@skillguard/cli 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.5.0
+
+- Added `skillguard auth` command group:
+  - `auth login` (store key),
+  - `auth status` (show effective auth source),
+  - `auth logout` (remove local config key)
+- Added auth help/man coverage in CLI help pages
+
 ## 0.4.0
 
 - Added `skillguard workflow` command to generate ready-to-use GitHub Actions CI gate workflow

package/README.md

@@ -34,6 +34,12 @@ npx @skillguard/cli help scan
 npx @skillguard/cli init
 ```
 
+Or via auth command:
+
+```bash
+npx @skillguard/cli auth login
+```
+
 You can also provide the key via env:
 
 ```bash
@@ -72,6 +78,13 @@ npx @skillguard/cli gate ./skills
 npx @skillguard/cli limits
 ```
 
+### Auth status and logout
+
+```bash
+npx @skillguard/cli auth status
+npx @skillguard/cli auth logout
+```
+
 ### Generate and push workflow in one command
 
 ```bash
@@ -119,6 +132,12 @@ npx @skillguard/cli verify ./SKILL.md
 - `--api-key <key>` (optional)
 - `--no-color`
 
+### auth
+
+- `auth login [--api-key <key>] [--base-url <url>]`
+- `auth status [--json] [--api-key <key>] [--base-url <url>]`
+- `auth logout`
+
 ### workflow
 
 - `--path <file>` (default: `.github/workflows/skillguard.yml`)
@@ -158,6 +177,8 @@ npx @skillguard/cli verify ./SKILL.md
   - `1` threshold exceeded
 - `workflow`:
   - `0` success
+- `auth`:
+  - `0` success
 - all commands:
   - `4` usage/input/config error
   - `5` network/API/runtime external failure

package/dist/cli.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { parseArgs } from 'node:util';
+import { runAuth } from './commands/auth.js';
 import { runInit } from './commands/init.js';
 import { runGate } from './commands/gate.js';
 import { runLimits } from './commands/limits.js';
@@ -115,6 +116,15 @@ async function run() {
             baseUrl: typeof options['base-url'] === 'string' ? options['base-url'] : undefined,
         });
     }
+    if (command === 'auth') {
+        const authOptions = {
+            subcommand: positionals[0],
+            json: options.json === true,
+            baseUrl: typeof options['base-url'] === 'string' ? options['base-url'] : undefined,
+            apiKey: typeof options['api-key'] === 'string' ? options['api-key'] : undefined,
+        };
+        return await runAuth(authOptions);
+    }
     if (command === 'scan') {
         const pathArg = positionals[0];
         let parsedTimeout;

package/dist/commands/auth.d.ts

@@ -0,0 +1,7 @@
+export interface AuthOptions {
+    subcommand?: string;
+    apiKey?: string;
+    baseUrl?: string;
+    json: boolean;
+}
+export declare function runAuth(options: AuthOptions): Promise<number>;

package/dist/commands/auth.js

@@ -0,0 +1,103 @@
+import { clearConfig, DEFAULT_BASE_URL, getConfigPath, normalizeBaseUrl, readConfig, resolveApiKey } from '../lib/config.js';
+import { runInit } from './init.js';
+function toAuthSubcommand(raw) {
+    if (!raw) {
+        return null;
+    }
+    const value = raw.trim().toLowerCase();
+    if (value === 'login')
+        return 'login';
+    if (value === 'status')
+        return 'status';
+    if (value === 'logout')
+        return 'logout';
+    return null;
+}
+function renderStatusHuman(input) {
+    const lines = [
+        `Auth: ${input.authenticated ? 'configured' : 'not configured'}`,
+        `Source: ${input.source}`,
+        `Base URL: ${input.baseUrl}`,
+        `Config file: ${input.configPath}`,
+    ];
+    if (!input.authenticated) {
+        lines.push('No API key found. Use "skillguard auth login" or set SKILLGUARD_API_KEY.');
+    }
+    if (input.hasEnvKey) {
+        lines.push('Env key detected: SKILLGUARD_API_KEY');
+    }
+    if (input.hasConfigKey) {
+        lines.push('Config key detected.');
+    }
+    return lines.join('\n');
+}
+async function runStatus(options) {
+    const configPath = getConfigPath();
+    let config = null;
+    try {
+        config = await readConfig(configPath);
+    }
+    catch (error) {
+        console.error(error.message);
+        return 4;
+    }
+    const resolvedApiKey = resolveApiKey({
+        apiKeyFlag: options.apiKey,
+        env: process.env,
+        config,
+    });
+    let baseUrl;
+    try {
+        baseUrl = normalizeBaseUrl(options.baseUrl || config?.apiUrl || DEFAULT_BASE_URL);
+    }
+    catch (error) {
+        console.error(error.message);
+        return 4;
+    }
+    const payload = {
+        authenticated: Boolean(resolvedApiKey),
+        source: (resolvedApiKey?.source || 'none'),
+        baseUrl,
+        configPath,
+        hasConfigKey: typeof config?.apiKey === 'string' && config.apiKey.trim().length > 0,
+        hasEnvKey: typeof process.env.SKILLGUARD_API_KEY === 'string' && process.env.SKILLGUARD_API_KEY.trim().length > 0,
+    };
+    if (options.json) {
+        console.log(JSON.stringify(payload, null, 2));
+        return 0;
+    }
+    console.log(renderStatusHuman(payload));
+    return 0;
+}
+async function runLogout() {
+    const configPath = getConfigPath();
+    try {
+        const removed = await clearConfig(configPath);
+        console.log(removed ? `Logged out. Removed ${configPath}` : `No config found at ${configPath}`);
+    }
+    catch (error) {
+        console.error(error.message);
+        return 4;
+    }
+    if (typeof process.env.SKILLGUARD_API_KEY === 'string' && process.env.SKILLGUARD_API_KEY.trim().length > 0) {
+        console.log('Note: SKILLGUARD_API_KEY is set in environment and will still be used by this shell.');
+    }
+    return 0;
+}
+export async function runAuth(options) {
+    const subcommand = toAuthSubcommand(options.subcommand);
+    if (!subcommand) {
+        console.error('Auth subcommand is required: login | status | logout');
+        return 4;
+    }
+    if (subcommand === 'login') {
+        return runInit({
+            apiKey: options.apiKey,
+            baseUrl: options.baseUrl,
+        });
+    }
+    if (subcommand === 'status') {
+        return runStatus(options);
+    }
+    return runLogout();
+}

package/dist/lib/config.d.ts

@@ -15,5 +15,6 @@ export interface ApiKeyResolutionInput {
 export declare function getConfigPath(home?: string): string;
 export declare function readConfig(configPath?: string): Promise<SkillguardCliConfig | null>;
 export declare function writeConfig(config: SkillguardCliConfig, configPath?: string): Promise<void>;
+export declare function clearConfig(configPath?: string): Promise<boolean>;
 export declare function normalizeBaseUrl(value?: string): string;
 export declare function resolveApiKey(input: ApiKeyResolutionInput): ResolvedApiKey | null;

package/dist/lib/config.js

@@ -1,4 +1,4 @@
-import { mkdir, readFile, chmod, writeFile } from 'node:fs/promises';
+import { access, chmod, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 export const DEFAULT_BASE_URL = 'https://skillguard.ai';
@@ -39,6 +39,25 @@ export async function writeConfig(config, configPath = getConfigPath()) {
     await writeFile(configPath, `${body}\n`, { encoding: 'utf8', mode: 0o600 });
     await chmod(configPath, 0o600);
 }
+export async function clearConfig(configPath = getConfigPath()) {
+    try {
+        await access(configPath);
+    }
+    catch (error) {
+        const typed = error;
+        if (typed?.code === 'ENOENT') {
+            return false;
+        }
+        throw new Error('Failed to clear CLI config.');
+    }
+    try {
+        await rm(configPath, { force: true });
+        return true;
+    }
+    catch {
+        throw new Error('Failed to clear CLI config.');
+    }
+}
 export function normalizeBaseUrl(value) {
     const raw = (value || DEFAULT_BASE_URL).trim();
     const withoutTrailingSlash = raw.replace(/\/+$/, '');

package/dist/lib/help.js

@@ -8,6 +8,7 @@ function normalizeTopic(topic) {
     const normalized = topic.trim().toLowerCase();
     const aliased = COMMAND_ALIASES[normalized] || normalized;
     if (aliased === 'help' ||
+        aliased === 'auth' ||
         aliased === 'init' ||
         aliased === 'scan' ||
         aliased === 'gate' ||
@@ -25,6 +26,7 @@ Usage:
   skillguard <command> [options]
 
 Core commands:
+  auth        API-key auth commands (login/status/logout)
   init        Save API key in local CLI config
   scan        Scan one file or recursively scan a directory
   gate        CI gate mode (0 pass, 1 fail)
@@ -38,6 +40,7 @@ Help commands:
 
 Quick start:
   skillguard scan SKILL.md
+  skillguard auth status
   skillguard gate .
   skillguard workflow
   skillguard workflow --auto-gh-push
@@ -80,6 +83,28 @@ OPTIONS
   --api-key <key>     API key to persist
   --base-url <url>    API base URL (default: https://skillguard.ai)
 
+EXIT CODES
+  0 success
+  4 usage/input/config error
+  5 external runtime error`;
+}
+function renderAuthHelp() {
+    return `NAME
+  skillguard auth - manage CLI authentication state
+
+SYNOPSIS
+  skillguard auth login [--api-key <key>] [--base-url <url>]
+  skillguard auth status [--json] [--api-key <key>] [--base-url <url>]
+  skillguard auth logout
+
+DESCRIPTION
+  login   Save API key in local config (interactive if key omitted)
+  status  Show effective auth source (flag/env/config/none)
+  logout  Remove local CLI config key
+
+NOTES
+  logout cannot unset SKILLGUARD_API_KEY environment variables from parent shell.
+
 EXIT CODES
   0 success
   4 usage/input/config error
@@ -222,6 +247,8 @@ export function renderTopicHelp(command) {
     switch (topic) {
         case 'help':
             return renderHelpCommandHelp();
+        case 'auth':
+            return renderAuthHelp();
         case 'init':
             return renderInitHelp();
         case 'scan':

package/dist/lib/version.d.ts

@@ -1 +1 @@
-export declare const CLI_VERSION = "0.4.0";
+export declare const CLI_VERSION = "0.5.0";

package/dist/lib/version.js

@@ -1 +1 @@
-export const CLI_VERSION = '0.4.0';
+export const CLI_VERSION = '0.5.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillguard/cli",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Security scanner for AI agent skill files",
   "type": "module",
   "bin": {