Merge branch 'main' into deprecate-crew-agent-executor

lib/cli/README.md

@@ -0,0 +1,26 @@
+# crewai-cli
+
+CLI for CrewAI — scaffold, run, deploy and manage AI agent crews without
+installing the full framework.
+
+## Installation
+
+```bash
+pip install crewai-cli
+```
+
+This pulls in `crewai-core` (shared utilities) but not the `crewai` framework
+itself, so commands that don't need a crew loaded — `crewai version`,
+`crewai login`, `crewai org list`, `crewai config *`, `crewai traces *`,
+`crewai create`, `crewai template *` — work standalone.
+
+Commands that load a user's crew or flow (`crewai run`, `crewai train`,
+`crewai test`, `crewai chat`, `crewai replay`, `crewai reset-memories`,
+`crewai deploy push`, `crewai tool publish`) require `crewai` to be installed
+in the project's environment. They print a clear error if it is missing.
+
+To install both at once:
+
+```bash
+pip install crewai[cli]
+```

lib/cli/pyproject.toml

@@ -0,0 +1,45 @@
+[project]
+name = "crewai-cli"
+dynamic = ["version"]
+description = "CLI for CrewAI — scaffold, run, deploy and manage AI agent crews."
+readme = "README.md"
+authors = [
+    { name = "Joao Moura", email = "joao@crewai.com" }
+]
+requires-python = ">=3.10, <3.14"
+dependencies = [
+    "crewai-core==1.14.5a3",
+    "click~=8.1.7",
+    "pydantic>=2.11.9,<2.13",
+    "pydantic-settings~=2.10.1",
+    "appdirs~=1.4.4",
+    "cryptography>=42.0",
+    "httpx~=0.28.1",
+    "pyjwt>=2.9.0,<3",
+    "rich>=13.7.1",
+    "tomli~=2.0.2",
+    "tomli-w~=1.1.0",
+    "packaging>=23.0",
+    "python-dotenv>=1.2.2,<2",
+    "uv~=0.11.6",
+    "textual>=7.5.0",
+    "certifi",
+]
+
+[project.urls]
+Homepage = "https://crewai.com"
+Documentation = "https://docs.crewai.com"
+Repository = "https://github.com/crewAIInc/crewAI"
+
+[project.scripts]
+crewai = "crewai_cli.cli:crewai"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.version]
+path = "src/crewai_cli/__init__.py"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/crewai_cli"]

lib/cli/src/crewai_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "1.14.5a3"

lib/cli/src/crewai_cli/add_crew_to_flow.py

@@ -1,9 +1,9 @@
 from pathlib import Path
 
 import click
+from crewai_core.printer import PRINTER
 
-from crewai.cli.utils import copy_template
-from crewai.utilities.printer import PRINTER
+from crewai_cli.utils import copy_template
 
 
 def add_crew_to_flow(crew_name: str) -> None:

lib/cli/src/crewai_cli/authentication/__init__.py

@@ -0,0 +1,8 @@
+"""CLI authentication entry point."""
+
+from __future__ import annotations
+
+from crewai_cli.authentication.main import AuthenticationCommand
+
+
+__all__ = ["AuthenticationCommand"]

lib/cli/src/crewai_cli/authentication/constants.py

@@ -0,0 +1,8 @@
+"""Re-export of authentication constants from ``crewai_core.auth.constants``."""
+
+from __future__ import annotations
+
+from crewai_core.auth.constants import ALGORITHMS as ALGORITHMS
+
+
+__all__ = ["ALGORITHMS"]

lib/cli/src/crewai_cli/authentication/main.py

@@ -0,0 +1,60 @@
+"""CLI-side authentication wiring.
+
+Re-exports the OAuth2 primitives from ``crewai_core.auth`` and overrides the
+``_post_login`` hook to also log into the tool repository.
+"""
+
+from __future__ import annotations
+
+from crewai_core.auth.oauth2 import (
+    AuthenticationCommand as _BaseAuthenticationCommand,
+    Oauth2Settings as Oauth2Settings,
+    ProviderFactory as ProviderFactory,
+    console,
+)
+from crewai_core.settings import Settings
+
+
+__all__ = ["AuthenticationCommand", "Oauth2Settings", "ProviderFactory"]
+
+
+class AuthenticationCommand(_BaseAuthenticationCommand):
+    """CLI-side login that also signs the user into the tool repository."""
+
+    def _post_login(self) -> None:
+        self._login_to_tool_repository()
+
+    def _login_to_tool_repository(self) -> None:
+        from crewai_cli.tools.main import ToolCommand
+
+        try:
+            console.print(
+                "Now logging you in to the Tool Repository... ",
+                style="bold blue",
+                end="",
+            )
+
+            ToolCommand().login()
+
+            console.print(
+                "Success!\n",
+                style="bold green",
+            )
+
+            settings = Settings()
+
+            console.print(
+                f"You are now authenticated to the tool repository for organization [bold cyan]'{settings.org_name if settings.org_name else settings.org_uuid}'[/bold cyan]",
+                style="green",
+            )
+        except (Exception, SystemExit):
+            console.print(
+                "\n[bold yellow]Warning:[/bold yellow] Authentication with the Tool Repository failed.",
+                style="yellow",
+            )
+            console.print(
+                "Other features will work normally, but you may experience limitations "
+                "with downloading and publishing tools."
+                "\nRun [bold]crewai login[/bold] to try logging in again.\n",
+                style="yellow",
+            )

lib/cli/src/crewai_cli/authentication/providers/__init__.py

@@ -0,0 +1 @@
+"""OAuth2 authentication providers — re-exported from ``crewai_core.auth.providers``."""

lib/cli/src/crewai_cli/authentication/providers/auth0.py

@@ -0,0 +1,8 @@
+"""Re-export of ``Auth0Provider`` from ``crewai_core.auth.providers.auth0``."""
+
+from __future__ import annotations
+
+from crewai_core.auth.providers.auth0 import Auth0Provider as Auth0Provider
+
+
+__all__ = ["Auth0Provider"]

lib/cli/src/crewai_cli/authentication/providers/base_provider.py

@@ -0,0 +1,8 @@
+"""Re-export of ``BaseProvider`` from ``crewai_core.auth.providers.base_provider``."""
+
+from __future__ import annotations
+
+from crewai_core.auth.providers.base_provider import BaseProvider as BaseProvider
+
+
+__all__ = ["BaseProvider"]

lib/cli/src/crewai_cli/authentication/providers/entra_id.py

@@ -0,0 +1,8 @@
+"""Re-export of ``EntraIdProvider`` from ``crewai_core.auth.providers.entra_id``."""
+
+from __future__ import annotations
+
+from crewai_core.auth.providers.entra_id import EntraIdProvider as EntraIdProvider
+
+
+__all__ = ["EntraIdProvider"]

lib/cli/src/crewai_cli/authentication/providers/keycloak.py

@@ -0,0 +1,8 @@
+"""Re-export of ``KeycloakProvider`` from ``crewai_core.auth.providers.keycloak``."""
+
+from __future__ import annotations
+
+from crewai_core.auth.providers.keycloak import KeycloakProvider as KeycloakProvider
+
+
+__all__ = ["KeycloakProvider"]

lib/cli/src/crewai_cli/authentication/providers/okta.py

@@ -0,0 +1,8 @@
+"""Re-export of ``OktaProvider`` from ``crewai_core.auth.providers.okta``."""
+
+from __future__ import annotations
+
+from crewai_core.auth.providers.okta import OktaProvider as OktaProvider
+
+
+__all__ = ["OktaProvider"]

lib/cli/src/crewai_cli/authentication/providers/workos.py

@@ -0,0 +1,8 @@
+"""Re-export of ``WorkosProvider`` from ``crewai_core.auth.providers.workos``."""
+
+from __future__ import annotations
+
+from crewai_core.auth.providers.workos import WorkosProvider as WorkosProvider
+
+
+__all__ = ["WorkosProvider"]

lib/cli/src/crewai_cli/authentication/token.py

@@ -0,0 +1,11 @@
+"""Re-exports of authentication token helpers from ``crewai_core.auth.token``."""
+
+from __future__ import annotations
+
+from crewai_core.auth.token import (
+    AuthError as AuthError,
+    get_auth_token as get_auth_token,
+)
+
+
+__all__ = ["AuthError", "get_auth_token"]

lib/cli/src/crewai_cli/authentication/utils.py

@@ -0,0 +1,8 @@
+"""Re-export of ``validate_jwt_token`` from ``crewai_core.auth.utils``."""
+
+from __future__ import annotations
+
+from crewai_core.auth.utils import validate_jwt_token as validate_jwt_token
+
+
+__all__ = ["validate_jwt_token"]

lib/cli/src/crewai_cli/checkpoint_tui.py

@@ -21,7 +21,7 @@ from textual.widgets import (
     Tree,
 )
 
-from crewai.cli.checkpoint_cli import (
+from crewai_cli.checkpoint_cli import (
     _format_size,
     _is_sqlite,
     _list_json,

lib/cli/src/crewai_cli/cli.py

@@ -1,50 +1,66 @@
+from __future__ import annotations
+
 from importlib.metadata import version as get_version
 import os
 import subprocess
 from typing import Any
 
 import click
+from crewai_core.token_manager import TokenManager
 
-from crewai.cli.add_crew_to_flow import add_crew_to_flow
-from crewai.cli.authentication.main import AuthenticationCommand
-from crewai.cli.config import Settings
-from crewai.cli.create_crew import create_crew
-from crewai.cli.create_flow import create_flow
-from crewai.cli.crew_chat import run_chat
-from crewai.cli.deploy.main import DeployCommand
-from crewai.cli.enterprise.main import EnterpriseConfigureCommand
-from crewai.cli.evaluate_crew import evaluate_crew
-from crewai.cli.install_crew import install_crew
-from crewai.cli.kickoff_flow import kickoff_flow
-from crewai.cli.organization.main import OrganizationCommand
-from crewai.cli.plot_flow import plot_flow
-from crewai.cli.remote_template.main import TemplateCommand
-from crewai.cli.replay_from_task import replay_task_command
-from crewai.cli.reset_memories_command import reset_memories_command
-from crewai.cli.run_crew import run_crew
-from crewai.cli.settings.main import SettingsCommand
-from crewai.cli.shared.token_manager import TokenManager
-from crewai.cli.tools.main import ToolCommand
-from crewai.cli.train_crew import train_crew
-from crewai.cli.triggers.main import TriggersCommand
-from crewai.cli.update_crew import update_crew
-from crewai.cli.utils import build_env_with_all_tool_credentials, read_toml
-from crewai.memory.storage.kickoff_task_outputs_storage import (
-    KickoffTaskOutputsSQLiteStorage,
+from crewai_cli.add_crew_to_flow import add_crew_to_flow
+from crewai_cli.authentication.main import AuthenticationCommand
+from crewai_cli.config import Settings
+from crewai_cli.create_crew import create_crew
+from crewai_cli.create_flow import create_flow
+from crewai_cli.crew_chat import run_chat
+from crewai_cli.deploy.main import DeployCommand
+from crewai_cli.enterprise.main import EnterpriseConfigureCommand
+from crewai_cli.evaluate_crew import evaluate_crew
+from crewai_cli.install_crew import install_crew
+from crewai_cli.kickoff_flow import kickoff_flow
+from crewai_cli.organization.main import OrganizationCommand
+from crewai_cli.plot_flow import plot_flow
+from crewai_cli.remote_template.main import TemplateCommand
+from crewai_cli.replay_from_task import replay_task_command
+from crewai_cli.reset_memories_command import reset_memories_command
+from crewai_cli.run_crew import run_crew
+from crewai_cli.settings.main import SettingsCommand
+from crewai_cli.task_outputs import load_task_outputs
+from crewai_cli.tools.main import ToolCommand
+from crewai_cli.train_crew import train_crew
+from crewai_cli.triggers.main import TriggersCommand
+from crewai_cli.update_crew import update_crew
+from crewai_cli.user_data import (
+    _load_user_data,
+    is_tracing_enabled,
+    update_user_data,
 )
+from crewai_cli.utils import build_env_with_all_tool_credentials, read_toml
+
+
+def _get_cli_version() -> str:
+    """Return the best available version string for the CLI."""
+    # Prefer crewai version if installed (keeps existing UX)
+    try:
+        return get_version("crewai")
+    except Exception:  # noqa: S110
+        pass
+    try:
+        return get_version("crewai-cli")
+    except Exception:
+        return "unknown"
 
 
 @click.group()
-@click.version_option(get_version("crewai"))
+@click.version_option(_get_cli_version())
 def crewai() -> None:
     """Top-level command group for crewai."""
 
 
 @crewai.command(
     name="uv",
-    context_settings=dict(
-        ignore_unknown_options=True,
-    ),
+    context_settings={"ignore_unknown_options": True},
 )
 @click.argument("uv_args", nargs=-1, type=click.UNPROCESSED)
 def uv(uv_args: tuple[str, ...]) -> None:
@@ -105,7 +121,7 @@ def version(tools: bool) -> None:
 
     if tools:
         try:
-            tools_version = get_version("crewai")
+            tools_version = get_version("crewai-tools")
             click.echo(f"crewai tools version: {tools_version}")
         except Exception:
             click.echo("crewai tools not installed")
@@ -139,28 +155,38 @@ def train(n_iterations: int, filename: str) -> None:
     type=str,
     help="Replay the crew from this task ID, including all subsequent tasks.",
 )
-def replay(task_id: str) -> None:
-    """
-    Replay the crew execution from a specific task.
+@click.option(
+    "-f",
+    "--filename",
+    "trained_agents_file",
+    type=str,
+    default=None,
+    help=(
+        "Path to a trained-agents pickle (produced by `crewai train -f`). "
+        "When set, agents load suggestions from this file instead of the "
+        "default trained_agents_data.pkl. Equivalent to setting "
+        "CREWAI_TRAINED_AGENTS_FILE."
+    ),
+)
+def replay(task_id: str, trained_agents_file: str | None) -> None:
+    """Replay the crew execution from a specific task.
 
     Args:
-        task_id (str): The ID of the task to replay from.
+        task_id: The ID of the task to replay from.
+        trained_agents_file: Optional trained-agents pickle path.
     """
     try:
         click.echo(f"Replaying the crew from task {task_id}")
-        replay_task_command(task_id)
+        replay_task_command(task_id, trained_agents_file=trained_agents_file)
     except Exception as e:
         click.echo(f"An error occurred while replaying: {e}", err=True)
 
 
 @crewai.command()
 def log_tasks_outputs() -> None:
-    """
-    Retrieve your latest crew.kickoff() task outputs.
-    """
+    """Retrieve your latest crew.kickoff() task outputs."""
     try:
-        storage = KickoffTaskOutputsSQLiteStorage()
-        tasks = storage.load()
+        tasks = load_task_outputs()
 
         if not tasks:
             click.echo(
@@ -218,11 +244,8 @@ def reset_memories(
     agent_knowledge: bool,
     all: bool,
 ) -> None:
-    """
-    Reset the crew memories (memory, knowledge, agent_knowledge, kickoff_outputs). This will delete all the data saved.
-    """
+    """Reset the crew memories (memory, knowledge, agent_knowledge, kickoff_outputs). This will delete all the data saved."""
     try:
-        # Treat legacy flags as --memory with a deprecation warning
         if long or short or entities:
             legacy_used = [
                 f
@@ -289,7 +312,7 @@ def memory(
 ) -> None:
     """Open the Memory TUI to browse scopes and recall memories."""
     try:
-        from crewai.cli.memory_tui import MemoryTUI
+        from crewai_cli.memory_tui import MemoryTUI
     except ImportError as exc:
         click.echo(
             "Textual is required for the memory TUI but could not be imported. "
@@ -332,17 +355,30 @@ def memory(
     default="gpt-4o-mini",
     help="LLM Model to run the tests on the Crew. For now only accepting only OpenAI models.",
 )
-def test(n_iterations: int, model: str) -> None:
+@click.option(
+    "-f",
+    "--filename",
+    "trained_agents_file",
+    type=str,
+    default=None,
+    help=(
+        "Path to a trained-agents pickle (produced by `crewai train -f`). "
+        "When set, agents load suggestions from this file instead of the "
+        "default trained_agents_data.pkl. Equivalent to setting "
+        "CREWAI_TRAINED_AGENTS_FILE."
+    ),
+)
+def test(n_iterations: int, model: str, trained_agents_file: str | None) -> None:
     """Test the crew and evaluate the results."""
     click.echo(f"Testing the crew for {n_iterations} iterations with model {model}")
-    evaluate_crew(n_iterations, model)
+    evaluate_crew(n_iterations, model, trained_agents_file=trained_agents_file)
 
 
 @crewai.command(
-    context_settings=dict(
-        ignore_unknown_options=True,
-        allow_extra_args=True,
-    )
+    context_settings={
+        "ignore_unknown_options": True,
+        "allow_extra_args": True,
+    }
 )
 @click.pass_context
 def install(context: click.Context) -> None:
@@ -351,9 +387,22 @@ def install(context: click.Context) -> None:
 
 
 @crewai.command()
-def run() -> None:
+@click.option(
+    "-f",
+    "--filename",
+    "trained_agents_file",
+    type=str,
+    default=None,
+    help=(
+        "Path to a trained-agents pickle (produced by `crewai train -f`). "
+        "When set, agents load suggestions from this file instead of the "
+        "default trained_agents_data.pkl. Equivalent to setting "
+        "CREWAI_TRAINED_AGENTS_FILE."
+    ),
+)
+def run(trained_agents_file: str | None) -> None:
     """Run the Crew."""
-    run_crew()
+    run_crew(trained_agents_file=trained_agents_file)
 
 
 @crewai.command()
@@ -432,7 +481,7 @@ def deploy_validate() -> None:
     `crewai deploy push` run automatically, without contacting the platform.
     Exits non-zero if any blocking issues are found.
     """
-    from crewai.cli.deploy.validate import run_validate_command
+    from crewai_cli.deploy.validate import run_validate_command
 
     run_validate_command()
 
@@ -573,14 +622,12 @@ def triggers_run(trigger_path: str) -> None:
 
 @crewai.command()
 def chat() -> None:
-    """
-    Start a conversation with the Crew, collecting user-supplied inputs,
+    """Start a conversation with the Crew, collecting user-supplied inputs,
     and using the Chat LLM to generate responses.
     """
     click.secho(
         "\nStarting a conversation with the Crew\nType 'exit' or Ctrl+C to quit.\n",
     )
-
     run_chat()
 
 
@@ -745,16 +792,14 @@ def traces_enable() -> None:
     from rich.console import Console
     from rich.panel import Panel
 
-    from crewai.events.listeners.tracing.utils import update_user_data
-
     console = Console()
 
     update_user_data({"trace_consent": True, "first_execution_done": True})
 
     panel = Panel(
-        "✅ Trace collection has been enabled!\n\n"
+        "✅ Trace collection enabled.\n\n"
         "Your crew/flow executions will now send traces to CrewAI+.\n"
-        "Use 'crewai traces disable' to turn off trace collection.",
+        "Use 'crewai traces disable' to opt out.",
         title="Traces Enabled",
         border_style="green",
         padding=(1, 2),
@@ -768,16 +813,16 @@ def traces_disable() -> None:
     from rich.console import Console
     from rich.panel import Panel
 
-    from crewai.events.listeners.tracing.utils import update_user_data
-
     console = Console()
 
     update_user_data({"trace_consent": False, "first_execution_done": True})
 
     panel = Panel(
-        "❌ Trace collection has been disabled!\n\n"
-        "Your crew/flow executions will no longer send traces.\n"
-        "Use 'crewai traces enable' to turn trace collection back on.",
+        "❌ Trace collection disabled.\n\n"
+        "Your crew/flow executions will no longer send traces "
+        "(unless [bold]CREWAI_TRACING_ENABLED=true[/bold] is set in the environment, "
+        "which overrides the opt-out).\n"
+        "Use 'crewai traces enable' to opt back in.",
         title="Traces Disabled",
         border_style="red",
         padding=(1, 2),
@@ -793,11 +838,6 @@ def traces_status() -> None:
     from rich.panel import Panel
     from rich.table import Table
 
-    from crewai.events.listeners.tracing.utils import (
-        _load_user_data,
-        is_tracing_enabled,
-    )
-
     console = Console()
     user_data = _load_user_data()
 
@@ -844,13 +884,13 @@ def traces_status() -> None:
 @click.pass_context
 def checkpoint(ctx: click.Context, location: str) -> None:
     """Browse and inspect checkpoints. Launches a TUI when called without a subcommand."""
-    from crewai.cli.checkpoint_cli import _detect_location
+    from crewai_cli.checkpoint_cli import _detect_location
 
     location = _detect_location(location)
     ctx.ensure_object(dict)
     ctx.obj["location"] = location
     if ctx.invoked_subcommand is None:
-        from crewai.cli.checkpoint_tui import run_checkpoint_tui
+        from crewai_cli.checkpoint_tui import run_checkpoint_tui
 
         run_checkpoint_tui(location)
 
@@ -859,7 +899,7 @@ def checkpoint(ctx: click.Context, location: str) -> None:
 @click.argument("location", default="./.checkpoints")
 def checkpoint_list(location: str) -> None:
     """List checkpoints in a directory."""
-    from crewai.cli.checkpoint_cli import _detect_location, list_checkpoints
+    from crewai_cli.checkpoint_cli import _detect_location, list_checkpoints
 
     list_checkpoints(_detect_location(location))
 
@@ -868,7 +908,7 @@ def checkpoint_list(location: str) -> None:
 @click.argument("path", default="./.checkpoints")
 def checkpoint_info(path: str) -> None:
     """Show details of a checkpoint. Pass a file or directory for latest."""
-    from crewai.cli.checkpoint_cli import _detect_location, info_checkpoint
+    from crewai_cli.checkpoint_cli import _detect_location, info_checkpoint
 
     info_checkpoint(_detect_location(path))
 
@@ -878,7 +918,7 @@ def checkpoint_info(path: str) -> None:
 @click.pass_context
 def checkpoint_resume(ctx: click.Context, checkpoint_id: str | None) -> None:
     """Resume from a checkpoint. Defaults to the most recent."""
-    from crewai.cli.checkpoint_cli import resume_checkpoint
+    from crewai_cli.checkpoint_cli import resume_checkpoint
 
     resume_checkpoint(ctx.obj["location"], checkpoint_id)
 
@@ -889,7 +929,7 @@ def checkpoint_resume(ctx: click.Context, checkpoint_id: str | None) -> None:
 @click.pass_context
 def checkpoint_diff(ctx: click.Context, id1: str, id2: str) -> None:
     """Compare two checkpoints side-by-side."""
-    from crewai.cli.checkpoint_cli import diff_checkpoints
+    from crewai_cli.checkpoint_cli import diff_checkpoints
 
     diff_checkpoints(ctx.obj["location"], id1, id2)
 
@@ -911,7 +951,7 @@ def checkpoint_prune(
     ctx: click.Context, keep: int | None, older_than: str | None, dry_run: bool
 ) -> None:
     """Remove old checkpoints."""
-    from crewai.cli.checkpoint_cli import prune_checkpoints
+    from crewai_cli.checkpoint_cli import prune_checkpoints
 
     prune_checkpoints(ctx.obj["location"], keep, older_than, dry_run)
 

lib/cli/src/crewai_cli/command.py

@@ -1,11 +1,13 @@
+from __future__ import annotations
+
 import json
 
+from crewai_core.telemetry import Telemetry
 import httpx
 from rich.console import Console
 
-from crewai.cli.authentication.token import get_auth_token
-from crewai.cli.plus_api import PlusAPI
-from crewai.telemetry.telemetry import Telemetry
+from crewai_cli.authentication.token import get_auth_token
+from crewai_cli.plus_api import PlusAPI
 
 
 console = Console()
@@ -32,11 +34,10 @@ class PlusAPIMixin:
             raise SystemExit from None
 
     def _validate_response(self, response: httpx.Response) -> None:
-        """
-        Handle and display error messages from API responses.
+        """Handle and display error messages from API responses.
 
         Args:
-            response (httpx.Response): The response from the Plus API
+            response: The response from the Plus API.
         """
         try:
             json_response = response.json()

lib/cli/src/crewai_cli/config.py

@@ -0,0 +1,30 @@
+"""Re-exports of shared settings from ``crewai_core.settings``.
+
+Kept as a stable import path for the CLI; new code should import from
+``crewai_core.settings`` directly.
+"""
+
+from __future__ import annotations
+
+from crewai_core.settings import (
+    CLI_SETTINGS_KEYS as CLI_SETTINGS_KEYS,
+    DEFAULT_CLI_SETTINGS as DEFAULT_CLI_SETTINGS,
+    DEFAULT_CONFIG_PATH as DEFAULT_CONFIG_PATH,
+    HIDDEN_SETTINGS_KEYS as HIDDEN_SETTINGS_KEYS,
+    READONLY_SETTINGS_KEYS as READONLY_SETTINGS_KEYS,
+    USER_SETTINGS_KEYS as USER_SETTINGS_KEYS,
+    Settings as Settings,
+    get_writable_config_path as get_writable_config_path,
+)
+
+
+__all__ = [
+    "CLI_SETTINGS_KEYS",
+    "DEFAULT_CLI_SETTINGS",
+    "DEFAULT_CONFIG_PATH",
+    "HIDDEN_SETTINGS_KEYS",
+    "READONLY_SETTINGS_KEYS",
+    "USER_SETTINGS_KEYS",
+    "Settings",
+    "get_writable_config_path",
+]

lib/cli/src/crewai_cli/constants.py

@@ -132,19 +132,44 @@ PROVIDERS: list[str] = [
 
 MODELS: dict[str, list[str]] = {
     "openai": [
-        "gpt-4",
+        "gpt-5.5",
+        "gpt-5.5-pro",
+        "gpt-5.4",
+        "gpt-5.4-pro",
+        "gpt-5.4-mini",
+        "gpt-5.4-nano",
+        "gpt-5.2",
+        "gpt-5.2-pro",
+        "gpt-5.1",
+        "gpt-5",
+        "gpt-5-pro",
+        "gpt-5-mini",
+        "gpt-5-nano",
         "gpt-4.1",
-        "gpt-4.1-mini-2025-04-14",
-        "gpt-4.1-nano-2025-04-14",
+        "gpt-4.1-mini",
+        "gpt-4.1-nano",
         "gpt-4o",
         "gpt-4o-mini",
+        "o4-mini",
+        "o3",
+        "o3-mini",
+        "o1",
         "o1-mini",
         "o1-preview",
+        "gpt-4",
+        "gpt-4.1-mini-2025-04-14",
+        "gpt-4.1-nano-2025-04-14",
     ],
     "anthropic": [
+        "claude-opus-4-6",
+        "claude-sonnet-4-6",
+        "claude-haiku-4-5-20251001",
+        "claude-3-7-sonnet-20250219",
+        "claude-3-5-sonnet-20241022",
+        "claude-3-5-haiku-20241022",
         "claude-3-5-sonnet-20240620",
-        "claude-3-sonnet-20240229",
         "claude-3-opus-20240229",
+        "claude-3-sonnet-20240229",
         "claude-3-haiku-20240307",
     ],
     "gemini": [

lib/cli/src/crewai_cli/create_crew.py

@@ -5,13 +5,13 @@ import sys
 import click
 import tomli
 
-from crewai.cli.constants import ENV_VARS, MODELS
-from crewai.cli.provider import (
+from crewai_cli.constants import ENV_VARS, MODELS
+from crewai_cli.provider import (
     get_provider_data,
     select_model,
     select_provider,
 )
-from crewai.cli.utils import copy_template, load_env_vars, write_env_file
+from crewai_cli.utils import copy_template, load_env_vars, write_env_file
 
 
 def get_reserved_script_names() -> set[str]:

lib/cli/src/crewai_cli/create_flow.py

@@ -2,8 +2,7 @@ from pathlib import Path
 import shutil
 
 import click
-
-from crewai.telemetry import Telemetry
+from crewai_core.telemetry import Telemetry
 
 
 def create_flow(name: str) -> None:
@@ -18,7 +17,6 @@ def create_flow(name: str) -> None:
         click.secho(f"Error: Folder {folder_name} already exists.", fg="red")
         return
 
-    # Initialize telemetry
     telemetry = Telemetry()
     telemetry.flow_creation_span(class_name)
 

lib/cli/src/crewai_cli/crew_chat.py

@@ -0,0 +1,23 @@
+"""Wrapper for the crew chat command.
+
+Delegates to ``crewai.utilities.crew_chat.run_chat`` when the full crewai
+package is installed, otherwise prints a helpful error message.
+"""
+
+from __future__ import annotations
+
+import click
+
+
+def run_chat() -> None:
+    try:
+        from crewai.utilities.crew_chat import run_chat as _run_chat
+    except ImportError:
+        click.secho(
+            "The 'chat' command requires the full crewai package.\n"
+            "Install it with: pip install crewai",
+            fg="red",
+        )
+        raise SystemExit(1) from None
+
+    _run_chat()

lib/cli/src/crewai_cli/deploy/main.py

@@ -2,10 +2,10 @@ from typing import Any
 
 from rich.console import Console
 
-from crewai.cli import git
-from crewai.cli.command import BaseCommand, PlusAPIMixin
-from crewai.cli.deploy.validate import validate_project
-from crewai.cli.utils import fetch_and_json_env_file, get_project_name
+from crewai_cli import git
+from crewai_cli.command import BaseCommand, PlusAPIMixin
+from crewai_cli.deploy.validate import validate_project
+from crewai_cli.utils import fetch_and_json_env_file, get_project_name
 
 
 console = Console()

lib/cli/src/crewai_cli/deploy/validate.py

@@ -40,7 +40,7 @@ from typing import Any
 
 from rich.console import Console
 
-from crewai.cli.utils import parse_toml
+from crewai_cli.utils import parse_toml
 
 
 console = Console()
@@ -438,7 +438,7 @@ class DeployValidator:
             "import json, sys, traceback, os\n"
             "os.chdir(sys.argv[1])\n"
             "try:\n"
-            "    from crewai.cli.utils import get_crews, get_flows\n"
+            "    from crewai.utilities.project_utils import get_crews, get_flows\n"
             "    is_flow = sys.argv[2] == 'flow'\n"
             "    if is_flow:\n"
             "        instances = get_flows()\n"

lib/cli/src/crewai_cli/enterprise/main.py

@@ -4,10 +4,10 @@ from typing import Any, cast
 import httpx
 from rich.console import Console
 
-from crewai.cli.authentication.main import Oauth2Settings, ProviderFactory
-from crewai.cli.command import BaseCommand
-from crewai.cli.settings.main import SettingsCommand
-from crewai.utilities.version import get_crewai_version
+from crewai_cli.authentication.main import Oauth2Settings, ProviderFactory
+from crewai_cli.command import BaseCommand
+from crewai_cli.settings.main import SettingsCommand
+from crewai_cli.version import get_crewai_version
 
 
 console = Console()

lib/cli/src/crewai_cli/evaluate_crew.py

@@ -0,0 +1,41 @@
+import subprocess
+
+import click
+from crewai_core.constants import CREWAI_TRAINED_AGENTS_FILE_ENV
+
+from crewai_cli.utils import build_env_with_all_tool_credentials
+
+
+def evaluate_crew(
+    n_iterations: int, model: str, trained_agents_file: str | None = None
+) -> None:
+    """Test and Evaluate the crew by running a command in the UV environment.
+
+    Args:
+        n_iterations: The number of iterations to test the crew.
+        model: The model to test the crew with.
+        trained_agents_file: Optional trained-agents pickle path forwarded to
+            the subprocess via the ``CREWAI_TRAINED_AGENTS_FILE`` env var.
+    """
+    command = ["uv", "run", "test", str(n_iterations), model]
+    env = build_env_with_all_tool_credentials()
+    if trained_agents_file:
+        env[CREWAI_TRAINED_AGENTS_FILE_ENV] = trained_agents_file
+
+    try:
+        if n_iterations <= 0:
+            raise ValueError("The number of iterations must be a positive integer.")
+
+        result = subprocess.run(  # noqa: S603
+            command, capture_output=False, text=True, check=True, env=env
+        )
+
+        if result.stderr:
+            click.echo(result.stderr, err=True)
+
+    except subprocess.CalledProcessError as e:
+        click.echo(f"An error occurred while testing the crew: {e}", err=True)
+        click.echo(e.output, err=True)
+
+    except Exception as e:
+        click.echo(f"An unexpected error occurred: {e}", err=True)

lib/cli/src/crewai_cli/install_crew.py

@@ -2,7 +2,7 @@ import subprocess
 
 import click
 
-from crewai.cli.utils import build_env_with_all_tool_credentials
+from crewai_cli.utils import build_env_with_all_tool_credentials
 
 
 # Be mindful about changing this.

lib/cli/src/crewai_cli/organization/main.py

@@ -2,8 +2,8 @@ from httpx import HTTPStatusError
 from rich.console import Console
 from rich.table import Table
 
-from crewai.cli.command import BaseCommand, PlusAPIMixin
-from crewai.cli.config import Settings
+from crewai_cli.command import BaseCommand, PlusAPIMixin
+from crewai_cli.config import Settings
 
 
 console = Console()

lib/cli/src/crewai_cli/plus_api.py

@@ -0,0 +1,12 @@
+"""Re-export of ``crewai_core.plus_api.PlusAPI``.
+
+Kept as a stable import path for the CLI; new code should import from
+``crewai_core.plus_api`` directly.
+"""
+
+from __future__ import annotations
+
+from crewai_core.plus_api import PlusAPI as PlusAPI
+
+
+__all__ = ["PlusAPI"]

lib/cli/src/crewai_cli/provider.py

@@ -10,7 +10,7 @@ import certifi
 import click
 import httpx
 
-from crewai.cli.constants import JSON_URL, MODELS, PROVIDERS
+from crewai_cli.constants import JSON_URL, MODELS, PROVIDERS
 
 
 def select_choice(prompt_message: str, choices: Sequence[str]) -> str | None:

lib/cli/src/crewai_cli/remote_template/main.py

@@ -11,7 +11,7 @@ from rich.console import Console
 from rich.panel import Panel
 from rich.text import Text
 
-from crewai.cli.command import BaseCommand
+from crewai_cli.command import BaseCommand
 
 
 logger = logging.getLogger(__name__)

lib/cli/src/crewai_cli/replay_from_task.py

@@ -0,0 +1,34 @@
+import subprocess
+
+import click
+from crewai_core.constants import CREWAI_TRAINED_AGENTS_FILE_ENV
+
+from crewai_cli.utils import build_env_with_all_tool_credentials
+
+
+def replay_task_command(task_id: str, trained_agents_file: str | None = None) -> None:
+    """Replay the crew execution from a specific task.
+
+    Args:
+        task_id: The ID of the task to replay from.
+        trained_agents_file: Optional trained-agents pickle path forwarded to
+            the subprocess via the ``CREWAI_TRAINED_AGENTS_FILE`` env var.
+    """
+    command = ["uv", "run", "replay", task_id]
+    env = build_env_with_all_tool_credentials()
+    if trained_agents_file:
+        env[CREWAI_TRAINED_AGENTS_FILE_ENV] = trained_agents_file
+
+    try:
+        result = subprocess.run(  # noqa: S603
+            command, capture_output=False, text=True, check=True, env=env
+        )
+        if result.stderr:
+            click.echo(result.stderr, err=True)
+
+    except subprocess.CalledProcessError as e:
+        click.echo(f"An error occurred while replaying the task: {e}", err=True)
+        click.echo(e.output, err=True)
+
+    except Exception as e:
+        click.echo(f"An unexpected error occurred: {e}", err=True)

lib/cli/src/crewai_cli/reset_memories_command.py

@@ -0,0 +1,31 @@
+"""Wrapper for the reset-memories command.
+
+Delegates to ``crewai.utilities.reset_memories`` when the full crewai
+package is installed, otherwise prints a helpful error message.
+"""
+
+from __future__ import annotations
+
+import click
+
+
+def reset_memories_command(
+    memory: bool,
+    knowledge: bool,
+    agent_knowledge: bool,
+    kickoff_outputs: bool,
+    all: bool,
+) -> None:
+    try:
+        from crewai.utilities.reset_memories import (
+            reset_memories_command as _reset,
+        )
+    except ImportError:
+        click.secho(
+            "The 'reset-memories' command requires the full crewai package.\n"
+            "Install it with: pip install crewai",
+            fg="red",
+        )
+        raise SystemExit(1) from None
+
+    _reset(memory, knowledge, agent_knowledge, kickoff_outputs, all)

lib/cli/src/crewai_cli/run_crew.py

@@ -2,10 +2,11 @@ from enum import Enum
 import subprocess
 
 import click
+from crewai_core.constants import CREWAI_TRAINED_AGENTS_FILE_ENV
 from packaging import version
 
-from crewai.cli.utils import build_env_with_all_tool_credentials, read_toml
-from crewai.utilities.version import get_crewai_version
+from crewai_cli.utils import build_env_with_all_tool_credentials, read_toml
+from crewai_cli.version import get_crewai_version
 
 
 class CrewType(Enum):
@@ -13,13 +14,18 @@ class CrewType(Enum):
     FLOW = "flow"
 
 
-def run_crew() -> None:
-    """
-    Run the crew or flow by running a command in the UV environment.
+def run_crew(trained_agents_file: str | None = None) -> None:
+    """Run the crew or flow by running a command in the UV environment.
 
     Starting from version 0.103.0, this command can be used to run both
     standard crews and flows. For flows, it detects the type from pyproject.toml
     and automatically runs the appropriate command.
+
+    Args:
+        trained_agents_file: Optional path to a trained-agents pickle produced
+            by ``crewai train -f``. When set, exported as
+            ``CREWAI_TRAINED_AGENTS_FILE`` so agents load suggestions from this
+            file instead of the default ``trained_agents_data.pkl``.
     """
     crewai_version = get_crewai_version()
     min_required_version = "0.71.0"
@@ -43,19 +49,24 @@ def run_crew() -> None:
     click.echo(f"Running the {'Flow' if is_flow else 'Crew'}")
 
     # Execute the appropriate command
-    execute_command(crew_type)
+    execute_command(crew_type, trained_agents_file=trained_agents_file)
 
 
-def execute_command(crew_type: CrewType) -> None:
-    """
-    Execute the appropriate command based on crew type.
+def execute_command(
+    crew_type: CrewType, trained_agents_file: str | None = None
+) -> None:
+    """Execute the appropriate command based on crew type.
 
     Args:
-        crew_type: The type of crew to run
+        crew_type: The type of crew to run.
+        trained_agents_file: Optional trained-agents pickle path forwarded to
+            the subprocess via the ``CREWAI_TRAINED_AGENTS_FILE`` env var.
     """
     command = ["uv", "run", "kickoff" if crew_type == CrewType.FLOW else "run_crew"]
 
     env = build_env_with_all_tool_credentials()
+    if trained_agents_file:
+        env[CREWAI_TRAINED_AGENTS_FILE_ENV] = trained_agents_file
 
     try:
         subprocess.run(command, capture_output=False, text=True, check=True, env=env)  # noqa: S603

lib/cli/src/crewai_cli/settings/main.py

@@ -5,9 +5,9 @@ from typing import Any
 from rich.console import Console
 from rich.table import Table
 
-from crewai.cli.command import BaseCommand
-from crewai.cli.config import HIDDEN_SETTINGS_KEYS, READONLY_SETTINGS_KEYS, Settings
-from crewai.events.listeners.tracing.utils import _load_user_data
+from crewai_cli.command import BaseCommand
+from crewai_cli.config import HIDDEN_SETTINGS_KEYS, READONLY_SETTINGS_KEYS, Settings
+from crewai_cli.user_data import _load_user_data
 
 
 console = Console()
@@ -91,7 +91,7 @@ class SettingsCommand(BaseCommand):
                 style="bold red",
             )
             console.print("Available keys:", style="yellow")
-            for field_name in Settings.model_fields.keys():
+            for field_name in Settings.model_fields:
                 if field_name not in readonly_settings:
                     console.print(f"  - {field_name}", style="yellow")
             raise SystemExit(1)

lib/cli/src/crewai_cli/shared/token_manager.py

@@ -0,0 +1,12 @@
+"""Re-export of ``crewai_core.token_manager.TokenManager``.
+
+Kept as a stable import path for the CLI; new code should import from
+``crewai_core.token_manager`` directly.
+"""
+
+from __future__ import annotations
+
+from crewai_core.token_manager import TokenManager as TokenManager
+
+
+__all__ = ["TokenManager"]

lib/cli/src/crewai_cli/task_outputs.py

@@ -0,0 +1,67 @@
+"""Lightweight SQLite reader for kickoff task outputs.
+
+Only used by the ``crewai log-tasks-outputs`` CLI command.  Depends solely on
+the standard library + *appdirs* so crewai-cli can read stored outputs without
+importing the full crewai framework.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+from pathlib import Path
+import sqlite3
+from typing import Any
+
+from crewai_cli.user_data import _db_storage_path
+
+
+logger = logging.getLogger(__name__)
+
+
+def load_task_outputs(db_path: str | None = None) -> list[dict[str, Any]]:
+    """Return all rows from the kickoff task outputs database."""
+    if db_path is None:
+        db_path = str(Path(_db_storage_path()) / "latest_kickoff_task_outputs.db")
+
+    if not Path(db_path).exists():
+        return []
+
+    try:
+        with sqlite3.connect(db_path) as conn:
+            conn.row_factory = sqlite3.Row
+            cursor = conn.cursor()
+            cursor.execute("""
+                SELECT task_id, expected_output, output, task_index,
+                       inputs, was_replayed, timestamp
+                FROM latest_kickoff_task_outputs
+                ORDER BY task_index
+            """)
+            rows = cursor.fetchall()
+    except sqlite3.Error as e:
+        logger.error("Failed to load task outputs: %s", e)
+        return []
+
+    return [
+        {
+            "task_id": row["task_id"],
+            "expected_output": row["expected_output"],
+            "output": _safe_json_loads(row["output"]),
+            "task_index": row["task_index"],
+            "inputs": _safe_json_loads(row["inputs"]),
+            "was_replayed": row["was_replayed"],
+            "timestamp": row["timestamp"],
+        }
+        for row in rows
+    ]
+
+
+def _safe_json_loads(value: str | None) -> Any:
+    """Decode a JSON column tolerantly: NULL/blank/corrupt → None."""
+    if not value:
+        return None
+    try:
+        return json.loads(value)
+    except (json.JSONDecodeError, TypeError) as e:
+        logger.warning("Failed to decode JSON column: %s", e)
+        return None

lib/cli/src/crewai_cli/templates/AGENTS.md

@@ -774,7 +774,7 @@ def calculator(expression: str) -> str:
 ```
 
 ### Built-in Tools (install with `uv add crewai-tools`)
-Web/Search: SerperDevTool, ScrapeWebsiteTool, WebsiteSearchTool, EXASearchTool, FirecrawlSearchTool
+Web/Search: SerperDevTool, ScrapeWebsiteTool, WebsiteSearchTool, ExaSearchTool, FirecrawlSearchTool
 Documents: FileReadTool, DirectoryReadTool, PDFSearchTool, DOCXSearchTool, CSVSearchTool, JSONSearchTool, XMLSearchTool, MDXSearchTool
 Code: CodeInterpreterTool, CodeDocsSearchTool, GithubSearchTool
 Media: DALL-E Tool, YoutubeChannelSearchTool, YoutubeVideoSearchTool

lib/cli/src/crewai_cli/templates/crew/pyproject.toml

@@ -5,7 +5,7 @@ description = "{{name}} using crewAI"
 authors = [{ name = "Your Name", email = "you@example.com" }]
 requires-python = ">=3.10,<3.14"
 dependencies = [
-    "crewai[tools]==1.14.3a2"
+    "crewai[tools]==1.14.5a2"
 ]
 
 [project.scripts]

lib/cli/src/crewai_cli/templates/flow/pyproject.toml

@@ -5,7 +5,7 @@ description = "{{name}} using crewAI"
 authors = [{ name = "Your Name", email = "you@example.com" }]
 requires-python = ">=3.10,<3.14"
 dependencies = [
-    "crewai[tools]==1.14.3a2"
+    "crewai[tools]==1.14.5a2"
 ]
 
 [project.scripts]

lib/cli/src/crewai_cli/templates/tool/pyproject.toml

@@ -5,7 +5,7 @@ description = "Power up your crews with {{folder_name}}"
 readme = "README.md"
 requires-python = ">=3.10,<3.14"
 dependencies = [
-    "crewai[tools]==1.14.3a2"
+    "crewai[tools]==1.14.5a2"
 ]
 
 [tool.crewai]

lib/cli/src/crewai_cli/tools/main.py

@@ -10,14 +10,12 @@ from typing import Any
 import click
 from rich.console import Console
 
-from crewai.cli import git
-from crewai.cli.command import BaseCommand, PlusAPIMixin
-from crewai.cli.config import Settings
-from crewai.cli.constants import DEFAULT_CREWAI_ENTERPRISE_URL
-from crewai.cli.utils import (
+from crewai_cli import git
+from crewai_cli.command import BaseCommand, PlusAPIMixin
+from crewai_cli.config import Settings
+from crewai_cli.constants import DEFAULT_CREWAI_ENTERPRISE_URL
+from crewai_cli.utils import (
     build_env_with_tool_repository_credentials,
-    extract_available_exports,
-    extract_tools_metadata,
     get_project_description,
     get_project_name,
     get_project_version,
@@ -25,12 +23,37 @@ from crewai.cli.utils import (
     tree_copy,
     tree_find_and_replace,
 )
-from crewai.events.listeners.tracing.utils import get_user_id
 
 
 console = Console()
 
 
+_REQUIRES_CREWAI_MSG = (
+    "[red]This subcommand requires the full crewai package.\n"
+    "Install it with: pip install crewai[/red]"
+)
+
+
+def _require_project_utils() -> Any:
+    try:
+        from crewai.utilities import project_utils
+
+        return project_utils
+    except ImportError:
+        console.print(_REQUIRES_CREWAI_MSG)
+        raise SystemExit(1) from None
+
+
+def _require_get_user_id() -> Any:
+    try:
+        from crewai.events.listeners.tracing.utils import get_user_id
+
+        return get_user_id
+    except ImportError:
+        console.print(_REQUIRES_CREWAI_MSG)
+        raise SystemExit(1) from None
+
+
 class ToolCommand(BaseCommand, PlusAPIMixin):
     """
     A class to handle tool repository related operations for CrewAI projects.
@@ -97,7 +120,8 @@ class ToolCommand(BaseCommand, PlusAPIMixin):
         encoded_tarball = None
 
         console.print("[bold blue]Discovering tools from your project...[/bold blue]")
-        available_exports = extract_available_exports()
+        project_utils = _require_project_utils()
+        available_exports = project_utils.extract_available_exports()
 
         if available_exports:
             console.print(
@@ -106,7 +130,7 @@ class ToolCommand(BaseCommand, PlusAPIMixin):
 
         console.print("[bold blue]Extracting tool metadata...[/bold blue]")
         try:
-            tools_metadata = extract_tools_metadata()
+            tools_metadata = project_utils.extract_tools_metadata()
         except Exception as e:
             console.print(
                 f"[yellow]Warning: Could not extract tool metadata: {e}[/yellow]\n"
@@ -200,6 +224,7 @@ class ToolCommand(BaseCommand, PlusAPIMixin):
         console.print(f"Successfully installed {handle}", style="bold green")
 
     def login(self) -> None:
+        get_user_id = _require_get_user_id()
         login_response = self.plus_api_client.login_to_tool_repository(
             user_identifier=get_user_id()
         )

lib/cli/src/crewai_cli/triggers/__init__.py

@@ -1,6 +1,6 @@
 """Triggers command module for CrewAI CLI."""
 
-from crewai.cli.triggers.main import TriggersCommand
+from crewai_cli.triggers.main import TriggersCommand
 
 
 __all__ = ["TriggersCommand"]

lib/cli/src/crewai_cli/triggers/main.py

@@ -5,7 +5,7 @@ from typing import Any
 from rich.console import Console
 from rich.table import Table
 
-from crewai.cli.command import BaseCommand, PlusAPIMixin
+from crewai_cli.command import BaseCommand, PlusAPIMixin
 
 
 console = Console()

lib/cli/src/crewai_cli/update_crew.py

@@ -4,7 +4,7 @@ from typing import Any
 
 import tomli_w
 
-from crewai.cli.utils import read_toml
+from crewai_cli.utils import read_toml
 
 
 def update_crew() -> None:

lib/cli/src/crewai_cli/user_data.py

@@ -0,0 +1,22 @@
+"""User-data helpers — re-exported from ``crewai_core.user_data``."""
+
+from __future__ import annotations
+
+from crewai_core.paths import db_storage_path as _db_storage_path
+from crewai_core.user_data import (
+    _load_user_data as _load_user_data,
+    _save_user_data as _save_user_data,
+    has_user_declined_tracing as has_user_declined_tracing,
+    is_tracing_enabled as is_tracing_enabled,
+    update_user_data as update_user_data,
+)
+
+
+__all__ = [
+    "_db_storage_path",
+    "_load_user_data",
+    "_save_user_data",
+    "has_user_declined_tracing",
+    "is_tracing_enabled",
+    "update_user_data",
+]

lib/cli/src/crewai_cli/utils.py

@@ -0,0 +1,137 @@
+from __future__ import annotations
+
+import os
+from pathlib import Path
+import shutil
+from typing import Any
+
+import click
+from crewai_core.project import (
+    get_project_description as get_project_description,
+    get_project_name as get_project_name,
+    get_project_version as get_project_version,
+    parse_toml as parse_toml,
+    read_toml as read_toml,
+)
+from crewai_core.tool_credentials import (
+    build_env_with_all_tool_credentials as build_env_with_all_tool_credentials,
+    build_env_with_tool_repository_credentials as build_env_with_tool_repository_credentials,
+)
+from rich.console import Console
+
+
+__all__ = [
+    "build_env_with_all_tool_credentials",
+    "build_env_with_tool_repository_credentials",
+    "copy_template",
+    "fetch_and_json_env_file",
+    "get_project_description",
+    "get_project_name",
+    "get_project_version",
+    "load_env_vars",
+    "parse_toml",
+    "read_toml",
+    "tree_copy",
+    "tree_find_and_replace",
+    "write_env_file",
+]
+
+
+console = Console()
+
+
+def copy_template(
+    src: Path, dst: Path, name: str, class_name: str, folder_name: str
+) -> None:
+    """Copy a file from src to dst."""
+    with open(src, "r") as file:
+        content = file.read()
+
+    content = content.replace("{{name}}", name)
+    content = content.replace("{{crew_name}}", class_name)
+    content = content.replace("{{folder_name}}", folder_name)
+
+    with open(dst, "w") as file:
+        file.write(content)
+
+    click.secho(f"  - Created {dst}", fg="green")
+
+
+def fetch_and_json_env_file(env_file_path: str = ".env") -> dict[str, Any]:
+    """Fetch the environment variables from a .env file and return them as a dictionary."""
+    try:
+        with open(env_file_path, "r") as f:
+            env_content = f.read()
+
+        env_dict = {}
+        for line in env_content.splitlines():
+            if line.strip() and not line.strip().startswith("#"):
+                key, value = line.split("=", 1)
+                env_dict[key.strip()] = value.strip()
+
+        return env_dict
+
+    except FileNotFoundError:
+        console.print(f"Error: {env_file_path} not found.", style="bold red")
+    except Exception as e:
+        console.print(f"Error reading the .env file: {e}", style="bold red")
+
+    return {}
+
+
+def tree_copy(source: Path, destination: Path) -> None:
+    """Copies the entire directory structure from the source to the destination."""
+    for item in os.listdir(source):
+        source_item = os.path.join(source, item)
+        destination_item = os.path.join(destination, item)
+        if os.path.isdir(source_item):
+            shutil.copytree(source_item, destination_item)
+        else:
+            shutil.copy2(source_item, destination_item)
+
+
+def tree_find_and_replace(directory: Path, find: str, replace: str) -> None:
+    """Recursively searches through a directory, replacing a target string in
+    both file contents and filenames with a specified replacement string.
+    """
+    for path, dirs, files in os.walk(os.path.abspath(directory), topdown=False):
+        for filename in files:
+            filepath = os.path.join(path, filename)
+
+            with open(filepath, "r", encoding="utf-8", errors="ignore") as file:
+                contents = file.read()
+            with open(filepath, "w") as file:
+                file.write(contents.replace(find, replace))
+
+            if find in filename:
+                new_filename = filename.replace(find, replace)
+                new_filepath = os.path.join(path, new_filename)
+                os.rename(filepath, new_filepath)
+
+        for dirname in dirs:
+            if find in dirname:
+                new_dirname = dirname.replace(find, replace)
+                new_dirpath = os.path.join(path, new_dirname)
+                old_dirpath = os.path.join(path, dirname)
+                os.rename(old_dirpath, new_dirpath)
+
+
+def load_env_vars(folder_path: Path) -> dict[str, Any]:
+    """Loads environment variables from a .env file in the specified folder path."""
+    env_file_path = folder_path / ".env"
+    env_vars = {}
+    if env_file_path.exists():
+        with open(env_file_path, "r") as file:
+            for line in file:
+                key, _, value = line.strip().partition("=")
+                if key and value:
+                    env_vars[key] = value
+    return env_vars
+
+
+def write_env_file(folder_path: Path, env_vars: dict[str, Any]) -> None:
+    """Writes environment variables to a .env file in the specified folder."""
+    env_file_path = folder_path / ".env"
+    with open(env_file_path, "w") as file:
+        for key, value in env_vars.items():
+            file.write(f"{key.upper()}={value}\n")

lib/cli/src/crewai_cli/version.py

@@ -0,0 +1,24 @@
+"""Re-exports of version utilities from ``crewai_core.version``.
+
+Kept as a stable import path for the CLI; new code should import from
+``crewai_core.version`` directly.
+"""
+
+from __future__ import annotations
+
+from crewai_core.version import (
+    check_version as check_version,
+    get_crewai_version as get_crewai_version,
+    get_latest_version_from_pypi as get_latest_version_from_pypi,
+    is_current_version_yanked as is_current_version_yanked,
+    is_newer_version_available as is_newer_version_available,
+)
+
+
+__all__ = [
+    "check_version",
+    "get_crewai_version",
+    "get_latest_version_from_pypi",
+    "is_current_version_yanked",
+    "is_newer_version_available",
+]

lib/cli/tests/authentication/providers/test_auth0.py

@@ -0,0 +1,91 @@
+import pytest
+from crewai_cli.authentication.main import Oauth2Settings
+from crewai_cli.authentication.providers.auth0 import Auth0Provider
+
+
+
+class TestAuth0Provider:
+
+    @pytest.fixture(autouse=True)
+    def setup_method(self):
+        self.valid_settings = Oauth2Settings(
+            provider="auth0",
+            domain="test-domain.auth0.com",
+            client_id="test-client-id",
+            audience="test-audience"
+        )
+        self.provider = Auth0Provider(self.valid_settings)
+
+    def test_initialization_with_valid_settings(self):
+        provider = Auth0Provider(self.valid_settings)
+        assert provider.settings == self.valid_settings
+        assert provider.settings.provider == "auth0"
+        assert provider.settings.domain == "test-domain.auth0.com"
+        assert provider.settings.client_id == "test-client-id"
+        assert provider.settings.audience == "test-audience"
+
+    def test_get_authorize_url(self):
+        expected_url = "https://test-domain.auth0.com/oauth/device/code"
+        assert self.provider.get_authorize_url() == expected_url
+
+    def test_get_authorize_url_with_different_domain(self):
+        settings = Oauth2Settings(
+            provider="auth0",
+            domain="my-company.auth0.com",
+            client_id="test-client",
+            audience="test-audience"
+        )
+        provider = Auth0Provider(settings)
+        expected_url = "https://my-company.auth0.com/oauth/device/code"
+        assert provider.get_authorize_url() == expected_url
+
+    def test_get_token_url(self):
+        expected_url = "https://test-domain.auth0.com/oauth/token"
+        assert self.provider.get_token_url() == expected_url
+
+    def test_get_token_url_with_different_domain(self):
+        settings = Oauth2Settings(
+            provider="auth0",
+            domain="another-domain.auth0.com",
+            client_id="test-client",
+            audience="test-audience"
+        )
+        provider = Auth0Provider(settings)
+        expected_url = "https://another-domain.auth0.com/oauth/token"
+        assert provider.get_token_url() == expected_url
+
+    def test_get_jwks_url(self):
+        expected_url = "https://test-domain.auth0.com/.well-known/jwks.json"
+        assert self.provider.get_jwks_url() == expected_url
+
+    def test_get_jwks_url_with_different_domain(self):
+        settings = Oauth2Settings(
+            provider="auth0",
+            domain="dev.auth0.com",
+            client_id="test-client",
+            audience="test-audience"
+        )
+        provider = Auth0Provider(settings)
+        expected_url = "https://dev.auth0.com/.well-known/jwks.json"
+        assert provider.get_jwks_url() == expected_url
+
+    def test_get_issuer(self):
+        expected_issuer = "https://test-domain.auth0.com/"
+        assert self.provider.get_issuer() == expected_issuer
+
+    def test_get_issuer_with_different_domain(self):
+        settings = Oauth2Settings(
+            provider="auth0",
+            domain="prod.auth0.com",
+            client_id="test-client",
+            audience="test-audience"
+        )
+        provider = Auth0Provider(settings)
+        expected_issuer = "https://prod.auth0.com/"
+        assert provider.get_issuer() == expected_issuer
+
+    def test_get_audience(self):
+        assert self.provider.get_audience() == "test-audience"
+
+    def test_get_client_id(self):
+        assert self.provider.get_client_id() == "test-client-id"

lib/cli/tests/authentication/providers/test_entra_id.py

@@ -0,0 +1,141 @@
+import pytest
+
+from crewai_cli.authentication.main import Oauth2Settings
+from crewai_cli.authentication.providers.entra_id import EntraIdProvider
+
+
+class TestEntraIdProvider:
+    @pytest.fixture(autouse=True)
+    def setup_method(self):
+        self.valid_settings = Oauth2Settings(
+            provider="entra_id",
+            domain="tenant-id-abcdef123456",
+            client_id="test-client-id",
+            audience="test-audience",
+            extra={
+                "scope": "openid profile email api://crewai-cli-dev/read"
+            }
+        )
+        self.provider = EntraIdProvider(self.valid_settings)
+
+    def test_initialization_with_valid_settings(self):
+        provider = EntraIdProvider(self.valid_settings)
+        assert provider.settings == self.valid_settings
+        assert provider.settings.provider == "entra_id"
+        assert provider.settings.domain == "tenant-id-abcdef123456"
+        assert provider.settings.client_id == "test-client-id"
+        assert provider.settings.audience == "test-audience"
+
+    def test_get_authorize_url(self):
+        expected_url = "https://login.microsoftonline.com/tenant-id-abcdef123456/oauth2/v2.0/devicecode"
+        assert self.provider.get_authorize_url() == expected_url
+
+    def test_get_authorize_url_with_different_domain(self):
+        # For EntraID, the domain is the tenant ID.
+        settings = Oauth2Settings(
+            provider="entra_id",
+            domain="my-company.entra.id",
+            client_id="test-client",
+            audience="test-audience",
+        )
+        provider = EntraIdProvider(settings)
+        expected_url = "https://login.microsoftonline.com/my-company.entra.id/oauth2/v2.0/devicecode"
+        assert provider.get_authorize_url() == expected_url
+    
+    def test_get_token_url(self):
+        expected_url = "https://login.microsoftonline.com/tenant-id-abcdef123456/oauth2/v2.0/token"
+        assert self.provider.get_token_url() == expected_url
+
+    def test_get_token_url_with_different_domain(self):
+        # For EntraID, the domain is the tenant ID.
+        settings = Oauth2Settings(
+            provider="entra_id",
+            domain="another-domain.entra.id",
+            client_id="test-client",
+            audience="test-audience",
+        )
+        provider = EntraIdProvider(settings)
+        expected_url = "https://login.microsoftonline.com/another-domain.entra.id/oauth2/v2.0/token"
+        assert provider.get_token_url() == expected_url
+
+    def test_get_jwks_url(self):
+        expected_url = "https://login.microsoftonline.com/tenant-id-abcdef123456/discovery/v2.0/keys"
+        assert self.provider.get_jwks_url() == expected_url
+
+    def test_get_jwks_url_with_different_domain(self):
+        # For EntraID, the domain is the tenant ID.
+        settings = Oauth2Settings(
+            provider="entra_id",
+            domain="dev.entra.id",
+            client_id="test-client",
+            audience="test-audience",
+        )
+        provider = EntraIdProvider(settings)
+        expected_url = "https://login.microsoftonline.com/dev.entra.id/discovery/v2.0/keys"
+        assert provider.get_jwks_url() == expected_url
+
+    def test_get_issuer(self):
+        expected_issuer = "https://login.microsoftonline.com/tenant-id-abcdef123456/v2.0"
+        assert self.provider.get_issuer() == expected_issuer
+
+    def test_get_issuer_with_different_domain(self):
+        # For EntraID, the domain is the tenant ID.
+        settings = Oauth2Settings(
+            provider="entra_id",
+            domain="other-tenant-id-xpto",
+            client_id="test-client",
+            audience="test-audience",
+        )
+        provider = EntraIdProvider(settings)
+        expected_issuer = "https://login.microsoftonline.com/other-tenant-id-xpto/v2.0"
+        assert provider.get_issuer() == expected_issuer
+
+    def test_get_audience(self):
+        assert self.provider.get_audience() == "test-audience"
+
+    def test_get_audience_assertion_error_when_none(self):
+        settings = Oauth2Settings(
+            provider="entra_id",
+            domain="test-tenant-id",
+            client_id="test-client-id",
+            audience=None,
+        )
+        provider = EntraIdProvider(settings)
+
+        with pytest.raises(ValueError, match="Audience is required"):
+            provider.get_audience()
+
+    def test_get_client_id(self):
+        assert self.provider.get_client_id() == "test-client-id"
+
+    def test_get_required_fields(self):
+        assert set(self.provider.get_required_fields()) == set(["scope"]) 
+
+    def test_get_oauth_scopes(self):
+        settings = Oauth2Settings(
+            provider="entra_id",
+            domain="tenant-id-abcdef123456",
+            client_id="test-client-id",
+            audience="test-audience",
+            extra={
+                "scope": "api://crewai-cli-dev/read"
+            }
+        )
+        provider = EntraIdProvider(settings)
+        assert provider.get_oauth_scopes() == ["openid", "profile", "email", "api://crewai-cli-dev/read"]
+    
+    def test_get_oauth_scopes_with_multiple_custom_scopes(self):
+        settings = Oauth2Settings(  
+            provider="entra_id",
+            domain="tenant-id-abcdef123456",
+            client_id="test-client-id",
+            audience="test-audience",
+            extra={
+                "scope": "api://crewai-cli-dev/read api://crewai-cli-dev/write custom-scope1 custom-scope2"
+            }
+        )
+        provider = EntraIdProvider(settings)
+        assert provider.get_oauth_scopes() == ["openid", "profile", "email", "api://crewai-cli-dev/read", "api://crewai-cli-dev/write", "custom-scope1", "custom-scope2"]
+
+    def test_base_url(self):
+        assert self.provider._base_url() == "https://login.microsoftonline.com/tenant-id-abcdef123456"

lib/cli/tests/authentication/providers/test_keycloak.py

@@ -0,0 +1,138 @@
+import pytest
+
+from crewai_cli.authentication.main import Oauth2Settings
+from crewai_cli.authentication.providers.keycloak import KeycloakProvider
+
+
+class TestKeycloakProvider:
+    @pytest.fixture(autouse=True)
+    def setup_method(self):
+        self.valid_settings = Oauth2Settings(
+            provider="keycloak",
+            domain="keycloak.example.com",
+            client_id="test-client-id",
+            audience="test-audience",
+            extra={
+                "realm": "test-realm"
+            }
+        )
+        self.provider = KeycloakProvider(self.valid_settings)
+
+    def test_initialization_with_valid_settings(self):
+        provider = KeycloakProvider(self.valid_settings)
+        assert provider.settings == self.valid_settings
+        assert provider.settings.provider == "keycloak"
+        assert provider.settings.domain == "keycloak.example.com"
+        assert provider.settings.client_id == "test-client-id"
+        assert provider.settings.audience == "test-audience"
+        assert provider.settings.extra.get("realm") == "test-realm"
+
+    def test_get_authorize_url(self):
+        expected_url = "https://keycloak.example.com/realms/test-realm/protocol/openid-connect/auth/device"
+        assert self.provider.get_authorize_url() == expected_url
+
+    def test_get_authorize_url_with_different_domain(self):
+        settings = Oauth2Settings(
+            provider="keycloak",
+            domain="auth.company.com",
+            client_id="test-client",
+            audience="test-audience",
+            extra={
+                "realm": "my-realm"
+            }
+        )
+        provider = KeycloakProvider(settings)
+        expected_url = "https://auth.company.com/realms/my-realm/protocol/openid-connect/auth/device"
+        assert provider.get_authorize_url() == expected_url
+
+    def test_get_token_url(self):
+        expected_url = "https://keycloak.example.com/realms/test-realm/protocol/openid-connect/token"
+        assert self.provider.get_token_url() == expected_url
+
+    def test_get_token_url_with_different_domain(self):
+        settings = Oauth2Settings(
+            provider="keycloak",
+            domain="sso.enterprise.com",
+            client_id="test-client",
+            audience="test-audience",
+            extra={
+                "realm": "enterprise-realm"
+            }
+        )
+        provider = KeycloakProvider(settings)
+        expected_url = "https://sso.enterprise.com/realms/enterprise-realm/protocol/openid-connect/token"
+        assert provider.get_token_url() == expected_url
+
+    def test_get_jwks_url(self):
+        expected_url = "https://keycloak.example.com/realms/test-realm/protocol/openid-connect/certs"
+        assert self.provider.get_jwks_url() == expected_url
+
+    def test_get_jwks_url_with_different_domain(self):
+        settings = Oauth2Settings(
+            provider="keycloak",
+            domain="identity.org",
+            client_id="test-client",
+            audience="test-audience",
+            extra={
+                "realm": "org-realm"
+            }
+        )
+        provider = KeycloakProvider(settings)
+        expected_url = "https://identity.org/realms/org-realm/protocol/openid-connect/certs"
+        assert provider.get_jwks_url() == expected_url
+
+    def test_get_issuer(self):
+        expected_issuer = "https://keycloak.example.com/realms/test-realm"
+        assert self.provider.get_issuer() == expected_issuer
+
+    def test_get_issuer_with_different_domain(self):
+        settings = Oauth2Settings(
+            provider="keycloak",
+            domain="login.myapp.io",
+            client_id="test-client",
+            audience="test-audience",
+            extra={
+                "realm": "app-realm"
+            }
+        )
+        provider = KeycloakProvider(settings)
+        expected_issuer = "https://login.myapp.io/realms/app-realm"
+        assert provider.get_issuer() == expected_issuer
+
+    def test_get_audience(self):
+        assert self.provider.get_audience() == "test-audience"
+
+    def test_get_client_id(self):
+        assert self.provider.get_client_id() == "test-client-id"
+
+    def test_get_required_fields(self):
+        assert self.provider.get_required_fields() == ["realm"]
+
+    def test_oauth2_base_url(self):
+        assert self.provider._oauth2_base_url() == "https://keycloak.example.com"
+
+    def test_oauth2_base_url_strips_https_prefix(self):
+        settings = Oauth2Settings(
+            provider="keycloak",
+            domain="https://keycloak.example.com",
+            client_id="test-client-id",
+            audience="test-audience",
+            extra={
+                "realm": "test-realm"
+            }
+        )
+        provider = KeycloakProvider(settings)
+        assert provider._oauth2_base_url() == "https://keycloak.example.com"
+
+    def test_oauth2_base_url_strips_http_prefix(self):
+        settings = Oauth2Settings(
+            provider="keycloak",
+            domain="http://keycloak.example.com",
+            client_id="test-client-id",
+            audience="test-audience",
+            extra={
+                "realm": "test-realm"
+            }
+        )
+        provider = KeycloakProvider(settings)
+        assert provider._oauth2_base_url() == "https://keycloak.example.com"

lib/cli/tests/authentication/providers/test_okta.py

@@ -0,0 +1,257 @@
+import pytest
+
+from crewai_cli.authentication.main import Oauth2Settings
+from crewai_cli.authentication.providers.okta import OktaProvider
+
+
+class TestOktaProvider:
+    @pytest.fixture(autouse=True)
+    def setup_method(self):
+        self.valid_settings = Oauth2Settings(
+            provider="okta",
+            domain="test-domain.okta.com",
+            client_id="test-client-id",
+            audience="test-audience",
+        )
+        self.provider = OktaProvider(self.valid_settings)
+
+    def test_initialization_with_valid_settings(self):
+        provider = OktaProvider(self.valid_settings)
+        assert provider.settings == self.valid_settings
+        assert provider.settings.provider == "okta"
+        assert provider.settings.domain == "test-domain.okta.com"
+        assert provider.settings.client_id == "test-client-id"
+        assert provider.settings.audience == "test-audience"
+
+    def test_get_authorize_url(self):
+        expected_url = "https://test-domain.okta.com/oauth2/default/v1/device/authorize"
+        assert self.provider.get_authorize_url() == expected_url
+
+    def test_get_authorize_url_with_different_domain(self):
+        settings = Oauth2Settings(
+            provider="okta",
+            domain="my-company.okta.com",
+            client_id="test-client",
+            audience="test-audience",
+        )
+        provider = OktaProvider(settings)
+        expected_url = "https://my-company.okta.com/oauth2/default/v1/device/authorize"
+        assert provider.get_authorize_url() == expected_url
+    
+    def test_get_authorize_url_with_custom_authorization_server_name(self):
+        settings = Oauth2Settings(
+            provider="okta",
+            domain="test-domain.okta.com",
+            client_id="test-client-id",
+            audience=None,
+            extra={
+                "using_org_auth_server": False,
+                "authorization_server_name": "my_auth_server_xxxAAA777"
+            }
+        )
+        provider = OktaProvider(settings)
+        expected_url = "https://test-domain.okta.com/oauth2/my_auth_server_xxxAAA777/v1/device/authorize"
+        assert provider.get_authorize_url() == expected_url
+
+    def test_get_authorize_url_when_using_org_auth_server(self):
+        settings = Oauth2Settings(
+            provider="okta",
+            domain="test-domain.okta.com",
+            client_id="test-client-id",
+            audience=None,
+            extra={
+                "using_org_auth_server": True,
+                "authorization_server_name": None
+            }
+        )
+        provider = OktaProvider(settings)
+        expected_url = "https://test-domain.okta.com/oauth2/v1/device/authorize"
+        assert provider.get_authorize_url() == expected_url
+
+    def test_get_token_url(self):
+        expected_url = "https://test-domain.okta.com/oauth2/default/v1/token"
+        assert self.provider.get_token_url() == expected_url
+
+    def test_get_token_url_with_different_domain(self):
+        settings = Oauth2Settings(
+            provider="okta",
+            domain="another-domain.okta.com",
+            client_id="test-client",
+            audience="test-audience",
+        )
+        provider = OktaProvider(settings)
+        expected_url = "https://another-domain.okta.com/oauth2/default/v1/token"
+        assert provider.get_token_url() == expected_url
+
+    def test_get_token_url_with_custom_authorization_server_name(self):
+        settings = Oauth2Settings(
+            provider="okta",
+            domain="test-domain.okta.com",
+            client_id="test-client-id",
+            audience=None,
+            extra={
+                "using_org_auth_server": False,
+                "authorization_server_name": "my_auth_server_xxxAAA777"
+            }
+        )
+        provider = OktaProvider(settings)
+        expected_url = "https://test-domain.okta.com/oauth2/my_auth_server_xxxAAA777/v1/token"
+        assert provider.get_token_url() == expected_url
+
+    def test_get_token_url_when_using_org_auth_server(self):
+        settings = Oauth2Settings(
+            provider="okta",
+            domain="test-domain.okta.com",
+            client_id="test-client-id",
+            audience=None,
+            extra={
+                "using_org_auth_server": True,
+                "authorization_server_name": None
+            }
+        )
+        provider = OktaProvider(settings)
+        expected_url = "https://test-domain.okta.com/oauth2/v1/token"
+        assert provider.get_token_url() == expected_url
+
+    def test_get_jwks_url(self):
+        expected_url = "https://test-domain.okta.com/oauth2/default/v1/keys"
+        assert self.provider.get_jwks_url() == expected_url
+
+    def test_get_jwks_url_with_different_domain(self):
+        settings = Oauth2Settings(
+            provider="okta",
+            domain="dev.okta.com",
+            client_id="test-client",
+            audience="test-audience",
+        )
+        provider = OktaProvider(settings)
+        expected_url = "https://dev.okta.com/oauth2/default/v1/keys"
+        assert provider.get_jwks_url() == expected_url
+
+    def test_get_jwks_url_with_custom_authorization_server_name(self):
+        settings = Oauth2Settings(
+            provider="okta",
+            domain="test-domain.okta.com",
+            client_id="test-client-id",
+            audience=None,
+            extra={
+                "using_org_auth_server": False,
+                "authorization_server_name": "my_auth_server_xxxAAA777"
+            }
+        )
+        provider = OktaProvider(settings)
+        expected_url = "https://test-domain.okta.com/oauth2/my_auth_server_xxxAAA777/v1/keys"
+        assert provider.get_jwks_url() == expected_url
+
+    def test_get_jwks_url_when_using_org_auth_server(self):
+        settings = Oauth2Settings(
+            provider="okta",
+            domain="test-domain.okta.com",
+            client_id="test-client-id",
+            audience=None,
+            extra={
+                "using_org_auth_server": True,
+                "authorization_server_name": None
+            }
+        )
+        provider = OktaProvider(settings)
+        expected_url = "https://test-domain.okta.com/oauth2/v1/keys"
+        assert provider.get_jwks_url() == expected_url
+
+    def test_get_issuer(self):
+        expected_issuer = "https://test-domain.okta.com/oauth2/default"
+        assert self.provider.get_issuer() == expected_issuer
+
+    def test_get_issuer_with_different_domain(self):
+        settings = Oauth2Settings(
+            provider="okta",
+            domain="prod.okta.com",
+            client_id="test-client",
+            audience="test-audience",
+        )
+        provider = OktaProvider(settings)
+        expected_issuer = "https://prod.okta.com/oauth2/default"
+        assert provider.get_issuer() == expected_issuer
+
+    def test_get_issuer_with_custom_authorization_server_name(self):
+        settings = Oauth2Settings(
+            provider="okta",
+            domain="test-domain.okta.com",
+            client_id="test-client-id",
+            audience=None,
+            extra={
+                "using_org_auth_server": False,
+                "authorization_server_name": "my_auth_server_xxxAAA777"
+            }
+        )
+        provider = OktaProvider(settings)
+        expected_issuer = "https://test-domain.okta.com/oauth2/my_auth_server_xxxAAA777"
+        assert provider.get_issuer() == expected_issuer
+
+    def test_get_issuer_when_using_org_auth_server(self):
+        settings = Oauth2Settings(
+            provider="okta",
+            domain="test-domain.okta.com",
+            client_id="test-client-id",
+            audience=None,
+            extra={
+                "using_org_auth_server": True,
+                "authorization_server_name": None
+            }
+        )
+        provider = OktaProvider(settings)
+        expected_issuer = "https://test-domain.okta.com"
+        assert provider.get_issuer() == expected_issuer
+
+    def test_get_audience(self):
+        assert self.provider.get_audience() == "test-audience"
+
+    def test_get_audience_assertion_error_when_none(self):
+        settings = Oauth2Settings(
+            provider="okta",
+            domain="test-domain.okta.com",
+            client_id="test-client-id",
+            audience=None,
+        )
+        provider = OktaProvider(settings)
+
+        with pytest.raises(ValueError, match="Audience is required"):
+            provider.get_audience()
+
+    def test_get_client_id(self):
+        assert self.provider.get_client_id() == "test-client-id"
+
+    def test_get_required_fields(self):
+        assert set(self.provider.get_required_fields()) == set(["authorization_server_name", "using_org_auth_server"]) 
+    
+    def test_oauth2_base_url(self):
+        assert self.provider._oauth2_base_url() == "https://test-domain.okta.com/oauth2/default"
+    
+    def test_oauth2_base_url_with_custom_authorization_server_name(self):
+        settings = Oauth2Settings(
+            provider="okta",
+            domain="test-domain.okta.com",
+            client_id="test-client-id",
+            audience=None,
+            extra={
+                "using_org_auth_server": False,
+                "authorization_server_name": "my_auth_server_xxxAAA777"
+            }
+        )
+
+        provider = OktaProvider(settings)
+        assert provider._oauth2_base_url() == "https://test-domain.okta.com/oauth2/my_auth_server_xxxAAA777"
+
+    def test_oauth2_base_url_when_using_org_auth_server(self):
+        settings = Oauth2Settings(
+            provider="okta",
+            domain="test-domain.okta.com",
+            client_id="test-client-id",
+            audience=None,
+            extra={
+                "using_org_auth_server": True,
+                "authorization_server_name": None
+            }
+        )
+        provider = OktaProvider(settings)
+        assert provider._oauth2_base_url() == "https://test-domain.okta.com/oauth2"

lib/cli/tests/authentication/providers/test_workos.py

@@ -0,0 +1,100 @@
+import pytest
+from crewai_cli.authentication.main import Oauth2Settings
+from crewai_cli.authentication.providers.workos import WorkosProvider
+
+
+class TestWorkosProvider:
+
+    @pytest.fixture(autouse=True)
+    def setup_method(self):
+        self.valid_settings = Oauth2Settings(
+            provider="workos",
+            domain="login.company.com",
+            client_id="test-client-id",
+            audience="test-audience"
+        )
+        self.provider = WorkosProvider(self.valid_settings)
+
+    def test_initialization_with_valid_settings(self):
+        provider = WorkosProvider(self.valid_settings)
+        assert provider.settings == self.valid_settings
+        assert provider.settings.provider == "workos"
+        assert provider.settings.domain == "login.company.com"
+        assert provider.settings.client_id == "test-client-id"
+        assert provider.settings.audience == "test-audience"
+
+    def test_get_authorize_url(self):
+        expected_url = "https://login.company.com/oauth2/device_authorization"
+        assert self.provider.get_authorize_url() == expected_url
+
+    def test_get_authorize_url_with_different_domain(self):
+        settings = Oauth2Settings(
+            provider="workos",
+            domain="login.example.com",
+            client_id="test-client",
+            audience="test-audience"
+        )
+        provider = WorkosProvider(settings)
+        expected_url = "https://login.example.com/oauth2/device_authorization"
+        assert provider.get_authorize_url() == expected_url
+
+    def test_get_token_url(self):
+        expected_url = "https://login.company.com/oauth2/token"
+        assert self.provider.get_token_url() == expected_url
+
+    def test_get_token_url_with_different_domain(self):
+        settings = Oauth2Settings(
+            provider="workos",
+            domain="api.workos.com",
+            client_id="test-client",
+            audience="test-audience"
+        )
+        provider = WorkosProvider(settings)
+        expected_url = "https://api.workos.com/oauth2/token"
+        assert provider.get_token_url() == expected_url
+
+    def test_get_jwks_url(self):
+        expected_url = "https://login.company.com/oauth2/jwks"
+        assert self.provider.get_jwks_url() == expected_url
+
+    def test_get_jwks_url_with_different_domain(self):
+        settings = Oauth2Settings(
+            provider="workos",
+            domain="auth.enterprise.com",
+            client_id="test-client",
+            audience="test-audience"
+        )
+        provider = WorkosProvider(settings)
+        expected_url = "https://auth.enterprise.com/oauth2/jwks"
+        assert provider.get_jwks_url() == expected_url
+
+    def test_get_issuer(self):
+        expected_issuer = "https://login.company.com"
+        assert self.provider.get_issuer() == expected_issuer
+
+    def test_get_issuer_with_different_domain(self):
+        settings = Oauth2Settings(
+            provider="workos",
+            domain="sso.company.com",
+            client_id="test-client",
+            audience="test-audience"
+        )
+        provider = WorkosProvider(settings)
+        expected_issuer = "https://sso.company.com"
+        assert provider.get_issuer() == expected_issuer
+
+    def test_get_audience(self):
+        assert self.provider.get_audience() == "test-audience"
+
+    def test_get_audience_fallback_to_default(self):
+        settings = Oauth2Settings(
+            provider="workos",
+            domain="login.company.com",
+            client_id="test-client-id",
+            audience=None
+        )
+        provider = WorkosProvider(settings)
+        assert provider.get_audience() == ""
+
+    def test_get_client_id(self):
+        assert self.provider.get_client_id() == "test-client-id"

lib/cli/tests/authentication/test_auth_main.py

@@ -3,8 +3,8 @@ from unittest.mock import MagicMock, call, patch
 
 import pytest
 import httpx
-from crewai.cli.authentication.main import AuthenticationCommand
-from crewai.cli.constants import (
+from crewai_cli.authentication.main import AuthenticationCommand
+from crewai_cli.constants import (
     CREWAI_ENTERPRISE_DEFAULT_OAUTH2_AUDIENCE,
     CREWAI_ENTERPRISE_DEFAULT_OAUTH2_CLIENT_ID,
     CREWAI_ENTERPRISE_DEFAULT_OAUTH2_DOMAIN,
@@ -13,10 +13,16 @@ from crewai.cli.constants import (
 
 class TestAuthenticationCommand:
     def setup_method(self):
-        self.auth_command = AuthenticationCommand()
+        # Mock Settings so we always use default constants regardless of local config.
+        with patch("crewai_cli.authentication.main.Settings") as mock_settings:
+            instance = mock_settings.return_value
+            instance.oauth2_provider = "workos"
+            instance.oauth2_domain = CREWAI_ENTERPRISE_DEFAULT_OAUTH2_DOMAIN
+            instance.oauth2_client_id = CREWAI_ENTERPRISE_DEFAULT_OAUTH2_CLIENT_ID
+            instance.oauth2_audience = CREWAI_ENTERPRISE_DEFAULT_OAUTH2_AUDIENCE
+            instance.oauth2_extra = {}
+            self.auth_command = AuthenticationCommand()
 
-    # TODO: these expectations are reading from the actual settings, we should mock them.
-    # E.g. if you change the client_id locally, this test will fail.
     @pytest.mark.parametrize(
         "user_provider,expected_urls",
         [
@@ -32,12 +38,12 @@ class TestAuthenticationCommand:
             ),
         ],
     )
-    @patch("crewai.cli.authentication.main.AuthenticationCommand._get_device_code")
+    @patch("crewai_cli.authentication.main.AuthenticationCommand._get_device_code")
     @patch(
-        "crewai.cli.authentication.main.AuthenticationCommand._display_auth_instructions"
+        "crewai_cli.authentication.main.AuthenticationCommand._display_auth_instructions"
     )
-    @patch("crewai.cli.authentication.main.AuthenticationCommand._poll_for_token")
-    @patch("crewai.cli.authentication.main.console.print")
+    @patch("crewai_cli.authentication.main.AuthenticationCommand._poll_for_token")
+    @patch("crewai_core.auth.oauth2.console.print")
     def test_login(
         self,
         mock_console_print,
@@ -76,8 +82,8 @@ class TestAuthenticationCommand:
             self.auth_command.oauth2_provider._get_domain() == expected_urls["domain"]
         )
 
-    @patch("crewai.cli.authentication.main.webbrowser")
-    @patch("crewai.cli.authentication.main.console.print")
+    @patch("crewai_core.auth.oauth2.webbrowser")
+    @patch("crewai_core.auth.oauth2.console.print")
     def test_display_auth_instructions(self, mock_console_print, mock_webbrowser):
         device_code_data = {
             "verification_uri_complete": "https://example.com/auth",
@@ -107,8 +113,8 @@ class TestAuthenticationCommand:
         ],
     )
     @pytest.mark.parametrize("has_expiration", [True, False])
-    @patch("crewai.cli.authentication.main.validate_jwt_token")
-    @patch("crewai.cli.authentication.main.TokenManager.save_tokens")
+    @patch("crewai_core.auth.oauth2.validate_jwt_token")
+    @patch("crewai_core.auth.oauth2.TokenManager.save_tokens")
     def test_validate_and_save_token(
         self,
         mock_save_tokens,
@@ -117,8 +123,8 @@ class TestAuthenticationCommand:
         jwt_config,
         has_expiration,
     ):
-        from crewai.cli.authentication.main import Oauth2Settings
-        from crewai.cli.authentication.providers.workos import WorkosProvider
+        from crewai_cli.authentication.main import Oauth2Settings
+        from crewai_cli.authentication.providers.workos import WorkosProvider
 
         if user_provider == "workos":
             self.auth_command.oauth2_provider = WorkosProvider(
@@ -156,9 +162,9 @@ class TestAuthenticationCommand:
         else:
             mock_save_tokens.assert_called_once_with("test_access_token", 0)
 
-    @patch("crewai.cli.tools.main.ToolCommand")
-    @patch("crewai.cli.authentication.main.Settings")
-    @patch("crewai.cli.authentication.main.console.print")
+    @patch("crewai_cli.tools.main.ToolCommand")
+    @patch("crewai_cli.authentication.main.Settings")
+    @patch("crewai_core.auth.oauth2.console.print")
     def test_login_to_tool_repository_success(
         self, mock_console_print, mock_settings, mock_tool_command
     ):
@@ -189,8 +195,8 @@ class TestAuthenticationCommand:
         ]
         mock_console_print.assert_has_calls(expected_calls)
 
-    @patch("crewai.cli.tools.main.ToolCommand")
-    @patch("crewai.cli.authentication.main.console.print")
+    @patch("crewai_cli.tools.main.ToolCommand")
+    @patch("crewai_core.auth.oauth2.console.print")
     def test_login_to_tool_repository_error(
         self, mock_console_print, mock_tool_command
     ):
@@ -220,7 +226,7 @@ class TestAuthenticationCommand:
         ]
         mock_console_print.assert_has_calls(expected_calls)
 
-    @patch("crewai.cli.authentication.main.httpx.post")
+    @patch("crewai_core.auth.oauth2.httpx.post")
     def test_get_device_code(self, mock_post):
         mock_response = MagicMock()
         mock_response.json.return_value = {
@@ -256,8 +262,8 @@ class TestAuthenticationCommand:
             "verification_uri_complete": "https://example.com/auth",
         }
 
-    @patch("crewai.cli.authentication.main.httpx.post")
-    @patch("crewai.cli.authentication.main.console.print")
+    @patch("crewai_core.auth.oauth2.httpx.post")
+    @patch("crewai_core.auth.oauth2.console.print")
     def test_poll_for_token_success(self, mock_console_print, mock_post):
         mock_response_success = MagicMock()
         mock_response_success.status_code = 200
@@ -305,8 +311,8 @@ class TestAuthenticationCommand:
             ]
             mock_console_print.assert_has_calls(expected_calls)
 
-    @patch("crewai.cli.authentication.main.httpx.post")
-    @patch("crewai.cli.authentication.main.console.print")
+    @patch("crewai_core.auth.oauth2.httpx.post")
+    @patch("crewai_core.auth.oauth2.console.print")
     def test_poll_for_token_timeout(self, mock_console_print, mock_post):
         mock_response_pending = MagicMock()
         mock_response_pending.status_code = 400
@@ -324,7 +330,7 @@ class TestAuthenticationCommand:
             "Timeout: Failed to get the token. Please try again.", style="bold red"
         )
 
-    @patch("crewai.cli.authentication.main.httpx.post")
+    @patch("crewai_core.auth.oauth2.httpx.post")
     def test_poll_for_token_error(self, mock_post):
         """Test the method to poll for token (error path)."""
         # Setup mock to return error

lib/cli/tests/authentication/test_utils.py

@@ -0,0 +1,107 @@
+import unittest
+from unittest.mock import MagicMock, patch
+
+import jwt
+
+from crewai_cli.authentication.utils import validate_jwt_token
+
+
+@patch("crewai_core.auth.utils.PyJWKClient", return_value=MagicMock())
+@patch("crewai_core.auth.utils.jwt")
+class TestUtils(unittest.TestCase):
+    def test_validate_jwt_token(self, mock_jwt, mock_pyjwkclient):
+        mock_jwt.decode.return_value = {"exp": 1719859200}
+
+        # Create signing key object mock with a .key attribute
+        mock_pyjwkclient.return_value.get_signing_key_from_jwt.return_value = MagicMock(
+            key="mock_signing_key"
+        )
+
+        jwt_token = "aaaaa.bbbbbb.cccccc"  # noqa: S105
+
+        decoded_token = validate_jwt_token(
+            jwt_token=jwt_token,
+            jwks_url="https://mock_jwks_url",
+            issuer="https://mock_issuer",
+            audience="app_id_xxxx",
+        )
+
+        mock_jwt.decode.assert_called_with(
+            jwt_token,
+            "mock_signing_key",
+            algorithms=["RS256"],
+            audience="app_id_xxxx",
+            issuer="https://mock_issuer",
+            leeway=10.0,
+            options={
+                "verify_signature": True,
+                "verify_exp": True,
+                "verify_nbf": True,
+                "verify_iat": True,
+                "require": ["exp", "iat", "iss", "aud", "sub"],
+            },
+        )
+        mock_pyjwkclient.assert_called_once_with("https://mock_jwks_url")
+        self.assertEqual(decoded_token, {"exp": 1719859200})
+
+    def test_validate_jwt_token_expired(self, mock_jwt, mock_pyjwkclient):
+        mock_jwt.decode.side_effect = jwt.ExpiredSignatureError
+        with self.assertRaises(Exception):  # noqa: B017
+            validate_jwt_token(
+                jwt_token="aaaaa.bbbbbb.cccccc",  # noqa: S106
+                jwks_url="https://mock_jwks_url",
+                issuer="https://mock_issuer",
+                audience="app_id_xxxx",
+            )
+
+    def test_validate_jwt_token_invalid_audience(self, mock_jwt, mock_pyjwkclient):
+        mock_jwt.decode.side_effect = jwt.InvalidAudienceError
+        with self.assertRaises(Exception):  # noqa: B017
+            validate_jwt_token(
+                jwt_token="aaaaa.bbbbbb.cccccc",  # noqa: S106
+                jwks_url="https://mock_jwks_url",
+                issuer="https://mock_issuer",
+                audience="app_id_xxxx",
+            )
+
+    def test_validate_jwt_token_invalid_issuer(self, mock_jwt, mock_pyjwkclient):
+        mock_jwt.decode.side_effect = jwt.InvalidIssuerError
+        with self.assertRaises(Exception):  # noqa: B017
+            validate_jwt_token(
+                jwt_token="aaaaa.bbbbbb.cccccc",  # noqa: S106
+                jwks_url="https://mock_jwks_url",
+                issuer="https://mock_issuer",
+                audience="app_id_xxxx",
+            )
+
+    def test_validate_jwt_token_missing_required_claims(
+        self, mock_jwt, mock_pyjwkclient
+    ):
+        mock_jwt.decode.side_effect = jwt.MissingRequiredClaimError
+        with self.assertRaises(Exception):  # noqa: B017
+            validate_jwt_token(
+                jwt_token="aaaaa.bbbbbb.cccccc",  # noqa: S106
+                jwks_url="https://mock_jwks_url",
+                issuer="https://mock_issuer",
+                audience="app_id_xxxx",
+            )
+
+    def test_validate_jwt_token_jwks_error(self, mock_jwt, mock_pyjwkclient):
+        mock_jwt.decode.side_effect = jwt.exceptions.PyJWKClientError
+        with self.assertRaises(Exception):  # noqa: B017
+            validate_jwt_token(
+                jwt_token="aaaaa.bbbbbb.cccccc",  # noqa: S106
+                jwks_url="https://mock_jwks_url",
+                issuer="https://mock_issuer",
+                audience="app_id_xxxx",
+            )
+
+    def test_validate_jwt_token_invalid_token(self, mock_jwt, mock_pyjwkclient):
+        mock_jwt.decode.side_effect = jwt.InvalidTokenError
+        with self.assertRaises(Exception):  # noqa: B017
+            validate_jwt_token(
+                jwt_token="aaaaa.bbbbbb.cccccc",  # noqa: S106
+                jwks_url="https://mock_jwks_url",
+                issuer="https://mock_issuer",
+                audience="app_id_xxxx",
+            )

lib/cli/tests/deploy/test_deploy_main.py

@@ -7,15 +7,20 @@ import pytest
 import json
 
 import httpx
-from crewai.cli.deploy.main import DeployCommand
-from crewai.cli.utils import parse_toml
+from crewai_cli.deploy.main import DeployCommand
+from crewai_cli.utils import parse_toml
 
 
 class TestDeployCommand(unittest.TestCase):
-    @patch("crewai.cli.command.get_auth_token")
-    @patch("crewai.cli.deploy.main.get_project_name")
-    @patch("crewai.cli.command.PlusAPI")
-    def setUp(self, mock_plus_api, mock_get_project_name, mock_get_auth_token):
+    @patch("crewai_cli.command.get_auth_token")
+    @patch("crewai_cli.deploy.main.get_project_name")
+    @patch("crewai_cli.command.PlusAPI")
+    def setUp(
+        self,
+        mock_plus_api,
+        mock_get_project_name,
+        mock_get_auth_token,
+    ):
         self.mock_get_auth_token = mock_get_auth_token
         self.mock_get_project_name = mock_get_project_name
         self.mock_plus_api = mock_plus_api
@@ -30,7 +35,7 @@ class TestDeployCommand(unittest.TestCase):
         self.assertEqual(self.deploy_command.project_name, "test_project")
         self.mock_plus_api.assert_called_once_with(api_key="test_token")
 
-    @patch("crewai.cli.command.get_auth_token")
+    @patch("crewai_cli.command.get_auth_token")
     def test_init_failure(self, mock_get_auth_token):
         mock_get_auth_token.side_effect = Exception("Auth failed")
 
@@ -118,7 +123,7 @@ class TestDeployCommand(unittest.TestCase):
             )
             self.assertIn("2023-01-01 - INFO: Test log", fake_out.getvalue())
 
-    @patch("crewai.cli.deploy.main.DeployCommand._display_deployment_info")
+    @patch("crewai_cli.deploy.main.DeployCommand._display_deployment_info")
     def test_deploy_with_uuid(self, mock_display):
         mock_response = MagicMock()
         mock_response.status_code = 200
@@ -130,7 +135,7 @@ class TestDeployCommand(unittest.TestCase):
         self.mock_client.deploy_by_uuid.assert_called_once_with("test-uuid")
         mock_display.assert_called_once_with({"uuid": "test-uuid"})
 
-    @patch("crewai.cli.deploy.main.DeployCommand._display_deployment_info")
+    @patch("crewai_cli.deploy.main.DeployCommand._display_deployment_info")
     def test_deploy_with_project_name(self, mock_display):
         mock_response = MagicMock()
         mock_response.status_code = 200
@@ -142,8 +147,8 @@ class TestDeployCommand(unittest.TestCase):
         self.mock_client.deploy_by_name.assert_called_once_with("test_project")
         mock_display.assert_called_once_with({"uuid": "test-uuid"})
 
-    @patch("crewai.cli.deploy.main.fetch_and_json_env_file")
-    @patch("crewai.cli.deploy.main.git.Repository.origin_url")
+    @patch("crewai_cli.deploy.main.fetch_and_json_env_file")
+    @patch("crewai_cli.deploy.main.git.Repository.origin_url")
     @patch("builtins.input")
     def test_create_crew(self, mock_input, mock_git_origin_url, mock_fetch_env):
         mock_fetch_env.return_value = {"ENV_VAR": "value"}
@@ -236,7 +241,7 @@ class TestDeployCommand(unittest.TestCase):
         """,
     )
     def test_get_project_name_python_310(self, mock_open):
-        from crewai.cli.utils import get_project_name
+        from crewai_cli.utils import get_project_name
 
         project_name = get_project_name()
         print("project_name", project_name)
@@ -255,12 +260,12 @@ class TestDeployCommand(unittest.TestCase):
     """,
     )
     def test_get_project_name_python_311_plus(self, mock_open):
-        from crewai.cli.utils import get_project_name
+        from crewai_cli.utils import get_project_name
 
         project_name = get_project_name()
         self.assertEqual(project_name, "test_project")
 
     def test_get_crewai_version(self):
-        from crewai.cli.version import get_crewai_version
+        from crewai_cli.version import get_crewai_version
 
         assert isinstance(get_crewai_version(), str)