autotouch-cli 0.2.30__tar.gz → 0.2.32__tar.gz

{autotouch_cli-0.2.30/autotouch_cli.egg-info → autotouch_cli-0.2.32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: autotouch-cli
-Version: 0.2.30
+Version: 0.2.32
 Summary: Autotouch Smart Table CLI
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
@@ -71,6 +71,7 @@ Developer keys and scopes are identical to raw API usage (`stk_...`, same scope
 autotouch auth set-key --api-key stk_... --base-url https://app.autotouch.ai
 autotouch auth check
 autotouch auth show
+autotouch auth whoami
 ```
 
 For user/admin endpoints like onboarding, org context, and personal context, sign in with a user session too:
@@ -107,8 +108,9 @@ autotouch auth bootstrap --data-file bootstrap.json --save-key
 
 Notes:
 - New orgs created through signup/bootstrap start with `50` credits.
-- `--save-key` stores the returned `apiKey` in local CLI config automatically.
+- `--save-key` stores the returned `apiKey` and also signs in the same user so the saved config has both the developer key and the user session.
 - Identity linking is email-based: later human sign-in with the same normalized email maps to the same user/org.
+- `auth whoami` shows which user/org the saved session belongs to.
 
 ## Onboarding and context
 
@@ -513,8 +515,8 @@ autotouch columns create --table-id <TABLE_ID> --data-file <payload.json>
 ```
 
 Recommendation:
-- For provider-backed workflow columns, start with `autotouch columns recipe`:
-  `add_to_crm`, `sync_to_table`, `add_to_sequence`.
+- For provider-backed or generated columns, start with `autotouch columns recipe`.
+- Built-in recipe types now include `formatter`, `llm_enrichment`, `email_finder`, `phone_finder`, `lead_finder`, `add_to_crm`, `sync_to_table`, and `add_to_sequence`.
 - Email/phone enrichment does not require creating `add_to_crm` first.
 - `add_to_crm` is an optional, non-billable export action.
 
@@ -779,6 +781,7 @@ Notes:
 Add-to-Leads note: `companyDomain` is required; LinkedIn is optional. Each row still needs at least one usable hard identity signal (LinkedIn, email, or phone). Names and location fields are metadata only for this flow. Run is non-billable.
 If `companyDomain` is missing in the table, derive or enrich that domain column first, then rerun `add_to_crm`.
 Queued lifecycle: the CLI/API accepts the run immediately, then the backend hands off `ops -> data_io` for execution.
+Creating `add_to_crm` after upstream email/phone/lead columns already finished does not replay those older updates. In that case, run `add_to_crm` explicitly or rerun the upstream source column.
 
 CRM data model expectations (recommended before `add_to_crm`):
 - Lead identity/dedupe expects `company_domain` plus one usable hard identity signal. `linkedin_url` is a strong optional signal, not a requirement.
@@ -817,6 +820,14 @@ CRM data model expectations (recommended before `add_to_crm`):
 Notes:
 - Single-destination mode uses `destinationTableId` + `columnMappings`.
 - Router mode is also supported with `config.routes[]` (top-to-bottom matching, first hit wins, default route catches unmatched rows).
+- Route conditions are evaluated against the parent/source row, not against each list item.
+- `autoRun: "onSourceUpdate"` means dependency-driven runs from source row inserts/updates. Saving the column does not backfill existing rows for `sync_to_table`; use an explicit column run/backfill when needed.
+- List mode uses `syncMode: "list"` with `listSourceColumnId` and optional `listPath` (default `items`) to expand a canonical JSON payload like `{ "items": [...], "reasoning": "..." }`.
+- In list mode:
+  - `sourceScope: "item"` maps fields from each `items[]` object.
+  - `sourceScope: "row"` maps fields from the parent/source row.
+  - Explicit item mappings are still recommended for renamed fields such as `name -> full_name`.
+- Blank placeholder list items are skipped and do not create destination rows.
 
 ### 8) `add_to_sequence`
 
@@ -842,10 +853,33 @@ Notes:
 - `sourceLeadColumn` must be the source column key that stores lead IDs (for example `add_to_leads` or another lead-id column key from `lead_finder` output), not the provider name `add_to_crm`.
 - `sequenceId` is the target sequence workflow ID.
 - The target sequence must already be `ACTIVE` for real enrollment. Table `add_to_sequence` runs and direct `POST /api/sequences/{id}/enroll` share the same activation check.
+- Common tail order after contact rows or lead IDs exist is `email_finder -> add_to_crm -> create/activate sequence -> add_to_sequence`.
+- Creating `add_to_sequence` after lead IDs already exist does not replay those older updates. In that case, run `add_to_sequence` explicitly or rerun the lead-id source column.
 - `add_to_sequence` runs auto-attach `research_context.source_table_id` (and table name when available). Field selection stays implicit so sequence drafts/audience resolve favorites from current starred columns by default.
 - Star/favorite the highest-signal fields so callers can see them quickly in the sidecar during live call workflows.
 - The same favorite set is also the default AI drafting context when explicit `fieldIds` are not provided.
 
+## Example pipeline: LLM items -> contacts table -> leads -> sequence
+
+Use this when an LLM column returns canonical JSON like `{ "items": [...] }` and each item should become a contact row.
+This is an example pattern, not the default recommendation for all person discovery.
+Use `lead_finder` first when the goal is explicit buyer/lead discovery with clear role targeting at scale.
+Use agent `llm_enrichment` when the workflow needs custom research output, website-discovered contacts, or low-coverage / hard-to-find cases.
+
+1. Create the source table and import company rows.
+2. Create the LLM enrichment column that outputs `items[]`.
+3. Create `sync_to_table` in `list` mode:
+   - set `listSourceColumnId` to the LLM column ID
+   - keep item fields on `sourceScope: "item"`
+   - keep parent company metadata on `sourceScope: "row"`
+4. Run or wait for `sync_to_table` so the destination contacts table has rows.
+5. On the destination contacts table, create and run `email_finder`.
+6. Create `add_to_crm` on that same destination contacts table.
+7. If email finder already finished before `add_to_crm` existed, run `add_to_crm` explicitly.
+8. Create the target sequence and set it `ACTIVE`.
+9. Create `add_to_sequence` with `sourceLeadColumn` set to the lead-id column key, usually `add_to_leads`.
+10. If leads already existed before `add_to_sequence` was created, run `add_to_sequence` explicitly.
+
 ## Common workflow
 
 ```bash
@@ -1157,6 +1191,7 @@ Agent expectations:
 - `column_types` tells you which column types are runnable and which are non-billable transforms (`json_split`, `formatter_formula`).
 - `filtering` describes valid scope/filter semantics for estimate/run.
 - `automation.auto_run` describes supported auto-run modes + config field names.
+- `automation.providers` exposes provider-specific setup contracts, save-time backfill behavior, dispatch strategy, and recipe type names for formatter/LLM/finders/action columns.
 - `execution_policies.llm.output_contract` describes output behavior by mode:
   - `agent` => JSON-oriented structured output
   - `basic` => text or JSON (`dataType=json` for structured JSON output)

{autotouch_cli-0.2.30 → autotouch_cli-0.2.32}/autotouch_cli/cli.py

@@ -34,6 +34,10 @@ from pathlib import Path
 from typing import Any, Dict, List, Optional, Tuple
 
 import requests
+from autotouch_shared.provider_registry import (
+    get_recipe_contract,
+    recipe_types,
+)
 
 try:
     from pymongo import MongoClient  # type: ignore
@@ -82,186 +86,24 @@ SETUP_BANNER = r"""
                          AI CLI SETUP
 """
 
-COLUMN_RECIPE_TYPES = [
-    "email_finder",
-    "phone_finder",
-    "lead_finder",
-    "llm_enrichment",
-    "add_to_crm",
-    "sync_to_table",
-    "add_to_sequence",
-]
+COLUMN_RECIPE_TYPES = recipe_types()
 
-COLUMN_CREATE_RECIPES: Dict[str, Dict[str, Any]] = {
-    "email_finder": {
-        "key": "work_email",
-        "label": "Work Email",
-        "kind": "enrichment",
-        "dataType": "json",
-        "origin": "email_finder",
-        "autoRun": "never",
-        "config": {
-            "provider": "smart_email_finder",
-            "strategy": "cost_optimized",
-            "lookupStrategy": "linkedin",
-            "linkedinOnly": True,
-            "enableProfileFallback": False,
-            "linkedinUrl": "linkedin_url",
-        },
-    },
-    "phone_finder": {
-        "key": "mobile_phone",
-        "label": "Mobile Phone",
-        "kind": "enrichment",
-        "dataType": "json",
-        "origin": "phone_finder",
-        "autoRun": "never",
-        "config": {
-            "provider": "smart_phone_finder",
-            "firstName": "first_name",
-            "lastName": "last_name",
-            "company": "company",
-            "linkedinUrl": "linkedin_url",
-        },
-    },
-    "lead_finder": {
-        "key": "lead_contacts",
-        "label": "Lead Contacts",
-        "kind": "enrichment",
-        "dataType": "json",
-        "origin": "ai",
-        "autoRun": "never",
-        "config": {
-            "provider": "lead_finder",
-            "sourceMode": "bulk_companies",
-            "companyDomain": "domain",
-            "strictness": "flexible_roles",
-            "storeAsLeads": True,
-            "autoEnrichEmails": True,
-            "autoEnrichPhones": False,
-            "jobTitles": ["Head of Sales", "VP Sales"],
-            "locations": ["United States"],
-            "maxResults": 10,
-        },
-    },
-    "llm_enrichment": {
-        "key": "company_research",
-        "label": "Company Research",
-        "kind": "enrichment",
-        "dataType": "json",
-        "origin": "ai",
-        "autoRun": "never",
-        "config": {
-            "instructions": "Research the company in this row and return JSON with icp_fit, summary, and risks.",
-            "mode": "agent",
-            "temperature": 0.7,
-            "batchSize": 50,
-            "promptSource": "generated",
-            "useCompanyContext": True,
-            "structuredOutput": True,
-            "useAutoSchema": True,
-        },
-    },
-    "add_to_crm": {
-        "key": "add_to_leads",
-        "label": "Add to Leads",
-        "kind": "enrichment",
-        "dataType": "json",
-        "origin": "manual",
-        "autoRun": "onSourceUpdate",
-        "config": {
-            "provider": "add_to_crm",
-            "leadSource": "research_table_export",
-            "fieldMappings": {
-                "mode": "single",
-                "linkedinUrl": "linkedin_url",
-                "companyDomain": "domain",
-                "firstName": "first_name",
-                "lastName": "last_name",
-                "title": "title",
-                "companyName": "company",
-                "emailAddresses": [{"column": "work_email", "type": "work"}],
-                "phoneNumbers": [{"column": "mobile_phone", "type": "mobile"}],
-            },
-            "sourceColumns": [
-                "linkedin_url",
-                "domain",
-                "first_name",
-                "last_name",
-                "title",
-                "company",
-                "work_email",
-                "mobile_phone",
-            ],
-        },
-    },
-    "sync_to_table": {
-        "key": "sync_to_table",
-        "label": "Sync to Table",
-        "kind": "enrichment",
-        "dataType": "json",
-        "origin": "manual",
-        "autoRun": "onSourceUpdate",
-        "config": {
-            "provider": "sync_to_table",
-            "destinationTableId": "<DESTINATION_TABLE_ID>",
-            "columnMappings": [
-                {"sourceKey": "company", "destKey": "company"},
-                {"sourceKey": "domain", "destKey": "company_domain"},
-                {"sourceKey": "work_email", "destKey": "work_email"},
-            ],
-        },
-    },
-    "add_to_sequence": {
-        "key": "add_to_sequence",
-        "label": "Add to Sequence",
-        "kind": "enrichment",
-        "dataType": "json",
-        "origin": "manual",
-        "autoRun": "onSourceUpdate",
-        "config": {
-            "provider": "add_to_sequence",
-            "sequenceId": "<SEQUENCE_ID>",
-            "sourceLeadColumn": "add_to_leads",
-        },
-    },
-}
 
-COLUMN_RECIPE_NOTES: Dict[str, List[str]] = {
-    "email_finder": [
-        "For non-LinkedIn lookup, use lookupStrategy=domain/company with firstName+lastName+domain/company fields.",
-    ],
-    "phone_finder": [
-        "You can use linkedinUrl or email/workEmail/personalEmail inputs.",
-    ],
-    "lead_finder": [
-        "Add more targeting keys as needed (jobFunctions, seniorities, keywords, excludeKeywords, skills).",
-    ],
-    "llm_enrichment": [
-        "Recommended default for agent mode: provide instructions and let the API compile the runnable prompt.",
-        "Generated agent-mode prompts always include company/requester context.",
-        "Basic mode stays manual-prompt-first; write the prompt directly from the user goal/preferences.",
-        "Runtime only injects values for placeholders the prompt explicitly references.",
-        "Manual/basic prompts should use explicit placeholders like {{company_name}}, {{domain}}, or {{user_value_proposition}} when those values are needed.",
-        "Agent mode is JSON-oriented.",
-        "Basic mode can be text or JSON; JSON requires dataType=json.",
-    ],
-    "add_to_crm": [
-        "companyDomain is required; LinkedIn is optional.",
-        "Include at least one usable hard-identity mapping such as LinkedIn, email, or phone.",
-        "If companyDomain is missing in the table, derive or enrich that domain column first.",
-        "Add to CRM is optional and non-billable.",
-    ],
-    "sync_to_table": [
-        "Use destinationTableId + columnMappings for single-destination sync.",
-        "Router mode is supported via config.routes[] (first matching route wins).",
-    ],
-    "add_to_sequence": [
-        "sourceLeadColumn should reference the source column key that stores lead IDs (for example add_to_leads), not the provider name add_to_crm.",
-        "Set sequenceId to the target workflow sequence ID.",
-        "The target sequence must already be ACTIVE for real enrollment.",
-    ],
-}
+def _build_column_recipe_catalog() -> Tuple[Dict[str, Dict[str, Any]], Dict[str, List[str]]]:
+    recipes: Dict[str, Dict[str, Any]] = {}
+    notes: Dict[str, List[str]] = {}
+    for recipe_type in COLUMN_RECIPE_TYPES:
+        contract = get_recipe_contract(recipe_type)
+        if not contract:
+            continue
+        payload = contract.recipe_payload_copy()
+        if isinstance(payload, dict):
+            recipes[recipe_type] = payload
+        notes[recipe_type] = contract.recipe_notes_list()
+    return recipes, notes
+
+
+COLUMN_CREATE_RECIPES, COLUMN_RECIPE_NOTES = _build_column_recipe_catalog()
 
 SEQUENCE_RECIPE_TYPES = [
     "create",
@@ -801,20 +643,73 @@ def _api_url(value: Optional[str] = None) -> str:
     return DEFAULT_API_URL.rstrip("/")
 
 
+def _looks_like_api_key(value: Optional[str]) -> bool:
+    token = str(value or "").strip()
+    return token.startswith("stk_") and "." in token
+
+
+def _looks_like_jwt(value: Optional[str]) -> bool:
+    token = str(value or "").strip()
+    return bool(token) and not _looks_like_api_key(token) and token.count(".") == 2
+
+
+def _env_user_token() -> Optional[str]:
+    for key in ("SMARTTABLE_TOKEN", "AUTOTOUCH_TOKEN"):
+        value = str(os.environ.get(key) or "").strip()
+        if value and not _looks_like_api_key(value):
+            return value
+    return None
+
+
+def _env_api_key() -> Optional[str]:
+    direct = str(os.environ.get("AUTOTOUCH_API_KEY") or "").strip()
+    if direct:
+        return direct
+    for key in ("SMARTTABLE_TOKEN", "AUTOTOUCH_TOKEN"):
+        value = str(os.environ.get(key) or "").strip()
+        if _looks_like_api_key(value):
+            return value
+    return None
+
+
 def _resolve_token(explicit_token: Optional[str], required: bool = True) -> Optional[str]:
-    tok = (
-        explicit_token
-        or os.environ.get("SMARTTABLE_TOKEN")
-        or os.environ.get("AUTOTOUCH_API_KEY")
-        or os.environ.get("AUTOTOUCH_TOKEN")
-    )
+    tok = str(explicit_token or "").strip()
+    if not tok:
+        cfg = _load_config()
+        tok = (
+            str(cfg.get("auth_token") or "").strip()
+            or str(cfg.get("api_key") or "").strip()
+            or str(_env_user_token() or "").strip()
+            or str(_env_api_key() or "").strip()
+        )
+    if not tok:
+        if required:
+            print(
+                "ERROR: missing token. Pass --token, run `autotouch auth login`, or run `autotouch auth set-key`.",
+                file=sys.stderr,
+            )
+            sys.exit(2)
+        return None
+    return tok
+
+
+def _resolve_user_session_token(explicit_token: Optional[str], required: bool = True) -> Optional[str]:
+    tok = str(explicit_token or "").strip()
+    if tok and _looks_like_api_key(tok):
+        print(
+            "ERROR: this command requires a user session token, not a developer API key. Run `autotouch auth login`.",
+            file=sys.stderr,
+        )
+        sys.exit(2)
+
     if not tok:
         cfg = _load_config()
-        tok = cfg.get("auth_token") or cfg.get("api_key")
+        tok = str(cfg.get("auth_token") or "").strip() or str(_env_user_token() or "").strip()
+
     if not tok:
         if required:
             print(
-                "ERROR: missing token. Pass --token, set SMARTTABLE_TOKEN/AUTOTOUCH_API_KEY, or run `autotouch auth login` / `autotouch auth set-key`.",
+                "ERROR: this command requires a saved user session. Run `autotouch auth login` or pass a JWT with --token.",
                 file=sys.stderr,
             )
             sys.exit(2)
@@ -3109,16 +3004,53 @@ def cmd_auth_bootstrap(args: argparse.Namespace) -> None:
     output: Any = data
     if getattr(args, "save_key", False) and isinstance(data, dict):
         api_key = str(data.get("apiKey") or data.get("api_key") or "").strip()
+        email = str(payload.get("email") or "").strip().lower()
+        password = str(payload.get("password") or "").strip()
+        session_data: Optional[Dict[str, Any]] = None
+        session_error: Optional[str] = None
+
+        if email and password:
+            try:
+                session_data = _request_api(
+                    "POST",
+                    "/api/auth/login",
+                    base_url=args.base_url,
+                    token=None,
+                    use_x_api_key=False,
+                    payload={"email": email, "password": password},
+                    timeout=args.timeout,
+                    verbose=args.verbose,
+                )
+            except SystemExit as exc:
+                session_error = f"login failed with exit code {exc.code}"
+            except Exception as exc:
+                session_error = str(exc)
+
         if api_key:
             cfg = _load_config()
             cfg["api_key"] = api_key
+            access_token = _normalize_string_value((session_data or {}).get("access_token"))
+            refresh_token = _normalize_string_value((session_data or {}).get("refresh_token"))
+            if access_token:
+                cfg["auth_token"] = access_token
+                cfg["auth_email"] = email
+                if refresh_token:
+                    cfg["refresh_token"] = refresh_token
             cfg["base_url"] = str(args.base_url or _api_url()).rstrip("/")
             cfg["updated_at_epoch"] = int(time.time())
             config_path = _save_config(cfg)
             output = dict(data)
             output["saved"] = True
+            output["saved_api_key"] = True
+            output["saved_session"] = bool(access_token)
             output["config_path"] = str(config_path)
             output["api_key_masked"] = _mask_api_key(api_key)
+            if access_token:
+                output["access_token_masked"] = _mask_secret(access_token)
+            if refresh_token:
+                output["refresh_token_masked"] = _mask_secret(refresh_token)
+            if session_error:
+                output["session_warning"] = session_error
         else:
             output = dict(data)
             output["saved"] = False
@@ -3202,6 +3134,9 @@ def cmd_auth_show(args: argparse.Namespace) -> None:
     refresh_token = str(cfg.get("refresh_token") or "").strip()
     base_url = str(cfg.get("base_url") or _api_url()).rstrip("/")
     path = _config_path()
+    default_general_auth = "auth_token" if auth_token else ("api_key" if api_key else None)
+    default_user_session_auth = "auth_token" if auth_token else ("env_token" if _env_user_token() else None)
+    default_developer_auth = "api_key" if api_key else ("env_api_key" if _env_api_key() else None)
     output = {
         "config_path": str(path),
         "config_exists": path.exists(),
@@ -3214,10 +3149,27 @@ def cmd_auth_show(args: argparse.Namespace) -> None:
         "auth_email": cfg.get("auth_email"),
         "base_url": base_url,
         "updated_at_epoch": cfg.get("updated_at_epoch"),
+        "default_general_auth": default_general_auth,
+        "default_user_session_auth": default_user_session_auth,
+        "default_developer_auth": default_developer_auth,
     }
     _print_json(output, compact=args.compact)
 
 
+def cmd_auth_whoami(args: argparse.Namespace) -> None:
+    token = _resolve_user_session_token(args.token, required=True)
+    data = _request_api(
+        "GET",
+        "/api/auth/me",
+        base_url=args.base_url,
+        token=token,
+        use_x_api_key=False,
+        timeout=args.timeout,
+        verbose=args.verbose,
+    )
+    _print_json(data, compact=args.compact)
+
+
 def cmd_auth_clear(args: argparse.Namespace) -> None:
     cfg = _load_config()
     changed = False
@@ -3355,7 +3307,7 @@ def _build_personal_context_payload(args: argparse.Namespace) -> Dict[str, Any]:
 
 
 def cmd_onboarding_submit_domain(args: argparse.Namespace) -> None:
-    token = _resolve_token(args.token, required=True)
+    token = _resolve_user_session_token(args.token, required=True)
     payload = _load_json_input(
         inline_json=getattr(args, "data_json", None),
         file_path=getattr(args, "data_file", None),
@@ -3377,7 +3329,7 @@ def cmd_onboarding_submit_domain(args: argparse.Namespace) -> None:
         "/api/onboarding/submit-domain",
         base_url=args.base_url,
         token=token,
-        use_x_api_key=args.use_x_api_key,
+        use_x_api_key=False,
         form_payload={
             "website": str(payload.get("website") or payload.get("domain") or "").strip(),
             "domain": str(payload.get("domain") or "").strip(),
@@ -3389,13 +3341,13 @@ def cmd_onboarding_submit_domain(args: argparse.Namespace) -> None:
 
 
 def cmd_org_context_get(args: argparse.Namespace) -> None:
-    token = _resolve_token(args.token, required=True)
+    token = _resolve_user_session_token(args.token, required=True)
     data = _request_api(
         "GET",
         "/api/org/context",
         base_url=args.base_url,
         token=token,
-        use_x_api_key=args.use_x_api_key,
+        use_x_api_key=False,
         timeout=args.timeout,
         verbose=args.verbose,
     )
@@ -3403,14 +3355,14 @@ def cmd_org_context_get(args: argparse.Namespace) -> None:
 
 
 def cmd_org_context_set(args: argparse.Namespace) -> None:
-    token = _resolve_token(args.token, required=True)
+    token = _resolve_user_session_token(args.token, required=True)
     payload = _build_org_context_payload(args)
     data = _request_api(
         "POST",
         "/api/org/context",
         base_url=args.base_url,
         token=token,
-        use_x_api_key=args.use_x_api_key,
+        use_x_api_key=False,
         form_payload=_org_context_form_payload(payload),
         timeout=args.timeout,
         verbose=args.verbose,
@@ -3419,13 +3371,13 @@ def cmd_org_context_set(args: argparse.Namespace) -> None:
 
 
 def cmd_personal_context_get(args: argparse.Namespace) -> None:
-    token = _resolve_token(args.token, required=True)
+    token = _resolve_user_session_token(args.token, required=True)
     data = _request_api(
         "GET",
         "/api/onboarding/personal-context",
         base_url=args.base_url,
         token=token,
-        use_x_api_key=args.use_x_api_key,
+        use_x_api_key=False,
         timeout=args.timeout,
         verbose=args.verbose,
     )
@@ -3433,14 +3385,14 @@ def cmd_personal_context_get(args: argparse.Namespace) -> None:
 
 
 def cmd_personal_context_set(args: argparse.Namespace) -> None:
-    token = _resolve_token(args.token, required=True)
+    token = _resolve_user_session_token(args.token, required=True)
     payload = _build_personal_context_payload(args)
     data = _request_api(
         "POST",
         "/api/onboarding/personal-context",
         base_url=args.base_url,
         token=token,
-        use_x_api_key=args.use_x_api_key,
+        use_x_api_key=False,
         payload=payload,
         timeout=args.timeout,
         verbose=args.verbose,
@@ -3449,13 +3401,13 @@ def cmd_personal_context_set(args: argparse.Namespace) -> None:
 
 
 def cmd_context_resolved(args: argparse.Namespace) -> None:
-    token = _resolve_token(args.token, required=True)
+    token = _resolve_user_session_token(args.token, required=True)
     data = _request_api(
         "GET",
         "/api/llm/company-context",
         base_url=args.base_url,
         token=token,
-        use_x_api_key=args.use_x_api_key,
+        use_x_api_key=False,
         timeout=args.timeout,
         verbose=args.verbose,
     )
@@ -3479,6 +3431,8 @@ def cmd_capabilities(args: argparse.Namespace) -> None:
         output_contract = llm.get("output_contract") if isinstance(llm.get("output_contract"), dict) else {}
         agent_contract = output_contract.get("agent") if isinstance(output_contract.get("agent"), dict) else {}
         basic_contract = output_contract.get("basic") if isinstance(output_contract.get("basic"), dict) else {}
+        automation = data.get("automation") if isinstance(data.get("automation"), dict) else {}
+        providers = automation.get("providers") if isinstance(automation.get("providers"), dict) else {}
 
         print(f"API version : {_as_display(data.get('api_version'))}")
         print(f"Base URL    : {_as_display(data.get('base_url'))}")
@@ -3502,7 +3456,13 @@ def cmd_capabilities(args: argparse.Namespace) -> None:
         basic_types = basic_contract.get("supported_data_types")
         basic_types_str = ", ".join(str(t) for t in basic_types) if isinstance(basic_types, list) else "text/json"
         print(f"basic : {basic_types_str} (JSON requires dataType=json)")
+        if providers:
+            print("")
+            print("Provider setup")
+            print("--------------")
+            print(", ".join(sorted(str(name) for name in providers.keys())))
         print("")
+        print("Tip: inspect automation.providers in JSON output for provider-specific setup contracts.")
         print("Tip: for JSON enrichment columns, run with `--wait` and verify terminal status before `autotouch columns projections`.")
         return
 
@@ -6290,7 +6250,7 @@ def build_parser() -> argparse.ArgumentParser:
     pab.add_argument("--scopes-file", help="Optional JSON file with scopes array")
     pab.add_argument("--data-json", help="Explicit agent bootstrap payload JSON")
     pab.add_argument("--data-file", help="Path to agent bootstrap payload JSON file")
-    pab.add_argument("--save-key", action="store_true", help="Persist the returned apiKey into local CLI config")
+    pab.add_argument("--save-key", action="store_true", help="Persist the returned apiKey and bootstrap a saved JWT session")
     pab.add_argument("--base-url", default=_api_url(), help=f"API base URL (default: {DEFAULT_API_URL})")
     pab.add_argument("--timeout", type=int, default=DEFAULT_TIMEOUT_SECONDS, help="HTTP timeout in seconds")
     pab.add_argument("--output", choices=["json", "human"], default="json", help="Output mode")
@@ -6325,6 +6285,15 @@ def build_parser() -> argparse.ArgumentParser:
     pashow.add_argument("--compact", action="store_true", help="Print compact JSON")
     pashow.set_defaults(func=cmd_auth_show)
 
+    pawho = auth_sub.add_parser("whoami", help="Show the current saved user session identity")
+    pawho.add_argument("--token", help="Explicit JWT session token")
+    pawho.add_argument("--base-url", default=_api_url(), help=f"API base URL (default: {DEFAULT_API_URL})")
+    pawho.add_argument("--timeout", type=int, default=DEFAULT_TIMEOUT_SECONDS, help="HTTP timeout in seconds")
+    pawho.add_argument("--output", choices=["json", "human"], default="json", help="Output mode")
+    pawho.add_argument("--compact", action="store_true", help="Print compact JSON")
+    pawho.add_argument("--verbose", action="store_true", help="Print request metadata to stderr")
+    pawho.set_defaults(func=cmd_auth_whoami)
+
     paclear = auth_sub.add_parser("clear", help="Clear stored auth config")
     paclear.add_argument("--all", action="store_true", help="Clear all config keys")
     paclear.add_argument("--clear-base-url", action="store_true", help="Also clear stored base_url")