@buildinternet/releases 0.38.1 → 0.40.0

package/README.md

@@ -4,6 +4,7 @@
 [![Release](https://github.com/buildinternet/releases-cli/actions/workflows/release.yml/badge.svg)](https://github.com/buildinternet/releases-cli/actions/workflows/release.yml)
 [![Test](https://github.com/buildinternet/releases-cli/actions/workflows/test.yml/badge.svg)](https://github.com/buildinternet/releases-cli/actions/workflows/test.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE)
+[![skills.sh](https://skills.sh/b/buildinternet/releases-cli)](https://skills.sh/buildinternet/releases-cli)
 
 Changelog registry for AI agents and developers. A lean HTTP client for [releases.sh](https://releases.sh) — search and browse release notes from GitHub, RSS/Atom/JSON feeds, and product changelog pages without any local infrastructure.
 
@@ -95,30 +96,44 @@ Or run a local stdio bridge that proxies the same tools to `api.releases.sh`:
 releases admin mcp serve
 ```
 
-### Claude Code plugin
+### Claude Code plugins
 
-Install from the marketplace manifest in this repo:
+This repo is a Claude Code marketplace named `releases` that publishes two plugins. Add the marketplace once, then install whichever surfaces you want:
 
 ```bash
 /plugin marketplace add buildinternet/releases-cli
+
+# Reader surface — search and look up releases:
 /plugin install releases@releases
+
+# Admin surface — onboard and maintain sources (requires admin API access):
+/plugin install releases-admin@releases
 ```
 
 Or point at a local clone for development:
 
 ```bash
-claude --plugin-dir plugins/claude/releases
+claude --plugin-dir .
 ```
 
-The plugin bundles:
+**`releases` (reader)** — for anyone querying the registry:
 
 - **Hosted MCP connection** to `mcp.releases.sh` — search, lookup, and changelog slicing tools.
-- **Auto-trigger skills**:
-  - `releases-mcp` — activates on user questions about releases, changelogs, or breaking changes ("what's new in Next.js 15?").
+- **`/releases <product> [query]`** command for manual lookups.
+- **Auto-trigger skills:**
+  - `releases-mcp` — activates on questions about releases, changelogs, or breaking changes ("what's new in Next.js 15?").
   - `releases-cli` — activates when a user mentions or runs the `releases` CLI.
-  - `finding-changelogs`, `managing-sources`, `parsing-changelogs`, `analyzing-releases`, `classify-media-relevance`, `seeding-playbooks` — operator playbooks for onboarding and maintaining sources (admin access required to act on them — see the callout at the top of this README).
+  - `analyzing-releases` — competitive intel across multiple companies.
+  - `finding-changelogs` — discovering and evaluating changelog URLs.
+
+**`releases-admin`** — for maintainers running their own registry or contributing back:
+
 - **Agents** — `discovery` (finds and onboards sources) and `worker` (executes fetches).
-- **Commands** — `/releases <product> [query]` for manual lookups.
+- **Auto-trigger skills:**
+  - `managing-sources` — CRUD on sources, ignored/blocked URLs, validation.
+  - `parsing-changelogs` — fetch and parse pipeline reference.
+  - `classify-media-relevance` — release-image classification helper.
+  - `seeding-playbooks` — bulk playbook authoring across orgs.
 
 > Claude Code plugins install atomically — there is no Claude Code–native flow for grabbing a single skill without the rest of the plugin. See the next section for an agent-neutral install path.
 
@@ -141,11 +156,37 @@ npx skills add buildinternet/releases-cli
 
 Use this path when you only want the skill behavior (auto-triggering on release/CLI questions) without also registering the hosted MCP connection, agents, and `/releases` command that the plugin provides. Skills are symlinked by default, so re-running `releases skills install` (or `npx skills update releases-cli`) refreshes everything atomically.
 
+## Authentication
+
+Admin commands require an API token. You can store one persistently using the `auth` command namespace so you don't need to set `RELEASED_API_KEY` in your shell every time.
+
+```bash
+releases auth login                     # interactive prompt (masked input)
+releases auth login --token <token>     # pass directly
+releases auth login --token -           # read from stdin (pipe-friendly)
+```
+
+The token is verified against `GET /v1/tokens/me` before being saved. If verification fails, nothing is written.
+
+```bash
+releases auth status                    # show current auth state
+releases auth status --json             # machine-readable (authenticated, source, scopes, …)
+releases auth status --verify           # re-check the token against the API live
+releases auth token                     # print the raw token (for scripts)
+releases auth logout                    # remove the stored token
+```
+
+`whoami` is an alias for `auth status`.
+
+**Credential precedence:** if `RELEASED_API_KEY` is set in the environment it takes priority over any stored credential — useful for CI or per-command overrides.
+
+**Storage:** credentials are written to `~/.releases/credentials` with `0600` permissions (owner read/write, rw-------). The file is JSON and contains the token, name, scopes, the API URL the token was verified against, and a `savedAt` timestamp.
+
 ## Environment
 
 Nothing is required for reader access. For admin operations (closed beta — see above):
 
-- `RELEASED_API_KEY` — Bearer token for write endpoints. Required for any `releases admin …` command that mutates state. Keys are not self-serve right now.
+- `RELEASED_API_KEY` — Bearer token for write endpoints. Overrides any stored credential from `releases auth login`. Required for any `releases admin …` command that mutates state if no stored credential is present. Keys are not self-serve right now.
 - `RELEASED_API_URL` — Override the default `https://api.releases.sh` endpoint (useful for staging).
 - `RELEASED_TELEMETRY_DISABLED=1` — Opt out of anonymous usage pings. `DO_NOT_TRACK=1` is also honored.
 - `RELEASES_DISABLE_SKILL_UPDATE_CHECK=1` — Silence the "skills are behind, run `releases skills install`" stderr nag that fires (at most once per 24h) when the GitHub `skills/` tree has moved since your last install.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@buildinternet/releases",
-  "version": "0.38.1",
+  "version": "0.40.0",
   "description": "Changelog indexer and registry for AI agents and developers",
   "bin": {
     "releases": "bin/releases"
@@ -13,11 +13,11 @@
     "README.md"
   ],
   "optionalDependencies": {
-    "@buildinternet/releases-darwin-arm64": "0.38.1",
-    "@buildinternet/releases-darwin-x64": "0.38.1",
-    "@buildinternet/releases-linux-x64": "0.38.1",
-    "@buildinternet/releases-linux-arm64": "0.38.1",
-    "@buildinternet/releases-windows-x64": "0.38.1"
+    "@buildinternet/releases-darwin-arm64": "0.40.0",
+    "@buildinternet/releases-darwin-x64": "0.40.0",
+    "@buildinternet/releases-linux-x64": "0.40.0",
+    "@buildinternet/releases-linux-arm64": "0.40.0",
+    "@buildinternet/releases-windows-x64": "0.40.0"
   },
   "keywords": [
     "changelog",