Default to offline 'local' provider when none is configured

[DrBaher]

Problem

sign-cli promises fully-offline signing with no signup and no keys, but the provider resolver defaulted to the hosted dropbox provider when nothing was configured. A brand-new user with no --provider flag, no SIGN_PROVIDER env, and no profile would have their first mutating command (request create / send) fail with:

DROPBOX_SIGN_API_KEY is not set.

i.e. being asked for hosted-provider credentials they never set up — contradicting the product's core promise.

Fix

Change the built-in default fallback in resolveSignProviderWithSource from dropbox to the offline local PAdES signer (needs no keys). The resolution order is otherwise unchanged (flag > env > project profile > user profile > built-in default); anyone selecting a hosted provider via flag/env/profile is unaffected.

Changes

• src/lib/providers.ts — default fallback dropbox → local; updated banner text
• .env.example — ships SIGN_PROVIDER=local with explanatory comments
• src/cli.ts — help text updated
• Docs: agent-guide.md, reference/profiles.md, regression-testing.md, setup/dropbox.md, setup/docusign.md
• CHANGELOG.md — [Unreleased] → Changed entry
• Tests: updated the two assertions on the old default; made the Dropbox signature-persistence tests set their provider explicitly instead of relying on the global default

Verification

• Full suite: 766 pass, 0 fail (1 pre-existing skip)
• tsc --noEmit: clean
• End-to-end: a zero-config request create now resolves to local and succeeds instead of erroring

https://claude.ai/code/session_019psdfrLHax8F93AneF733K

---

Generated by Claude Code