@sendbird/cli 0.3.0-alpha.1 → 0.4.0

package/skills/sendbird/SKILL.md

@@ -3,7 +3,7 @@ name: sendbird
 description: >-
   Add or edit a chat screen or any code that connects to a Sendbird app
   (staging apps need host settings that only this CLI provides), and operate
-  Sendbird Chat resources with the CLI, choosing native-plugin, temporary ZIP or
+  Sendbird Chat resources with the CLI, choosing native-plugin, guide-only or
   no client assistance for customer-app creation and edits.
   Use for Chat users, channels, messages, project connection settings,
   Webhooks, custom channel-type policies, usage/plan information and Dashboard
@@ -16,7 +16,7 @@ description: >-
   or manage Calls rooms/logs or Live.
 ---
 
-Use the installed `sendbird` CLI for account/app context, Chat resources and independent verification. For customer-app creation or edits, read [the three assistance modes](references/build-chat-app.md) and obtain/reuse the person's selection: official native-plugin information/installation, an explicitly selected one-time ZIP run, or no client assistance. Before plugin installation or execution, show the [notice summary and README link](references/client-plugin-install.md#explain-before-installation). The ZIP helper also emits the publisher notice before starting Claude. Never claim printing proves the person read or accepted it. Do not guess or switch modes after failure. A previous guide-only selection remains guide-only; it is not permission to launch another model. For account setup, inspect `sendbird --json agent` and explicit auth/org/app commands; the optional `sendbird-setup` skill can guide that flow.
+Use the installed `sendbird` CLI for account/app context, Chat resources and independent verification. Find the official Quickstart, Chat/Calls tutorials, CLI reference, plugins and integrations with `sendbird docs search WORDS`. These guides are pinned from https://github.com/sendbird/sendbird-tools-docs; installed command inputs from `describe` remain authoritative. Official examples use prod, but an explicit user or repository environment policy takes precedence. For customer-app creation or edits, read [the three assistance modes](references/build-chat-app.md) and obtain/reuse the person's selection: official native-plugin information/installation, pinned guide-only work in this conversation, or no client assistance. Temporary ZIP execution remains a separate advanced route only when explicitly requested. Before plugin installation or execution, show the [notice summary and README link](references/client-plugin-install.md#explain-before-installation). The ZIP helper also emits the publisher notice before starting Claude. Never claim printing proves the person read or accepted it. Do not guess or switch modes after failure. A previous guide-only selection remains guide-only; it is not permission to launch another model. For account setup, inspect `sendbird --json agent` and explicit auth/org/app commands; the optional `sendbird-setup` skill can guide that flow.
 
 On first use or after a version change, run `sendbird --json agent` (bare `sendbird` shows the same guide for people). Then use `sendbird --json commands --compact --search "task words"` and `sendbird --json describe <command path>`. Add `--json` to commands whose results or errors you parse; otherwise output is a bounded human-readable view. Do not load the full schema catalog for every task. `describe` returns real flags, credential type, constraints and a preview argv template. Replace placeholders; never execute a template against a guessed target.
 
@@ -51,7 +51,7 @@ Reply in the language of the request.
 
 For a connection failure, temporary mute/freeze check, or credential-bearing input, read [operational checks](references/operational-checks.md). Match the customer's actual failing configuration before replacing it with CLI defaults. The CLI can redact its own output but cannot redact secrets you quote from the person's input; explain the error without echoing those values or asking for tokens in chat.
 
-For task guidance, use `sendbird --json docs search "task words"` to find guide/tutorial sections offline. Read one returned ID with `sendbird --json docs read 'guide/SLUG#ANCHOR'`; full text needs a matching docs server. In a source checkout start `npm run docs -- --no-open`; use `--base-url` or `SENDBIRD_DOCS_URL` if its port differs. A missing server is a documentation availability problem, not a reason to guess an API command. Use `commands`/`describe` for exact CLI flags.
+For task guidance, use `sendbird --json docs search "task words"` to find guide/tutorial sections offline. Use a returned read argv with --json; for example, `sendbird --json docs read 'guide/official/getting-started/quickstart#intro'`; full text needs a matching docs server. In a source checkout start `npm run docs -- --no-open`; use `--base-url` or `SENDBIRD_DOCS_URL` if its port differs. A missing server is a documentation availability problem, not a reason to guess an API command. Use `commands`/`describe` for exact CLI flags.
 
 - Resolve the intended environment before checking authentication. If the task context selects staging, run `sendbird --profile staging auth status --summary` and keep `--profile staging` on every later CLI invocation; do not interpret a default `prod` 401 as staging failure. Use the same explicit app ID on app-scoped commands. Do not use a Chat API token as a Dashboard credential. Credentials belong in hidden terminal prompts or private input files, never messages or command arguments.
 - If staging authentication is missing, `sendbird --profile staging auth login` opens Gate browser OAuth and waits for the user to approve in their browser. Show the URL only when needed; never capture the callback code or token in conversation. This staging grant currently has broad Dashboard reach, so execute only the user's authorized CLI commands. Production login uses an explicit prod profile and requires Gate CLI OAuth enablement and an authorized test/customer scope. Confirm the intended account and app before production writes.
@@ -79,11 +79,11 @@ For task guidance, use `sendbird --json docs search "task words"` to find guide/
 - List outputs are bounded. Follow cursor/offset pagination only as far as the task requires.
 - Report actual verified results and unresolved steps separately. A send handler, local message append, mock conversation, or successful build does not prove remote delivery. Dry-runs, mocks and package installation do not prove that staging or production operations work.
 
-For CLI onboarding examples, run `sendbird --json workflows` and read the relevant workflow. Calls General/Webhook/Chat integration and VoIP push credentials use `calls settings` and `calls push`; inspect `describe` before acting. Writes require --yes, URL/password/keys use private inputs, and readback failure must not trigger a repeated write. The CLI does not place calls or manage Calls rooms/logs, Live, Vercel deployment, or billing mutations in this alpha; follow the selected assistance mode for customer-app code.
+For CLI onboarding examples, run `sendbird --json workflows` and read the relevant workflow. Calls General/Webhook/Chat integration and VoIP push credentials use `calls settings` and `calls push`; inspect `describe` before acting. Writes require --yes, URL/password/keys use private inputs, and readback failure must not trigger a repeated write. The CLI does not place calls or manage Calls rooms/logs, Live, Vercel deployment, or billing mutations in this release; follow the selected assistance mode for customer-app code.
 
-Before diagnosing feature or permission failures, run `sendbird --profile staging --json doctor --command "COMMAND PATH"` with the exact `--type`, `--id` and `--as-user` when applicable. Keep the user-selected staging profile if it has a different name. This reads subscription, app activation and role/actor evidence separately; it never connects the SDK or attempts the requested mutation. `unknown` is not authorization or proof of a disabled feature. Only a live non-secret GET probe verifies that read; writes still need execution and readback. See `guide/execution-diagnosis` for interpretation.
+Before diagnosing feature or permission failures, run `sendbird --profile staging --json doctor --command "COMMAND PATH"` with the exact `--type`, `--id` and `--as-user` when applicable. Keep the user-selected staging profile if it has a different name. This reads subscription, app activation and role/actor evidence separately; it never connects the SDK or attempts the requested mutation. `unknown` is not authorization or proof of a disabled feature. Only a live non-secret GET probe verifies that read; writes still need execution and readback. See `guide/execution-diagnosis#intro` for interpretation.
 
-Use `app feature list` for safe activation snapshots and `app feature set --feature KEY --enabled true|false` for Dashboard Features toggles. Inspect `--dry-run`, bind the exact org/app, and use `--yes` only within authorized scope. Active self-service org, current Chat subscription, and application.settings.all are required; no plan purchase is performed. Enabling can affect usage charges. Advanced profanity enablement also disables the basic filter. Message Search checks region/migration locks; its status GET may reset a failed non-live pipeline, so never substitute it for a harmless status probe. Inspect readback.status and run the context-bound next read before retrying; matches is activation only, never SDK/index readiness. Data Export, Desk and AI Engine toggles are excluded. Read `guide/app-features` for details.
+Use `app feature list` for safe activation snapshots and `app feature set --feature KEY --enabled true|false` for Dashboard Features toggles. Inspect `--dry-run`, bind the exact org/app, and use `--yes` only within authorized scope. Active self-service org, current Chat subscription, and application.settings.all are required; no plan purchase is performed. Enabling can affect usage charges. Advanced profanity enablement also disables the basic filter. Message Search checks region/migration locks; its status GET may reset a failed non-live pipeline, so never substitute it for a harmless status probe. Inspect readback.status and run the context-bound next read before retrying; matches is activation only, never SDK/index readiness. Data Export, Desk and AI Engine toggles are excluded. Read `guide/app-features#intro` for details.
 
 For Pro feature tasks (search, mentions, translation, Polls, Push/DND, filters, announcements, analytics and security settings), read [Pro operations and evidence](references/pro-capabilities.md). Keep CLI implementation, contract tests, staging runtime and customer-app/device evidence separate. Data Export remains excluded.
 

package/skills/sendbird/references/build-chat-app.md

@@ -1,14 +1,14 @@
-# Choose assistance for customer-app work
+# Build or update a customer app
 
-Use this when the person asks to create or edit an app using Sendbird. CLI account/resource operations stay separate from customer code. Before the first app-code task, offer these three choices in the person's language and wait for their answer. Use a single-choice host question UI when available; otherwise ask in the conversation. If they already explicitly selected a mode for this task, reuse it rather than asking again on every edit.
+Follow the official Sendbird Tools [app-code choices](https://github.com/sendbird/sendbird-tools-docs/blob/main/getting-started/ai-agents.md#choose-how-to-work-on-your-app-code). CLI account/resource operations stay separate from customer code. Offer these three choices in the person's language and reuse a choice already made for the task:
 
-1. **View official plugin installation and execution information.** Open or link the publisher's notice/installation page; do not install immediately. Use an already callable native client plugin when the person chooses that route, or wait for installation/loading before invoking it.
-2. **Use the client plugin once from a release ZIP.** With explicit selection, run a temporary, checksum-verified ZIP in a separate Claude Code process (macOS/Linux, authenticated Claude and GitHub required). It uses the person's Claude account, with a default USD 3 budget. The helper prints the publisher notice before execution, allows source editing only, and leaves install/build/runtime checks to the current Agent. It does not install a persistent plugin.
-3. **Do not use the client plugin or its guides.** Continue the authorized task with the current Agent's normal tools and official SDK documentation. Do not fetch plugin guides or claim plugin-assisted checks. If the person only wants CLI preparation, stop there.
+1. **Official native plugin.** Show the publisher notice and installation path, let the person complete installation/trust, then verify the current session can invoke it.
+2. **Guide-only assistance.** Read pinned publisher Markdown with [the read-only reader](client-guide.md) and edit in the current conversation. Activate no downloaded hooks/tools and launch no separate model.
+3. **No client assistance.** Use the current Agent's normal tools and official SDK documentation without fetching publisher guides.
 
-Explain that mode 2 starts another model process, while mode 1 uses the host's native plugin. Mode 2 permits only the bounded ZIP execution described above; it does not authorize persistent installation, trusting/enabling hooks, changing host permissions or automatic updates. Mode 3 permits none of those actions. Already enabled host plugins/hooks may still affect the session; choosing 2 or 3 does not disable them in the parent session. If a loaded plugin is visible and the person wants it disabled, direct them to host controls and do not claim isolation. Unclear/no selection means pending, never a guessed default or automatic fallback. A failure in one mode does not authorize another mode. Record the selected mode in the conversation and final report, not as proof of legal consent.
+No choice is an automatic default or fallback. A failure never authorizes another mode. Already enabled host plugins/hooks may still affect the parent session; do not claim guide-only work disables them. Honor the person's existing authorization, and do not ask again for a choice they already supplied.
 
-If the person explicitly requests guide-only work, or already chose it for this task, honor that selection using [the read-only reader](client-guide.md). Do not reinterpret a previous choice of “2” under the old guide-only menu as permission for ZIP execution. Guide-only work stays in this conversation and does not execute plugin code.
+The retained [temporary ZIP bridge](client-plugin-bridge.md) is a separate advanced route only for an explicit ZIP-execution request. It starts a separate edit-only Claude process on macOS/Linux, uses the person's Claude account with a default USD 3 budget, and requires the publisher notice before execution. Guide-only permission never authorizes it. Preserve any previously explicit ZIP selection by its meaning; do not reinterpret a numbered choice from an earlier menu. Do not install native plugins, trust hooks or widen host permissions as part of ZIP or guide-only work.
 
 ## Prepare only the needed context
 
@@ -18,9 +18,10 @@ Keep a small non-secret brief: customer repository, product/user journey, verifi
 
 ## Follow the selected mode
 
-- **1 — Native plugin:** read [official installation guidance](client-plugin-install.md). Once callable in this host, use its actual installed namespace and appropriate `setup`, `add-feature`, `ui-customize` or `verify-integration` capability. A name or shell install success does not prove the current session loaded it.
-- **2 — Temporary ZIP execution:** read [the ZIP bridge](client-plugin-bridge.md). Show the notice summary and README link in the conversation before invoking the helper; keep its stderr visible. Do not run another model or download execution assets until this mode is explicitly selected. A failed prerequisite remains pending; do not widen permissions or choose another mode automatically.
-- **3 — No client assistance:** do the requested app work directly using normal project inspection and current official SDK docs. Do not invent APIs or silently invoke the client plugin. This explicit mode permits customer-code work without the client plugin; it does not weaken credentials, paid-change, resource or host-permission boundaries.
+- **1 — Native plugin:** read [official installation guidance](client-plugin-install.md). Once callable, use its actual installed namespace and the requested capability. A shell install success does not establish current-session availability.
+- **2 — Guide-only:** read [the guide reader](client-guide.md). Fetch only relevant pinned Markdown and perform the authorized edits in this conversation. Do not execute publisher code.
+- **3 — No client assistance:** inspect the project and official SDK docs directly. Do not claim plugin-assisted checks or silently invoke a plugin.
+- **Explicit ZIP request:** read [the ZIP bridge](client-plugin-bridge.md), show the publisher notice/README and keep stderr visible. Leave failed prerequisites pending rather than widening permissions or changing modes.
 
 ## Verify the actual app
 

package/skills/sendbird-setup/SKILL.md

@@ -5,11 +5,11 @@ description: Install or update Sendbird CLI for Claude Code or Codex, connect an
 
 Prepare a working Sendbird connection and verify account/app read access. Chat practice is optional; setup alone does not authorize resource creation. Installing a plugin, authenticating, sending an SDK message and completing a customer app are separate outcomes. Reuse the user's working installation and login when possible. Read [installation and first task](references/onboarding.md) for the complete procedure and per-host commands.
 
-1. **Check the installation.** Resolve the actual executable, Node version and `sendbird --version`, then run `sendbird --json agent`. Inspect the commands needed for the task. An equal alpha version does not prove an old npm link is current. If missing/incompatible, run this skill's `scripts/install-cli.mjs` with Node, resolving its absolute path from the installed skill location. It prints JSON with a verified executable; use that path for later commands or add its bin directory to this session's PATH. Never invent an npm release, overwrite an unmanaged executable, or edit shell rc files without a separate request. If project Skill registration is denied because the host protects `.agents` or `.claude`, give the exact `sendbird skills install --agent HOST --scope project` command for the person’s normal terminal. Do not retry through a different path, create custom permission rules, or disable the host sandbox. Restart or reload the host after registration and check actual Skill consumption.
+1. **Check the installation.** Resolve the actual executable, Node version and `sendbird --version`, then run `sendbird --json agent`. Inspect the commands needed for the task. An equal version does not prove an old npm link is current. If missing/incompatible, run this skill's `scripts/install-cli.mjs` with Node, resolving its absolute path from the installed skill location. It prints JSON with a verified executable; use that path for later commands or add its bin directory to this session's PATH. Never invent an npm release, overwrite an unmanaged executable, or edit shell rc files without a separate request. If project Skill registration is denied because the host protects `.agents` or `.claude`, give the exact `sendbird skills install --agent HOST --scope project` command for the person’s normal terminal. Do not retry through a different path, create custom permission rules, or disable the host sandbox. Restart or reload the host after registration and check actual Skill consumption.
 2. **Connect the intended environment.** CLI browser OAuth supports the selected prod/staging profile where Gate advertises and enables its CLI client. Use the requested profile/environment explicitly; ask if the intended target is unclear. Run `--profile PROFILE --json auth status --summary`. If missing/expired, start `auth login` and wait for the person to approve in their browser, then recheck. Do not request passwords, cookies, callback codes or tokens in chat. Explain OS credential store failures; there is no credential-file fallback. Do not rerun login after a role denial.
 3. **Select existing resources.** List the accessible organizations and apps, confirm the intended organization and exact app, then use explicit IDs on commands. Ask whether to save this exact organization/app as defaults in the selected profile or use them only for this session. Reuse a choice already supplied; do not silently choose either. Inspect `--profile PROFILE profile` before saving. `org use` clears the saved app and region, so skip it when the same org is already saved; use `app use` to save the app. Ask before making the profile globally active with `profile use`; storing context and activating a profile are separate choices. Read the profile back and report what was saved. If declined, keep explicit IDs on commands and report that defaults were not changed. No results or ambiguous results need a user choice. Do not create an organization/app as a setup shortcut. If the user wants an account or new resources, route to the CLI's `new-account-chat` workflow and preserve human signup/terms approval.
 4. **Offer optional Chat practice.** After read-only connection checks, offer to finish setup or run a two-user Chat practice. Default to finishing without writes until the person authorizes practice. Reuse explicit authorization for this target/task; do not ask again. A generic request to install, connect or set up is not permission to create users/channels, issue tokens, send messages or delete resources. If practice is authorized, read `describe` and the matching workflow, then show the planned target/resources and supported offline previews. A safe Chat practice uses two dedicated test users and a private Group channel in the user-approved app, issues user access tokens explicitly, sends a unique message as each user and reads it as the other. Inventory collisions first and never modify existing customer users/channels to make the demo pass. Write acknowledgement alone is not delivery or read state. Record returned user/channel/message IDs without tokens. Clean up only resources this run created when authorized. With no permission for writes, stop after read-only checks and previews and label practice unexecuted.
-5. **Choose assistance only when customer code is requested.** Read the sibling Skill's [three app-assistance modes](../sendbird/references/build-chat-app.md). Offer official plugin information/installation, explicitly selected temporary ZIP execution, or no client assistance; reuse an explicit selection for the same task. Do not guess or auto-switch. Show the notice summary and publisher README link before installation/execution guidance. Native installation/loading can remain pending; the ZIP route starts a separate edit-only Claude process only after explicit selection and emits the notice before launch. Preserve prior guide-only selections; never treat them as permission to launch a model. CLI setup does not require a client plugin.
+5. **Choose assistance only when customer code is requested.** Read the sibling Skill's [three app-assistance modes](../sendbird/references/build-chat-app.md). Offer official plugin information/installation, pinned guide-only assistance in this conversation, or no client assistance; reuse an explicit selection for the same task. Do not guess or auto-switch. Show the notice summary and publisher README link before installation/execution guidance. Native installation/loading can remain pending; the separate advanced ZIP route starts a separate edit-only Claude process only after an explicit ZIP request and emits the notice before launch. Preserve prior guide-only selections; never treat them as permission to launch a model. CLI setup does not require a client plugin.
 
 Report the executable/version, plugin loaded, authentication status, verified org/app, saved defaults (or session-only context), optional practice completed/skipped/pending, first-task checks and customer-app handoff separately. Keep pending human approvals and server/account restrictions visible. Do not label a dry-run, mock, plugin install or build as first-chat success. Billing changes stay in Dashboard; never use onboarding as permission to buy credits, change a plan, start a trial, enroll 2FA or enable guest access.
 

package/skills/sendbird-setup/references/onboarding.md

@@ -1,6 +1,6 @@
 # Install and connect Sendbird
 
-The npm package is `@sendbird/cli`; the executable is `sendbird`. Node.js 22.23.4+ (22.x) or 24.22.1+ (24.x) is required. The private alpha may not be on npm. The installer checks the exact plugin version and required command capabilities, prefers a checksum-verified bundled CLI archive, and otherwise tries npm before building a temporary copy of a trusted Git-installed plugin checkout. It never stores Sendbird credentials or changes shell rc files. Duplicate flags or missing option values are rejected before installation. An incomplete cached install is rechecked using the returned executable, including its npm bin link.
+The npm package is `@sendbird/cli`; the executable is `sendbird`. Node.js 22.23.4+ (22.x) or 24.22.1+ (24.x) is required. Install the published package with npm; use an approved bundled artifact when testing an unpublished candidate. The installer checks the exact plugin version and required command capabilities, prefers a checksum-verified bundled CLI archive, and otherwise tries npm before building a temporary copy of a trusted Git-installed plugin checkout. It never stores Sendbird credentials or changes shell rc files. Duplicate flags or missing option values are rejected before installation. An incomplete cached install is rechecked using the returned executable, including its npm bin link.
 
 Resolve `../scripts/install-cli.mjs` relative to this reference's skill folder: