@hasna/skills 0.9.20 → 0.10.1

package/dist/lib/sign-in.d.ts

@@ -0,0 +1,213 @@
+/**
+ * Signing in and out, shared by `skills login` / `skills logout` / `skills
+ * whoami` and the interactive TUI's `/login`, `/logout` and `/whoami`.
+ *
+ * The flow follows the Codex CLI model the owner chose (2026-09-23): a browser
+ * sign-in by default, a printed device code for headless machines, an API key
+ * read from stdin, and a logout that revokes what the sign-in minted.
+ *
+ * Device authorization follows RFC 8628: poll no faster than the server's
+ * `interval`, add five seconds on every `slow_down`, and stop on
+ * `expired_token`, `invalid_device_code` or `access_denied`. A pending device
+ * session is saved beside the credentials file, owner-only, so a headless
+ * `skills login --device` can be finished later with `skills login --poll`
+ * instead of starting a new session and discarding the code the user approved.
+ *
+ * Nothing here decides WHERE to sign in: callers pass the origin from
+ * `resolveSkillsSignInOrigin()`, which never sends a legacy internal key to the
+ * product default.
+ */
+import { type StoredCredentialOrigin, type StoredKeyIssuer } from "./auth-store.js";
+import { type SkillsFleetOptions } from "./fleet-credentials.js";
+type Env = Record<string, string | undefined>;
+/** The CLI's device-authorization client label, recorded by the server. */
+export declare const SKILLS_CLI_DEVICE_CLIENT = "skills-cli";
+/** RFC 8628 §3.5: every slow_down adds five seconds to the polling interval. */
+export declare const SLOW_DOWN_INCREMENT_MS = 5000;
+export interface DeviceAuthorizationStart {
+    /** Bearer capability for the pending key. Never printed; stored owner-only. */
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete?: string;
+    expiresIn: number;
+    interval: number;
+}
+/** What a successful sign-in returns: the key (or a session to mint one) and who signed in. */
+export interface SignInResult {
+    apiKey?: string;
+    token?: string;
+    user?: {
+        id?: string;
+        email?: string;
+        role?: string;
+    };
+    organization?: {
+        id?: string;
+        slug?: string;
+        name?: string;
+    };
+    firstLogin?: boolean;
+}
+export type DevicePollOutcome = {
+    status: "authorized";
+    result: SignInResult;
+} | {
+    status: "expired";
+} | {
+    status: "invalid";
+} | {
+    status: "denied";
+} | {
+    status: "timeout";
+} | {
+    status: "cancelled";
+};
+/** Validate the server's device-start answer; a malformed one is refused, never guessed at. */
+export declare function parseDeviceAuthorizationStart(body: unknown): DeviceAuthorizationStart;
+/** Ask the instance for a device code. Sends no credential. */
+export declare function startDeviceAuthorization(origin: string, client?: string): Promise<DeviceAuthorizationStart>;
+/** One poll of the token endpoint. Sends only the device code. */
+export declare function pollDeviceToken(origin: string, deviceCode: string): Promise<unknown>;
+export interface PollDeviceAuthorizationInput {
+    /** One token-endpoint request. Resolves with the body or throws HostedApiError. */
+    poll: () => Promise<unknown>;
+    intervalSeconds: number;
+    /** Epoch milliseconds after which polling stops with `timeout`. */
+    deadline: number;
+    signal?: AbortSignal;
+    /** Called with the new interval each time the server asks to slow down. */
+    onSlowDown?: (intervalMs: number) => void;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+}
+/**
+ * Poll until the user approves, the code expires, or the deadline passes.
+ *
+ * Transport failures and unexpected server errors are thrown, never read as
+ * "still pending": a sign-in that cannot reach its server must say so.
+ */
+export declare function pollDeviceAuthorization(input: PollDeviceAuthorizationInput): Promise<DevicePollOutcome>;
+export interface PendingDeviceSignIn {
+    origin: string;
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete?: string;
+    interval: number;
+    /** Epoch milliseconds. */
+    expiresAt: number;
+}
+/**
+ * Beside the credentials file, one per profile AND instance:
+ * `device-login[-<profile>]-<origin hash>.json`. Keyed by origin so a sign-in
+ * started on one server never overwrites a pending session for another.
+ */
+export declare function pendingDeviceSignInPath(origin: string, env?: Env): string;
+export declare function savePendingDeviceSignIn(origin: string, start: DeviceAuthorizationStart, env?: Env, now?: number): string;
+/**
+ * The saved session for exactly this instance, if it has not expired. A session
+ * saved for a different instance is never returned, so its device code is only
+ * ever sent back to the server that issued it.
+ */
+export declare function loadPendingDeviceSignIn(origin: string, env?: Env, now?: number): PendingDeviceSignIn | null;
+/** The instances with an unexpired pending sign-in for this profile. */
+export declare function pendingDeviceSignInOrigins(env?: Env, now?: number): string[];
+/** Forget the pending session for one instance, or every pending session of this profile. */
+export declare function clearPendingDeviceSignIn(env?: Env, origin?: string): void;
+/**
+ * Store the key a sign-in produced, bound to the instance that issued it.
+ * A session-only answer (a token, no key) mints a CLI key first.
+ */
+export declare function persistSignIn(result: SignInResult, origin: string, env?: Env, issuedBy?: StoredKeyIssuer): Promise<string>;
+/**
+ * What happened to server-side revocation.
+ *
+ *   revoked        — the server confirmed it revoked the key.
+ *   already_ended  — the server no longer accepts the key (HTTP 401/403).
+ *   not_requested  — a user-brought key deleted without --revoke (still works).
+ *   skipped        — --no-revoke on a login-minted key (may still be live).
+ *   unsupported    — cannot be revoked: the server has no revoke route
+ *                    (404/405/501), the internal gateway has no login service,
+ *                    or an older sign-in left no record of how it was issued.
+ *   not_revoked    — the server answered without confirming revocation.
+ *   failed         — the request did not complete (network, 5xx, bad answer).
+ *   none           — no credential stored by `skills login` to revoke.
+ */
+export type RevocationOutcome = "revoked" | "already_ended" | "not_requested" | "skipped" | "unsupported" | "not_revoked" | "failed" | "none";
+/** A stable reason code plus one plain sentence. Never contains a credential. */
+export interface SignOutReason {
+    code: "revocation_failed" | "revocation_not_confirmed" | "revocation_unsupported" | "revocation_skipped" | "credential_not_from_login" | "credential_still_active" | "local_delete_failed";
+    message: string;
+}
+export interface SignOutResult {
+    /** Exit 0 when true: every reason list is empty. */
+    signedOut: boolean;
+    /** What happened to the active profile's stored credential. */
+    stored: "deleted" | "none" | "left_alone" | "delete_failed";
+    storedBy?: StoredCredentialOrigin;
+    /** The credentials file, when one holds a credential. */
+    file?: string;
+    /** The instance the stored credential belongs to. */
+    origin?: string;
+    revocation: RevocationOutcome;
+    /** Sentences for a human: what was done, in order. */
+    notes: string[];
+    /** Why the command must exit non-zero. Empty when signed out. */
+    reasons: SignOutReason[];
+}
+export interface SignOutOptions {
+    /**
+     * true: also revoke a user-brought or legacy key (`--revoke`).
+     * false: revoke nothing (`--no-revoke`); a login-minted key left live exits non-zero.
+     * undefined: the default — revoke only what login minted.
+     */
+    revoke?: boolean;
+    env?: Env;
+    /** Resolution controls (a fake Keychain in tests). */
+    fleet?: SkillsFleetOptions;
+    /**
+     * A profile the ENVIRONMENT selects that differs from the active one, e.g.
+     * `HASNA_PROFILE=b skills --profile a logout`. If it still holds a credential,
+     * the next plain command uses it, so logout names it and exits non-zero.
+     */
+    environmentProfile?: string;
+}
+/** Where a person revokes a key by hand. Never a composed URL. */
+export declare function manualRevocationHint(origin: string): string;
+export declare function signOut(options?: SignOutOptions): Promise<SignOutResult>;
+export type SignedInAccount = {
+    signedIn: false;
+    reason: string;
+} | {
+    signedIn: true;
+    apiOrigin: string;
+    source: string;
+    email?: string;
+    organization?: string;
+    error?: string;
+};
+/** The account in effect, for a compact display (the TUI's `/whoami`). */
+export declare function readSignedInAccount(env?: Env): Promise<SignedInAccount>;
+/**
+ * The verification page to open, or null when it must only be printed.
+ *
+ * The URL comes from the server's answer, so it is opened only when it is an
+ * https URL (http only on loopback) with no userinfo, on the sign-in origin
+ * itself or on `auth.<sign-in host>` — where rule global-product-auth-url-layout
+ * will move the identity endpoints. Anything else is printed for the user to
+ * judge and never handed to the operating system.
+ */
+export declare function verificationUrlToOpen(raw: string, signInOrigin: string): string | null;
+/**
+ * The opener argv for a platform. Never a shell: on Windows `cmd /c start`
+ * would re-parse `&`, `|` and `^` in a server-provided URL, so the URL goes to
+ * the URL protocol handler as one argument instead.
+ */
+export declare function browserCommand(url: string, platform?: NodeJS.Platform): string[];
+/**
+ * Best effort: the URL and code are always printed too, so a refusal or a
+ * failure here costs nothing. Returns whether a browser was asked to open it.
+ */
+export declare function openVerificationPage(url: string, signInOrigin: string): boolean;
+export {};

package/dist/lib/vendor-host-policy.d.ts

@@ -69,6 +69,32 @@ export declare const VENDOR_HOST_URL_EXCEPTIONS: readonly {
     url: string;
     reason: string;
 }[];
+/**
+ * The product default: the one vendor URL an UNCONFIGURED install may name.
+ *
+ * Owner rulings 2026-09-23 (Todos PLA8-00366) made the product the default place
+ * to SIGN IN, superseding R1 for that one path: with no URL and no credential,
+ * `skills login` targets this origin. Every data surface still fails closed with
+ * no URL at all, and a credential that already resolves keeps its own instance
+ * (see unconfigured-client-boundary.test.ts and skills-md-default.test.ts).
+ *
+ * Unlike {@link VENDOR_HOST_URL_EXCEPTIONS}, this exception is scoped to FILES as
+ * well as to the exact URL. The origin is declared once, in `src/lib/product-default.ts`;
+ * it may appear in the two bundles built from the CLI and MCP entry points that
+ * import it, and in the README that documents it. The same URL anywhere else —
+ * a server default, a skill, a split or folded literal — is still a finding, so
+ * a second copy cannot quietly become another default. The URL is not repeated
+ * in this file: it is the imported constant.
+ */
+export declare const PRODUCT_DEFAULT_URL_EXCEPTION: {
+    url: string;
+    files: readonly string[];
+    reason: string;
+};
+/** Is this exact URL excepted in this exact file? Global exceptions, then the scoped product default. */
+export declare function isExceptedVendorUrl(url: string, file: string): boolean;
+/** Every excepted URL for one file, for the value-independent token scan to strip. */
+export declare function exceptedVendorUrlsFor(file: string | undefined): string[];
 /** Reduce a hostname to its registrable domain (approximate eTLD+1). */
 export declare function registrableDomain(host: string): string;
 export declare function isLoopbackHost(host: string): boolean;

package/dist/lib/vendor-host-url.d.ts

@@ -65,7 +65,7 @@ export interface VendorHostFinding {
 /**
  * Find known vendor domains even when they do not appear in a complete URL.
  */
-export declare function findVendorDomainTokens(text: string): {
+export declare function findVendorDomainTokens(text: string, file?: string): {
     domain: string;
     index: number;
 }[];

package/dist/sdk/index.js

@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.20",
+  version: "0.10.1",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -33390,9 +33390,17 @@ var AUTHORITY_OVERRIDE_HEADERS = new Set([
 
 // src/lib/instance-credentials.ts
 import { closeSync as closeSync3, constants, fstatSync as fstatSync3, lstatSync as lstatSync2, openSync as openSync3, readSync } from "fs";
+
+// src/lib/cli-credential-profile.ts
+var cliCredentialProfile;
+function selectedCliSkillsCredentialProfile() {
+  return cliCredentialProfile;
+}
+
+// src/lib/instance-credentials.ts
 var SKILLS_BOUND_API_URL = "HASNA_SKILLS_BOUND_API_URL";
 function selectedSkillsProfile(env, explicit) {
-  const selected = explicit ?? env.HASNA_PROFILE;
+  const selected = explicit ?? selectedCliSkillsCredentialProfile() ?? env.HASNA_PROFILE;
   if (selected === undefined)
     return null;
   const profile = selected.trim();
@@ -33505,13 +33513,15 @@ var SKILLS_API_URL_ENV_KEYS = ENV_KEYS.apiUrlKeys;
 var SKILLS_API_KEY_ENV_KEYS = ENV_KEYS.apiKeyKeys;
 var SKILLS_API_URL_ENV = SKILLS_API_URL_ENV_KEYS[0];
 var SKILLS_API_KEY_ENV = SKILLS_API_KEY_ENV_KEYS[0];
-
 class SkillsFleetCredentialError extends Error {
   code;
-  constructor(message, code = "MISSING_API_CREDENTIAL") {
+  next;
+  constructor(message, code = "MISSING_API_CREDENTIAL", next) {
     super(message);
     this.name = "SkillsFleetCredentialError";
     this.code = code;
+    if (next)
+      this.next = next;
   }
 }
 function isCredentialResolutionError(error) {
@@ -33569,7 +33579,7 @@ function configuredSkillsApiUrl(env = process.env, keychain, profile) {
     if (!entry.value.trim() || /[\x00-\x1f\x7f]/.test(entry.value))
       throw new SkillsFleetCredentialError(`${entry.key} is blank or contains control characters`, "INVALID_API_URL");
   }
-  const normalized = declared.map((entry) => ({ value: normalizeSkillsApiOrigin(entry.value), source: entry.key }));
+  const normalized = declared.map((entry) => ({ value: normalizeSkillsApiOrigin(entry.value), source: entry.key, trust: "environment" }));
   if (new Set(normalized.map((entry) => entry.value)).size > 1)
     throw new SkillsFleetCredentialError("Skills API URL aliases disagree", "INVALID_API_URL");
   if (normalized[0])
@@ -33578,19 +33588,19 @@ function configuredSkillsApiUrl(env = process.env, keychain, profile) {
     for (const file of skillsProfileCredentialFiles(env, profile)) {
       const metadata = readSkillsInstanceMetadata(file);
       if (metadata.apiUrl || metadata.binding)
-        return { value: metadata.apiUrl ?? metadata.binding, source: file };
+        return { value: metadata.apiUrl ?? metadata.binding, source: file, trust: "file" };
     }
-    return { value: defaultFleetGatewayBaseUrl(SKILLS_APP), source: "default" };
+    return { value: defaultFleetGatewayBaseUrl(SKILLS_APP), source: "default", trust: "default" };
   }
   const fromKeychain = keychainConfigValue(SKILLS_APP, env, keychain);
   if (fromKeychain)
-    return { value: fromKeychain.value.trim(), source: fromKeychain.source };
+    return { value: fromKeychain.value.trim(), source: fromKeychain.source, trust: "keychain" };
   const fromDisk = appConfigDiskValue(SKILLS_APP, env, SKILLS_API_URL_ENV_KEYS);
   if (fromDisk?.unusable) {
     throw new SkillsFleetCredentialError(`${fromDisk.key} in ${fromDisk.path} is declared but blank or malformed; ` + `a Skills authority must be a valid https URL (or an exact loopback http URL).`, "INVALID_API_URL");
   }
   if (fromDisk)
-    return { value: fromDisk.value.trim(), source: fromDisk.path };
+    return { value: fromDisk.value.trim(), source: fromDisk.path, trust: "file" };
   return null;
 }
 function skillsCredentialFiles(env = process.env) {
@@ -33638,11 +33648,13 @@ function snapshotSkillsEnvironment(env) {
   return Object.freeze(snapshot);
 }
 function snapshotSkillsOptions(env, options) {
+  const profile = options.credentials?.profile ?? selectedCliSkillsCredentialProfile();
+  const credentials = profile === undefined ? options.credentials : { ...options.credentials, profile };
   if (env !== process.env)
-    return options;
-  return { ...options, credentials: { ...options.credentials, keychain: {
-    ...options.credentials?.keychain,
-    enabled: options.credentials?.keychain?.enabled ?? true
+    return credentials === options.credentials ? options : { ...options, credentials };
+  return { ...options, credentials: { ...credentials, keychain: {
+    ...credentials?.keychain,
+    enabled: credentials?.keychain?.enabled ?? true
   } } };
 }
 function resolveSkillsFleetOrThrow(env, options) {
@@ -33653,13 +33665,13 @@ function resolveSkillsFleetOrThrow(env, options) {
   const credential = resolveCredential(SKILLS_APP, env, options.credentials);
   if (!credential) {
     if (!configured) {
-      throw new SkillsFleetCredentialError(`No API key resolved and no Skills API URL is configured \u2014 failing closed ` + `(local mode is opt-in only: set ${SKILLS_LOCAL_OPT_IN_ENV_KEYS[0]}=1 to run on this machine). ` + `Looked in ${credentialLocations(env)}. Sign in with: skills auth login`);
+      throw new SkillsFleetCredentialError(`No API key resolved and no Skills API URL is configured \u2014 failing closed ` + `(local mode is opt-in only: set ${SKILLS_LOCAL_OPT_IN_ENV_KEYS[0]}=1 to run on this machine). ` + `Looked in ${credentialLocations(env)}. Sign in with: skills login`);
     }
-    throw new SkillsFleetCredentialError(`${configured.source} points this CLI at a Skills service but no API key resolved \u2014 refusing to run locally instead. ` + `Looked in ${credentialLocations(env)}. Sign in with: skills auth login`);
+    throw new SkillsFleetCredentialError(`${configured.source} points this CLI at a Skills service but no API key resolved \u2014 refusing to run locally instead. ` + `Looked in ${credentialLocations(env)}. Sign in with: skills login`);
   }
   const apiOrigin = normalizeSkillsApiOrigin(configured?.value ?? defaultFleetGatewayBaseUrl(SKILLS_APP));
   toV1BaseUrl(apiOrigin);
-  assertCredentialInstance(credential, apiOrigin, env, options);
+  assertCredentialInstancePairing(credential, configured, apiOrigin, env, options);
   assertFilesUnchanged();
   const base = {
     mode: "hosted",
@@ -33673,7 +33685,7 @@ function resolveSkillsFleetOrThrow(env, options) {
     return { ...base, apiKey: null, apiKeyPointer: credential };
   }
   if (!credential.apiKey.trim()) {
-    throw new SkillsFleetCredentialError(`The Skills API key from ${credential.source} is empty \u2014 refusing to send an unauthenticated request. ` + `Sign in with: skills auth login`);
+    throw new SkillsFleetCredentialError(`The Skills API key from ${credential.source} is empty \u2014 refusing to send an unauthenticated request. ` + `Sign in with: skills login`);
   }
   return { ...base, apiKey: credential.apiKey, apiKeyPointer: null };
 }
@@ -33681,25 +33693,58 @@ function credentialLocations(env) {
   const files = skillsCredentialFiles(env).join(" or ") || "no credentials file (HOME is unset)";
   return `hasna.credentials.${SKILLS_APP}.api-key (macOS Keychain, account HASNA_STATION or the host name), ${files}, and ${SKILLS_API_KEY_ENV}`;
 }
-function assertCredentialInstance(credential, apiOrigin, env, options) {
-  let bound;
-  if (credential.tier === "disk" || credential.tier === "profile" || credential.tier === "pointer" && credential.diskCandidates.includes(credential.source)) {
-    const metadata = readSkillsInstanceMetadata(credential.source);
-    bound = metadata.binding ?? metadata.apiUrl ?? defaultFleetGatewayBaseUrl(SKILLS_APP);
-  } else if (credential.tier === "keychain") {
-    bound = keychainConfigValue(SKILLS_APP, env, options.credentials?.keychain)?.value ?? defaultFleetGatewayBaseUrl(SKILLS_APP);
+function credentialPairing(credential, env, options = {}) {
+  const fileBinding = (file) => {
+    const metadata = readSkillsInstanceMetadata(file);
+    return { kind: "bound", instance: normalizeSkillsApiOrigin(metadata.binding ?? metadata.apiUrl ?? defaultFleetGatewayBaseUrl(SKILLS_APP)) };
+  };
+  const tier = credential.tier;
+  switch (tier) {
+    case "disk":
+    case "profile":
+      return fileBinding(credential.source);
+    case "pointer":
+      return credential.diskCandidates.includes(credential.source) ? fileBinding(credential.source) : { kind: "unbound" };
+    case "keychain":
+      return {
+        kind: "bound",
+        instance: normalizeSkillsApiOrigin(keychainConfigValue(SKILLS_APP, env, options.credentials?.keychain)?.value ?? defaultFleetGatewayBaseUrl(SKILLS_APP))
+      };
+    case "env":
+    case "override":
+    case "argument":
+      return { kind: "unbound" };
+    default: {
+      const unclassified = tier;
+      throw new SkillsFleetCredentialError(`The Skills credential from ${credential.source} has an unclassified tier (${String(unclassified)}); refusing to send it.`, "INSTANCE_CREDENTIAL_MISMATCH");
+    }
   }
-  if (bound && normalizeSkillsApiOrigin(bound) !== apiOrigin) {
+}
+function assertCredentialInstancePairing(credential, configured, apiOrigin, env, options) {
+  const pairing = credentialPairing(credential, env, options);
+  if (pairing.kind === "bound") {
+    if (pairing.instance === apiOrigin)
+      return;
     throw new SkillsFleetCredentialError("The selected Skills API does not match this credential's instance. Select its profile or sign in to the new instance; no credential was sent.", "INSTANCE_CREDENTIAL_MISMATCH");
   }
+  if (apiOrigin === normalizeSkillsApiOrigin(defaultFleetGatewayBaseUrl(SKILLS_APP)))
+    return;
+  if (configured?.trust === "environment")
+    return;
+  const next = [
+    `set ${SKILLS_API_URL_ENV} alongside ${credential.source}`,
+    `unset ${credential.source}, then run: skills login`
+  ];
+  throw new SkillsFleetCredentialError(`${credential.source} records no Skills server of its own, so it is only sent to the internal gateway or to a URL ` + `from the environment (${SKILLS_API_URL_ENV}); the Skills URL here comes from ${configured?.source ?? "nowhere"}. ` + `No credential was sent. To use your own server, ${next[0]}; otherwise ${next[1]}.`, "INSTANCE_CREDENTIAL_MISMATCH", next);
 }
 async function resolveSkillsApiKey(env = process.env, options = {}) {
   return (await resolveSkillsConnection(env, options))?.apiKey ?? null;
 }
 async function resolveSkillsConnection(env = process.env, options = {}) {
   const snapshotEnv = snapshotSkillsEnvironment(env);
-  const assertFilesUnchanged = selectsSkillsLocalMode(snapshotEnv) ? () => {} : captureSkillsCredentialFiles(skillsProfileCredentialFiles(snapshotEnv, options.credentials?.profile));
-  const fleet = resolveSkillsFleet(snapshotEnv, snapshotSkillsOptions(env, options));
+  const resolvedOptions = snapshotSkillsOptions(env, options);
+  const assertFilesUnchanged = selectsSkillsLocalMode(snapshotEnv) ? () => {} : captureSkillsCredentialFiles(skillsProfileCredentialFiles(snapshotEnv, resolvedOptions.credentials?.profile));
+  const fleet = resolveSkillsFleet(snapshotEnv, resolvedOptions);
   if (fleet.mode === "local" && env === process.env)
     noticeLocalSkillsMode();
   if (fleet.mode !== "hosted")
@@ -33708,7 +33753,7 @@ async function resolveSkillsConnection(env = process.env, options = {}) {
     return { ...fleet, apiKey: fleet.apiKey };
   const pointer = fleet.apiKeyPointer;
   if (!pointer) {
-    throw new SkillsFleetCredentialError(`A Skills authority resolved but no API key did. Sign in with: skills auth login`);
+    throw new SkillsFleetCredentialError(`A Skills authority resolved but no API key did. Sign in with: skills login`);
   }
   let completed;
   try {
@@ -33775,7 +33820,7 @@ function requireSkillsFleet(action = "This command", env = process.env, options
 class MissingSkillsFleetError extends Error {
   code = "MISSING_API_URL";
   constructor(action = "This command") {
-    super(`${action} requires a Skills API credential and none is configured \u2014 ` + `run: skills auth login, or set ${SKILLS_API_KEY_ENV} ` + `(add the Keychain item hasna.credentials.${SKILLS_APP}.api-key, or write ~/.hasna/skills/config/credentials). ` + `Point at your own instance with ${SKILLS_API_URL_ENV}, or run: skills setup --api-url <your Skills instance origin>`);
+    super(`${action} requires a Skills API credential and none is configured \u2014 ` + `run: skills login, or set ${SKILLS_API_KEY_ENV} ` + `(add the Keychain item hasna.credentials.${SKILLS_APP}.api-key, or write ~/.hasna/skills/config/credentials). ` + `Point at your own instance with ${SKILLS_API_URL_ENV}, or run: skills setup --api-url <your Skills instance origin>`);
     this.name = "MissingSkillsFleetError";
   }
 }
@@ -90557,7 +90602,7 @@ class RemoteSkillsAuthClient {
     return (await this.sessionClient(email4, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
   }
   request(path2, options) {
-    if (!["/api/auth/login", "/api/auth/verify", "/api/auth/device/start", "/api/auth/device/token", "/api/auth/keys", "/api/auth/whoami"].includes(path2))
+    if (!["/api/auth/login", "/api/auth/verify", "/api/auth/device/start", "/api/auth/device/token", "/api/auth/keys", "/api/auth/whoami", "/api/auth/logout"].includes(path2))
       throw new Error("Unsupported authentication operation");
     return requestAuthApi(this.apiOrigin, path2, options);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.9.20",
+  "version": "0.10.1",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {