@everfir/az8-cli 0.2.0-preview.2 → 0.2.0-preview.3

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable AZ8 CLI changes are recorded here. The CLI package has its own linear version sequence;
 it does not inherit the Web application or monorepo root version.
 
+## 0.2.0-preview.3 - 2026-07-21
+
+### Changed
+
+- The built-in Skill now treats credentials as an operator or agent-host provisioning precondition
+  and explains inherited environment, default `.env.local`, and explicit `--env-file` resolution.
+- Authentication is verified with a bounded Project read without inspecting, printing, copying, or
+  editing the token source.
+- The shell example that could encourage an agent to type a real token into a recorded interaction
+  has been removed, and missing or invalid credentials now direct the agent back to secure external
+  provisioning.
+
 ## 0.2.0-preview.2 - 2026-07-21
 
 ### Added

package/README.md

@@ -17,7 +17,7 @@ az8 guide
 For a supplied release artifact, install the exact immutable tarball instead:
 
 ```bash
-npm install --global ./everfir-az8-cli-0.2.0-preview.2.tgz
+npm install --global ./everfir-az8-cli-0.2.0-preview.3.tgz
 az8 --version
 ```
 
@@ -46,15 +46,20 @@ generation inputs.
 
 ## Credentials and environment
 
-Use an ignored `.env.local` or process environment:
+Credentials must be provisioned outside the agent's recorded interaction. Use an ignored
+`.env.local`, an explicit env-file path, or an inherited process environment:
 
 ```dotenv
-AZ8_TOKEN=...
+AZ8_TOKEN=<operator-provisioned-secret>
 AZ8_ENVIRONMENT=test
 ```
 
 `AZ8_ENVIRONMENT` accepts `test` or `production`. Command-line `--environment` overrides the env
-value. Tokens must not be passed through argv or stdio protocol payloads.
+value. Without `--env-file`, the CLI searches from the working directory upward for `.env.local`.
+An explicit file is selected by path, for example
+`--environment test --env-file /secure/path/.env.local`. Agents must not read, print, edit, or ask
+users to paste credential contents; verify authentication with a bounded `projects list` read.
+Tokens must not be passed through argv or stdio protocol payloads.
 
 ## Project Management
 

package/RELEASE.md

@@ -35,7 +35,7 @@ repository-wide `pnpm verify`. Publishing is an external action and requires exp
 authorization:
 
 ```bash
-npm publish ./tmp/az8-cli-release/everfir-az8-cli-0.2.0-preview.2.tgz --tag preview
+npm publish ./tmp/az8-cli-release/everfir-az8-cli-0.2.0-preview.3.tgz --tag preview
 npm view @everfir/az8-cli dist-tags versions --json
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everfir/az8-cli",
-  "version": "0.2.0-preview.2",
+  "version": "0.2.0-preview.3",
   "description": "Semantic Project Canvas client for AZ8 Studio agents.",
   "license": "UNLICENSED",
   "type": "module",

package/skills/az8-cli/SKILL.md

@@ -21,8 +21,9 @@ capabilities instead of guessing operation names or input shapes.
   indeterminate result; do not execute later steps.
 - Never automatically retry a write. Retry only bounded reads when the returned error says doing so
   is safe. An idempotency key does not authorize blind replay.
-- Keep tokens in the process environment or an ignored env file. Never put a token in argv, an
-  stdio frame, a prompt, a log, or output.
+- Require the operator or agent host to provision credentials outside the recorded interaction.
+  Keep tokens in the inherited process environment or an ignored env file. Never type, read, copy,
+  print, or return a token through a shell tool call, argv, stdio frame, prompt, log, or output.
 
 ## Concepts
 
@@ -52,18 +53,41 @@ capabilities instead of guessing operation names or input shapes.
 
 ## Bootstrap
 
-1. Verify the installed client and explicitly choose an environment:
+1. Verify the installed client without credentials:
 
    ```bash
    az8 --version
-   export AZ8_ENVIRONMENT=test
-   export AZ8_TOKEN=...
    ```
 
-   Prefer an ignored `.env.local` when the shell environment is not appropriate. Never print the
-   token to confirm it.
+2. Require credentials to be provisioned by the operator or agent host before authenticating. The
+   CLI accepts `AZ8_TOKEN` from its inherited process environment or an env file. A provisioned env
+   file has this shape, but the agent must not fill the placeholder with a real token in a recorded
+   interaction:
 
-2. Select an existing Project or create a bounded workspace:
+   ```dotenv
+   AZ8_TOKEN=<operator-provisioned-secret>
+   AZ8_ENVIRONMENT=test
+   ```
+
+   With no `--env-file`, the CLI searches for `.env.local` from the working directory upward. An
+   explicit file may live elsewhere and is selected only by path:
+
+   ```bash
+   az8 projects list --scope owned --page-size 1 \
+     --environment test --env-file /secure/path/.env.local
+   ```
+
+   Use the authenticated read as the credential check. Never verify a token with `cat`, `sed`,
+   `grep`, `env`, `printenv`, `echo`, shell tracing, or by reading the env file through another
+   tool. Do not create, edit, move, or delete a credential file unless the operator explicitly asks
+   through a secure provisioning workflow. Keep it outside version control with owner-only access.
+
+   The inherited process environment overrides env-file values; `--environment` overrides
+   `AZ8_ENVIRONMENT`. Always pass or provision the intended environment explicitly. If the CLI
+   reports a missing token or authentication failure, stop and ask the operator to provision or
+   replace it outside the conversation. Never ask them to paste the secret into chat.
+
+3. Select an existing Project or create a bounded workspace:
 
    ```bash
    az8 projects list --scope owned
@@ -73,7 +97,7 @@ capabilities instead of guessing operation names or input shapes.
 
    Retain the returned Project ID. Confirm the authenticated role before assuming write access.
 
-3. Discover the effective surface for that Project:
+4. Discover the effective surface for that Project:
 
    ```bash
    az8 canvas query <project-id> capabilities.summary
@@ -85,13 +109,13 @@ capabilities instead of guessing operation names or input shapes.
    Schema, `effect`, `history`, `completion`, and `retry`. Availability is filtered by the current
    account, Project role, upstream services, and CLI version. Do not rely on remembered schemas.
 
-4. Use `canvas.detail` only when exact node geometry, Draft, status, or bindings are needed:
+5. Use `canvas.detail` only when exact node geometry, Draft, status, or bindings are needed:
 
    ```bash
    az8 canvas query <project-id> canvas.detail --view-node-id <view-node-id>
    ```
 
-5. Choose one-shot for independent tasks and persistent stdio for a collaborative session. Finish
+6. Choose one-shot for independent tasks and persistent stdio for a collaborative session. Finish
    by inspecting the affected View Nodes or Workflow Run rather than trusting visual assumptions.
 
 ## Interaction modes
@@ -248,6 +272,8 @@ Never:
   conclude that an Awareness event persisted data;
 - expose a token, presigned URL, permanent media URL, env-file contents, or private output in logs
   or protocol payloads;
+- inspect, print, or edit an operator-provisioned credential source merely to check whether it
+  exists; authenticate with a bounded read instead;
 - use awareness client names to impersonate persisted authors or treat Attention Cursor position as
   authority;
 - use one-shot as if it retained History, Receipts, replay state, observations, or presence;