@rayul/kordis 0.6.1 → 0.6.3

package/assets/kordis-recommend/SKILL.md

@@ -45,17 +45,24 @@ re-ranking ONLY — never persisted (see CLAUDE.md "Telemetry / privacy").
 
 ## Personalization opt-in
 
-The user is asked ONCE — at first interactive `kordis setup` OR (if
-postinstall ran in `--silent` mode) at first `kordis recommend`. Answer
-persists in `~/.kordis/config.json` (`personalization: 'on' | 'off'`).
+The user is asked ONCE. Three paths persist the answer to
+`~/.kordis/config.json` as `personalization: 'on' | 'off'`:
 
-Override at runtime:
+1. **Interactive `kordis setup`** in a real TTY — Y/n prompt.
+2. **First `kordis recommend`** in a TTY (lazy fallback if postinstall
+   ran `--silent`).
+3. **`kordis setup --personalization on|off`** — non-interactive flag
+   (0.6.3+). The **agent-facing path**: works without a TTY, no prompt.
+   Use this when the user has confirmed consent in chat — see Step 2.5.
+
+Override at runtime (does not change the persisted answer):
 - `KORDIS_NO_CONTEXT=1` env — no header for the entire shell session
 - `--no-context` flag — no header for this single call
 
 If the response field `personalized` is `false`, the server returned
-popularity-only results — surface this to the user so they know the
-recommendations aren't tailored.
+popularity-only results — almost always because the user hasn't been
+asked yet (agent contexts have no TTY, so paths 1 and 2 never fire).
+Surface this AND ask the user before flipping the flag (Step 2.5).
 
 ## Menu envelope (one item)
 
@@ -92,8 +99,7 @@ explicitly asked you not to share their stack.)
 
 ### 2. Triage
 Filter mentally by `confidence`. If everything is `low` and `personalized`
-is `false`, tell the user personalization is off and they can enable it
-via `kordis setup` (re-asks the prompt on next interactive run).
+is `false`, follow Step 2.5 to offer the user a one-click consent path.
 
 If the response carries `capped_by_author > 0`, ALSO surface a one-line
 note to the user — e.g. "N more candidates from the same publisher were
@@ -101,6 +107,30 @@ skipped by the diversity cap" — so they understand why the list is
 shorter than the requested `--limit`. Without this hint users frequently
 mistake a short menu for a sparse or broken registry.
 
+### 2.5. Offer personalization consent (when `personalized: false`)
+
+If the response is `personalized: false` and the user is engaged in chat
+(i.e., you can ask them a question), surface this naturally:
+
+> "추천 결과가 popularity-only로 왔어요 (개인화 OFF). 익명 신호
+> (설치된 에이전트 툴, 현재 디렉토리의 언어/프레임워크 힌트)로
+> 추천을 맞춤화할 수 있는데 켜드릴까요? 서버는 신호를 저장하지
+> 않고 응답 re-ranking에만 사용해요."
+
+ONLY after the user explicitly says yes, run:
+
+```
+kordis setup --personalization on
+```
+
+Then re-run `kordis recommend --limit 10 --json` to get the personalized
+menu. **Never run `--personalization on` without the user's confirmation
+in chat** — it persists a consent flag, which is the user's choice.
+
+If the user says no (or doesn't reply), don't push it — record opt-out
+optionally via `kordis setup --personalization off` so the question
+isn't asked again.
+
 ### 3. Present
 Surface 3-5 picks max. For each, show: full_slug, one-line `why_recommended`,
 confidence wording per the table above, and the next-step
@@ -127,7 +157,9 @@ User: "any new tools I should try?"
 <example>
 User: "추천 좀 해봐"
 1. kordis recommend --limit 10 --json
-2. If personalized is false, tell the user briefly + suggest `kordis setup`
+2. If `personalized: false`, ask in chat (Step 2.5): "개인화 켜드릴까요? ..."
+   - if user says yes → `kordis setup --personalization on`, then re-run
+   - if user says no → surface popularity-only picks as-is
 3. Surface 3-5 in Korean using the why_recommended verbatim (English is fine
    — re-render the user-facing prose in Korean as needed)
 </example>

package/dist/index.js

@@ -1779,14 +1779,25 @@ function loginCommand() {
 
 // src/commands/whoami.ts
 import { Command as Command2 } from "commander";
+
+// src/lib/require-auth.ts
+init_src2();
+function requireAuth(bundle) {
+  if (bundle.username) return;
+  throw new KordisApiError(401, {
+    error: {
+      code: "not_authenticated",
+      message: "authentication required",
+      hint: "Run `kordis login --emit-only` to start browser sign-in (exits immediately, no blocking poll), then re-run this command \u2014 the next CLI call auto-claims the token. For interactive shells, plain `kordis login` (10-min poll) also works."
+    }
+  });
+}
+
+// src/commands/whoami.ts
 function whoamiCommand() {
   return new Command2("whoami").description("show the currently authenticated user").action(async () => {
     const bundle = await useClient();
-    if (!bundle.username) {
-      printHuman(c.yellow("Not logged in. Run `kordis login`."));
-      process.exitCode = 10;
-      return;
-    }
+    requireAuth(bundle);
     const me = await bundle.authedRequest((api) => api.me());
     printDual({
       json: me,
@@ -3631,9 +3642,33 @@ async function copyBundledSkill(filePath, content, dryRun) {
   return existing === null ? "injected" : "updated";
 }
 function setupCommand() {
-  return new Command9("setup").description("inject kordis usage guide into global agent instruction files").option("--silent", "suppress errors \u2014 safe for postinstall").option("--dry-run", "detect installed tools without writing any files").action(async (opts) => {
+  return new Command9("setup").description("inject kordis usage guide into global agent instruction files").option("--silent", "suppress errors \u2014 safe for postinstall").option("--dry-run", "detect installed tools without writing any files").option(
+    "--personalization <choice>",
+    "record opt-in non-interactively: 'on' | 'off' (skips the Y/n prompt; safe for agents that just received user consent in chat)"
+  ).action(async (opts) => {
     const home = homedir7();
     const dryRun = opts.dryRun ?? false;
+    if (opts.personalization !== void 0) {
+      const v = opts.personalization.toLowerCase();
+      if (v !== "on" && v !== "off") {
+        throw new Error("--personalization must be 'on' or 'off'");
+      }
+      if (!dryRun) {
+        const cfg = await loadCliConfig();
+        await saveCliConfig({ ...cfg, personalization: v });
+      }
+      if (!opts.silent) {
+        if (v === "on") {
+          printHuman(
+            c.green("\u2713 personalization on") + c.gray(" \u2014 disable any time: `KORDIS_NO_CONTEXT=1` env, `--no-context` flag, or `kordis setup --personalization off`")
+          );
+        } else {
+          printHuman(
+            c.gray("\u2192 personalization off \u2014 recommendations use popularity only.")
+          );
+        }
+      }
+    }
     let hubContent;
     let subSkillContents;
     try {
@@ -3763,11 +3798,7 @@ function commentCommand() {
         throw new Error('full_slug must be "{username}/{slug}"');
       }
       const bundle = await useClient();
-      if (!bundle.username) {
-        printHuman(c.yellow("Not logged in. Run `kordis login`."));
-        process.exitCode = 10;
-        return;
-      }
+      requireAuth(bundle);
       const res = await bundle.authedRequest(
         (api) => api.createComment(username, slug, {
           kind: opts.kind,
@@ -3798,11 +3829,7 @@ function starCommand() {
       throw new Error('full_slug must be "{username}/{slug}"');
     }
     const bundle = await useClient();
-    if (!bundle.username) {
-      printHuman(c.yellow("Not logged in. Run `kordis login`."));
-      process.exitCode = 10;
-      return;
-    }
+    requireAuth(bundle);
     const res = await bundle.authedRequest((api) => api.star(username, slug));
     printDual({
       json: res,
@@ -3820,11 +3847,7 @@ function unstarCommand() {
       throw new Error('full_slug must be "{username}/{slug}"');
     }
     const bundle = await useClient();
-    if (!bundle.username) {
-      printHuman(c.yellow("Not logged in. Run `kordis login`."));
-      process.exitCode = 10;
-      return;
-    }
+    requireAuth(bundle);
     const res = await bundle.authedRequest(
       (api) => api.unstar(username, slug)
     );
@@ -3883,9 +3906,7 @@ function listCommand() {
   return new Command13("list").description("list your own packages (requires login)").option("--limit <n>", "max results per page", (v) => parseInt(v, 10), 20).option("--page <n>", "page number (1-based)", (v) => parseInt(v, 10), 1).option("--sort <mode>", "sort: latest|popular", "latest").action(async (opts) => {
     const sort = opts.sort === "popular" ? "popular" : "latest";
     const bundle = await useClient();
-    if (!bundle.username) {
-      throw new Error("Not logged in. Run `kordis login` first.");
-    }
+    requireAuth(bundle);
     const spin = spinner("Fetching your packages");
     const res = await bundle.authedRequest(
       (api) => api.listMyPackages({ page: opts.page, limit: opts.limit, sort })
@@ -4290,7 +4311,7 @@ function recommendCommand() {
       if (!enable) {
         printHuman(
           c.gray(
-            "\u2192 recommendations will use popularity only. Re-enable later: `kordis setup` (re-asks the opt-in)."
+            "\u2192 recommendations will use popularity only. Re-enable later: `kordis setup --personalization on`."
           )
         );
       }
@@ -4338,7 +4359,7 @@ function recommendCommand() {
         if (!res.personalized) {
           printHuman(
             c.gray(
-              "\u2192 enable personalization for tailored picks: `kordis setup` (re-asks the opt-in)"
+              "\u2192 enable personalization for tailored picks: `kordis setup --personalization on` (no Y/n prompt \u2014 agent-friendly; confirm with the user in chat first)"
             )
           );
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rayul/kordis",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "private": false,
   "description": "Command-line client for the Kordis registry — discover, install, and publish agentic-coding packages.",
   "license": "MIT",