WeKnora CLI, shared base

weknora is the agent-first CLI for a WeKnora RAG server. Every command prints a JSON envelope and uses a typed exit code, so you branch on machine-readable output, not prose. Read this skill before any task-specific weknora-* skill.

1. Authenticate (do this first, order matters)

Agents usually skip profiles entirely: set WEKNORA_API_KEY (or WEKNORA_TOKEN) + WEKNORA_HOST and every command authenticates statelessly and zero-disk, no profile add / auth login needed. auth token echoes that env credential; auth status / doctor confirm it. The steps below set up a persistent named profile instead (interactive / multi-environment use).

Authentication is a two-step sequence. weknora auth login operates on the active profile, so the profile must exist first:

# 1. register a connection target and make it active
weknora profile add prod --host https://kb.example.com --use
# 2a. API key (agent default, pipe the key on stdin, non-interactive):
echo "$WEKNORA_API_KEY" | weknora auth login --with-token
# 2b. OR email+password (interactive prompt only, no flags; not for agents)
weknora auth login

weknora auth status          # verify: who am I, which tenant

• Target a non-active profile for one command with the global --profile NAME (e.g. weknora --profile staging auth refresh). There is no per-command --name/--host on auth commands.
• Get the raw token for scripting with WEKNORA_TOKEN=$(weknora auth token) (raw token by default; works with an env credential too; --format json gives the {token, mode, profile} envelope).
• weknora auth logout clears a profile's stored credentials but keeps the profile registered (re-auth later with auth login); use profile remove to delete the profile entirely.
• weknora doctor runs 4 health checks (reachability, credential, version, storage).

2. Selecting a knowledge base (--kb)