+        try {
+            await setupCursorWorkspace();
+        }
+        catch (err) {
+            console.log(`  WARNING: Failed to update .cursor/mcp.json: ${err instanceof Error ? err.message : err}`);
         }
         try {
-            await setupVsCodeClaude(session);
-            await setupVsCodeCopilot(session);
+            await setupVsCodeClaude();
+            await setupVsCodeCopilot();
         }
         catch (err) {
             console.log(`  WARNING: Failed to update .vscode/mcp.json: ${err instanceof Error ? err.message : err}`);
         }
         try {
-            await setupClaudeCodeCli(session);
+            await setupClaudeCodeCli();
         }
         catch (err) {
             console.log(`  WARNING: Failed to update Claude Code CLI config: ${err instanceof Error ? err.message : err}`);
         }
+        if (writeMode === "create" && !opts.yes && !opts.noBind) {
+            const orgLabel = orgName ? `${orgName} (${organizationId})` : organizationId;
+            const ok = await confirm(`Bind this project to ${orgLabel}? [Y/n] `);
+            if (!ok) {
+                console.log("Login succeeded but project was not bound.");
+                await discardOauthAfterLogin({ session, config });
+                process.exit(0);
+            }
+        }
         await ensureProjectBinding({
             config,
             session: sessionName,
             accessToken: tokens.access_token,
             organizationId,
             cwd: process.cwd(),
-            autoBind: opts.bind === true,
+            autoBind: opts.bind === true || writeMode !== "no-write",
             skipBind: opts.noBind === true,
+            force: writeMode === "replace",
         });
+        await tryAutoMintBindingTokenAfterLogin({
+            cwd: process.cwd(),
+            sessionName,
+            accessToken: tokens.access_token,
+            skip: opts.skipMintKey === true,
+            warnOnFailure: true,
+        });
+        await discardOauthAfterLogin({ session, config });
+        try {
+            const linkagePrompt = await buildLinkagePrompt({ config });
+            if (linkagePrompt)
+                console.log(linkagePrompt);
+        }
+        catch {
+        }
         process.exit(0);
     }
     catch (err) {
@@ -62,4 +163,21 @@ export async function loginCommand(opts) {
         process.exit(1);
     }
 }
-//# sourceMappingURL=login.js.map
+async function runIdentityThenPicker(config, session, pickOpts) {
+    console.log("Opening browser to identify your account (no org scope yet)...");
+    let identity;
+    try {
+        identity = await login(config, session, undefined, { skipConfirm: true });
+    }
+    catch (err) {
+        console.error("Login failed:", err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+    try {
+        return await pickOrg(config, identity.access_token, pickOpts);
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+}

package/dist/commands/auth/logout.js

@@ -1,14 +1,26 @@
-import { keychainClearAll, keychainClearSession } from "@zivis/mcp/auth";
+import { keychainClearAll, keychainClearSession, keychainDelete, keychainRead } from "@zivis/mcp/auth";
 import { removeSessionEntry } from "@zivis/mcp/auth";
+import { detectProjectBinding, resolveConfigFromBinding } from "@zivis/mcp/project-binding";
+import { credentialStorageFromConfig } from "@zivis/mcp/types";
 export async function logoutCommand(opts) {
-    if (opts.session) {
-        await keychainClearSession(opts.session);
-        await removeSessionEntry(opts.session);
-        console.log(`✓ Session "${opts.session}" credentials cleared`);
+    const config = resolveConfigFromBinding(process.cwd());
+    const st = credentialStorageFromConfig(config);
+    const sessionName = opts.session ??
+        detectProjectBinding(process.cwd())?.binding.session;
+    if (sessionName) {
+        await keychainClearSession(sessionName, st);
+        const apiKeyAccount = `apikey.${sessionName}`;
+        const hadApiKey = !!(await keychainRead(apiKeyAccount, st).catch(() => null));
+        if (hadApiKey) {
+            await keychainDelete(apiKeyAccount, st);
+            console.log(`✓ Local Project Binding Token cleared for session "${sessionName}"`);
+            console.log(`  Note: To revoke the key server-side, visit Settings → API Tokens in the ZIVIS UI.`);
+        }
+        await removeSessionEntry(sessionName, st);
+        console.log(`✓ Session "${sessionName}" credentials cleared`);
         return;
     }
-    await keychainClearAll();
+    await keychainClearAll(st);
     console.log("✓ Default credentials cleared");
     console.log("  Note: Named sessions are not affected. Use 'zivis auth sessions' to list them.");
 }
-//# sourceMappingURL=logout.js.map

package/dist/commands/auth/sessions.js

@@ -1,12 +1,16 @@
 import { listSessions, removeSessionEntry, keychainClearSession } from "@zivis/mcp/auth";
+import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
+import { credentialStorageFromConfig } from "@zivis/mcp/types";
 export async function sessionsCommand(opts) {
+    const config = resolveConfigFromBinding(process.cwd());
+    const st = credentialStorageFromConfig(config);
     if (opts.remove) {
-        await keychainClearSession(opts.remove);
-        await removeSessionEntry(opts.remove);
+        await keychainClearSession(opts.remove, st);
+        await removeSessionEntry(opts.remove, st);
         console.log(`✓ Session "${opts.remove}" removed`);
         return;
     }
-    const sessions = await listSessions();
+    const sessions = await listSessions(st);
     const activeSession = process.env.ZIVIS_SESSION;
     if (sessions.length === 0) {
         console.log("No sessions stored.");
@@ -27,4 +31,3 @@ export async function sessionsCommand(opts) {
     console.log("To use a session in a project, add to .mcp.json:");
     console.log('  "env": { "ZIVIS_SESSION": "<session-name>" }');
 }
-//# sourceMappingURL=sessions.js.map