feat: add helpers and improve workspace auth flows

packages/cli/src/ai-guide.ts

@@ -167,6 +167,21 @@ export const POST = async (ctx) => {
 \`req: Request\`, \`url: URL\`, \`params: Record<string,string>\` (dynamic route params, e.g. \`/users/[id]\` → \`ctx.params.id\`),
 \`lang: string\`, \`t(key, params?)\` (i18n), \`cookies\` (get/set), \`session\` (get/set). Auth: \`getUser(ctx)\` after \`sessionAuth\`/\`logIn\`.
 
+When an SSO forward-auth verifier needs the URL that originally reached the gateway, use
+\`@wrnexus/helpers\` instead of constructing it from untrusted headers:
+
+\`\`\`ts
+import { redirectToLogin } from "@wrnexus/helpers";
+
+return redirectToLogin(ctx, "/login", {
+  allowedHosts: ["admin.localhost:3000", "reports.localhost:3000"],
+});
+\`\`\`
+
+The package also exports \`getOriginalRequestUrl\`, \`getOriginalRequestOrigin\`,
+\`getOriginalRequestPath\`, and \`getOriginalRequestMethod\`. Always pass \`allowedHosts\` when
+using forwarded gateway URLs; the helper rejects untrusted redirect destinations.
+
 ## Middleware & realtime
 
 \`\`\`ts