@rayul/kordis 0.6.0 → 0.6.2

package/dist/index.js

@@ -904,8 +904,8 @@ var init_client = __esm({
         if (this.config.userAgent) headers["user-agent"] = this.config.userAgent;
         return headers;
       }
-      async request(path, opts = {}) {
-        const url = new URL(this.baseUrl + path);
+      async request(path2, opts = {}) {
+        const url = new URL(this.baseUrl + path2);
         if (opts.query) {
           for (const [k, v] of Object.entries(opts.query)) {
             if (v === void 0) continue;
@@ -1367,11 +1367,11 @@ async function detectLanguages(cwd = process.cwd()) {
   await walk(cwd, 4, counts);
   return [...counts.entries()].sort((a, b) => b[1] - a[1]).slice(0, 3).map(([tag]) => tag);
 }
-async function walk(dir, depth, counts) {
+async function walk(dir2, depth, counts) {
   if (depth < 0) return;
   let entries;
   try {
-    entries = await readdir(dir, { withFileTypes: true });
+    entries = await readdir(dir2, { withFileTypes: true });
   } catch {
     return;
   }
@@ -1380,7 +1380,7 @@ async function walk(dir, depth, counts) {
       if (SKIP_DIRS.has(e.name)) continue;
     }
     if (SKIP_DIRS.has(e.name)) continue;
-    const full = join3(dir, e.name);
+    const full = join3(dir2, e.name);
     if (e.isDirectory()) {
       await walk(full, depth - 1, counts);
     } else if (e.isFile()) {
@@ -1509,12 +1509,46 @@ async function getCachedContextHeader(cwd = process.cwd()) {
   return header;
 }
 
+// src/lib/pending-login.ts
+import { readFile as readFile4, writeFile as writeFile3, unlink as unlink2, mkdir as mkdir3 } from "fs/promises";
+import { homedir as homedir4 } from "os";
+import { join as join4 } from "path";
+function dir() {
+  return process.env["KORDIS_HOME"] ?? join4(homedir4(), ".kordis");
+}
+function path() {
+  return join4(dir(), "pending-login.json");
+}
+async function readPending() {
+  try {
+    const raw = await readFile4(path(), "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed.device_code || !parsed.expires_at_epoch) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+async function savePending(file) {
+  await mkdir3(dir(), { recursive: true });
+  await writeFile3(path(), JSON.stringify(file, null, 2) + "\n", "utf8");
+}
+async function clearPending() {
+  try {
+    await unlink2(path());
+  } catch {
+  }
+}
+function isExpired(file) {
+  return Math.floor(Date.now() / 1e3) >= file.expires_at_epoch;
+}
+
 // src/version.ts
 import { readFileSync } from "fs";
 import { fileURLToPath } from "url";
-import { dirname, join as join4 } from "path";
+import { dirname, join as join5 } from "path";
 var __dir = dirname(fileURLToPath(import.meta.url));
-var pkgPath = join4(__dir, "..", "package.json");
+var pkgPath = join5(__dir, "..", "package.json");
 var VERSION = (() => {
   try {
     const raw = readFileSync(pkgPath, "utf8");
@@ -1527,10 +1561,48 @@ var VERSION = (() => {
 
 // src/client.ts
 async function useClient() {
-  const cfg = await loadCliConfig();
+  let cfg = await loadCliConfig();
   const keychain = await createKeychain();
-  const username = cfg.username ?? null;
+  let username = cfg.username ?? null;
   let currentTokens = username ? await keychain.load(username) : null;
+  if (!currentTokens) {
+    const pending = await readPending();
+    if (pending) {
+      if (isExpired(pending)) {
+        await clearPending();
+      } else {
+        const bootstrapApi = new KordisClient({
+          baseUrl: cfg.apiUrl,
+          userAgent: `kordis-cli/${VERSION} node/${process.version}`
+        });
+        try {
+          const tokens = await bootstrapApi.pollDeviceFlow(pending.device_code);
+          const meClient = new KordisClient({
+            baseUrl: cfg.apiUrl,
+            userAgent: `kordis-cli/${VERSION} node/${process.version}`,
+            getAccessToken: () => tokens.access_token
+          });
+          const me = await meClient.me();
+          username = me.username;
+          currentTokens = {
+            access_token: tokens.access_token,
+            refresh_token: tokens.refresh_token,
+            session_id: tokens.session_id,
+            expires_at_epoch: Math.floor(Date.now() / 1e3) + tokens.expires_in
+          };
+          await keychain.save(username, currentTokens);
+          cfg = { ...cfg, username, sessionId: tokens.session_id };
+          await saveCliConfig(cfg);
+          await clearPending();
+        } catch (err) {
+          const code = err.code;
+          if (code && code !== "authorization_pending") {
+            await clearPending();
+          }
+        }
+      }
+    }
+  }
   const personalizationEnabled = cfg.personalization === "on" && process.env["KORDIS_NO_CONTEXT"] !== "1" && !process.argv.includes("--no-context");
   const api = new KordisClient({
     baseUrl: cfg.apiUrl,
@@ -1608,12 +1680,14 @@ var c = kleur;
 
 // src/commands/login.ts
 function loginCommand() {
-  return new Command("login").description("authenticate with the Kordis registry").option("--provider <name>", "OAuth provider", "discord").option("--no-browser", "don't auto-open the browser; print the URL instead").action(async (opts) => {
+  return new Command("login").description("authenticate with the Kordis registry").option("--provider <name>", "OAuth provider", "discord").option("--no-browser", "don't auto-open the browser; print the URL instead").option(
+    "--emit-only",
+    "start device flow, open browser, save pending state, exit immediately \u2014 for non-interactive (agent) contexts where the 10-min poll would exceed the bash timeout"
+  ).action(async (opts) => {
     const bundle = await useClient();
     const started = spinner("Requesting device code");
-    const device = await bundle.api.startDeviceFlow(
-      opts.provider ?? "discord"
-    );
+    const provider = opts.provider ?? "discord";
+    const device = await bundle.api.startDeviceFlow(provider);
     started.succeed();
     printHuman("");
     printHuman(c.bold("Confirm the code in your browser:"));
@@ -1633,6 +1707,29 @@ function loginCommand() {
       }
       printHuman("");
     }
+    if (opts.emitOnly) {
+      await savePending({
+        device_code: device.device_code,
+        user_code: device.user_code,
+        verification_url: device.verification_url,
+        expires_at_epoch: Math.floor(Date.now() / 1e3) + device.expires_in,
+        provider
+      });
+      printDual({
+        json: {
+          status: "pending",
+          user_code: device.user_code,
+          verification_url: device.verification_url,
+          expires_in: device.expires_in
+        },
+        human: () => printHuman(
+          c.gray(
+            "\u2192 pending login saved. Click Authorize in the browser, then re-run any kordis command \u2014 the next call will claim the token automatically."
+          )
+        )
+      });
+      return;
+    }
     const poll = spinner("Waiting for browser confirmation");
     const start = Date.now();
     const deadline = start + device.expires_in * 1e3;
@@ -1682,14 +1779,25 @@ function loginCommand() {
 
 // src/commands/whoami.ts
 import { Command as Command2 } from "commander";
+
+// src/lib/require-auth.ts
+init_src2();
+function requireAuth(bundle) {
+  if (bundle.username) return;
+  throw new KordisApiError(401, {
+    error: {
+      code: "not_authenticated",
+      message: "authentication required",
+      hint: "Run `kordis login --emit-only` to start browser sign-in (exits immediately, no blocking poll), then re-run this command \u2014 the next CLI call auto-claims the token. For interactive shells, plain `kordis login` (10-min poll) also works."
+    }
+  });
+}
+
+// src/commands/whoami.ts
 function whoamiCommand() {
   return new Command2("whoami").description("show the currently authenticated user").action(async () => {
     const bundle = await useClient();
-    if (!bundle.username) {
-      printHuman(c.yellow("Not logged in. Run `kordis login`."));
-      process.exitCode = 10;
-      return;
-    }
+    requireAuth(bundle);
     const me = await bundle.authedRequest((api) => api.me());
     printDual({
       json: me,
@@ -1706,18 +1814,18 @@ function whoamiCommand() {
 import { Command as Command3 } from "commander";
 
 // src/lib/recommendation-cache.ts
-import { readFile as readFile4, writeFile as writeFile3, mkdir as mkdir3 } from "fs/promises";
-import { homedir as homedir4 } from "os";
-import { join as join5 } from "path";
+import { readFile as readFile5, writeFile as writeFile4, mkdir as mkdir4 } from "fs/promises";
+import { homedir as homedir5 } from "os";
+import { join as join6 } from "path";
 function cacheDir() {
-  return process.env["KORDIS_HOME"] ?? join5(homedir4(), ".kordis");
+  return process.env["KORDIS_HOME"] ?? join6(homedir5(), ".kordis");
 }
 function cachePath() {
-  return join5(cacheDir(), "recommendations.json");
+  return join6(cacheDir(), "recommendations.json");
 }
 async function readCache() {
   try {
-    const raw = await readFile4(cachePath(), "utf8");
+    const raw = await readFile5(cachePath(), "utf8");
     const parsed = JSON.parse(raw);
     if (!parsed.generated_at || !Array.isArray(parsed.items)) return null;
     return parsed;
@@ -1726,23 +1834,23 @@ async function readCache() {
   }
 }
 async function writeCache(items, generatedAt) {
-  await mkdir3(cacheDir(), { recursive: true });
+  await mkdir4(cacheDir(), { recursive: true });
   const payload = {
     generated_at: generatedAt,
     items,
     seen_at: null
   };
-  await writeFile3(cachePath(), JSON.stringify(payload, null, 2) + "\n", "utf8");
+  await writeFile4(cachePath(), JSON.stringify(payload, null, 2) + "\n", "utf8");
 }
 async function markSeen() {
   const existing = await readCache();
   if (!existing) return;
-  await mkdir3(cacheDir(), { recursive: true });
+  await mkdir4(cacheDir(), { recursive: true });
   const updated = {
     ...existing,
     seen_at: (/* @__PURE__ */ new Date()).toISOString()
   };
-  await writeFile3(cachePath(), JSON.stringify(updated, null, 2) + "\n", "utf8");
+  await writeFile4(cachePath(), JSON.stringify(updated, null, 2) + "\n", "utf8");
 }
 
 // src/lib/recommendation-footer.ts
@@ -1869,8 +1977,8 @@ function searchCommand() {
 
 // src/commands/push.ts
 import { Command as Command4 } from "commander";
-import { readFile as readFile5, stat as stat2, readdir as readdir2 } from "fs/promises";
-import { resolve, join as join6, posix, sep } from "path";
+import { readFile as readFile6, stat as stat2, readdir as readdir2 } from "fs/promises";
+import { resolve, join as join7, posix, sep } from "path";
 import JSZip from "jszip";
 
 // ../../packages/harness-schema/src/parser.ts
@@ -2435,9 +2543,9 @@ function pushCommand() {
     "--slug <slug>",
     'override slug; accepts "user/slug" to point at a specific package'
   ).option("--type <type>", "override type inference").option("--changelog <text>", "optional changelog entry").option("--dry-run", "validate only; do not publish").option("--no-wait", "return immediately without waiting for review").action(
-    async (path, opts) => {
+    async (path2, opts) => {
       const bundle = await useClient();
-      const abs = resolve(process.cwd(), path);
+      const abs = resolve(process.cwd(), path2);
       const s = await stat2(abs);
       let content;
       let assets = [];
@@ -2448,7 +2556,7 @@ function pushCommand() {
         ({ content, assets } = await bundleSkillZip(abs));
         content = ensureTypeField(content, "skill");
       } else {
-        content = await readFile5(abs, "utf8");
+        content = await readFile6(abs, "utf8");
       }
       let nameFromFm = null;
       try {
@@ -2629,19 +2737,19 @@ function shouldExclude(relPath, isDir) {
   return false;
 }
 async function walkDir(base, relDir, collected) {
-  const entries = await readdir2(join6(base, relDir), { withFileTypes: true });
+  const entries = await readdir2(join7(base, relDir), { withFileTypes: true });
   for (const entry of entries) {
     const rel = relDir ? `${relDir}/${entry.name}` : entry.name;
     if (shouldExclude(rel, entry.isDirectory())) continue;
     if (entry.isDirectory()) {
       await walkDir(base, rel, collected);
     } else if (entry.isFile()) {
-      collected.push({ rel, abs: join6(base, rel) });
+      collected.push({ rel, abs: join7(base, rel) });
     }
   }
 }
 async function readAsset(absPath) {
-  const buf = await readFile5(absPath);
+  const buf = await readFile6(absPath);
   const text = buf.toString("utf8");
   const roundtrip = Buffer.from(text, "utf8");
   if (roundtrip.equals(buf)) {
@@ -2651,14 +2759,14 @@ async function readAsset(absPath) {
   printHuman(c.gray(`  \u2192 encoding ${absPath.split(sep).pop()} as base64`));
   return { content: b64, encoding: "base64" };
 }
-async function bundleDirectory(dir) {
+async function bundleDirectory(dir2) {
   const all = [];
-  await walkDir(dir, "", all);
+  await walkDir(dir2, "", all);
   const skillEntry = all.find((f) => f.rel === "SKILL.md");
   if (!skillEntry) {
-    throw new Error(`No SKILL.md found in directory ${dir}. Push a directory that has SKILL.md at its root.`);
+    throw new Error(`No SKILL.md found in directory ${dir2}. Push a directory that has SKILL.md at its root.`);
   }
-  const content = await readFile5(skillEntry.abs, "utf8");
+  const content = await readFile6(skillEntry.abs, "utf8");
   const assets = [];
   for (const f of all) {
     if (f.rel === "SKILL.md") continue;
@@ -2668,7 +2776,7 @@ async function bundleDirectory(dir) {
   return { content, assets };
 }
 async function bundleSkillZip(zipPath) {
-  const buf = await readFile5(zipPath);
+  const buf = await readFile6(zipPath);
   const zip = await JSZip.loadAsync(buf);
   const entries = Object.keys(zip.files).filter((k) => !zip.files[k].dir);
   if (entries.length === 0) throw new Error(".skill file is empty");
@@ -2702,8 +2810,8 @@ async function bundleSkillZip(zipPath) {
 
 // src/commands/pull.ts
 import { Command as Command5 } from "commander";
-import { mkdir as mkdir5, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname2, join as join8 } from "path";
+import { mkdir as mkdir6, writeFile as writeFile6 } from "fs/promises";
+import { dirname as dirname2, join as join9 } from "path";
 
 // ../../packages/translators/src/skill/identity.ts
 function buildSkillFile(input, outputPath) {
@@ -3145,21 +3253,21 @@ function getTranslator(type, format) {
 }
 
 // src/lockfile.ts
-import { homedir as homedir5 } from "os";
-import { join as join7 } from "path";
-import { readFile as readFile6, writeFile as writeFile4, mkdir as mkdir4 } from "fs/promises";
-var LOCKFILE_PATH = join7(homedir5(), ".kordis", "installed.json");
+import { homedir as homedir6 } from "os";
+import { join as join8 } from "path";
+import { readFile as readFile7, writeFile as writeFile5, mkdir as mkdir5 } from "fs/promises";
+var LOCKFILE_PATH = join8(homedir6(), ".kordis", "installed.json");
 async function readLockfile() {
   try {
-    const raw = await readFile6(LOCKFILE_PATH, "utf8");
+    const raw = await readFile7(LOCKFILE_PATH, "utf8");
     return JSON.parse(raw);
   } catch {
     return { packages: {} };
   }
 }
 async function writeLockfile(lf) {
-  await mkdir4(join7(homedir5(), ".kordis"), { recursive: true });
-  await writeFile4(LOCKFILE_PATH, JSON.stringify(lf, null, 2) + "\n", "utf8");
+  await mkdir5(join8(homedir6(), ".kordis"), { recursive: true });
+  await writeFile5(LOCKFILE_PATH, JSON.stringify(lf, null, 2) + "\n", "utf8");
 }
 async function recordInstalled(fullSlug, entry) {
   const lf = await readLockfile();
@@ -3195,8 +3303,8 @@ async function doPullInstall(fullSlug, tool, installRoot, version) {
       assets: contentRes.assets
     });
     for (const f of result.files) {
-      const abs = join8(installRoot, f.path);
-      await mkdir5(dirname2(abs), { recursive: true });
+      const abs = join9(installRoot, f.path);
+      await mkdir6(dirname2(abs), { recursive: true });
       await writeEmittedFile(abs, f.content, f.encoding);
       written.push(abs);
     }
@@ -3215,8 +3323,8 @@ async function doPullInstall(fullSlug, tool, installRoot, version) {
         `Tool "${format}" is not supported for type "${parsed.type}"; installed canonical form instead.`
       );
       for (const f of result.files) {
-        const abs = join8(installRoot, f.path);
-        await mkdir5(dirname2(abs), { recursive: true });
+        const abs = join9(installRoot, f.path);
+        await mkdir6(dirname2(abs), { recursive: true });
         await writeEmittedFile(abs, f.content, f.encoding);
         written.push(abs);
       }
@@ -3293,9 +3401,9 @@ async function detectTool(root) {
     [".windsurfrules", "windsurf"],
     [".github/copilot-instructions.md", "copilot"]
   ];
-  for (const [path, tool] of checks) {
+  for (const [path2, tool] of checks) {
     try {
-      await stat3(join8(root, path));
+      await stat3(join9(root, path2));
       return tool;
     } catch {
     }
@@ -3304,9 +3412,9 @@ async function detectTool(root) {
 }
 async function writeEmittedFile(abs, content, encoding) {
   if (encoding === "base64") {
-    await writeFile5(abs, Buffer.from(content, "base64"));
+    await writeFile6(abs, Buffer.from(content, "base64"));
   } else {
-    await writeFile5(abs, content, "utf8");
+    await writeFile6(abs, content, "utf8");
   }
 }
 
@@ -3340,8 +3448,8 @@ function readCommand() {
           `${c.gray("\u2014")} ${c.bold(`\u24D8 ${bundled.length} bundled asset(s)`)} \u2014 fetch with ${c.cyan(`kordis pull ${res.full_slug}`)}:
 `
         );
-        for (const path of bundled) {
-          process.stderr.write(`    ${c.gray("-")} ${path}
+        for (const path2 of bundled) {
+          process.stderr.write(`    ${c.gray("-")} ${path2}
 `);
         }
       }
@@ -3427,9 +3535,9 @@ function logoutCommand() {
 }
 
 // src/commands/setup.ts
-import { readFile as readFile7, writeFile as writeFile6, mkdir as mkdir6, access as access3 } from "fs/promises";
-import { homedir as homedir6 } from "os";
-import { join as join9, dirname as dirname3 } from "path";
+import { readFile as readFile8, writeFile as writeFile7, mkdir as mkdir7, access as access3 } from "fs/promises";
+import { homedir as homedir7 } from "os";
+import { join as join10, dirname as dirname3 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { Command as Command9 } from "commander";
 import prompts from "prompts";
@@ -3452,9 +3560,9 @@ var SKILL_TARGETS = [
   { tool: "Codex CLI", dir: ".codex", skillsDir: ".codex/skills" },
   { tool: "Gemini CLI", dir: ".gemini", skillsDir: ".gemini/skills" }
 ];
-async function exists(path) {
+async function exists(path2) {
   try {
-    await access3(path);
+    await access3(path2);
     return true;
   } catch {
     return false;
@@ -3464,18 +3572,18 @@ function assetRoots() {
   const __dir2 = dirname3(fileURLToPath2(import.meta.url));
   return {
     // Built binary: bin/kordis.js → assets/ is one level up
-    bundled: join9(__dir2, "..", "assets"),
+    bundled: join10(__dir2, "..", "assets"),
     // Dev mode: src/commands/setup.ts → 4 levels up to repo root, then packages/skills/
-    source: join9(__dir2, "..", "..", "..", "..", "packages", "skills")
+    source: join10(__dir2, "..", "..", "..", "..", "packages", "skills")
   };
 }
 async function pickAssetRoot() {
   const { bundled, source } = assetRoots();
-  return await exists(join9(bundled, "KORDIS.md")) ? bundled : source;
+  return await exists(join10(bundled, "KORDIS.md")) ? bundled : source;
 }
 async function loadHubContent() {
   const root = await pickAssetRoot();
-  const raw = await readFile7(join9(root, "KORDIS.md"), "utf-8");
+  const raw = await readFile8(join10(root, "KORDIS.md"), "utf-8");
   if (raw.startsWith("---")) {
     const end = raw.indexOf("\n---", 4);
     if (end !== -1) return raw.slice(end + 4).trimStart();
@@ -3484,7 +3592,7 @@ async function loadHubContent() {
 }
 async function loadSubSkillContent(name) {
   const root = await pickAssetRoot();
-  return readFile7(join9(root, name, "SKILL.md"), "utf-8");
+  return readFile8(join10(root, name, "SKILL.md"), "utf-8");
 }
 async function injectBlock(filePath, content, dryRun) {
   const block = `${MARKER_START}
@@ -3493,14 +3601,14 @@ ${MARKER_END}`;
   let existing = "";
   let fileExists = true;
   try {
-    existing = await readFile7(filePath, "utf-8");
+    existing = await readFile8(filePath, "utf-8");
   } catch {
     fileExists = false;
   }
   if (!fileExists) {
     if (!dryRun) {
-      await mkdir6(dirname3(filePath), { recursive: true });
-      await writeFile6(filePath, block + "\n", "utf-8");
+      await mkdir7(dirname3(filePath), { recursive: true });
+      await writeFile7(filePath, block + "\n", "utf-8");
     }
     return "injected";
   }
@@ -3511,31 +3619,31 @@ ${MARKER_END}`;
     if (current === block) return "unchanged";
     if (!dryRun) {
       const updated = existing.slice(0, startIdx) + block + existing.slice(endIdx + MARKER_END.length);
-      await writeFile6(filePath, updated, "utf-8");
+      await writeFile7(filePath, updated, "utf-8");
     }
     return "updated";
   }
   if (!dryRun) {
-    await writeFile6(filePath, existing.trimEnd() + "\n\n" + block + "\n", "utf-8");
+    await writeFile7(filePath, existing.trimEnd() + "\n\n" + block + "\n", "utf-8");
   }
   return "injected";
 }
 async function copyBundledSkill(filePath, content, dryRun) {
   let existing = null;
   try {
-    existing = await readFile7(filePath, "utf-8");
+    existing = await readFile8(filePath, "utf-8");
   } catch {
   }
   if (existing === content) return "unchanged";
   if (!dryRun) {
-    await mkdir6(dirname3(filePath), { recursive: true });
-    await writeFile6(filePath, content, "utf-8");
+    await mkdir7(dirname3(filePath), { recursive: true });
+    await writeFile7(filePath, content, "utf-8");
   }
   return existing === null ? "injected" : "updated";
 }
 function setupCommand() {
   return new Command9("setup").description("inject kordis usage guide into global agent instruction files").option("--silent", "suppress errors \u2014 safe for postinstall").option("--dry-run", "detect installed tools without writing any files").action(async (opts) => {
-    const home = homedir6();
+    const home = homedir7();
     const dryRun = opts.dryRun ?? false;
     let hubContent;
     let subSkillContents;
@@ -3552,8 +3660,8 @@ function setupCommand() {
     let anyFound = false;
     const changedTools = /* @__PURE__ */ new Set();
     for (const target of HUB_TARGETS) {
-      const dirPath = join9(home, target.dir);
-      const filePath = join9(home, target.file);
+      const dirPath = join10(home, target.dir);
+      const filePath = join10(home, target.file);
       if (!await exists(dirPath)) {
         if (!opts.silent) {
           printHuman(c.gray(`  - ${target.tool.padEnd(12)} not installed, skipped`));
@@ -3580,10 +3688,10 @@ function setupCommand() {
       }
     }
     for (const target of SKILL_TARGETS) {
-      const dirPath = join9(home, target.dir);
+      const dirPath = join10(home, target.dir);
       if (!await exists(dirPath)) continue;
       for (const subName of SUB_SKILLS) {
-        const filePath = join9(home, target.skillsDir, subName, "SKILL.md");
+        const filePath = join10(home, target.skillsDir, subName, "SKILL.md");
         const dest = `~/${target.skillsDir}/${subName}/SKILL.md`;
         try {
           const result = await copyBundledSkill(filePath, subSkillContents[subName], dryRun);
@@ -3666,11 +3774,7 @@ function commentCommand() {
         throw new Error('full_slug must be "{username}/{slug}"');
       }
       const bundle = await useClient();
-      if (!bundle.username) {
-        printHuman(c.yellow("Not logged in. Run `kordis login`."));
-        process.exitCode = 10;
-        return;
-      }
+      requireAuth(bundle);
       const res = await bundle.authedRequest(
         (api) => api.createComment(username, slug, {
           kind: opts.kind,
@@ -3701,11 +3805,7 @@ function starCommand() {
       throw new Error('full_slug must be "{username}/{slug}"');
     }
     const bundle = await useClient();
-    if (!bundle.username) {
-      printHuman(c.yellow("Not logged in. Run `kordis login`."));
-      process.exitCode = 10;
-      return;
-    }
+    requireAuth(bundle);
     const res = await bundle.authedRequest((api) => api.star(username, slug));
     printDual({
       json: res,
@@ -3723,11 +3823,7 @@ function unstarCommand() {
       throw new Error('full_slug must be "{username}/{slug}"');
     }
     const bundle = await useClient();
-    if (!bundle.username) {
-      printHuman(c.yellow("Not logged in. Run `kordis login`."));
-      process.exitCode = 10;
-      return;
-    }
+    requireAuth(bundle);
     const res = await bundle.authedRequest(
       (api) => api.unstar(username, slug)
     );
@@ -3786,9 +3882,7 @@ function listCommand() {
   return new Command13("list").description("list your own packages (requires login)").option("--limit <n>", "max results per page", (v) => parseInt(v, 10), 20).option("--page <n>", "page number (1-based)", (v) => parseInt(v, 10), 1).option("--sort <mode>", "sort: latest|popular", "latest").action(async (opts) => {
     const sort = opts.sort === "popular" ? "popular" : "latest";
     const bundle = await useClient();
-    if (!bundle.username) {
-      throw new Error("Not logged in. Run `kordis login` first.");
-    }
+    requireAuth(bundle);
     const spin = spinner("Fetching your packages");
     const res = await bundle.authedRequest(
       (api) => api.listMyPackages({ page: opts.page, limit: opts.limit, sort })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rayul/kordis",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "private": false,
   "description": "Command-line client for the Kordis registry — discover, install, and publish agentic-coding packages.",
   "license": "MIT",
@@ -21,7 +21,8 @@
     "build": "tsup && rm -rf assets && mkdir -p assets && cp -R ../../packages/skills/. assets/",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
-    "postinstall": "node scripts/postinstall.mjs"
+    "postinstall": "node scripts/postinstall.mjs",
+    "prepublishOnly": "pnpm build"
   },
   "dependencies": {
     "@iarna/toml": "^2.2.5",