@vatio-ai/skills 1.18.0 → 1.19.0

package/.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
       "name": "vatio",
       "source": "./",
       "description": "Vatio skills for Claude Code, Cursor and Codex: add an AI agent to the app you're building with /vatio-init, put it in your web, iOS, Android or Flutter app with /vatio-add-to-app, then improve it daily with /vatio-improve and learn what people ask it with /vatio-analyze.",
-      "version": "1.18.0",
+      "version": "1.19.0",
       "homepage": "https://vatio.ai/docs/integrations/claude-code",
       "category": "development",
       "keywords": [

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "vatio",
   "description": "Vatio skills for Claude Code, Cursor and Codex: add an AI agent to the app you're building with /vatio-init, put it in your web, iOS, Android or Flutter app with /vatio-add-to-app, then improve it daily with /vatio-improve and learn what people ask it with /vatio-analyze.",
-  "version": "1.18.0",
+  "version": "1.19.0",
   "author": {
     "name": "Vatio",
     "url": "https://vatio.ai"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vatio-ai/skills",
-  "version": "1.18.0",
+  "version": "1.19.0",
   "description": "Vatio skills for Claude Code, Cursor and Codex: add an AI agent to the app you're building with /vatio-init, put it in your web, iOS, Android or Flutter app with /vatio-add-to-app, then improve it daily with /vatio-improve and learn what people ask it with /vatio-analyze.",
   "keywords": [
     "vatio",

package/skills/vatio-add-to-app/SKILL.md

@@ -30,7 +30,8 @@ SDK, Android SDK, Flutter SDK, Authentication, Supabase) have the details.
    screens or layout, which tokens, how signed-in users are passed, and ask
    them to confirm.
 3. **Tokens.** `vatio tokens create --env preview` for development builds and
-   `--env live` for release builds, each with its origins. `vatpub_` tokens
+   `--env live` for release builds, each with its origins (`--json` when the
+   token goes straight into a config or secrets store). `vatpub_` tokens
    ship in the app's configuration; a `vat_` token never does.
 4. **Add it.** Web: the widget, once for the whole app. iOS, Android and Flutter: the
    SDK has no UI, so write the chat screen in the app's own style from the
@@ -56,3 +57,13 @@ Code, offer to send this session to the Vatio team, as the
 `no`, say nothing.
 
 `vatio` is `npx @vatio-ai/cli` when it is not installed globally.
+
+A command you hand the developer to run themselves, because a permission
+check refused it or it needs their own credentials, says
+`npx @vatio-ai/cli@latest`, never `vatio`: the `vatio` installed on their
+machine can be too old for Vatio to accept. When one command's output feeds
+another (a token into a secrets store), take it with `--json` and chain with
+`&&`, never through `grep`, so a failure stops there instead of passing on an
+empty value. If Claude Code's auto mode refused a `vatio` command and the
+project's `.claude/settings.json` has no `Bash(vatio *)` rule, also mention
+**Auto mode** on the docs' Claude Code page.

package/skills/vatio-improve/SKILL.md

@@ -66,3 +66,13 @@ the fix needs more than the digest says. If `vatio` is not installed, use
 opens the browser on the developer's machine (if it doesn't, give them the
 link it prints), and they sign in and check the code matches. If it times
 out, run it again after they have signed in.
+
+A command you hand the developer to run themselves, because a permission
+check refused it or it needs their own credentials, says
+`npx @vatio-ai/cli@latest`, never `vatio`: the `vatio` installed on their
+machine can be too old for Vatio to accept. When one command's output feeds
+another (a token into a secrets store), take it with `--json` and chain with
+`&&`, never through `grep`, so a failure stops there instead of passing on an
+empty value. If Claude Code's auto mode refused a `vatio` command and the
+project's `.claude/settings.json` has no `Bash(vatio *)` rule, also mention
+**Auto mode** on the docs' Claude Code page.

package/skills/vatio-init/SKILL.md

@@ -73,6 +73,21 @@ you recommend, and ask them to confirm.
   in: Vatio keeps what was deployed, not the files it came from. Do not
   `vatio init` one instead.
 
+## Claude Code permissions
+
+In Claude Code, once the agent is pushed, check the project's
+`.claude/settings.json` (in the folder Claude Code was opened in). If it has
+no `Bash(vatio *)` rule, offer once to add the block in **Auto mode** on the
+docs' Claude Code page: it lets you run `vatio` without the auto mode
+classifier refusing it, and still asks the developer before `vatio publish`,
+`vatio rollback`, `vatio secrets` and `vatio keys`. Add it only with their
+yes, merged into what the file has, never replacing it, and add no other rule.
+It matches `vatio`, so it needs the CLI installed:
+`npm install -g @vatio-ai/cli`, also only with their yes. Run each `vatio`
+command on its own, not in a pipe or after `cd … &&`, so the rule matches.
+Never edit `~/.claude/settings.json`; for `vatio share-session` point them to
+that same section.
+
 ## 3. Before you finish
 
 1. If an error or the docs left you guessing, say so:
@@ -89,3 +104,13 @@ prints). Tell them to sign in with the account that kept it and check that
 the code on the page matches the one the terminal printed. If the command
 times out waiting, run it again after they have signed in: it picks up the
 same sign-in page.
+
+A command you hand the developer to run themselves, because a permission
+check refused it or it needs their own credentials, says
+`npx @vatio-ai/cli@latest`, never `vatio`: the `vatio` installed on their
+machine can be too old for Vatio to accept. When one command's output feeds
+another (a token into a secrets store), take it with `--json` and chain with
+`&&`, never through `grep`, so a failure stops there instead of passing on an
+empty value. If Claude Code's auto mode refused a `vatio` command and the
+project's `.claude/settings.json` has no `Bash(vatio *)` rule, also mention
+**Auto mode** on the docs' Claude Code page.

package/skills/vatio-share-session/SKILL.md

@@ -95,7 +95,10 @@ It is sent in one of two ways: the user asked for it, or you offer it because
 
    When they say they ran it, check instead of asking:
    `npx @vatio-ai/cli@latest share-session --list` marks a session that was
-   sent with `(sent #N, when)`. If it is not marked, it did not go.
+   sent with `(sent #N, when)`. If it is not marked, it did not go. To have
+   auto mode let it through next time, point them to **Auto mode** on the
+   docs' Claude Code page: it is a line in their own Claude Code settings,
+   which you do not edit.
 
 Only Claude Code sessions can be sent. In any other coding agent, do not offer
 it; when the user asks, write what happened instead: