@hasna/skills 0.9.19 → 0.10.0

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.9.19",
+    version: "0.10.0",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -20921,7 +20921,7 @@ function toV1BaseUrl(apiUrl) {
   url2.pathname = `${path}/v1`;
   return url2.toString().replace(/\/+$/, "");
 }
-var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", PACKAGE = "@hasna/secrets", MAX_PACKAGE_BYTES, CredentialResolutionError, CredentialFileUnsafeError, HASNA_HOME_ENV_KEY = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION", HASNA_HOME_DIR = ".hasna", CONFIG_SUBDIR = "config", CREDENTIALS_FILE = "credentials", KEYCHAIN_SECURITY_BIN = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44, KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4, MAX_CREDENTIAL_FILE_BYTES, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM, CREDENTIAL_SEAL, AMBIENT_ENVIRONMENT, requireSecretsSdk, DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com", ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, IDEMPOTENT_METHODS, AUTHORITY_OVERRIDE_HEADERS;
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", PACKAGE = "@hasna/secrets", MAX_PACKAGE_BYTES, CredentialResolutionError, CredentialFileUnsafeError, HASNA_HOME_ENV_KEY = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION", HASNA_HOME_DIR = ".hasna", CONFIG_SUBDIR = "config", CREDENTIALS_FILE = "credentials", KEYCHAIN_SECURITY_BIN = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44, KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4, MAX_CREDENTIAL_FILE_BYTES, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM, CREDENTIAL_SEAL, AMBIENT_ENVIRONMENT, requireSecretsSdk, DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com", ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, ClientTransportConfigurationError, IDEMPOTENT_METHODS, AUTHORITY_OVERRIDE_HEADERS;
 var init_transport = __esm(() => {
   MAX_PACKAGE_BYTES = 1024 * 1024;
   CredentialResolutionError = class CredentialResolutionError extends Error {
@@ -20954,6 +20954,16 @@ var init_transport = __esm(() => {
   requireSecretsSdk = createRequire(import.meta.url);
   ASCII_CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
   DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+  ClientTransportConfigurationError = class ClientTransportConfigurationError extends Error {
+    appName;
+    sources;
+    constructor(appName, message, sources = []) {
+      super(message);
+      this.name = "ClientTransportConfigurationError";
+      this.appName = appName;
+      this.sources = Object.freeze([...sources]);
+    }
+  };
   IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
   AUTHORITY_OVERRIDE_HEADERS = new Set([
     "host",
@@ -21050,6 +21060,12 @@ function readSkillsInstanceMetadata(file2) {
     throw new Error("Skills API URL aliases disagree");
   return { apiUrl: urls[0], binding: values.get(SKILLS_BOUND_API_URL) };
 }
+function skillsFileHasCredential(file2) {
+  const text = readMetadataText(file2);
+  if (text === null)
+    return false;
+  return /^\s*(?:export\s+)?(?:HASNA_SKILLS_API_KEY|SKILLS_API_KEY|HASNA_SKILLS_API_KEY_REF)\s*=\s*\S/m.test(text);
+}
 var SKILLS_BOUND_API_URL = "HASNA_SKILLS_BOUND_API_URL";
 var init_instance_credentials = __esm(() => {
   init_transport();
@@ -21081,6 +21097,9 @@ var init_local_opt_in = __esm(() => {
   SKILLS_LOCAL_OPT_IN_ENV_KEYS = ["HASNA_SKILLS_LOCAL", "SKILLS_LOCAL"];
 });
 
+// src/lib/product-default.ts
+var SKILLS_PRODUCT_DEFAULT_ORIGIN = "https://skills.md";
+
 // src/lib/fleet-credentials.ts
 var exports_fleet_credentials = {};
 __export(exports_fleet_credentials, {
@@ -21089,6 +21108,7 @@ __export(exports_fleet_credentials, {
   skillsCredentialFilePath: () => skillsCredentialFilePath,
   skillsApiRequestUrl: () => skillsApiRequestUrl,
   selectsSkillsLocalMode: () => selectsSkillsLocalMode,
+  resolveSkillsSignInOrigin: () => resolveSkillsSignInOrigin,
   resolveSkillsFleet: () => resolveSkillsFleet,
   resolveSkillsConnection: () => resolveSkillsConnection,
   resolveSkillsApiOrigin: () => resolveSkillsApiOrigin,
@@ -21101,9 +21121,12 @@ __export(exports_fleet_credentials, {
   normalizeSkillsApiOrigin: () => normalizeSkillsApiOrigin,
   isSkillsLocalOptIn: () => isSkillsLocalOptIn,
   isSkillsFleetCredentialError: () => isSkillsFleetCredentialError,
+  gatewaySignInRefusal: () => gatewaySignInRefusal,
+  credentialPairing: () => credentialPairing,
   configuredSkillsApiUrl: () => configuredSkillsApiUrl,
   SkillsFleetCredentialError: () => SkillsFleetCredentialError,
   SKILLS_LOCAL_OPT_IN_ENV_KEYS: () => SKILLS_LOCAL_OPT_IN_ENV_KEYS,
+  SKILLS_CREDENTIAL_TIERS: () => SKILLS_CREDENTIAL_TIERS,
   SKILLS_APP: () => SKILLS_APP,
   SKILLS_API_URL_ENV_KEYS: () => SKILLS_API_URL_ENV_KEYS,
   SKILLS_API_URL_ENV: () => SKILLS_API_URL_ENV,
@@ -21112,6 +21135,9 @@ __export(exports_fleet_credentials, {
   REDACTED_VAULT_REFERENCE: () => REDACTED_VAULT_REFERENCE,
   MissingSkillsFleetError: () => MissingSkillsFleetError
 });
+function isClientTransportConfigurationError(error61) {
+  return error61 instanceof ClientTransportConfigurationError || typeof error61 === "object" && error61 !== null && error61.name === "ClientTransportConfigurationError";
+}
 function isCredentialResolutionError(error61) {
   return error61 instanceof CredentialResolutionError || typeof error61 === "object" && error61 !== null && error61.name === "CredentialResolutionError";
 }
@@ -21166,7 +21192,7 @@ function configuredSkillsApiUrl(env = process.env, keychain, profile) {
     if (!entry.value.trim() || /[\x00-\x1f\x7f]/.test(entry.value))
       throw new SkillsFleetCredentialError(`${entry.key} is blank or contains control characters`, "INVALID_API_URL");
   }
-  const normalized = declared.map((entry) => ({ value: normalizeSkillsApiOrigin(entry.value), source: entry.key }));
+  const normalized = declared.map((entry) => ({ value: normalizeSkillsApiOrigin(entry.value), source: entry.key, trust: "environment" }));
   if (new Set(normalized.map((entry) => entry.value)).size > 1)
     throw new SkillsFleetCredentialError("Skills API URL aliases disagree", "INVALID_API_URL");
   if (normalized[0])
@@ -21175,19 +21201,19 @@ function configuredSkillsApiUrl(env = process.env, keychain, profile) {
     for (const file2 of skillsProfileCredentialFiles(env, profile)) {
       const metadata = readSkillsInstanceMetadata(file2);
       if (metadata.apiUrl || metadata.binding)
-        return { value: metadata.apiUrl ?? metadata.binding, source: file2 };
+        return { value: metadata.apiUrl ?? metadata.binding, source: file2, trust: "file" };
     }
-    return { value: defaultFleetGatewayBaseUrl(SKILLS_APP), source: "default" };
+    return { value: defaultFleetGatewayBaseUrl(SKILLS_APP), source: "default", trust: "default" };
   }
   const fromKeychain = keychainConfigValue(SKILLS_APP, env, keychain);
   if (fromKeychain)
-    return { value: fromKeychain.value.trim(), source: fromKeychain.source };
+    return { value: fromKeychain.value.trim(), source: fromKeychain.source, trust: "keychain" };
   const fromDisk = appConfigDiskValue(SKILLS_APP, env, SKILLS_API_URL_ENV_KEYS);
   if (fromDisk?.unusable) {
     throw new SkillsFleetCredentialError(`${fromDisk.key} in ${fromDisk.path} is declared but blank or malformed; ` + `a Skills authority must be a valid https URL (or an exact loopback http URL).`, "INVALID_API_URL");
   }
   if (fromDisk)
-    return { value: fromDisk.value.trim(), source: fromDisk.path };
+    return { value: fromDisk.value.trim(), source: fromDisk.path, trust: "file" };
   return null;
 }
 function skillsCredentialFiles(env = process.env) {
@@ -21252,13 +21278,13 @@ function resolveSkillsFleetOrThrow(env, options) {
   const credential = resolveCredential(SKILLS_APP, env, options.credentials);
   if (!credential) {
     if (!configured) {
-      throw new SkillsFleetCredentialError(`No API key resolved and no Skills API URL is configured \u2014 failing closed ` + `(local mode is opt-in only: set ${SKILLS_LOCAL_OPT_IN_ENV_KEYS[0]}=1 to run on this machine). ` + `Looked in ${credentialLocations(env)}. Sign in with: skills auth login`);
+      throw new SkillsFleetCredentialError(`No API key resolved and no Skills API URL is configured \u2014 failing closed ` + `(local mode is opt-in only: set ${SKILLS_LOCAL_OPT_IN_ENV_KEYS[0]}=1 to run on this machine). ` + `Looked in ${credentialLocations(env)}. Sign in with: skills login`);
     }
-    throw new SkillsFleetCredentialError(`${configured.source} points this CLI at a Skills service but no API key resolved \u2014 refusing to run locally instead. ` + `Looked in ${credentialLocations(env)}. Sign in with: skills auth login`);
+    throw new SkillsFleetCredentialError(`${configured.source} points this CLI at a Skills service but no API key resolved \u2014 refusing to run locally instead. ` + `Looked in ${credentialLocations(env)}. Sign in with: skills login`);
   }
   const apiOrigin = normalizeSkillsApiOrigin(configured?.value ?? defaultFleetGatewayBaseUrl(SKILLS_APP));
   toV1BaseUrl(apiOrigin);
-  assertCredentialInstance(credential, apiOrigin, env, options);
+  assertCredentialInstancePairing(credential, configured, apiOrigin, env, options);
   assertFilesUnchanged();
   const base = {
     mode: "hosted",
@@ -21272,7 +21298,7 @@ function resolveSkillsFleetOrThrow(env, options) {
     return { ...base, apiKey: null, apiKeyPointer: credential };
   }
   if (!credential.apiKey.trim()) {
-    throw new SkillsFleetCredentialError(`The Skills API key from ${credential.source} is empty \u2014 refusing to send an unauthenticated request. ` + `Sign in with: skills auth login`);
+    throw new SkillsFleetCredentialError(`The Skills API key from ${credential.source} is empty \u2014 refusing to send an unauthenticated request. ` + `Sign in with: skills login`);
   }
   return { ...base, apiKey: credential.apiKey, apiKeyPointer: null };
 }
@@ -21280,17 +21306,49 @@ function credentialLocations(env) {
   const files = skillsCredentialFiles(env).join(" or ") || "no credentials file (HOME is unset)";
   return `hasna.credentials.${SKILLS_APP}.api-key (macOS Keychain, account HASNA_STATION or the host name), ${files}, and ${SKILLS_API_KEY_ENV}`;
 }
-function assertCredentialInstance(credential, apiOrigin, env, options) {
-  let bound;
-  if (credential.tier === "disk" || credential.tier === "profile" || credential.tier === "pointer" && credential.diskCandidates.includes(credential.source)) {
-    const metadata = readSkillsInstanceMetadata(credential.source);
-    bound = metadata.binding ?? metadata.apiUrl ?? defaultFleetGatewayBaseUrl(SKILLS_APP);
-  } else if (credential.tier === "keychain") {
-    bound = keychainConfigValue(SKILLS_APP, env, options.credentials?.keychain)?.value ?? defaultFleetGatewayBaseUrl(SKILLS_APP);
+function credentialPairing(credential, env, options = {}) {
+  const fileBinding = (file2) => {
+    const metadata = readSkillsInstanceMetadata(file2);
+    return { kind: "bound", instance: normalizeSkillsApiOrigin(metadata.binding ?? metadata.apiUrl ?? defaultFleetGatewayBaseUrl(SKILLS_APP)) };
+  };
+  const tier = credential.tier;
+  switch (tier) {
+    case "disk":
+    case "profile":
+      return fileBinding(credential.source);
+    case "pointer":
+      return credential.diskCandidates.includes(credential.source) ? fileBinding(credential.source) : { kind: "unbound" };
+    case "keychain":
+      return {
+        kind: "bound",
+        instance: normalizeSkillsApiOrigin(keychainConfigValue(SKILLS_APP, env, options.credentials?.keychain)?.value ?? defaultFleetGatewayBaseUrl(SKILLS_APP))
+      };
+    case "env":
+    case "override":
+    case "argument":
+      return { kind: "unbound" };
+    default: {
+      const unclassified = tier;
+      throw new SkillsFleetCredentialError(`The Skills credential from ${credential.source} has an unclassified tier (${String(unclassified)}); refusing to send it.`, "INSTANCE_CREDENTIAL_MISMATCH");
+    }
   }
-  if (bound && normalizeSkillsApiOrigin(bound) !== apiOrigin) {
+}
+function assertCredentialInstancePairing(credential, configured, apiOrigin, env, options) {
+  const pairing = credentialPairing(credential, env, options);
+  if (pairing.kind === "bound") {
+    if (pairing.instance === apiOrigin)
+      return;
     throw new SkillsFleetCredentialError("The selected Skills API does not match this credential's instance. Select its profile or sign in to the new instance; no credential was sent.", "INSTANCE_CREDENTIAL_MISMATCH");
   }
+  if (apiOrigin === normalizeSkillsApiOrigin(defaultFleetGatewayBaseUrl(SKILLS_APP)))
+    return;
+  if (configured?.trust === "environment")
+    return;
+  const next = [
+    `set ${SKILLS_API_URL_ENV} alongside ${credential.source}`,
+    `unset ${credential.source}, then run: skills login`
+  ];
+  throw new SkillsFleetCredentialError(`${credential.source} records no Skills server of its own, so it is only sent to the internal gateway or to a URL ` + `from the environment (${SKILLS_API_URL_ENV}); the Skills URL here comes from ${configured?.source ?? "nowhere"}. ` + `No credential was sent. To use your own server, ${next[0]}; otherwise ${next[1]}.`, "INSTANCE_CREDENTIAL_MISMATCH", next);
 }
 async function resolveSkillsApiKey(env = process.env, options = {}) {
   return (await resolveSkillsConnection(env, options))?.apiKey ?? null;
@@ -21307,7 +21365,7 @@ async function resolveSkillsConnection(env = process.env, options = {}) {
     return { ...fleet, apiKey: fleet.apiKey };
   const pointer = fleet.apiKeyPointer;
   if (!pointer) {
-    throw new SkillsFleetCredentialError(`A Skills authority resolved but no API key did. Sign in with: skills auth login`);
+    throw new SkillsFleetCredentialError(`A Skills authority resolved but no API key did. Sign in with: skills login`);
   }
   let completed;
   try {
@@ -21364,13 +21422,84 @@ function requireSkillsApiOrigin(action = "This command", env = process.env, opti
     throw new MissingSkillsFleetError(action);
   return resolved.origin;
 }
+function gatewaySignInRefusal(target) {
+  if (normalizeSkillsApiOrigin(target.origin) !== normalizeSkillsApiOrigin(defaultFleetGatewayBaseUrl(SKILLS_APP)))
+    return null;
+  const cause = target.credentialSource ? `${target.credentialSource} holds a Skills credential for the internal gateway` : target.source === "--url" ? "--url names the internal gateway" : `${target.source} selects the internal gateway`;
+  const unset = target.credentialSource ?? (target.source === "--url" ? null : target.source);
+  return new SkillsFleetCredentialError(`${cause}, which has no sign-in service. Nothing was sent.` + (unset ? ` To sign in to the default server instead, first unset ${unset} (or remove it from where it is stored), then run: skills login.` : ""), "GATEWAY_AUTH_UNAVAILABLE", unset ? [`unset ${unset}`, "skills login"] : undefined);
+}
+function explicitSignInOrigin(url2) {
+  if (!url2.trim() || /[\x00-\x1f\x7f]/.test(url2)) {
+    throw new SkillsFleetCredentialError("--url is blank or contains control characters", "INVALID_API_URL");
+  }
+  let origin;
+  try {
+    origin = normalizeSkillsApiOrigin(url2.trim());
+  } catch (error61) {
+    if (isSkillsFleetCredentialError(error61))
+      throw error61;
+    throw new SkillsFleetCredentialError("--url is not a valid URL", "INVALID_API_URL");
+  }
+  try {
+    toV1BaseUrl(origin);
+  } catch (error61) {
+    if (isClientTransportConfigurationError(error61))
+      throw new SkillsFleetCredentialError(error61.message, "INVALID_API_URL");
+    throw error61;
+  }
+  return origin;
+}
+function resolveSkillsSignInOrigin(env = process.env, options = {}, explicitUrl) {
+  try {
+    const snapshot = snapshotSkillsEnvironment(env);
+    const resolvedOptions = snapshotSkillsOptions(env, options);
+    const profile = resolvedOptions.credentials?.profile;
+    const configured = configuredSkillsApiUrl(snapshot, resolvedOptions.credentials?.keychain, profile);
+    const declared = configured && configured.source !== "default" ? configured : null;
+    if (explicitUrl !== undefined) {
+      const origin = explicitSignInOrigin(explicitUrl);
+      const storedHere = declared ? skillsProfileCredentialFiles(snapshot, profile).includes(declared.source) : false;
+      if (declared && !storedHere && normalizeSkillsApiOrigin(declared.value) !== origin) {
+        throw new SkillsFleetCredentialError(`--url ${origin} conflicts with ${declared.source}, which outranks the saved configuration and would ` + `shadow the key this sign-in stores. Unset ${declared.source} or pass the same URL.`, "INVALID_API_URL");
+      }
+      return { origin, source: "--url" };
+    }
+    if (declared) {
+      toV1BaseUrl(declared.value);
+      return { origin: normalizeSkillsApiOrigin(declared.value), source: declared.source };
+    }
+    let credential;
+    try {
+      credential = resolveCredential(SKILLS_APP, snapshot, resolvedOptions.credentials);
+    } catch (error61) {
+      const files = selectedSkillsProfile(snapshot, profile) ? skillsProfileCredentialFiles(snapshot, profile) : [];
+      if (!isCredentialResolutionError(error61) || files.length === 0 || files.some(skillsFileHasCredential))
+        throw error61;
+      credential = null;
+    }
+    if (credential) {
+      const pairing = credentialPairing(credential, snapshot, resolvedOptions);
+      const origin = pairing.kind === "bound" ? pairing.instance : normalizeSkillsApiOrigin(defaultFleetGatewayBaseUrl(SKILLS_APP));
+      return { origin, source: "default", credentialSource: credential.source };
+    }
+    return { origin: SKILLS_PRODUCT_DEFAULT_ORIGIN, source: "default" };
+  } catch (error61) {
+    const translated = asSkillsFleetCredentialError(error61);
+    if (translated)
+      throw translated;
+    if (isClientTransportConfigurationError(error61))
+      throw new SkillsFleetCredentialError(error61.message, "INVALID_API_URL");
+    throw error61;
+  }
+}
 function requireSkillsFleet(action = "This command", env = process.env, options = {}) {
   const fleet = resolveSkillsFleet(env, options);
   if (fleet.mode === "hosted")
     return fleet;
   throw new MissingSkillsFleetError(action);
 }
-var SKILLS_APP = "skills", ENV_KEYS, SKILLS_API_URL_ENV_KEYS, SKILLS_API_KEY_ENV_KEYS, SKILLS_API_URL_ENV, SKILLS_API_KEY_ENV, SkillsFleetCredentialError, REDACTED_VAULT_REFERENCE = "[redacted vault reference]", localNoticePrinted = false, MissingSkillsFleetError;
+var SKILLS_APP = "skills", ENV_KEYS, SKILLS_API_URL_ENV_KEYS, SKILLS_API_KEY_ENV_KEYS, SKILLS_API_URL_ENV, SKILLS_API_KEY_ENV, SKILLS_CREDENTIAL_TIERS, SkillsFleetCredentialError, REDACTED_VAULT_REFERENCE = "[redacted vault reference]", localNoticePrinted = false, MissingSkillsFleetError;
 var init_fleet_credentials = __esm(() => {
   init_transport();
   init_instance_credentials();
@@ -21381,18 +21510,22 @@ var init_fleet_credentials = __esm(() => {
   SKILLS_API_KEY_ENV_KEYS = ENV_KEYS.apiKeyKeys;
   SKILLS_API_URL_ENV = SKILLS_API_URL_ENV_KEYS[0];
   SKILLS_API_KEY_ENV = SKILLS_API_KEY_ENV_KEYS[0];
+  SKILLS_CREDENTIAL_TIERS = ["argument", "override", "pointer", "profile", "keychain", "disk", "env"];
   SkillsFleetCredentialError = class SkillsFleetCredentialError extends Error {
     code;
-    constructor(message, code = "MISSING_API_CREDENTIAL") {
+    next;
+    constructor(message, code = "MISSING_API_CREDENTIAL", next) {
       super(message);
       this.name = "SkillsFleetCredentialError";
       this.code = code;
+      if (next)
+        this.next = next;
     }
   };
   MissingSkillsFleetError = class MissingSkillsFleetError extends Error {
     code = "MISSING_API_URL";
     constructor(action = "This command") {
-      super(`${action} requires a Skills API credential and none is configured \u2014 ` + `run: skills auth login, or set ${SKILLS_API_KEY_ENV} ` + `(add the Keychain item hasna.credentials.${SKILLS_APP}.api-key, or write ~/.hasna/skills/config/credentials). ` + `Point at your own instance with ${SKILLS_API_URL_ENV}, or run: skills setup --api-url <your Skills instance origin>`);
+      super(`${action} requires a Skills API credential and none is configured \u2014 ` + `run: skills login, or set ${SKILLS_API_KEY_ENV} ` + `(add the Keychain item hasna.credentials.${SKILLS_APP}.api-key, or write ~/.hasna/skills/config/credentials). ` + `Point at your own instance with ${SKILLS_API_URL_ENV}, or run: skills setup --api-url <your Skills instance origin>`);
       this.name = "MissingSkillsFleetError";
     }
   };
@@ -49905,7 +50038,7 @@ var init_api_url = __esm(() => {
   init_fleet_credentials();
   init_fleet_credentials();
   API_URL_ENV_VAR = SKILLS_API_URL_ENV;
-  MISSING_API_URL_HINT = `run: skills auth login, or set ${API_URL_ENV_VAR}=<your Skills instance origin>, ` + `or run: skills setup --api-url <your Skills instance origin>`;
+  MISSING_API_URL_HINT = `run: skills login, or set ${API_URL_ENV_VAR}=<your Skills instance origin>, ` + `or run: skills setup --api-url <your Skills instance origin>`;
 });
 
 // src/lib/discovery.ts
@@ -53006,7 +53139,7 @@ class RemoteSkillsAuthClient {
     return (await this.sessionClient(email4, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
   }
   request(path, options) {
-    if (!["/api/auth/login", "/api/auth/verify", "/api/auth/device/start", "/api/auth/device/token", "/api/auth/keys", "/api/auth/whoami"].includes(path))
+    if (!["/api/auth/login", "/api/auth/verify", "/api/auth/device/start", "/api/auth/device/token", "/api/auth/keys", "/api/auth/whoami", "/api/auth/logout"].includes(path))
       throw new Error("Unsupported authentication operation");
     return requestAuthApi(this.apiOrigin, path, options);
   }
@@ -55241,7 +55374,7 @@ async function readSurface(body) {
     return await body();
   } catch (error61) {
     if (isSkillsFleetCredentialError(error61))
-      return mcpError("AUTH_REQUIRED", error61.message, ["skills auth login"]);
+      return mcpError("AUTH_REQUIRED", error61.message, ["skills login"]);
     throw error61;
   }
 }

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.19",
+  version: "0.10.0",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -24122,7 +24122,7 @@ var init_dist_es9 = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.19",
+  version: "0.10.0",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -36906,13 +36906,15 @@ var SKILLS_API_URL_ENV_KEYS = ENV_KEYS.apiUrlKeys;
 var SKILLS_API_KEY_ENV_KEYS = ENV_KEYS.apiKeyKeys;
 var SKILLS_API_URL_ENV = SKILLS_API_URL_ENV_KEYS[0];
 var SKILLS_API_KEY_ENV = SKILLS_API_KEY_ENV_KEYS[0];
-
 class SkillsFleetCredentialError extends Error {
   code;
-  constructor(message, code = "MISSING_API_CREDENTIAL") {
+  next;
+  constructor(message, code = "MISSING_API_CREDENTIAL", next2) {
     super(message);
     this.name = "SkillsFleetCredentialError";
     this.code = code;
+    if (next2)
+      this.next = next2;
   }
 }
 function normalizeSkillsApiOrigin(apiUrl) {

package/bin/worker.js

@@ -24125,7 +24125,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.19",
+  version: "0.10.0",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/cli/commands/auth.d.ts

@@ -1,2 +1,4 @@
 import { Command } from "commander";
+/** `skills login`, `skills logout`, `skills whoami` — the account verbs, at the top level. */
+export declare function registerAccountCommands(parent: Command): void;
 export declare function registerAuth(parent: Command): void;

package/dist/cli/components/AccountView.d.ts

@@ -0,0 +1,16 @@
+import React from "react";
+/** The TUI's account commands: `/login [url]`, `/logout`, `/whoami`, `/help`. */
+export type AccountAction = "login" | "logout" | "whoami" | "help";
+export declare const SLASH_COMMANDS: ReadonlyArray<{
+    usage: string;
+    description: string;
+}>;
+interface AccountViewProps {
+    action: AccountAction;
+    /** `/login <url>`: sign in to this server instead of the default. */
+    argument?: string;
+    /** Leave the view; `changed` is true when the stored credential changed. */
+    onDone: (changed: boolean) => void;
+}
+export declare function AccountView({ action, argument, onDone }: AccountViewProps): React.JSX.Element;
+export {};

package/dist/cli/components/App.d.ts

@@ -1,7 +1,24 @@
 import React from "react";
+/**
+ * What the read gate said when the TUI opened (and after every sign-in or
+ * sign-out). A signed-out TUI still renders — that is where `/login` lives —
+ * but it offers no catalog: data views stay behind the same fail-closed gate
+ * as every other surface.
+ */
+export type TuiAccess = {
+    state: "hosted";
+    origin: string;
+} | {
+    state: "local";
+} | {
+    state: "signed-out";
+    reason: string;
+    code?: string;
+};
 interface AppProps {
     initialSkills?: string[];
     overwrite?: boolean;
+    initialAccess?: TuiAccess;
 }
-export declare function App({ initialSkills, overwrite }: AppProps): React.JSX.Element;
+export declare function App({ initialSkills, overwrite, initialAccess }: AppProps): React.JSX.Element;
 export {};

package/dist/cli/components/SearchView.d.ts

@@ -4,6 +4,8 @@ interface SearchViewProps {
     onToggle: (name: string) => void;
     onConfirm: () => void;
     onBack: () => void;
+    /** A query starting with "/" is a slash command, run on Enter instead of searched. */
+    onCommand?: (line: string) => void;
 }
-export declare function SearchView({ selected, onToggle, onConfirm, onBack, }: SearchViewProps): React.JSX.Element;
+export declare function SearchView({ selected, onToggle, onConfirm, onBack, onCommand, }: SearchViewProps): React.JSX.Element;
 export {};

package/dist/cli/profile-selection.d.ts

@@ -0,0 +1,3 @@
+/** Called once by the program's preAction hook, before `--profile` is applied. */
+export declare function recordEnvironmentProfile(value: string | undefined): void;
+export declare function getEnvironmentProfile(): string | undefined;

package/dist/index.js

@@ -9611,7 +9611,7 @@ import { isAbsolute as isAbsolute11, join as join23, resolve as resolve11 } from
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.19",
+  version: "0.10.0",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -10684,13 +10684,15 @@ var SKILLS_API_URL_ENV_KEYS = ENV_KEYS.apiUrlKeys;
 var SKILLS_API_KEY_ENV_KEYS = ENV_KEYS.apiKeyKeys;
 var SKILLS_API_URL_ENV = SKILLS_API_URL_ENV_KEYS[0];
 var SKILLS_API_KEY_ENV = SKILLS_API_KEY_ENV_KEYS[0];
-
 class SkillsFleetCredentialError extends Error {
   code;
-  constructor(message, code = "MISSING_API_CREDENTIAL") {
+  next;
+  constructor(message, code = "MISSING_API_CREDENTIAL", next) {
     super(message);
     this.name = "SkillsFleetCredentialError";
     this.code = code;
+    if (next)
+      this.next = next;
   }
 }
 function isCredentialResolutionError(error) {
@@ -10748,7 +10750,7 @@ function configuredSkillsApiUrl(env = process.env, keychain, profile) {
     if (!entry.value.trim() || /[\x00-\x1f\x7f]/.test(entry.value))
       throw new SkillsFleetCredentialError(`${entry.key} is blank or contains control characters`, "INVALID_API_URL");
   }
-  const normalized = declared.map((entry) => ({ value: normalizeSkillsApiOrigin(entry.value), source: entry.key }));
+  const normalized = declared.map((entry) => ({ value: normalizeSkillsApiOrigin(entry.value), source: entry.key, trust: "environment" }));
   if (new Set(normalized.map((entry) => entry.value)).size > 1)
     throw new SkillsFleetCredentialError("Skills API URL aliases disagree", "INVALID_API_URL");
   if (normalized[0])
@@ -10757,19 +10759,19 @@ function configuredSkillsApiUrl(env = process.env, keychain, profile) {
     for (const file of skillsProfileCredentialFiles(env, profile)) {
       const metadata = readSkillsInstanceMetadata(file);
       if (metadata.apiUrl || metadata.binding)
-        return { value: metadata.apiUrl ?? metadata.binding, source: file };
+        return { value: metadata.apiUrl ?? metadata.binding, source: file, trust: "file" };
     }
-    return { value: defaultFleetGatewayBaseUrl(SKILLS_APP), source: "default" };
+    return { value: defaultFleetGatewayBaseUrl(SKILLS_APP), source: "default", trust: "default" };
   }
   const fromKeychain = keychainConfigValue(SKILLS_APP, env, keychain);
   if (fromKeychain)
-    return { value: fromKeychain.value.trim(), source: fromKeychain.source };
+    return { value: fromKeychain.value.trim(), source: fromKeychain.source, trust: "keychain" };
   const fromDisk = appConfigDiskValue(SKILLS_APP, env, SKILLS_API_URL_ENV_KEYS);
   if (fromDisk?.unusable) {
     throw new SkillsFleetCredentialError(`${fromDisk.key} in ${fromDisk.path} is declared but blank or malformed; ` + `a Skills authority must be a valid https URL (or an exact loopback http URL).`, "INVALID_API_URL");
   }
   if (fromDisk)
-    return { value: fromDisk.value.trim(), source: fromDisk.path };
+    return { value: fromDisk.value.trim(), source: fromDisk.path, trust: "file" };
   return null;
 }
 function skillsCredentialFiles(env = process.env) {
@@ -10832,13 +10834,13 @@ function resolveSkillsFleetOrThrow(env, options) {
   const credential = resolveCredential(SKILLS_APP, env, options.credentials);
   if (!credential) {
     if (!configured) {
-      throw new SkillsFleetCredentialError(`No API key resolved and no Skills API URL is configured \u2014 failing closed ` + `(local mode is opt-in only: set ${SKILLS_LOCAL_OPT_IN_ENV_KEYS[0]}=1 to run on this machine). ` + `Looked in ${credentialLocations(env)}. Sign in with: skills auth login`);
+      throw new SkillsFleetCredentialError(`No API key resolved and no Skills API URL is configured \u2014 failing closed ` + `(local mode is opt-in only: set ${SKILLS_LOCAL_OPT_IN_ENV_KEYS[0]}=1 to run on this machine). ` + `Looked in ${credentialLocations(env)}. Sign in with: skills login`);
     }
-    throw new SkillsFleetCredentialError(`${configured.source} points this CLI at a Skills service but no API key resolved \u2014 refusing to run locally instead. ` + `Looked in ${credentialLocations(env)}. Sign in with: skills auth login`);
+    throw new SkillsFleetCredentialError(`${configured.source} points this CLI at a Skills service but no API key resolved \u2014 refusing to run locally instead. ` + `Looked in ${credentialLocations(env)}. Sign in with: skills login`);
   }
   const apiOrigin = normalizeSkillsApiOrigin(configured?.value ?? defaultFleetGatewayBaseUrl(SKILLS_APP));
   toV1BaseUrl(apiOrigin);
-  assertCredentialInstance(credential, apiOrigin, env, options);
+  assertCredentialInstancePairing(credential, configured, apiOrigin, env, options);
   assertFilesUnchanged();
   const base = {
     mode: "hosted",
@@ -10852,7 +10854,7 @@ function resolveSkillsFleetOrThrow(env, options) {
     return { ...base, apiKey: null, apiKeyPointer: credential };
   }
   if (!credential.apiKey.trim()) {
-    throw new SkillsFleetCredentialError(`The Skills API key from ${credential.source} is empty \u2014 refusing to send an unauthenticated request. ` + `Sign in with: skills auth login`);
+    throw new SkillsFleetCredentialError(`The Skills API key from ${credential.source} is empty \u2014 refusing to send an unauthenticated request. ` + `Sign in with: skills login`);
   }
   return { ...base, apiKey: credential.apiKey, apiKeyPointer: null };
 }
@@ -10860,17 +10862,49 @@ function credentialLocations(env) {
   const files = skillsCredentialFiles(env).join(" or ") || "no credentials file (HOME is unset)";
   return `hasna.credentials.${SKILLS_APP}.api-key (macOS Keychain, account HASNA_STATION or the host name), ${files}, and ${SKILLS_API_KEY_ENV}`;
 }
-function assertCredentialInstance(credential, apiOrigin, env, options) {
-  let bound;
-  if (credential.tier === "disk" || credential.tier === "profile" || credential.tier === "pointer" && credential.diskCandidates.includes(credential.source)) {
-    const metadata = readSkillsInstanceMetadata(credential.source);
-    bound = metadata.binding ?? metadata.apiUrl ?? defaultFleetGatewayBaseUrl(SKILLS_APP);
-  } else if (credential.tier === "keychain") {
-    bound = keychainConfigValue(SKILLS_APP, env, options.credentials?.keychain)?.value ?? defaultFleetGatewayBaseUrl(SKILLS_APP);
+function credentialPairing(credential, env, options = {}) {
+  const fileBinding = (file) => {
+    const metadata = readSkillsInstanceMetadata(file);
+    return { kind: "bound", instance: normalizeSkillsApiOrigin(metadata.binding ?? metadata.apiUrl ?? defaultFleetGatewayBaseUrl(SKILLS_APP)) };
+  };
+  const tier = credential.tier;
+  switch (tier) {
+    case "disk":
+    case "profile":
+      return fileBinding(credential.source);
+    case "pointer":
+      return credential.diskCandidates.includes(credential.source) ? fileBinding(credential.source) : { kind: "unbound" };
+    case "keychain":
+      return {
+        kind: "bound",
+        instance: normalizeSkillsApiOrigin(keychainConfigValue(SKILLS_APP, env, options.credentials?.keychain)?.value ?? defaultFleetGatewayBaseUrl(SKILLS_APP))
+      };
+    case "env":
+    case "override":
+    case "argument":
+      return { kind: "unbound" };
+    default: {
+      const unclassified = tier;
+      throw new SkillsFleetCredentialError(`The Skills credential from ${credential.source} has an unclassified tier (${String(unclassified)}); refusing to send it.`, "INSTANCE_CREDENTIAL_MISMATCH");
+    }
   }
-  if (bound && normalizeSkillsApiOrigin(bound) !== apiOrigin) {
+}
+function assertCredentialInstancePairing(credential, configured, apiOrigin, env, options) {
+  const pairing = credentialPairing(credential, env, options);
+  if (pairing.kind === "bound") {
+    if (pairing.instance === apiOrigin)
+      return;
     throw new SkillsFleetCredentialError("The selected Skills API does not match this credential's instance. Select its profile or sign in to the new instance; no credential was sent.", "INSTANCE_CREDENTIAL_MISMATCH");
   }
+  if (apiOrigin === normalizeSkillsApiOrigin(defaultFleetGatewayBaseUrl(SKILLS_APP)))
+    return;
+  if (configured?.trust === "environment")
+    return;
+  const next = [
+    `set ${SKILLS_API_URL_ENV} alongside ${credential.source}`,
+    `unset ${credential.source}, then run: skills login`
+  ];
+  throw new SkillsFleetCredentialError(`${credential.source} records no Skills server of its own, so it is only sent to the internal gateway or to a URL ` + `from the environment (${SKILLS_API_URL_ENV}); the Skills URL here comes from ${configured?.source ?? "nowhere"}. ` + `No credential was sent. To use your own server, ${next[0]}; otherwise ${next[1]}.`, "INSTANCE_CREDENTIAL_MISMATCH", next);
 }
 async function resolveSkillsApiKey(env = process.env, options = {}) {
   return (await resolveSkillsConnection(env, options))?.apiKey ?? null;
@@ -10887,7 +10921,7 @@ async function resolveSkillsConnection(env = process.env, options = {}) {
     return { ...fleet, apiKey: fleet.apiKey };
   const pointer = fleet.apiKeyPointer;
   if (!pointer) {
-    throw new SkillsFleetCredentialError(`A Skills authority resolved but no API key did. Sign in with: skills auth login`);
+    throw new SkillsFleetCredentialError(`A Skills authority resolved but no API key did. Sign in with: skills login`);
   }
   let completed;
   try {
@@ -10954,7 +10988,7 @@ function requireSkillsFleet(action = "This command", env = process.env, options
 class MissingSkillsFleetError extends Error {
   code = "MISSING_API_URL";
   constructor(action = "This command") {
-    super(`${action} requires a Skills API credential and none is configured \u2014 ` + `run: skills auth login, or set ${SKILLS_API_KEY_ENV} ` + `(add the Keychain item hasna.credentials.${SKILLS_APP}.api-key, or write ~/.hasna/skills/config/credentials). ` + `Point at your own instance with ${SKILLS_API_URL_ENV}, or run: skills setup --api-url <your Skills instance origin>`);
+    super(`${action} requires a Skills API credential and none is configured \u2014 ` + `run: skills login, or set ${SKILLS_API_KEY_ENV} ` + `(add the Keychain item hasna.credentials.${SKILLS_APP}.api-key, or write ~/.hasna/skills/config/credentials). ` + `Point at your own instance with ${SKILLS_API_URL_ENV}, or run: skills setup --api-url <your Skills instance origin>`);
     this.name = "MissingSkillsFleetError";
   }
 }
@@ -36498,7 +36532,7 @@ function date4(params) {
 }
 // src/lib/api-url.ts
 var API_URL_ENV_VAR = SKILLS_API_URL_ENV;
-var MISSING_API_URL_HINT = `run: skills auth login, or set ${API_URL_ENV_VAR}=<your Skills instance origin>, ` + `or run: skills setup --api-url <your Skills instance origin>`;
+var MISSING_API_URL_HINT = `run: skills login, or set ${API_URL_ENV_VAR}=<your Skills instance origin>, ` + `or run: skills setup --api-url <your Skills instance origin>`;
 function resolveApiUrl(env = process.env, options = {}) {
   const fleet = resolveSkillsFleet(env, options);
   return fleet.mode === "hosted" ? fleet.apiOrigin : undefined;
@@ -40659,7 +40693,7 @@ class RemoteSkillsAuthClient {
     return (await this.sessionClient(email4, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
   }
   request(path, options) {
-    if (!["/api/auth/login", "/api/auth/verify", "/api/auth/device/start", "/api/auth/device/token", "/api/auth/keys", "/api/auth/whoami"].includes(path))
+    if (!["/api/auth/login", "/api/auth/verify", "/api/auth/device/start", "/api/auth/device/token", "/api/auth/keys", "/api/auth/whoami", "/api/auth/logout"].includes(path))
       throw new Error("Unsupported authentication operation");
     return requestAuthApi(this.apiOrigin, path, options);
   }