showpane 0.4.16 → 0.4.18

package/bundle/meta/scaffold-manifest.json

@@ -1,18 +1,18 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-04-11T21:51:10.517Z",
-  "scaffoldVersion": "0.2.6",
+  "generatedAt": "2026-04-11T23:07:20.944Z",
+  "scaffoldVersion": "0.2.7",
   "files": {
     ".env.example": "ed105f2bdcd1888a98181d55e3c9f7d6eff3ae9c3e2366c2e777a12e3caddfa7",
     ".gitignore": "998e5f43865ea56ac79a05acfd5d4b0d696f310bd5325a1ed458c3d40154d437",
-    "VERSION": "be3c6d2c6c406a64d44f0b6464a887e290416dd90c524094485b1be00936d6d7",
+    "VERSION": "5b57e3b8c153d1d33b0c0f1ee29d3de1bf93232ed95aa78b80fe885e99faa915",
     "next.config.ts": "cf27999cc274cce79bc4c8df11789807719abf40752b60e4b4967a3d2f0ed013",
     "package-lock.json": "d8e30eb86f08e70787d4459a084b4ab2a9f119696bbd3146ec4ba5675fffd3c2",
     "package.json": "b095e17e7fc181c630e87fe9f473c5a4ef969afcd4b110f9f9c6d6a6d93f1c0b",
     "postcss.config.js": "fa650b380adfabb151a0b352f7135e107e6352345f899060f1c5c231228f94bf",
     "prisma.config.ts": "36f56fd74eae70632e484443e38d08665158d72d5c978dc456651d8d5e1a636e",
     "prisma/schema.local.prisma": "f5d6f3cb17d6d229f46ef82eef7c0ff4261596924f0173fef075ac394f423073",
-    "prisma/seed.ts": "bb8eb3bc189fabbab3be83d3909afee583a5b724d258139feda22af504bed134",
+    "prisma/seed.ts": "98f7d5fd97ce2ff66bdf060ccb6695416d18ac983672b256d5d95d315ccee6e5",
     "public/example-avatar.svg": "0edeb0d3fbefa89cc27ffe6564d20e3ee0fd073cb6d9f2a025248ef3b3f277fd",
     "public/example-logo.svg": "bc5cd933aff2a17698dee66a7b4ea940ad12238e9d813474d643b459b1e8d6da",
     "public/robots.txt": "331ea9090db0c9f6f597bd9840fd5b171830f6e0b3ba1cb24dfa91f0c95aedc1",
@@ -27,7 +27,7 @@
     "src/app/(portal)/client/example/example-client.tsx": "ed32b111acea861f448d865338f8841d47c6ca7c2f87ed30d85bb0804940d4ec",
     "src/app/(portal)/client/example/page.tsx": "f330864f63c9feea76c8a62c3eba3ce57578627e0d4abd929fd7fefdfc7af058",
     "src/app/(portal)/client/layout.tsx": "4f43871510408a81da229d48ae316ec1d1c1beda93121922246300a2c8fd0999",
-    "src/app/(portal)/client/page.tsx": "7b4e3e5b286672f83581e24349e98ac930d8bbf5dfed02793754be2ddadf430f",
+    "src/app/(portal)/client/page.tsx": "7efe97c047e9ad8f5d9034fe616c0c915277a9cb92fa4ce57fe35af672c80320",
     "src/app/api/client-auth/route.ts": "ce1858559b1e944d5b1dc719d1f03bebf66286671700b1b5397382109f0f1e0d",
     "src/app/api/client-auth/share/route.ts": "ed82414212dcd26af8c6c0f2bd44d9d79a727ed35cfedbac8c4077a6220aad14",
     "src/app/api/client-events/route.ts": "13d545537b7e8ce421e6169d25c105adf2a2de3d978ae0a2c6751ff5f7d2eb33",
@@ -57,7 +57,7 @@
     "src/lib/storage.ts": "ae3b85fc6cccd39d4174a391dcbe6e91fb9460eb407ec9dbfedd63594a441d08",
     "src/lib/token.ts": "518898ca3cbba069f507f736ed80f5afa0c5af07b0b02fdd2d682e466598c803",
     "src/lib/utils.ts": "d1f1e0d62cb8d8d1e04c26e14de842d8a151f75812d81b046c65b5d1fe8e4b27",
-    "src/middleware.ts": "5623ef170d9327e47373943eae33a8b07a6dda970525d0833e0865e4429df094",
+    "src/middleware.ts": "5925c0b1ad801a201e82c26ccd6c0642717670446d1503e9ed82dcf3ea03c825",
     "src/types/adm-zip.d.ts": "a9a32ea84d6d6cd89626ba5cd6f5519158a652362abbe5647474114c30ecc3c4",
     "tailwind.config.ts": "dc0dec22249b290b857190495ce7140327a6f4d94fedd5dffcdb298fa3928071",
     "tests/.gitkeep": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",

package/bundle/scaffold/VERSION

@@ -1 +1 @@
-0.2.6
+0.2.7

package/bundle/scaffold/prisma/seed.ts

@@ -33,6 +33,7 @@ async function main() {
   const contactName = process.env.SHOWPANE_CONTACT_NAME?.trim() || null;
   const contactEmail = process.env.SHOWPANE_CONTACT_EMAIL?.trim() || null;
   const websiteUrl = normalizeWebsiteUrl(process.env.SHOWPANE_WEBSITE_URL);
+  const contactTitle = "Point of contact";
 
   const org = await prisma.organization.upsert({
     where: { slug: organizationSlug },
@@ -41,7 +42,7 @@ async function main() {
       name: organizationName,
       slug: organizationSlug,
       contactName,
-      contactTitle: null,
+      contactTitle,
       contactEmail,
       supportEmail: contactEmail,
       websiteUrl,

package/bundle/scaffold/src/app/(portal)/client/page.tsx

@@ -1,19 +1,92 @@
-"use client";
-
 import { PortalLogin } from "@/components/portal-login";
+import { getInitialLogo } from "@/lib/branding";
+import { prisma } from "@/lib/db";
+import { resolveDefaultOrganizationId } from "@/lib/client-portals";
+import { getRuntimePortalBySlug, getRuntimeState, isRuntimeSnapshotMode } from "@/lib/runtime-state";
+
+export default async function ClientLogin({
+  searchParams,
+}: {
+  searchParams?: Promise<{ portal?: string }>;
+}) {
+  const params = (await searchParams) ?? {};
+  const portalSlug = params.portal?.trim() || null;
+
+  let companyName = "Your Portal";
+  let companyUrl = "https://showpane.com";
+  let supportEmail = "support@showpane.com";
+  let portalLabel = "Client Portal";
+  let description = "Private portal access. Sign in with the credentials you were sent.";
+  let companyInitial = "P";
+
+  if (portalSlug) {
+    try {
+      if (isRuntimeSnapshotMode()) {
+        const state = await getRuntimeState();
+        const portal = await getRuntimePortalBySlug(portalSlug);
+        if (portal) {
+          companyName = portal.companyName;
+          portalLabel = `${portal.companyName} Portal`;
+          description = `Private portal for ${portal.companyName}. Sign in with the credentials you were sent.`;
+          companyInitial = portal.companyName[0]?.toUpperCase() || "P";
+          if (state?.organization?.websiteUrl) {
+            companyUrl = state.organization.websiteUrl;
+          }
+          if (state?.organization?.supportEmail) {
+            supportEmail = state.organization.supportEmail;
+          }
+        }
+      } else {
+        const organizationId = await resolveDefaultOrganizationId();
+        if (organizationId) {
+          const portal = await prisma.clientPortal.findFirst({
+            where: {
+              organizationId,
+              slug: portalSlug,
+              isActive: true,
+            },
+            select: { companyName: true },
+          });
+          const organization = await prisma.organization.findUnique({
+            where: { id: organizationId },
+            select: {
+              websiteUrl: true,
+              supportEmail: true,
+              portalLabel: true,
+            },
+          });
+
+          if (portal) {
+            companyName = portal.companyName;
+            portalLabel = organization?.portalLabel || `${portal.companyName} Portal`;
+            description = `Private portal for ${portal.companyName}. Sign in with the credentials you were sent.`;
+            companyInitial = portal.companyName[0]?.toUpperCase() || "P";
+          }
+          if (organization?.websiteUrl) {
+            companyUrl = organization.websiteUrl;
+          }
+          if (organization?.supportEmail) {
+            supportEmail = organization.supportEmail;
+          }
+        }
+      }
+    } catch {
+      // Fall back to the generic login shell if portal-aware context cannot be resolved.
+    }
+  }
 
-export default function ClientLogin() {
   return (
     <PortalLogin
-      companyName="Your Portal"
+      companyName={companyName}
       companyLogo={
         <div className="flex h-7 w-7 items-center justify-center rounded-lg bg-gray-900">
-          <span className="text-xs font-bold text-white">P</span>
+          <span className="text-xs font-bold text-white">{companyInitial}</span>
         </div>
       }
-      companyUrl="https://showpane.com"
-      supportEmail="support@showpane.com"
-      description="Private portal access. Sign in with the credentials you were sent."
+      companyUrl={companyUrl}
+      supportEmail={supportEmail}
+      portalLabel={portalLabel}
+      description={description}
     />
   );
 }

package/bundle/scaffold/src/middleware.ts

@@ -35,18 +35,28 @@ export async function middleware(req: NextRequest) {
     try {
       const portal = await getAuthenticatedPortal(req);
       if (!portal) {
-        return NextResponse.redirect(new URL("/client", req.url));
+        const loginUrl = new URL("/client", req.url);
+        const requestedSlug = pathname.split("/")[2];
+        if (requestedSlug) {
+          loginUrl.searchParams.set("portal", requestedSlug);
+        }
+        return NextResponse.redirect(loginUrl);
       }
       // Ensure the URL slug matches the authenticated slug
       const urlSlug = pathname.split("/")[2];
       if (urlSlug !== portal.slug) {
-        return NextResponse.redirect(new URL("/client", req.url));
+        return NextResponse.redirect(new URL(`/client/${portal.slug}`, req.url));
       }
       return NextResponse.next();
     } catch (e) {
       console.error("Middleware: DB error checking auth on portal page", e);
       // Fail closed — redirect to login
-      return NextResponse.redirect(new URL("/client", req.url));
+      const loginUrl = new URL("/client", req.url);
+      const requestedSlug = pathname.split("/")[2];
+      if (requestedSlug) {
+        loginUrl.searchParams.set("portal", requestedSlug);
+      }
+      return NextResponse.redirect(loginUrl);
     }
   }
 

package/bundle/toolchain/CLI_VERSION

@@ -1 +1 @@
-0.4.16
+0.4.18

package/bundle/toolchain/VERSION

@@ -1 +1 @@
-1.1.6 (requires app >= 0.2.6)
+1.1.7 (requires app >= 0.2.7)

package/bundle/toolchain/bin/get-org.ts

@@ -0,0 +1,46 @@
+import { PrismaClient } from "@/lib/prisma-client";
+
+function fail(message: string): never {
+  console.error(JSON.stringify({ ok: false, error: message }));
+  process.exit(1);
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+
+  if (args.includes("--help")) {
+    console.log("Usage: get-org --slug <orgSlug>");
+    console.log("Looks up a local Showpane organization by slug.");
+    process.exit(0);
+  }
+
+  const getArg = (flag: string) => {
+    const index = args.indexOf(flag);
+    return index !== -1 ? args[index + 1] : undefined;
+  };
+
+  const slug = getArg("--slug");
+  if (!slug) {
+    fail("Missing --slug");
+  }
+
+  const prisma = new PrismaClient();
+  try {
+    const org = await prisma.organization.findUnique({
+      where: { slug },
+      select: { id: true, slug: true, name: true },
+    });
+
+    if (!org) {
+      fail(`Organization "${slug}" not found`);
+    }
+
+    console.log(JSON.stringify({ ok: true, org }));
+  } finally {
+    await prisma.$disconnect();
+  }
+}
+
+main().catch((error) => {
+  fail(String(error));
+});

package/bundle/toolchain/skills/VERSION

@@ -1 +1 @@
-1.1.6 (requires app >= 0.2.6)
+1.1.7 (requires app >= 0.2.7)

package/bundle/toolchain/skills/portal-analytics/SKILL.md

@@ -22,6 +22,10 @@ fi
 APP_PATH=$("$SHOWPANE_BIN/showpane-config" get app_path 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('app_path',''))" 2>/dev/null)
 DEPLOY_MODE=$("$SHOWPANE_BIN/showpane-config" get deploy_mode 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('deploy_mode','local'))" 2>/dev/null || echo "local")
 ORG_SLUG=$("$SHOWPANE_BIN/showpane-config" get orgSlug 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('orgSlug','') or d.get('org_slug',''))" 2>/dev/null || true)
+CLOUD_API_TOKEN=$("$SHOWPANE_BIN/showpane-config" get accessToken 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('accessToken',''))" 2>/dev/null || true)
+CLOUD_API_BASE="${SHOWPANE_CLOUD_URL:-https://app.showpane.com}"
+CLOUD_ORG_SLUG="${ORG_SLUG:-}"
+CLOUD_PORTAL_URL=$("$SHOWPANE_BIN/showpane-config" get portalUrl 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('portalUrl',''))" 2>/dev/null || true)
 APP_PATH="${SHOWPANE_APP_PATH:-$APP_PATH}"
 if [ -f "$APP_PATH/.env" ]; then set -a && source "$APP_PATH/.env" && set +a; fi
 DATABASE_URL="${DATABASE_URL:-}"
@@ -62,6 +66,13 @@ SHOWPANE_TIMELINE="$SHOWPANE_HOME/timeline.jsonl"
 mkdir -p "$(dirname "$SHOWPANE_TIMELINE")"
 echo '{"skill":"portal-analytics","event":"started","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}' >> "$SHOWPANE_TIMELINE" 2>/dev/null
 echo "SHOWPANE: v$SKILL_VERSION | MODE: $DEPLOY_MODE | APP: $APP_PATH"
+if [ "portal-analytics" = "portal-deploy" ]; then
+  echo "ORG_SLUG: $ORG_SLUG"
+  echo "CLOUD_API_TOKEN: ${CLOUD_API_TOKEN:+present}${CLOUD_API_TOKEN:-missing}"
+  echo "CLOUD_API_BASE: ${CLOUD_API_BASE:-missing}"
+  echo "CLOUD_ORG_SLUG: ${CLOUD_ORG_SLUG:-missing}"
+  echo "CLOUD_PORTAL_URL: ${CLOUD_PORTAL_URL:-missing}"
+fi
 echo "TELEMETRY: $TEL"
 echo "TEL_PROMPTED: $TEL_PROMPTED"
 ```

package/bundle/toolchain/skills/portal-create/SKILL.md

@@ -27,6 +27,10 @@ fi
 APP_PATH=$("$SHOWPANE_BIN/showpane-config" get app_path 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('app_path',''))" 2>/dev/null)
 DEPLOY_MODE=$("$SHOWPANE_BIN/showpane-config" get deploy_mode 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('deploy_mode','local'))" 2>/dev/null || echo "local")
 ORG_SLUG=$("$SHOWPANE_BIN/showpane-config" get orgSlug 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('orgSlug','') or d.get('org_slug',''))" 2>/dev/null || true)
+CLOUD_API_TOKEN=$("$SHOWPANE_BIN/showpane-config" get accessToken 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('accessToken',''))" 2>/dev/null || true)
+CLOUD_API_BASE="${SHOWPANE_CLOUD_URL:-https://app.showpane.com}"
+CLOUD_ORG_SLUG="${ORG_SLUG:-}"
+CLOUD_PORTAL_URL=$("$SHOWPANE_BIN/showpane-config" get portalUrl 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('portalUrl',''))" 2>/dev/null || true)
 APP_PATH="${SHOWPANE_APP_PATH:-$APP_PATH}"
 if [ -f "$APP_PATH/.env" ]; then set -a && source "$APP_PATH/.env" && set +a; fi
 DATABASE_URL="${DATABASE_URL:-}"
@@ -67,6 +71,13 @@ SHOWPANE_TIMELINE="$SHOWPANE_HOME/timeline.jsonl"
 mkdir -p "$(dirname "$SHOWPANE_TIMELINE")"
 echo '{"skill":"portal-create","event":"started","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}' >> "$SHOWPANE_TIMELINE" 2>/dev/null
 echo "SHOWPANE: v$SKILL_VERSION | MODE: $DEPLOY_MODE | APP: $APP_PATH"
+if [ "portal-create" = "portal-deploy" ]; then
+  echo "ORG_SLUG: $ORG_SLUG"
+  echo "CLOUD_API_TOKEN: ${CLOUD_API_TOKEN:+present}${CLOUD_API_TOKEN:-missing}"
+  echo "CLOUD_API_BASE: ${CLOUD_API_BASE:-missing}"
+  echo "CLOUD_ORG_SLUG: ${CLOUD_ORG_SLUG:-missing}"
+  echo "CLOUD_PORTAL_URL: ${CLOUD_PORTAL_URL:-missing}"
+fi
 echo "TELEMETRY: $TEL"
 echo "TEL_PROMPTED: $TEL_PROMPTED"
 ```
@@ -99,14 +110,45 @@ If `skills/shared/platform-constraints.md` exists, read it once near the start o
 
 ## Steps
 
-### Step 1: Determine the portal slug
+### Step 1: Resolve the local organization
+
+Resolve the organization from the configured `ORG_SLUG` before doing anything else:
+
+```bash
+cd "$APP_PATH" && NODE_PATH="$APP_PATH/node_modules" npx tsx --tsconfig "$APP_PATH/tsconfig.json" "$SKILL_DIR/bin/get-org.ts" --slug "$ORG_SLUG"
+```
+
+The helper returns:
+
+```json
+{"ok":true,"org":{"id":"...","slug":"...","name":"..."}}
+```
+
+Store:
+
+- `ORG_ID`
+- `ORG_NAME`
+
+If the helper fails, stop and tell the user to run `/portal-setup` again instead
+of guessing with ad-hoc SQL.
+
+Do not probe `showpane --help`, `package.json`, `scripts/`, `prisma/`, or template
+directories just to understand the project. The canonical references for this skill are:
+
+- the configured `APP_PATH`
+- the configured `ORG_SLUG`
+- this skill file
+- `$SKILL_DIR/templates/<chosen-template>/...`
+- `$APP_PATH/src/app/(portal)/client/example/example-client.tsx`
+
+### Step 2: Determine the portal slug
 
 If the user provided a slug (e.g., `/portal-create acme-health`), use it. Otherwise, infer from context — the company name mentioned in conversation, a meeting transcript, or ask the user directly.
 
 Validate the slug by running:
 
 ```bash
-cd "$APP_PATH" && NODE_PATH="$APP_PATH/node_modules" npx tsx --tsconfig "$APP_PATH/tsconfig.json" "$SKILL_DIR/bin/check-slug.ts" --slug <slug> --org-id <org_id>
+cd "$APP_PATH" && NODE_PATH="$APP_PATH/node_modules" npx tsx --tsconfig "$APP_PATH/tsconfig.json" "$SKILL_DIR/bin/check-slug.ts" --slug <slug> --org-id "$ORG_ID"
 ```
 
 The script returns `{"valid":true}` or `{"valid":false,"reason":"...","message":"..."}`. If invalid:
@@ -120,7 +162,7 @@ Also ask for the client's website domain (e.g., "acme-health.com"). This is opti
 - If provided, the client logo will be fetched via `getLogoUrl(domain)` and stored in `ClientPortal.logoUrl`
 - If not provided, an initial-based logo is generated via `getInitialLogo(companyName)` and stored as a data URI
 
-### Step 2: Granola MCP integration (optional)
+### Step 3: Granola MCP integration (optional)
 
 Try to use the Granola MCP `list_meetings` tool to fetch recent meetings. This is a convenience, not a requirement.
 
@@ -139,7 +181,7 @@ Try to use the Granola MCP `list_meetings` tool to fetch recent meetings. This i
 
 Never fail or block because Granola is unavailable. It is purely additive.
 
-### Step 3: Template selection
+### Step 4: Template selection
 
 Ask which template to use as a starting point. Keep this brief and practical —
 the user chose `/portal-create` because they want the fast path, not a wizard.
@@ -163,7 +205,7 @@ cat "$APP_PATH/src/app/(portal)/client/example/example-client.tsx"
 
 The template provides content structure. The example provides quality and styling. Match the example's patterns: card styles, typography, spacing, responsive breakpoints. Templates are inspiration, not rigid scaffolds. Adapt the structure to fit the actual content.
 
-### Step 4: Analyze transcript (if available)
+### Step 5: Analyze transcript (if available)
 
 If a transcript was provided (from Granola or pasted), analyze it to extract:
 
@@ -189,7 +231,7 @@ Extract from the transcript:
 - **Mentioned documents** (for documents tab)
 - **Services or products discussed** (for services/overview content)
 
-### Step 5: Generate the portal files
+### Step 6: Generate the portal files
 
 Create two files in `$APP_PATH/src/app/(portal)/client/<slug>/`:
 
@@ -275,17 +317,22 @@ Import only the icons you need from `lucide-react`. Common choices:
 </details>
 ```
 
-### Step 6: Create database record
+### Step 7: Create database record
 
 Run the create-portal script to register the portal in the database:
 
 ```bash
-cd "$APP_PATH" && NODE_PATH="$APP_PATH/node_modules" npx tsx --tsconfig "$APP_PATH/tsconfig.json" "$SKILL_DIR/bin/create-portal.ts" --slug <slug> --company "<client_company_name>" --org-id <org_id>
+cd "$APP_PATH" && NODE_PATH="$APP_PATH/node_modules" npx tsx --tsconfig "$APP_PATH/tsconfig.json" "$SKILL_DIR/bin/create-portal.ts" --slug <slug> --company "<client_company_name>" --org-id "$ORG_ID"
 ```
 
-This creates the `ClientPortal` record with the slug, company name, and links it to the Organization. It does NOT create credentials — that is a separate step via `/portal-credentials`.
+This creates the `ClientPortal` record with the slug and company name, links it to
+the Organization, and currently auto-generates initial credentials. The script
+returns `username` and `password`.
+
+Do not dump those credentials into the middle of the flow unless the user asked.
+For onboarding, carry them forward quietly and show them at the access phase.
 
-### Step 7: Self-review
+### Step 8: Self-review
 
 After generating the files, read them back and verify:
 
@@ -300,7 +347,7 @@ After generating the files, read them back and verify:
 
 If any check fails, fix the issue before proceeding.
 
-### Step 8: Open preview
+### Step 9: Open preview
 
 Check if the dev server is running:
 
@@ -318,7 +365,7 @@ If not running, suggest:
 
 > "Start the dev server with `/portal-dev` to preview your portal at http://localhost:3000/client/<slug>"
 
-### Step 9: Summary and next steps
+### Step 10: Summary and next steps
 
 Print a summary:
 
@@ -331,13 +378,13 @@ Portal created: <slug>
              src/app/(portal)/client/<slug>/<slug>-client.tsx
 
 Next steps:
-  1. Create login credentials: /portal-credentials <slug>
-  2. Preview the portal:       /portal-preview <slug>
-  3. Edit content:             /portal-update <slug>
+  1. Preview the portal:       /portal-preview <slug>
+  2. Edit content:             /portal-update <slug>
+  3. Rotate credentials:       /portal-credentials <slug>
   4. Deploy:                   /portal-deploy
 ```
 
-### Step 10: Record learning
+### Step 11: Record learning
 
 Append a learning about the portal creation for future reference:
 

package/bundle/toolchain/skills/portal-create/SKILL.md.tmpl

@@ -15,14 +15,45 @@ capabilities, read `skills/shared/platform-constraints.md` and apply the relevan
 
 ## Steps
 
-### Step 1: Determine the portal slug
+### Step 1: Resolve the local organization
+
+Resolve the organization from the configured `ORG_SLUG` before doing anything else:
+
+```bash
+cd "$APP_PATH" && NODE_PATH="$APP_PATH/node_modules" npx tsx --tsconfig "$APP_PATH/tsconfig.json" "$SKILL_DIR/bin/get-org.ts" --slug "$ORG_SLUG"
+```
+
+The helper returns:
+
+```json
+{"ok":true,"org":{"id":"...","slug":"...","name":"..."}}
+```
+
+Store:
+
+- `ORG_ID`
+- `ORG_NAME`
+
+If the helper fails, stop and tell the user to run `/portal-setup` again instead
+of guessing with ad-hoc SQL.
+
+Do not probe `showpane --help`, `package.json`, `scripts/`, `prisma/`, or template
+directories just to understand the project. The canonical references for this skill are:
+
+- the configured `APP_PATH`
+- the configured `ORG_SLUG`
+- this skill file
+- `$SKILL_DIR/templates/<chosen-template>/...`
+- `$APP_PATH/src/app/(portal)/client/example/example-client.tsx`
+
+### Step 2: Determine the portal slug
 
 If the user provided a slug (e.g., `/portal-create acme-health`), use it. Otherwise, infer from context — the company name mentioned in conversation, a meeting transcript, or ask the user directly.
 
 Validate the slug by running:
 
 ```bash
-cd "$APP_PATH" && NODE_PATH="$APP_PATH/node_modules" npx tsx --tsconfig "$APP_PATH/tsconfig.json" "$SKILL_DIR/bin/check-slug.ts" --slug <slug> --org-id <org_id>
+cd "$APP_PATH" && NODE_PATH="$APP_PATH/node_modules" npx tsx --tsconfig "$APP_PATH/tsconfig.json" "$SKILL_DIR/bin/check-slug.ts" --slug <slug> --org-id "$ORG_ID"
 ```
 
 The script returns `{"valid":true}` or `{"valid":false,"reason":"...","message":"..."}`. If invalid:
@@ -36,7 +67,7 @@ Also ask for the client's website domain (e.g., "acme-health.com"). This is opti
 - If provided, the client logo will be fetched via `getLogoUrl(domain)` and stored in `ClientPortal.logoUrl`
 - If not provided, an initial-based logo is generated via `getInitialLogo(companyName)` and stored as a data URI
 
-### Step 2: Granola MCP integration (optional)
+### Step 3: Granola MCP integration (optional)
 
 Try to use the Granola MCP `list_meetings` tool to fetch recent meetings. This is a convenience, not a requirement.
 
@@ -55,7 +86,7 @@ Try to use the Granola MCP `list_meetings` tool to fetch recent meetings. This i
 
 Never fail or block because Granola is unavailable. It is purely additive.
 
-### Step 3: Template selection
+### Step 4: Template selection
 
 Ask which template to use as a starting point. Keep this brief and practical —
 the user chose `/portal-create` because they want the fast path, not a wizard.
@@ -79,7 +110,7 @@ cat "$APP_PATH/src/app/(portal)/client/example/example-client.tsx"
 
 The template provides content structure. The example provides quality and styling. Match the example's patterns: card styles, typography, spacing, responsive breakpoints. Templates are inspiration, not rigid scaffolds. Adapt the structure to fit the actual content.
 
-### Step 4: Analyze transcript (if available)
+### Step 5: Analyze transcript (if available)
 
 If a transcript was provided (from Granola or pasted), analyze it to extract:
 
@@ -105,7 +136,7 @@ Extract from the transcript:
 - **Mentioned documents** (for documents tab)
 - **Services or products discussed** (for services/overview content)
 
-### Step 5: Generate the portal files
+### Step 6: Generate the portal files
 
 Create two files in `$APP_PATH/src/app/(portal)/client/<slug>/`:
 
@@ -191,17 +222,22 @@ Import only the icons you need from `lucide-react`. Common choices:
 </details>
 ```
 
-### Step 6: Create database record
+### Step 7: Create database record
 
 Run the create-portal script to register the portal in the database:
 
 ```bash
-cd "$APP_PATH" && NODE_PATH="$APP_PATH/node_modules" npx tsx --tsconfig "$APP_PATH/tsconfig.json" "$SKILL_DIR/bin/create-portal.ts" --slug <slug> --company "<client_company_name>" --org-id <org_id>
+cd "$APP_PATH" && NODE_PATH="$APP_PATH/node_modules" npx tsx --tsconfig "$APP_PATH/tsconfig.json" "$SKILL_DIR/bin/create-portal.ts" --slug <slug> --company "<client_company_name>" --org-id "$ORG_ID"
 ```
 
-This creates the `ClientPortal` record with the slug, company name, and links it to the Organization. It does NOT create credentials — that is a separate step via `/portal-credentials`.
+This creates the `ClientPortal` record with the slug and company name, links it to
+the Organization, and currently auto-generates initial credentials. The script
+returns `username` and `password`.
+
+Do not dump those credentials into the middle of the flow unless the user asked.
+For onboarding, carry them forward quietly and show them at the access phase.
 
-### Step 7: Self-review
+### Step 8: Self-review
 
 After generating the files, read them back and verify:
 
@@ -216,7 +252,7 @@ After generating the files, read them back and verify:
 
 If any check fails, fix the issue before proceeding.
 
-### Step 8: Open preview
+### Step 9: Open preview
 
 Check if the dev server is running:
 
@@ -234,7 +270,7 @@ If not running, suggest:
 
 > "Start the dev server with `/portal-dev` to preview your portal at http://localhost:3000/client/<slug>"
 
-### Step 9: Summary and next steps
+### Step 10: Summary and next steps
 
 Print a summary:
 
@@ -247,13 +283,13 @@ Portal created: <slug>
              src/app/(portal)/client/<slug>/<slug>-client.tsx
 
 Next steps:
-  1. Create login credentials: /portal-credentials <slug>
-  2. Preview the portal:       /portal-preview <slug>
-  3. Edit content:             /portal-update <slug>
+  1. Preview the portal:       /portal-preview <slug>
+  2. Edit content:             /portal-update <slug>
+  3. Rotate credentials:       /portal-credentials <slug>
   4. Deploy:                   /portal-deploy
 ```
 
-### Step 10: Record learning
+### Step 11: Record learning
 
 Append a learning about the portal creation for future reference:
 

package/bundle/toolchain/skills/portal-credentials/SKILL.md

@@ -32,6 +32,10 @@ fi
 APP_PATH=$("$SHOWPANE_BIN/showpane-config" get app_path 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('app_path',''))" 2>/dev/null)
 DEPLOY_MODE=$("$SHOWPANE_BIN/showpane-config" get deploy_mode 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('deploy_mode','local'))" 2>/dev/null || echo "local")
 ORG_SLUG=$("$SHOWPANE_BIN/showpane-config" get orgSlug 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('orgSlug','') or d.get('org_slug',''))" 2>/dev/null || true)
+CLOUD_API_TOKEN=$("$SHOWPANE_BIN/showpane-config" get accessToken 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('accessToken',''))" 2>/dev/null || true)
+CLOUD_API_BASE="${SHOWPANE_CLOUD_URL:-https://app.showpane.com}"
+CLOUD_ORG_SLUG="${ORG_SLUG:-}"
+CLOUD_PORTAL_URL=$("$SHOWPANE_BIN/showpane-config" get portalUrl 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('portalUrl',''))" 2>/dev/null || true)
 APP_PATH="${SHOWPANE_APP_PATH:-$APP_PATH}"
 if [ -f "$APP_PATH/.env" ]; then set -a && source "$APP_PATH/.env" && set +a; fi
 DATABASE_URL="${DATABASE_URL:-}"
@@ -72,6 +76,13 @@ SHOWPANE_TIMELINE="$SHOWPANE_HOME/timeline.jsonl"
 mkdir -p "$(dirname "$SHOWPANE_TIMELINE")"
 echo '{"skill":"portal-credentials","event":"started","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}' >> "$SHOWPANE_TIMELINE" 2>/dev/null
 echo "SHOWPANE: v$SKILL_VERSION | MODE: $DEPLOY_MODE | APP: $APP_PATH"
+if [ "portal-credentials" = "portal-deploy" ]; then
+  echo "ORG_SLUG: $ORG_SLUG"
+  echo "CLOUD_API_TOKEN: ${CLOUD_API_TOKEN:+present}${CLOUD_API_TOKEN:-missing}"
+  echo "CLOUD_API_BASE: ${CLOUD_API_BASE:-missing}"
+  echo "CLOUD_ORG_SLUG: ${CLOUD_ORG_SLUG:-missing}"
+  echo "CLOUD_PORTAL_URL: ${CLOUD_PORTAL_URL:-missing}"
+fi
 echo "TELEMETRY: $TEL"
 echo "TEL_PROMPTED: $TEL_PROMPTED"
 ```

package/bundle/toolchain/skills/portal-delete/SKILL.md

@@ -32,6 +32,10 @@ fi
 APP_PATH=$("$SHOWPANE_BIN/showpane-config" get app_path 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('app_path',''))" 2>/dev/null)
 DEPLOY_MODE=$("$SHOWPANE_BIN/showpane-config" get deploy_mode 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('deploy_mode','local'))" 2>/dev/null || echo "local")
 ORG_SLUG=$("$SHOWPANE_BIN/showpane-config" get orgSlug 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('orgSlug','') or d.get('org_slug',''))" 2>/dev/null || true)
+CLOUD_API_TOKEN=$("$SHOWPANE_BIN/showpane-config" get accessToken 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('accessToken',''))" 2>/dev/null || true)
+CLOUD_API_BASE="${SHOWPANE_CLOUD_URL:-https://app.showpane.com}"
+CLOUD_ORG_SLUG="${ORG_SLUG:-}"
+CLOUD_PORTAL_URL=$("$SHOWPANE_BIN/showpane-config" get portalUrl 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('portalUrl',''))" 2>/dev/null || true)
 APP_PATH="${SHOWPANE_APP_PATH:-$APP_PATH}"
 if [ -f "$APP_PATH/.env" ]; then set -a && source "$APP_PATH/.env" && set +a; fi
 DATABASE_URL="${DATABASE_URL:-}"
@@ -72,6 +76,13 @@ SHOWPANE_TIMELINE="$SHOWPANE_HOME/timeline.jsonl"
 mkdir -p "$(dirname "$SHOWPANE_TIMELINE")"
 echo '{"skill":"portal-delete","event":"started","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}' >> "$SHOWPANE_TIMELINE" 2>/dev/null
 echo "SHOWPANE: v$SKILL_VERSION | MODE: $DEPLOY_MODE | APP: $APP_PATH"
+if [ "portal-delete" = "portal-deploy" ]; then
+  echo "ORG_SLUG: $ORG_SLUG"
+  echo "CLOUD_API_TOKEN: ${CLOUD_API_TOKEN:+present}${CLOUD_API_TOKEN:-missing}"
+  echo "CLOUD_API_BASE: ${CLOUD_API_BASE:-missing}"
+  echo "CLOUD_ORG_SLUG: ${CLOUD_ORG_SLUG:-missing}"
+  echo "CLOUD_PORTAL_URL: ${CLOUD_PORTAL_URL:-missing}"
+fi
 echo "TELEMETRY: $TEL"
 echo "TEL_PROMPTED: $TEL_PROMPTED"
 ```

package/bundle/toolchain/skills/portal-deploy/SKILL.md

@@ -25,6 +25,10 @@ fi
 APP_PATH=$("$SHOWPANE_BIN/showpane-config" get app_path 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('app_path',''))" 2>/dev/null)
 DEPLOY_MODE=$("$SHOWPANE_BIN/showpane-config" get deploy_mode 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('deploy_mode','local'))" 2>/dev/null || echo "local")
 ORG_SLUG=$("$SHOWPANE_BIN/showpane-config" get orgSlug 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('orgSlug','') or d.get('org_slug',''))" 2>/dev/null || true)
+CLOUD_API_TOKEN=$("$SHOWPANE_BIN/showpane-config" get accessToken 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('accessToken',''))" 2>/dev/null || true)
+CLOUD_API_BASE="${SHOWPANE_CLOUD_URL:-https://app.showpane.com}"
+CLOUD_ORG_SLUG="${ORG_SLUG:-}"
+CLOUD_PORTAL_URL=$("$SHOWPANE_BIN/showpane-config" get portalUrl 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('portalUrl',''))" 2>/dev/null || true)
 APP_PATH="${SHOWPANE_APP_PATH:-$APP_PATH}"
 if [ -f "$APP_PATH/.env" ]; then set -a && source "$APP_PATH/.env" && set +a; fi
 DATABASE_URL="${DATABASE_URL:-}"
@@ -65,6 +69,13 @@ SHOWPANE_TIMELINE="$SHOWPANE_HOME/timeline.jsonl"
 mkdir -p "$(dirname "$SHOWPANE_TIMELINE")"
 echo '{"skill":"portal-deploy","event":"started","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}' >> "$SHOWPANE_TIMELINE" 2>/dev/null
 echo "SHOWPANE: v$SKILL_VERSION | MODE: $DEPLOY_MODE | APP: $APP_PATH"
+if [ "portal-deploy" = "portal-deploy" ]; then
+  echo "ORG_SLUG: $ORG_SLUG"
+  echo "CLOUD_API_TOKEN: ${CLOUD_API_TOKEN:+present}${CLOUD_API_TOKEN:-missing}"
+  echo "CLOUD_API_BASE: ${CLOUD_API_BASE:-missing}"
+  echo "CLOUD_ORG_SLUG: ${CLOUD_ORG_SLUG:-missing}"
+  echo "CLOUD_PORTAL_URL: ${CLOUD_PORTAL_URL:-missing}"
+fi
 echo "TELEMETRY: $TEL"
 echo "TEL_PROMPTED: $TEL_PROMPTED"
 ```
@@ -112,12 +123,26 @@ Check that the preamble successfully read cloud config values:
 
 ```bash
 if [ -z "$CLOUD_API_TOKEN" ]; then
-  echo "ERROR: No API token found. Run 'showpane login' to authenticate."
+  echo "ERROR: No cloud access token found. Run 'showpane login' to authenticate."
   exit 1
 fi
 ```
 
-If the token is missing, stop and tell the user to run `showpane login`.
+If the token is missing, stop and tell the user:
+
+- `showpane login` is the right next step
+- it opens browser auth for Showpane Cloud automatically
+- if they need an account first:
+  - sign up: `https://app.showpane.com/sign-up`
+  - sign in: `https://app.showpane.com/sign-in`
+
+If they are already inside Claude Code, explicitly suggest:
+
+```text
+! showpane login
+```
+
+Then resume deploy after login finishes.
 
 #### 1b. Verify Showpane Cloud is reachable
 

package/bundle/toolchain/skills/portal-deploy/SKILL.md.tmpl

@@ -28,12 +28,26 @@ Check that the preamble successfully read cloud config values:
 
 ```bash
 if [ -z "$CLOUD_API_TOKEN" ]; then
-  echo "ERROR: No API token found. Run 'showpane login' to authenticate."
+  echo "ERROR: No cloud access token found. Run 'showpane login' to authenticate."
   exit 1
 fi
 ```
 
-If the token is missing, stop and tell the user to run `showpane login`.
+If the token is missing, stop and tell the user:
+
+- `showpane login` is the right next step
+- it opens browser auth for Showpane Cloud automatically
+- if they need an account first:
+  - sign up: `https://app.showpane.com/sign-up`
+  - sign in: `https://app.showpane.com/sign-in`
+
+If they are already inside Claude Code, explicitly suggest:
+
+```text
+! showpane login
+```
+
+Then resume deploy after login finishes.
 
 #### 1b. Verify Showpane Cloud is reachable
 

package/bundle/toolchain/skills/portal-dev/SKILL.md

@@ -22,6 +22,10 @@ fi
 APP_PATH=$("$SHOWPANE_BIN/showpane-config" get app_path 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('app_path',''))" 2>/dev/null)
 DEPLOY_MODE=$("$SHOWPANE_BIN/showpane-config" get deploy_mode 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('deploy_mode','local'))" 2>/dev/null || echo "local")
 ORG_SLUG=$("$SHOWPANE_BIN/showpane-config" get orgSlug 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('orgSlug','') or d.get('org_slug',''))" 2>/dev/null || true)
+CLOUD_API_TOKEN=$("$SHOWPANE_BIN/showpane-config" get accessToken 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('accessToken',''))" 2>/dev/null || true)
+CLOUD_API_BASE="${SHOWPANE_CLOUD_URL:-https://app.showpane.com}"
+CLOUD_ORG_SLUG="${ORG_SLUG:-}"
+CLOUD_PORTAL_URL=$("$SHOWPANE_BIN/showpane-config" get portalUrl 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('portalUrl',''))" 2>/dev/null || true)
 APP_PATH="${SHOWPANE_APP_PATH:-$APP_PATH}"
 if [ -f "$APP_PATH/.env" ]; then set -a && source "$APP_PATH/.env" && set +a; fi
 DATABASE_URL="${DATABASE_URL:-}"
@@ -62,6 +66,13 @@ SHOWPANE_TIMELINE="$SHOWPANE_HOME/timeline.jsonl"
 mkdir -p "$(dirname "$SHOWPANE_TIMELINE")"
 echo '{"skill":"portal-dev","event":"started","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}' >> "$SHOWPANE_TIMELINE" 2>/dev/null
 echo "SHOWPANE: v$SKILL_VERSION | MODE: $DEPLOY_MODE | APP: $APP_PATH"
+if [ "portal-dev" = "portal-deploy" ]; then
+  echo "ORG_SLUG: $ORG_SLUG"
+  echo "CLOUD_API_TOKEN: ${CLOUD_API_TOKEN:+present}${CLOUD_API_TOKEN:-missing}"
+  echo "CLOUD_API_BASE: ${CLOUD_API_BASE:-missing}"
+  echo "CLOUD_ORG_SLUG: ${CLOUD_ORG_SLUG:-missing}"
+  echo "CLOUD_PORTAL_URL: ${CLOUD_PORTAL_URL:-missing}"
+fi
 echo "TELEMETRY: $TEL"
 echo "TEL_PROMPTED: $TEL_PROMPTED"
 ```

package/bundle/toolchain/skills/portal-list/SKILL.md

@@ -22,6 +22,10 @@ fi
 APP_PATH=$("$SHOWPANE_BIN/showpane-config" get app_path 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('app_path',''))" 2>/dev/null)
 DEPLOY_MODE=$("$SHOWPANE_BIN/showpane-config" get deploy_mode 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('deploy_mode','local'))" 2>/dev/null || echo "local")
 ORG_SLUG=$("$SHOWPANE_BIN/showpane-config" get orgSlug 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('orgSlug','') or d.get('org_slug',''))" 2>/dev/null || true)
+CLOUD_API_TOKEN=$("$SHOWPANE_BIN/showpane-config" get accessToken 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('accessToken',''))" 2>/dev/null || true)
+CLOUD_API_BASE="${SHOWPANE_CLOUD_URL:-https://app.showpane.com}"
+CLOUD_ORG_SLUG="${ORG_SLUG:-}"
+CLOUD_PORTAL_URL=$("$SHOWPANE_BIN/showpane-config" get portalUrl 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('portalUrl',''))" 2>/dev/null || true)
 APP_PATH="${SHOWPANE_APP_PATH:-$APP_PATH}"
 if [ -f "$APP_PATH/.env" ]; then set -a && source "$APP_PATH/.env" && set +a; fi
 DATABASE_URL="${DATABASE_URL:-}"
@@ -62,6 +66,13 @@ SHOWPANE_TIMELINE="$SHOWPANE_HOME/timeline.jsonl"
 mkdir -p "$(dirname "$SHOWPANE_TIMELINE")"
 echo '{"skill":"portal-list","event":"started","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}' >> "$SHOWPANE_TIMELINE" 2>/dev/null
 echo "SHOWPANE: v$SKILL_VERSION | MODE: $DEPLOY_MODE | APP: $APP_PATH"
+if [ "portal-list" = "portal-deploy" ]; then
+  echo "ORG_SLUG: $ORG_SLUG"
+  echo "CLOUD_API_TOKEN: ${CLOUD_API_TOKEN:+present}${CLOUD_API_TOKEN:-missing}"
+  echo "CLOUD_API_BASE: ${CLOUD_API_BASE:-missing}"
+  echo "CLOUD_ORG_SLUG: ${CLOUD_ORG_SLUG:-missing}"
+  echo "CLOUD_PORTAL_URL: ${CLOUD_PORTAL_URL:-missing}"
+fi
 echo "TELEMETRY: $TEL"
 echo "TEL_PROMPTED: $TEL_PROMPTED"
 ```

package/bundle/toolchain/skills/portal-onboard/SKILL.md

@@ -67,17 +67,13 @@ SHOWPANE_TIMELINE="$SHOWPANE_HOME/timeline.jsonl"
 mkdir -p "$(dirname "$SHOWPANE_TIMELINE")"
 echo '{"skill":"portal-onboard","event":"started","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}' >> "$SHOWPANE_TIMELINE" 2>/dev/null
 echo "SHOWPANE: v$SKILL_VERSION | MODE: $DEPLOY_MODE"
-echo "CONFIG_PRESENT: $CONFIG_PRESENT"
-echo "APP_PATH: ${APP_PATH:-missing}"
-echo "ORG_SLUG: ${ORG_SLUG:-missing}"
-echo "TELEMETRY: $TEL"
-echo "TEL_PROMPTED: $TEL_PROMPTED"
+echo "WORKSPACE: ${APP_PATH:+ready}${APP_PATH:-missing}"
+echo "ORG: ${ORG_SLUG:-missing}"
 if [ -f "$CHECKPOINT" ]; then
-  echo "CHECKPOINT_PRESENT: true"
-  echo "CHECKPOINT_DATA:"
+  echo "CHECKPOINT: present"
   cat "$CHECKPOINT"
 else
-  echo "CHECKPOINT_PRESENT: false"
+  echo "CHECKPOINT: missing"
 fi
 ```
 
@@ -256,12 +252,33 @@ Save checkpoint with:
 Run the `portal-create` flow inline, but frame it as part of the wizard, not as
 a separate command.
 
+Before you do, resolve the local organization with the canonical helper and keep
+that result in hand:
+
+```bash
+cd "$APP_PATH" && NODE_PATH="$APP_PATH/node_modules" npx tsx --tsconfig "$APP_PATH/tsconfig.json" "$SKILL_DIR/bin/get-org.ts" --slug "$ORG_SLUG"
+```
+
+Use the returned `org.id` as the canonical org id for the rest of the create flow.
+Do not guess schema fields or discover the org via ad-hoc SQLite queries if this helper succeeds.
+
+Also: do not probe `showpane --help`, `package.json`, `scripts/`, `prisma/`, or
+template directories just to reorient yourself. At this point the canonical inputs
+are already known:
+
+- workspace app path
+- org slug
+- selected client company name
+- selected template
+- optional transcript source
+
 During this phase:
 
 - suggest a slug if needed
 - prefer a real company/client name in the portal
 - prefer useful structure over completeness
 - aim for a credible first draft, not a perfect final artifact
+- do not re-ask for the company name or template if the user already chose them
 
 If the slug is taken, treat that as a soft retry, not a failure.
 
@@ -293,6 +310,16 @@ Run the `portal-preview` flow inline.
 
 If no dev server is running, start it using the `portal-dev` instructions first.
 
+If the create step already generated local credentials, show them before opening
+the preview link. Keep it simple:
+
+- username
+- password
+- one sentence saying these are for local preview right now
+
+Do this before opening the browser so the user is not dropped onto a login screen
+without the credentials they need.
+
 Tell the user exactly what to inspect:
 
 - does the overall story feel right?
@@ -316,10 +343,14 @@ Recommended first-run choice:
 Important rule: share links still require portal credentials to exist, because
 share links are tied to credential versioning.
 
+The `create-portal` flow currently creates initial credentials automatically. If
+you already have a generated username/password from that step, do not immediately
+re-run `portal-credentials` unless the user wants to rotate or replace them.
+
 So the flow is:
 
-1. run `portal-credentials` inline
-2. show the credentials once
+1. if credentials were already generated during create, show them once here
+2. if credentials do not exist or need changing, run `portal-credentials` inline
 3. explain that external sharing starts with `portal-deploy`
 4. if the user wants a direct hosted access link after publish, plan to run `portal-share`
 

package/bundle/toolchain/skills/portal-onboard/SKILL.md.tmpl

@@ -159,12 +159,33 @@ Save checkpoint with:
 Run the `portal-create` flow inline, but frame it as part of the wizard, not as
 a separate command.
 
+Before you do, resolve the local organization with the canonical helper and keep
+that result in hand:
+
+```bash
+cd "$APP_PATH" && NODE_PATH="$APP_PATH/node_modules" npx tsx --tsconfig "$APP_PATH/tsconfig.json" "$SKILL_DIR/bin/get-org.ts" --slug "$ORG_SLUG"
+```
+
+Use the returned `org.id` as the canonical org id for the rest of the create flow.
+Do not guess schema fields or discover the org via ad-hoc SQLite queries if this helper succeeds.
+
+Also: do not probe `showpane --help`, `package.json`, `scripts/`, `prisma/`, or
+template directories just to reorient yourself. At this point the canonical inputs
+are already known:
+
+- workspace app path
+- org slug
+- selected client company name
+- selected template
+- optional transcript source
+
 During this phase:
 
 - suggest a slug if needed
 - prefer a real company/client name in the portal
 - prefer useful structure over completeness
 - aim for a credible first draft, not a perfect final artifact
+- do not re-ask for the company name or template if the user already chose them
 
 If the slug is taken, treat that as a soft retry, not a failure.
 
@@ -196,6 +217,16 @@ Run the `portal-preview` flow inline.
 
 If no dev server is running, start it using the `portal-dev` instructions first.
 
+If the create step already generated local credentials, show them before opening
+the preview link. Keep it simple:
+
+- username
+- password
+- one sentence saying these are for local preview right now
+
+Do this before opening the browser so the user is not dropped onto a login screen
+without the credentials they need.
+
 Tell the user exactly what to inspect:
 
 - does the overall story feel right?
@@ -219,10 +250,14 @@ Recommended first-run choice:
 Important rule: share links still require portal credentials to exist, because
 share links are tied to credential versioning.
 
+The `create-portal` flow currently creates initial credentials automatically. If
+you already have a generated username/password from that step, do not immediately
+re-run `portal-credentials` unless the user wants to rotate or replace them.
+
 So the flow is:
 
-1. run `portal-credentials` inline
-2. show the credentials once
+1. if credentials were already generated during create, show them once here
+2. if credentials do not exist or need changing, run `portal-credentials` inline
 3. explain that external sharing starts with `portal-deploy`
 4. if the user wants a direct hosted access link after publish, plan to run `portal-share`
 

package/bundle/toolchain/skills/portal-preview/SKILL.md

@@ -22,6 +22,10 @@ fi
 APP_PATH=$("$SHOWPANE_BIN/showpane-config" get app_path 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('app_path',''))" 2>/dev/null)
 DEPLOY_MODE=$("$SHOWPANE_BIN/showpane-config" get deploy_mode 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('deploy_mode','local'))" 2>/dev/null || echo "local")
 ORG_SLUG=$("$SHOWPANE_BIN/showpane-config" get orgSlug 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('orgSlug','') or d.get('org_slug',''))" 2>/dev/null || true)
+CLOUD_API_TOKEN=$("$SHOWPANE_BIN/showpane-config" get accessToken 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('accessToken',''))" 2>/dev/null || true)
+CLOUD_API_BASE="${SHOWPANE_CLOUD_URL:-https://app.showpane.com}"
+CLOUD_ORG_SLUG="${ORG_SLUG:-}"
+CLOUD_PORTAL_URL=$("$SHOWPANE_BIN/showpane-config" get portalUrl 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('portalUrl',''))" 2>/dev/null || true)
 APP_PATH="${SHOWPANE_APP_PATH:-$APP_PATH}"
 if [ -f "$APP_PATH/.env" ]; then set -a && source "$APP_PATH/.env" && set +a; fi
 DATABASE_URL="${DATABASE_URL:-}"
@@ -62,6 +66,13 @@ SHOWPANE_TIMELINE="$SHOWPANE_HOME/timeline.jsonl"
 mkdir -p "$(dirname "$SHOWPANE_TIMELINE")"
 echo '{"skill":"portal-preview","event":"started","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}' >> "$SHOWPANE_TIMELINE" 2>/dev/null
 echo "SHOWPANE: v$SKILL_VERSION | MODE: $DEPLOY_MODE | APP: $APP_PATH"
+if [ "portal-preview" = "portal-deploy" ]; then
+  echo "ORG_SLUG: $ORG_SLUG"
+  echo "CLOUD_API_TOKEN: ${CLOUD_API_TOKEN:+present}${CLOUD_API_TOKEN:-missing}"
+  echo "CLOUD_API_BASE: ${CLOUD_API_BASE:-missing}"
+  echo "CLOUD_ORG_SLUG: ${CLOUD_ORG_SLUG:-missing}"
+  echo "CLOUD_PORTAL_URL: ${CLOUD_PORTAL_URL:-missing}"
+fi
 echo "TELEMETRY: $TEL"
 echo "TEL_PROMPTED: $TEL_PROMPTED"
 ```

package/bundle/toolchain/skills/portal-share/SKILL.md

@@ -25,6 +25,10 @@ fi
 APP_PATH=$("$SHOWPANE_BIN/showpane-config" get app_path 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('app_path',''))" 2>/dev/null)
 DEPLOY_MODE=$("$SHOWPANE_BIN/showpane-config" get deploy_mode 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('deploy_mode','local'))" 2>/dev/null || echo "local")
 ORG_SLUG=$("$SHOWPANE_BIN/showpane-config" get orgSlug 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('orgSlug','') or d.get('org_slug',''))" 2>/dev/null || true)
+CLOUD_API_TOKEN=$("$SHOWPANE_BIN/showpane-config" get accessToken 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('accessToken',''))" 2>/dev/null || true)
+CLOUD_API_BASE="${SHOWPANE_CLOUD_URL:-https://app.showpane.com}"
+CLOUD_ORG_SLUG="${ORG_SLUG:-}"
+CLOUD_PORTAL_URL=$("$SHOWPANE_BIN/showpane-config" get portalUrl 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('portalUrl',''))" 2>/dev/null || true)
 APP_PATH="${SHOWPANE_APP_PATH:-$APP_PATH}"
 if [ -f "$APP_PATH/.env" ]; then set -a && source "$APP_PATH/.env" && set +a; fi
 DATABASE_URL="${DATABASE_URL:-}"
@@ -65,6 +69,13 @@ SHOWPANE_TIMELINE="$SHOWPANE_HOME/timeline.jsonl"
 mkdir -p "$(dirname "$SHOWPANE_TIMELINE")"
 echo '{"skill":"portal-share","event":"started","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}' >> "$SHOWPANE_TIMELINE" 2>/dev/null
 echo "SHOWPANE: v$SKILL_VERSION | MODE: $DEPLOY_MODE | APP: $APP_PATH"
+if [ "portal-share" = "portal-deploy" ]; then
+  echo "ORG_SLUG: $ORG_SLUG"
+  echo "CLOUD_API_TOKEN: ${CLOUD_API_TOKEN:+present}${CLOUD_API_TOKEN:-missing}"
+  echo "CLOUD_API_BASE: ${CLOUD_API_BASE:-missing}"
+  echo "CLOUD_ORG_SLUG: ${CLOUD_ORG_SLUG:-missing}"
+  echo "CLOUD_PORTAL_URL: ${CLOUD_PORTAL_URL:-missing}"
+fi
 echo "TELEMETRY: $TEL"
 echo "TEL_PROMPTED: $TEL_PROMPTED"
 ```

package/bundle/toolchain/skills/portal-status/SKILL.md

@@ -22,6 +22,10 @@ fi
 APP_PATH=$("$SHOWPANE_BIN/showpane-config" get app_path 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('app_path',''))" 2>/dev/null)
 DEPLOY_MODE=$("$SHOWPANE_BIN/showpane-config" get deploy_mode 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('deploy_mode','local'))" 2>/dev/null || echo "local")
 ORG_SLUG=$("$SHOWPANE_BIN/showpane-config" get orgSlug 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('orgSlug','') or d.get('org_slug',''))" 2>/dev/null || true)
+CLOUD_API_TOKEN=$("$SHOWPANE_BIN/showpane-config" get accessToken 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('accessToken',''))" 2>/dev/null || true)
+CLOUD_API_BASE="${SHOWPANE_CLOUD_URL:-https://app.showpane.com}"
+CLOUD_ORG_SLUG="${ORG_SLUG:-}"
+CLOUD_PORTAL_URL=$("$SHOWPANE_BIN/showpane-config" get portalUrl 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('portalUrl',''))" 2>/dev/null || true)
 APP_PATH="${SHOWPANE_APP_PATH:-$APP_PATH}"
 if [ -f "$APP_PATH/.env" ]; then set -a && source "$APP_PATH/.env" && set +a; fi
 DATABASE_URL="${DATABASE_URL:-}"
@@ -62,6 +66,13 @@ SHOWPANE_TIMELINE="$SHOWPANE_HOME/timeline.jsonl"
 mkdir -p "$(dirname "$SHOWPANE_TIMELINE")"
 echo '{"skill":"portal-status","event":"started","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}' >> "$SHOWPANE_TIMELINE" 2>/dev/null
 echo "SHOWPANE: v$SKILL_VERSION | MODE: $DEPLOY_MODE | APP: $APP_PATH"
+if [ "portal-status" = "portal-deploy" ]; then
+  echo "ORG_SLUG: $ORG_SLUG"
+  echo "CLOUD_API_TOKEN: ${CLOUD_API_TOKEN:+present}${CLOUD_API_TOKEN:-missing}"
+  echo "CLOUD_API_BASE: ${CLOUD_API_BASE:-missing}"
+  echo "CLOUD_ORG_SLUG: ${CLOUD_ORG_SLUG:-missing}"
+  echo "CLOUD_PORTAL_URL: ${CLOUD_PORTAL_URL:-missing}"
+fi
 echo "TELEMETRY: $TEL"
 echo "TEL_PROMPTED: $TEL_PROMPTED"
 ```

package/bundle/toolchain/skills/portal-update/SKILL.md

@@ -22,6 +22,10 @@ fi
 APP_PATH=$("$SHOWPANE_BIN/showpane-config" get app_path 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('app_path',''))" 2>/dev/null)
 DEPLOY_MODE=$("$SHOWPANE_BIN/showpane-config" get deploy_mode 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('deploy_mode','local'))" 2>/dev/null || echo "local")
 ORG_SLUG=$("$SHOWPANE_BIN/showpane-config" get orgSlug 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('orgSlug','') or d.get('org_slug',''))" 2>/dev/null || true)
+CLOUD_API_TOKEN=$("$SHOWPANE_BIN/showpane-config" get accessToken 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('accessToken',''))" 2>/dev/null || true)
+CLOUD_API_BASE="${SHOWPANE_CLOUD_URL:-https://app.showpane.com}"
+CLOUD_ORG_SLUG="${ORG_SLUG:-}"
+CLOUD_PORTAL_URL=$("$SHOWPANE_BIN/showpane-config" get portalUrl 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('portalUrl',''))" 2>/dev/null || true)
 APP_PATH="${SHOWPANE_APP_PATH:-$APP_PATH}"
 if [ -f "$APP_PATH/.env" ]; then set -a && source "$APP_PATH/.env" && set +a; fi
 DATABASE_URL="${DATABASE_URL:-}"
@@ -62,6 +66,13 @@ SHOWPANE_TIMELINE="$SHOWPANE_HOME/timeline.jsonl"
 mkdir -p "$(dirname "$SHOWPANE_TIMELINE")"
 echo '{"skill":"portal-update","event":"started","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}' >> "$SHOWPANE_TIMELINE" 2>/dev/null
 echo "SHOWPANE: v$SKILL_VERSION | MODE: $DEPLOY_MODE | APP: $APP_PATH"
+if [ "portal-update" = "portal-deploy" ]; then
+  echo "ORG_SLUG: $ORG_SLUG"
+  echo "CLOUD_API_TOKEN: ${CLOUD_API_TOKEN:+present}${CLOUD_API_TOKEN:-missing}"
+  echo "CLOUD_API_BASE: ${CLOUD_API_BASE:-missing}"
+  echo "CLOUD_ORG_SLUG: ${CLOUD_ORG_SLUG:-missing}"
+  echo "CLOUD_PORTAL_URL: ${CLOUD_PORTAL_URL:-missing}"
+fi
 echo "TELEMETRY: $TEL"
 echo "TEL_PROMPTED: $TEL_PROMPTED"
 ```

package/bundle/toolchain/skills/portal-upgrade/SKILL.md

@@ -22,6 +22,10 @@ fi
 APP_PATH=$("$SHOWPANE_BIN/showpane-config" get app_path 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('app_path',''))" 2>/dev/null)
 DEPLOY_MODE=$("$SHOWPANE_BIN/showpane-config" get deploy_mode 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('deploy_mode','local'))" 2>/dev/null || echo "local")
 ORG_SLUG=$("$SHOWPANE_BIN/showpane-config" get orgSlug 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('orgSlug','') or d.get('org_slug',''))" 2>/dev/null || true)
+CLOUD_API_TOKEN=$("$SHOWPANE_BIN/showpane-config" get accessToken 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('accessToken',''))" 2>/dev/null || true)
+CLOUD_API_BASE="${SHOWPANE_CLOUD_URL:-https://app.showpane.com}"
+CLOUD_ORG_SLUG="${ORG_SLUG:-}"
+CLOUD_PORTAL_URL=$("$SHOWPANE_BIN/showpane-config" get portalUrl 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('portalUrl',''))" 2>/dev/null || true)
 APP_PATH="${SHOWPANE_APP_PATH:-$APP_PATH}"
 if [ -f "$APP_PATH/.env" ]; then set -a && source "$APP_PATH/.env" && set +a; fi
 DATABASE_URL="${DATABASE_URL:-}"
@@ -62,6 +66,13 @@ SHOWPANE_TIMELINE="$SHOWPANE_HOME/timeline.jsonl"
 mkdir -p "$(dirname "$SHOWPANE_TIMELINE")"
 echo '{"skill":"portal-upgrade","event":"started","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}' >> "$SHOWPANE_TIMELINE" 2>/dev/null
 echo "SHOWPANE: v$SKILL_VERSION | MODE: $DEPLOY_MODE | APP: $APP_PATH"
+if [ "portal-upgrade" = "portal-deploy" ]; then
+  echo "ORG_SLUG: $ORG_SLUG"
+  echo "CLOUD_API_TOKEN: ${CLOUD_API_TOKEN:+present}${CLOUD_API_TOKEN:-missing}"
+  echo "CLOUD_API_BASE: ${CLOUD_API_BASE:-missing}"
+  echo "CLOUD_ORG_SLUG: ${CLOUD_ORG_SLUG:-missing}"
+  echo "CLOUD_PORTAL_URL: ${CLOUD_PORTAL_URL:-missing}"
+fi
 echo "TELEMETRY: $TEL"
 echo "TEL_PROMPTED: $TEL_PROMPTED"
 ```

package/bundle/toolchain/skills/portal-verify/SKILL.md

@@ -22,6 +22,10 @@ fi
 APP_PATH=$("$SHOWPANE_BIN/showpane-config" get app_path 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('app_path',''))" 2>/dev/null)
 DEPLOY_MODE=$("$SHOWPANE_BIN/showpane-config" get deploy_mode 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('deploy_mode','local'))" 2>/dev/null || echo "local")
 ORG_SLUG=$("$SHOWPANE_BIN/showpane-config" get orgSlug 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('orgSlug','') or d.get('org_slug',''))" 2>/dev/null || true)
+CLOUD_API_TOKEN=$("$SHOWPANE_BIN/showpane-config" get accessToken 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('accessToken',''))" 2>/dev/null || true)
+CLOUD_API_BASE="${SHOWPANE_CLOUD_URL:-https://app.showpane.com}"
+CLOUD_ORG_SLUG="${ORG_SLUG:-}"
+CLOUD_PORTAL_URL=$("$SHOWPANE_BIN/showpane-config" get portalUrl 2>/dev/null || python3 -c "import json; d=json.load(open('$CONFIG')); print(d.get('portalUrl',''))" 2>/dev/null || true)
 APP_PATH="${SHOWPANE_APP_PATH:-$APP_PATH}"
 if [ -f "$APP_PATH/.env" ]; then set -a && source "$APP_PATH/.env" && set +a; fi
 DATABASE_URL="${DATABASE_URL:-}"
@@ -62,6 +66,13 @@ SHOWPANE_TIMELINE="$SHOWPANE_HOME/timeline.jsonl"
 mkdir -p "$(dirname "$SHOWPANE_TIMELINE")"
 echo '{"skill":"portal-verify","event":"started","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}' >> "$SHOWPANE_TIMELINE" 2>/dev/null
 echo "SHOWPANE: v$SKILL_VERSION | MODE: $DEPLOY_MODE | APP: $APP_PATH"
+if [ "portal-verify" = "portal-deploy" ]; then
+  echo "ORG_SLUG: $ORG_SLUG"
+  echo "CLOUD_API_TOKEN: ${CLOUD_API_TOKEN:+present}${CLOUD_API_TOKEN:-missing}"
+  echo "CLOUD_API_BASE: ${CLOUD_API_BASE:-missing}"
+  echo "CLOUD_ORG_SLUG: ${CLOUD_ORG_SLUG:-missing}"
+  echo "CLOUD_PORTAL_URL: ${CLOUD_PORTAL_URL:-missing}"
+fi
 echo "TELEMETRY: $TEL"
 echo "TEL_PROMPTED: $TEL_PROMPTED"
 ```

package/dist/index.js

@@ -32,7 +32,7 @@ var GREEN = "\x1B[32m";
 var BLUE = "\x1B[34m";
 var WHITE = "\x1B[37m";
 var RED = "\x1B[31m";
-var API_BASE = "https://app.showpane.com";
+var API_BASE = process.env.SHOWPANE_CLOUD_URL || "https://app.showpane.com";
 var ORGANIZATION_REQUIRED_ERROR = "organization_required";
 var ORGANIZATION_NOT_READY_ERROR = "organization_not_ready";
 var SHOWPANE_HOME = join(homedir(), ".showpane");
@@ -62,10 +62,10 @@ function error(message) {
   console.error(`  ${RED}\u2717${RESET} ${message}`);
 }
 function printCreateUsage() {
-  console.log("Usage: showpane [--yes --name <company>] [--no-open] [--verbose]");
+  console.log("Usage: showpane [--yes --name <company> --full-name <name> --work-email <email> [--website <domain>]] [--no-open] [--verbose]");
 }
 function printClaudeUsage() {
-  console.log("Usage: showpane claude [--project <name-or-path>] [--yes --name <company>] [--verbose]");
+  console.log("Usage: showpane claude [--project <name-or-path>] [--yes --name <company> --full-name <name> --work-email <email> [--website <domain>]] [--verbose]");
 }
 function printBanner() {
   const banner = `
@@ -120,10 +120,37 @@ function parseCreateArgs(args) {
       index += 1;
       continue;
     }
+    if (arg === "--full-name") {
+      const value = args[index + 1];
+      if (!value || value.startsWith("--")) {
+        throw new Error("Missing value for --full-name.");
+      }
+      options.contactName = value.trim();
+      index += 1;
+      continue;
+    }
+    if (arg === "--work-email") {
+      const value = args[index + 1];
+      if (!value || value.startsWith("--")) {
+        throw new Error("Missing value for --work-email.");
+      }
+      options.contactEmail = value.trim();
+      index += 1;
+      continue;
+    }
+    if (arg === "--website") {
+      const value = args[index + 1];
+      if (!value || value.startsWith("--")) {
+        throw new Error("Missing value for --website.");
+      }
+      options.websiteUrl = value.trim();
+      index += 1;
+      continue;
+    }
     throw new Error(`Unknown argument: ${arg}`);
   }
-  if (options.yes && !options.companyName) {
-    throw new Error("`--yes` requires `--name <company>` for a non-interactive install.");
+  if (options.yes && (!options.companyName || !options.contactName || !options.contactEmail)) {
+    throw new Error("`--yes` requires `--name <company> --full-name <name> --work-email <email>` for a non-interactive install.");
   }
   return options;
 }
@@ -314,7 +341,7 @@ async function maybeConfigureShellPath(config, options) {
     };
   }
   const answer = await ask(
-    `  ${BOLD}Add Showpane to your PATH so 'showpane' works in future terminals?${RESET} ${DIM}(recommended) [Y/n]${RESET} `
+    `  ${DIM}(recommended)${RESET} ${BOLD}Want me to add Showpane to your PATH so \`showpane\` works in new terminals?${RESET} ${DIM}[Y/n]${RESET} `
   );
   if (answer && !["y", "yes"].includes(answer.toLowerCase())) {
     config.shellPathPrompted = true;
@@ -1257,9 +1284,9 @@ async function createProject(args) {
     blue("Let's get some basic info to set up your account.");
     console.log();
   }
-  const contactName = options.yes || !process.stdin.isTTY || !process.stdout.isTTY ? "" : await ask(`  ${BOLD}What's your full name?${RESET} `);
-  const contactEmail = options.yes || !process.stdin.isTTY || !process.stdout.isTTY ? "" : await ask(`  ${BOLD}What's your email?${RESET} `);
-  const websiteUrl = options.yes || !process.stdin.isTTY || !process.stdout.isTTY ? "" : await ask(`  ${BOLD}What's your company website or domain?${RESET} `);
+  const contactName = options.contactName ?? (options.yes || !process.stdin.isTTY || !process.stdout.isTTY ? "" : await ask(`  ${BOLD}What's your full name?${RESET} `));
+  const contactEmail = options.contactEmail ?? (options.yes || !process.stdin.isTTY || !process.stdout.isTTY ? "" : await ask(`  ${BOLD}What's your work email?${RESET} `));
+  const websiteUrl = options.websiteUrl ?? (options.yes || !process.stdin.isTTY || !process.stdout.isTTY ? "" : await ask(`  ${BOLD}What's your company website or domain?${RESET} `));
   const slug = toSlug(companyName);
   const dirName = `showpane-${slug}`;
   const projectRoot = resolve(process.cwd(), dirName);
@@ -1529,7 +1556,15 @@ async function login() {
   ensureShowpaneShim();
   blue("Authenticating with Showpane...");
   console.log();
-  const initRes = await fetch(`${API_BASE}/api/cli/init`, { method: "POST" });
+  let initRes;
+  try {
+    initRes = await fetch(`${API_BASE}/api/cli/init`, { method: "POST" });
+  } catch (errorLike) {
+    const message = errorLike instanceof Error ? errorLike.message : String(errorLike);
+    throw new Error(
+      `Could not reach Showpane Cloud at ${API_BASE}. Check your internet connection, VPN/proxy settings, or try again in a moment. (${message})`
+    );
+  }
   if (!initRes.ok) {
     throw new Error(`Failed to start auth flow (${initRes.status})`);
   }
@@ -1589,12 +1624,21 @@ if (process.argv.includes("--version")) {
   console.log(getPackageVersion(packageRoot));
   process.exit(0);
 }
+if (process.argv.length <= 2 && process.argv.includes("--help")) {
+  printCreateUsage();
+  console.log("Commands: claude, login, projects, sync, upgrade");
+  process.exit(0);
+}
 if (command === "login") {
   login().catch((err) => {
     error(String(err));
     process.exit(1);
   });
 } else if (command === "claude") {
+  if (process.argv.includes("--help")) {
+    printClaudeUsage();
+    process.exit(0);
+  }
   openClaude(process.argv.slice(3)).catch((err) => {
     error(String(err));
     process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "showpane",
-  "version": "0.4.16",
+  "version": "0.4.18",
   "description": "CLI for Showpane — AI-generated client portals",
   "type": "module",
   "bin": {