KeeperHub · suisuss · Jul 28, 2026 · Jul 28, 2026
diff --git a/.github/workflows/sync-cli-docs.yml b/.github/workflows/sync-cli-docs.yml
@@ -29,6 +29,18 @@ jobs:
       - name: Regenerate CLI docs
         run: go generate ./docs/...
 
+      # The sync copies whatever is on disk. If regeneration changes anything,
+      # the tag's committed reference did not match its own command tree, and
+      # the copy would silently publish stale pages. Fail here rather than open
+      # a PR that looks authoritative.
+      - name: Fail if the tag's committed docs are stale
+        run: |
+          if ! git diff --quiet -- docs/ || [ -n "$(git ls-files --others --exclude-standard docs/)" ]; then
+            echo "::error::Committed docs do not match generated output for this ref."
+            git status --short -- docs/
+            exit 1
+          fi
+
       - name: Checkout KeeperHub repo
         uses: actions/checkout@v4
         with:
@@ -47,6 +59,16 @@ jobs:
           rm -rf "$KH_DOCS/commands/"kh*.md
           cp "$CLI_DOCS/"kh*.md "$KH_DOCS/commands/"
 
+          # A partial copy publishes a reference that looks complete but omits
+          # commands entirely, which reads as "this command does not exist".
+          GENERATED=$(find "$CLI_DOCS" -maxdepth 1 -name 'kh*.md' | wc -l)
+          COPIED=$(find "$KH_DOCS/commands" -maxdepth 1 -name 'kh*.md' | wc -l)
+          if [ "$GENERATED" -ne "$COPIED" ]; then
+            echo "::error::Synced $COPIED of $GENERATED command pages."
+            exit 1
+          fi
+          echo "Synced $COPIED command pages."
+
           # Sync hand-written guides (add frontmatter for Nextra)
           for file in quickstart.md concepts.md; do
             TITLE=$(head -1 "$CLI_DOCS/$file" | sed 's/^# //')

diff --git a/cmd/auth/login.go b/cmd/auth/login.go
@@ -41,7 +41,7 @@ func NewLoginCmd(f *cmdutil.Factory) *cobra.Command {
 		Short: "Log in to KeeperHub",
 		Args:  cobra.NoArgs,
 		Long: `Authenticate with KeeperHub using the device code flow.
-Opens a browser to confirm a one-time code.
+Prints a URL and a one-time code; open the URL in a browser to confirm it.
 Use --with-token to read an API key from stdin for non-interactive automation.
 
 See also: kh auth status, kh auth logout`,

diff --git a/docs/doc.go b/docs/doc.go
@@ -0,0 +1,14 @@
+// Package docs holds the generated command reference.
+//
+// The generator itself lives in generate.go, which carries a `//go:build
+// ignore` constraint so it is not compiled into the module. That constraint is
+// also why the `//go:generate` directive cannot live there: a build-excluded
+// file is never scanned, so `go generate ./docs/` silently did nothing, exited
+// 0, and left the CI docs check comparing an unchanged tree against itself.
+//
+// Keeping the directive in this compiled file is what makes `go generate
+// ./docs/` regenerate the reference, and therefore what makes the docs check
+// and the downstream sync to keeperhub meaningful.
+package docs
+
+//go:generate go run generate.go
diff --git a/docs/generate.go b/docs/generate.go
@@ -11,7 +11,9 @@ import (
 	"github.com/spf13/cobra/doc"
 )
 
-//go:generate go run generate.go
+// The //go:generate directive lives in doc.go, not here: this file is excluded
+// from the build by the constraint above, so directives in it are never
+// scanned.
 
 func main() {
 	ios := iostreams.System()

diff --git a/docs/kh.md b/docs/kh.md
@@ -10,6 +10,7 @@ KeeperHub CLI
       --jq string     Filter JSON output with a jq expression
       --json          Output as JSON
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 
@@ -18,19 +19,20 @@ KeeperHub CLI
 * [kh action](kh_action.md)	 - Browse available actions
 * [kh auth](kh_auth.md)	 - Authenticate with KeeperHub
 * [kh billing](kh_billing.md)	 - View billing and usage
+* [kh chain](kh_chain.md)	 - Manage blockchain chains
 * [kh completion](kh_completion.md)	 - Generate shell completion scripts
 * [kh config](kh_config.md)	 - Manage CLI configuration
 * [kh doctor](kh_doctor.md)	 - Check CLI health
 * [kh execute](kh_execute.md)	 - Execute direct blockchain actions
 * [kh org](kh_org.md)	 - Manage organizations
+* [kh plugin](kh_plugin.md)	 - Browse available plugins and integrations
 * [kh project](kh_project.md)	 - Manage projects
-* [kh protocol](kh_protocol.md)	 - Browse blockchain protocols
+* [kh read](kh_read.md)	 - Read a smart contract view function
 * [kh run](kh_run.md)	 - Monitor workflow runs
-* [kh serve](kh_serve.md)	 - Start a server
 * [kh tag](kh_tag.md)	 - Manage tags
 * [kh template](kh_template.md)	 - Manage workflow templates
 * [kh update](kh_update.md)	 - Update kh to the latest version
 * [kh version](kh_version.md)	 - Show CLI version
-* [kh wallet](kh_wallet.md)	 - Manage wallets
+* [kh wallet](kh_wallet.md)	 - Manage wallets (creator-wallet REST API or agentic-wallet npm package)
 * [kh workflow](kh_workflow.md)	 - Manage workflows
 
diff --git a/docs/kh_action.md b/docs/kh_action.md
@@ -25,6 +25,7 @@ Browse available actions
 ```
   -H, --host string   KeeperHub host (default: app.keeperhub.com)
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 

diff --git a/docs/kh_action_get.md b/docs/kh_action_get.md
@@ -29,6 +29,7 @@ kh action get <action-name> [flags]
       --jq string     Filter JSON output with a jq expression
       --json          Output as JSON
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 

diff --git a/docs/kh_action_list.md b/docs/kh_action_list.md
@@ -30,6 +30,7 @@ kh action list [flags]
       --jq string     Filter JSON output with a jq expression
       --json          Output as JSON
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 

diff --git a/docs/kh_auth.md b/docs/kh_auth.md
@@ -25,6 +25,7 @@ Authenticate with KeeperHub
       --jq string     Filter JSON output with a jq expression
       --json          Output as JSON
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 

diff --git a/docs/kh_auth_login.md b/docs/kh_auth_login.md
@@ -5,7 +5,7 @@ Log in to KeeperHub
 ### Synopsis
 
 Authenticate with KeeperHub using the device code flow.
-Opens a browser to confirm a one-time code.
+Prints a URL and a one-time code; open the URL in a browser to confirm it.
 Use --with-token to read an API key from stdin for non-interactive automation.
 
 See also: kh auth status, kh auth logout

diff --git a/docs/kh_auth_logout.md b/docs/kh_auth_logout.md
@@ -36,6 +36,7 @@ kh auth logout [flags]
       --jq string     Filter JSON output with a jq expression
       --json          Output as JSON
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 

diff --git a/docs/kh_auth_status.md b/docs/kh_auth_status.md
@@ -29,6 +29,7 @@ kh auth status [flags]
       --jq string     Filter JSON output with a jq expression
       --json          Output as JSON
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 

diff --git a/docs/kh_billing.md b/docs/kh_billing.md
@@ -25,6 +25,7 @@ View billing and usage
 ```
   -H, --host string   KeeperHub host (default: app.keeperhub.com)
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 

diff --git a/docs/kh_billing_status.md b/docs/kh_billing_status.md
@@ -29,6 +29,7 @@ kh billing status [flags]
       --jq string     Filter JSON output with a jq expression
       --json          Output as JSON
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 

diff --git a/docs/kh_billing_usage.md b/docs/kh_billing_usage.md
@@ -30,6 +30,7 @@ kh billing usage [flags]
       --jq string     Filter JSON output with a jq expression
       --json          Output as JSON
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 

diff --git a/docs/kh_chain.md b/docs/kh_chain.md
@@ -0,0 +1,33 @@
+## kh chain
+
+Manage blockchain chains
+
+### Examples
+
+```
+  # List supported chains
+  kh ch ls
+```
+
+### Options
+
+```
+  -h, --help   help for chain
+```
+
+### Options inherited from parent commands
+
+```
+  -H, --host string   KeeperHub host (default: app.keeperhub.com)
+      --jq string     Filter JSON output with a jq expression
+      --json          Output as JSON
+      --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
+  -y, --yes           Skip confirmation prompts
+```
+
+### SEE ALSO
+
+* [kh](kh.md)	 - KeeperHub CLI
+* [kh chain list](kh_chain_list.md)	 - List supported blockchain chains
+
diff --git a/docs/kh_chain_list.md b/docs/kh_chain_list.md
@@ -0,0 +1,60 @@
+## kh chain list
+
+List supported blockchain chains
+
+### Synopsis
+
+List supported blockchain chains.
+
+Note the type change if you are copying a chain id into a workflow. This
+command reports "chainId" as a JSON number, but web3 workflow nodes expect
+config.network as a STRING:
+
+  kh chain list --json   ->   "chainId": 103
+  workflow node config   ->   "network": "103"
+
+Writing the number form into a node config is accepted by the API and fails
+later at execution time, so it is worth getting right up front.
+
+The list reflects the chains table in the target environment, which is
+seeded on deploy. It is the authoritative answer for which chains are live;
+the chain-config repo is only an input to that seed.
+
+```
+kh chain list [flags]
+```
+
+### Examples
+
+```
+  # List all chains
+  kh ch ls
+
+  # List chains as JSON
+  kh ch ls --json
+
+  # Chain id in the string form a workflow node config expects
+  kh ch ls --json | jq -r '.[] | select(.name == "Solana Devnet") | .chainId | tostring'
+```
+
+### Options
+
+```
+  -h, --help   help for list
+```
+
+### Options inherited from parent commands
+
+```
+  -H, --host string   KeeperHub host (default: app.keeperhub.com)
+      --jq string     Filter JSON output with a jq expression
+      --json          Output as JSON
+      --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
+  -y, --yes           Skip confirmation prompts
+```
+
+### SEE ALSO
+
+* [kh chain](kh_chain.md)	 - Manage blockchain chains
+
diff --git a/docs/kh_completion.md b/docs/kh_completion.md
@@ -36,6 +36,7 @@ kh completion <shell> [flags]
       --jq string     Filter JSON output with a jq expression
       --json          Output as JSON
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 

diff --git a/docs/kh_config.md b/docs/kh_config.md
@@ -25,6 +25,7 @@ Manage CLI configuration
       --jq string     Filter JSON output with a jq expression
       --json          Output as JSON
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 

diff --git a/docs/kh_config_get.md b/docs/kh_config_get.md
@@ -26,6 +26,7 @@ kh config get <key> [flags]
       --jq string     Filter JSON output with a jq expression
       --json          Output as JSON
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 

diff --git a/docs/kh_config_list.md b/docs/kh_config_list.md
@@ -26,6 +26,7 @@ kh config list [flags]
       --jq string     Filter JSON output with a jq expression
       --json          Output as JSON
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 

diff --git a/docs/kh_config_set.md b/docs/kh_config_set.md
@@ -37,6 +37,7 @@ kh config set <key> <value> [flags]
       --jq string     Filter JSON output with a jq expression
       --json          Output as JSON
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 

diff --git a/docs/kh_doctor.md b/docs/kh_doctor.md
@@ -37,6 +37,7 @@ kh doctor [flags]
       --jq string     Filter JSON output with a jq expression
       --json          Output as JSON
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 

diff --git a/docs/kh_execute.md b/docs/kh_execute.md
@@ -33,6 +33,7 @@ See also: kh r st, kh wf run
       --jq string     Filter JSON output with a jq expression
       --json          Output as JSON
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 

diff --git a/docs/kh_execute_contract-call.md b/docs/kh_execute_contract-call.md
@@ -36,6 +36,7 @@ kh execute contract-call [flags]
       --jq string     Filter JSON output with a jq expression
       --json          Output as JSON
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 

diff --git a/docs/kh_execute_status.md b/docs/kh_execute_status.md
@@ -37,6 +37,7 @@ kh execute status <execution-id> [flags]
       --jq string     Filter JSON output with a jq expression
       --json          Output as JSON
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 

diff --git a/docs/kh_execute_transfer.md b/docs/kh_execute_transfer.md
@@ -36,6 +36,7 @@ kh execute transfer [flags]
       --jq string     Filter JSON output with a jq expression
       --json          Output as JSON
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 

diff --git a/docs/kh_org.md b/docs/kh_org.md
@@ -25,6 +25,7 @@ Manage organizations
 ```
   -H, --host string   KeeperHub host (default: app.keeperhub.com)
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```
 

diff --git a/docs/kh_org_list.md b/docs/kh_org_list.md
@@ -2,6 +2,16 @@
 
 List organizations
 
+### Synopsis
+
+List organizations.
+
+Requires a browser session. The underlying endpoint resolves a session cookie
+and does not inspect the Authorization header, so this command returns 401
+under an API key regardless of the key's scope - even while 'kh workflow list'
+and the rest of the CLI work normally with that same key. A 401 here is not a
+sign that your key is broken. See 'kh auth-scope'.
+
 ```
 kh org list [flags]
 ```
@@ -29,6 +39,7 @@ kh org list [flags]
       --jq string     Filter JSON output with a jq expression
       --json          Output as JSON
       --no-color      Disable color output
+      --org string    Organization ID to use (overrides default from auth)
   -y, --yes           Skip confirmation prompts
 ```