npm - @hasna/skills - Versions diffs - 0.10.42 → 0.10.43 - Mend

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.42",
+    version: "0.10.43",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -83228,7 +83228,7 @@ async function persistSignIn(result2, origin, env3 = process.env, issuedBy = "si
     const created = await new RemoteSkillsAuthClient(origin).request("/api/auth/keys", {
       method: "POST",
       headers: { Authorization: `Bearer ${result2.token}` },
-      body: JSON.stringify({ name: "cli" })
+      body: JSON.stringify({ name: "cli", scopes: HOSTED_CLI_API_KEY_SCOPES })
     });
     apiKey = isRecord7(created) && typeof created.key === "string" && created.key.trim() ? created.key : undefined;
   }
@@ -83441,13 +83441,22 @@ function openVerificationPage(url2, signInOrigin) {
     return false;
   }
 }
-var SKILLS_CLI_DEVICE_CLIENT = "skills-cli", SLOW_DOWN_INCREMENT_MS = 5000, MIN_INTERVAL_MS = 1000, MAX_INTERVAL_MS = 60000, DEFAULT_INTERVAL_SECONDS = 5, DEFAULT_EXPIRES_IN_SECONDS = 900, LOOPBACK_HOSTS;
+var SKILLS_CLI_DEVICE_CLIENT = "skills-cli", HOSTED_CLI_API_KEY_SCOPES, SLOW_DOWN_INCREMENT_MS = 5000, MIN_INTERVAL_MS = 1000, MAX_INTERVAL_MS = 60000, DEFAULT_INTERVAL_SECONDS = 5, DEFAULT_EXPIRES_IN_SECONDS = 900, LOOPBACK_HOSTS;
 var init_sign_in = __esm(() => {
   init_transport();
   init_auth_store();
   init_fleet_credentials();
   init_instance_credentials();
   init_remote_auth();
+  HOSTED_CLI_API_KEY_SCOPES = [
+    "skills:read",
+    "skills:run",
+    "runs:read",
+    "connectors:read",
+    "connectors:write",
+    "billing:read",
+    "billing:write"
+  ];
   LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
 });
@@ -117159,11 +117168,11 @@ async function doLogin(email5, code2, json3, target) {
     }
     if (!json3)
       console.log(source_default.green("\u2713 Code sent to " + email5));
-    if (json3 || !isTTY) {
-      console.log(JSON.stringify({ status: "code_sent", email: email5, message: `Check email for 6-digit code, then run: skills login --email ${email5} --code <CODE>${targetFlag(target)}` }));
+    if (json3 || !isTTY || !process.stderr.isTTY) {
+      console.log(JSON.stringify({ status: "code_sent", email: email5, message: `Supply the fresh six-digit code on stdin to: skills login --email ${email5} --code-stdin${targetFlag(target)}` }));
       return;
     }
-    const answer = await prompt(source_default.bold("Code: "));
+    const answer = await promptCode();
     if (answer === null)
       return;
     code2 = answer;
@@ -117354,6 +117363,10 @@ Waiting for authentication...`));
   await finishSignIn(outcome.result, target, json3);
 }
 async function runLogin(options) {
+  if (options.codeStdin && (!options.email || options.code !== undefined || options.apiKey !== undefined || options.device || options.poll)) {
+    writeCommandError(new Error("--code-stdin requires --email and cannot be combined with --code, --api-key, --device or --poll"), "Invalid login options", options.json);
+    return;
+  }
   if (options.apiKey !== undefined && (options.device || options.poll || options.email || options.code)) {
     writeCommandError(new Error("--api-key cannot be combined with --device, --poll, --email or --code"), "Invalid login options", options.json);
     return;
@@ -117394,7 +117407,16 @@ async function runLogin(options) {
     writeCommandError(new Error("Email required. Use: skills login --email you@example.com"), "Email required", options.json);
     return;
   }
-  await doLogin(email5, options.code, options.json, target);
+  let code2 = options.code;
+  if (options.codeStdin) {
+    try {
+      code2 = await readCode();
+    } catch (error61) {
+      writeCommandError(error61, "Could not read the verification code", options.json);
+      return;
+    }
+  }
+  await doLogin(email5, code2, options.json, target);
 }
 async function runLogout(options) {
   const result2 = await signOut({ revoke: options.revoke, environmentProfile: getEnvironmentProfile() });
@@ -117473,7 +117495,7 @@ async function runWhoami(options) {
   }
 }
 function withLoginOptions(command) {
-  return command.option("--url <origin>", "Sign in to this Skills server instead of the default (your own instance)").option("--email <email>", "Sign in with an email code (non-interactive with --code)").option("--code <code>", "Verification code from the sign-in email").option("--api-key [key]", "Verify and store an API key; with no value, read it from stdin").option("--device", "Print a code to approve on another device; do not open a browser", false).option("--no-open", "Do not open a browser").option("--poll", "Wait for approval, resuming a pending `skills login --device` session", false).option("--poll-timeout-ms <ms>", "Maximum time to wait for approval").option("--json", "Output result as JSON", false);
+  return command.option("--url <origin>", "Sign in to this Skills server instead of the default (your own instance)").option("--email <email>", "Sign in with an email code (non-interactive with --code-stdin)").option("--code <code>", "Legacy verification code argument; prefer --code-stdin to keep it out of shell history").option("--code-stdin", "Read a previously requested six-digit verification code from stdin").option("--api-key [key]", "Verify and store an API key; with no value, read it from stdin").option("--device", "Print a code to approve on another device; do not open a browser", false).option("--no-open", "Do not open a browser").option("--poll", "Wait for approval, resuming a pending `skills login --device` session", false).option("--poll-timeout-ms <ms>", "Maximum time to wait for approval").option("--json", "Output result as JSON", false);
 }
 function registerAccountCommands(parent) {
   withLoginOptions(parent.command("login").description("Sign in (browser by default; --device, --email or --api-key; --url for your own server)")).action(async (options) => runLogin(options));
@@ -117531,7 +117553,7 @@ function registerAuth(parent) {
       writeCommandError(error61, "Failed to add Skills publication scope", options.json);
     }
   });
-  withLoginOptions(auth.command("login").description("Sign in with browser/device code, email code or an API key (same as `skills login`)").option("--membership-id <id>", "Enroll an exact workspace membership into an explicit HASNA_PROFILE").option("--code-stdin", "Read a fresh six-digit code for workspace enrollment from stdin")).action(async (options) => {
+  withLoginOptions(auth.command("login").description("Sign in with browser/device code, email code or an API key (same as `skills login`)").option("--membership-id <id>", "Enroll an exact workspace membership into an explicit HASNA_PROFILE")).action(async (options) => {
     if (options.membershipId !== undefined) {
       if (options.apiKey || options.device || options.code || options.poll || options.url) {
         writeCommandError(new Error("Workspace login uses email and --code-stdin; do not combine it with device, API key, --url or --code login."), "Invalid login options", options.json);
@@ -117540,10 +117562,6 @@ function registerAuth(parent) {
       await loginWorkspace({ email: options.email, codeStdin: options.codeStdin, json: options.json, membershipId: options.membershipId });
       return;
     }
-    if (options.codeStdin) {
-      writeCommandError(new Error("--code-stdin requires --membership-id for this login flow."), "Invalid login options", options.json);
-      return;
-    }
     await runLogin(options);
   });
   auth.command("signup").description("Create or sign in with your email (passwordless)").option("--url <origin>", "Sign up on this Skills server instead of the default (your own instance)").option("--email <email>", "Email address (non-interactive)").option("--code <code>", "Verification code (non-interactive)").option("--json", "Output result as JSON without prompting", false).action(async (options) => {
@@ -117582,6 +117600,7 @@ function registerAuth(parent) {
 var isTTY, DEFAULT_DEVICE_POLL_TIMEOUT_MS, CONFIG_HINT_STATUSES;
 var init_auth = __esm(() => {
   init_workspace_selection();
+  init_customer_verification();
   init_workspace_profile();
   init_source();
   init_auth_store();

@@ -56,6 +56,11 @@ changes), when the profile holds a credential `skills login` did not store
 - An API key you already have: `printenv MY_SKILLS_KEY | skills login --api-key`
   reads it from stdin, verifies it and stores it. Nothing is echoed.
 - An email code instead of the browser: `skills login --email you@example.com`.
+  Interactive code input is masked. For an agent or headless terminal, first
+  request a code with `skills login --email you@example.com --json`, then send
+  the fresh code through stdin to `skills login --email you@example.com
+  --code-stdin --json`. This finishes the same sign-in without requesting another
+  code. Keep the code out of shell commands, arguments and logs.
 - Running `skills` in a terminal opens the interactive browser. It also works
   signed out and has the same account commands: `/login`, `/logout`, `/whoami`.

@@ -1,3 +1,4 @@
+#!/usr/bin/env bun
 // @bun
 var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;

	@@ -1 +1,2 @@
1	+ #!/usr/bin/env bun
1 2	export {};

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.10.42",
+  "version": "0.10.43",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {

@hasna/skills 0.10.42 → 0.10.43