@vatio-ai/skills 1.18.0 → 1.20.0

package/.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
       "name": "vatio",
       "source": "./",
       "description": "Vatio skills for Claude Code, Cursor and Codex: add an AI agent to the app you're building with /vatio-init, put it in your web, iOS, Android or Flutter app with /vatio-add-to-app, then improve it daily with /vatio-improve and learn what people ask it with /vatio-analyze.",
-      "version": "1.18.0",
+      "version": "1.20.0",
       "homepage": "https://vatio.ai/docs/integrations/claude-code",
       "category": "development",
       "keywords": [

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "vatio",
   "description": "Vatio skills for Claude Code, Cursor and Codex: add an AI agent to the app you're building with /vatio-init, put it in your web, iOS, Android or Flutter app with /vatio-add-to-app, then improve it daily with /vatio-improve and learn what people ask it with /vatio-analyze.",
-  "version": "1.18.0",
+  "version": "1.20.0",
   "author": {
     "name": "Vatio",
     "url": "https://vatio.ai"

package/README.md

@@ -19,7 +19,7 @@ need your app’s project on your computer and Node.js 20 or newer.
 
 | Skill | What it does |
 |---|---|
-| `vatio-init` | The first one in a project: looks at what is already there (a `vatio.yml` anywhere in the repository, the app's code) and recommends from it. With no agent yet, builds one: asks the owner what the code does not answer, writes `vatio.yml`, pushes it (with no account, as a trial) and hands over a link to try it and one to keep it. With one, gets a developer who joined the project up to speed |
+| `vatio-init` | The first one in a project: looks at what is already there (a `vatio.yml` anywhere in the repository, the app's code) and recommends from it. With no agent yet, builds one: asks the owner what the code does not answer, writes `vatio.yml`, pushes it and hands over a link to try. With one, gets a developer who joined the project up to speed |
 | `vatio-add-to-app` | Puts the agent in your app once you have tried it: the web widget, or the iOS, Android or Flutter SDK with a chat screen in your app's style, a publishable token for development and one for release, and your signed-in users passed along |
 | `vatio-improve` | Takes every reply your supervisors reported in the inbox in one session: reads `vatio flags`, fixes each cause, `vatio push`, proves it with `vatio test` (on Vatio's servers, in the background) and publishes with `vatio publish` after your approval |
 | `vatio-analyze` | Reads what people talked about with the agent between two dates, from `vatio chat export` (redacted by Vatio before it leaves): topics with their counts, the questions it could not answer and the words people use, in a report for writing content, FAQs or knowledge. Anyone on the workspace's team can run it, viewers included |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vatio-ai/skills",
-  "version": "1.18.0",
+  "version": "1.20.0",
   "description": "Vatio skills for Claude Code, Cursor and Codex: add an AI agent to the app you're building with /vatio-init, put it in your web, iOS, Android or Flutter app with /vatio-add-to-app, then improve it daily with /vatio-improve and learn what people ask it with /vatio-analyze.",
   "keywords": [
     "vatio",

package/skills/vatio-add-to-app/SKILL.md

@@ -30,7 +30,8 @@ SDK, Android SDK, Flutter SDK, Authentication, Supabase) have the details.
    screens or layout, which tokens, how signed-in users are passed, and ask
    them to confirm.
 3. **Tokens.** `vatio tokens create --env preview` for development builds and
-   `--env live` for release builds, each with its origins. `vatpub_` tokens
+   `--env live` for release builds, each with its origins (`--json` when the
+   token goes straight into a config or secrets store). `vatpub_` tokens
    ship in the app's configuration; a `vat_` token never does.
 4. **Add it.** Web: the widget, once for the whole app. iOS, Android and Flutter: the
    SDK has no UI, so write the chat screen in the app's own style from the
@@ -56,3 +57,13 @@ Code, offer to send this session to the Vatio team, as the
 `no`, say nothing.
 
 `vatio` is `npx @vatio-ai/cli` when it is not installed globally.
+
+A command you hand the developer to run themselves, because a permission
+check refused it or it needs their own credentials, says
+`npx @vatio-ai/cli@latest`, never `vatio`: the `vatio` installed on their
+machine can be too old for Vatio to accept. When one command's output feeds
+another (a token into a secrets store), take it with `--json` and chain with
+`&&`, never through `grep`, so a failure stops there instead of passing on an
+empty value. If Claude Code's auto mode refused a `vatio` command and the
+project's `.claude/settings.json` has no `Bash(vatio *)` rule, also mention
+**Auto mode** on the docs' Claude Code page.

package/skills/vatio-improve/SKILL.md

@@ -66,3 +66,13 @@ the fix needs more than the digest says. If `vatio` is not installed, use
 opens the browser on the developer's machine (if it doesn't, give them the
 link it prints), and they sign in and check the code matches. If it times
 out, run it again after they have signed in.
+
+A command you hand the developer to run themselves, because a permission
+check refused it or it needs their own credentials, says
+`npx @vatio-ai/cli@latest`, never `vatio`: the `vatio` installed on their
+machine can be too old for Vatio to accept. When one command's output feeds
+another (a token into a secrets store), take it with `--json` and chain with
+`&&`, never through `grep`, so a failure stops there instead of passing on an
+empty value. If Claude Code's auto mode refused a `vatio` command and the
+project's `.claude/settings.json` has no `Bash(vatio *)` rule, also mention
+**Auto mode** on the docs' Claude Code page.

package/skills/vatio-init/SKILL.md

@@ -26,8 +26,8 @@ contract for `vatio.yml`, tools, knowledge and the CLI.
 - **The app.** What the project does and for whom; the API an agent could
   call (routes, controllers, an OpenAPI file); how its users sign in; and the
   docs, FAQs or policies an agent could read as knowledge.
-- **This machine.** `vatio doctor`: whether it is signed in, which
-  workspace this directory resolves to, and whether it pushed to a trial.
+- **This machine.** `vatio doctor`: whether it is signed in, and which
+  workspace this directory resolves to.
 
 ## 2. Say what you found, and recommend
 
@@ -46,17 +46,11 @@ you recommend, and ask them to confirm.
      team when a person should take over: **Human in the loop** in the docs).
   3. `vatio diff`, `vatio push`, then try it with `vatio chat`, including a
      conversation that should hand off.
-  4. Give them what `vatio push` printed, with what you tried. With no
-     account on this machine, the first push deploys a trial preview and
-     prints a **Try it** link and a **Keep it** link: give them both. Try it
-     is a web chat anyone with the link can use; Keep it is where they sign
-     in (email, Google or GitHub) and keep the agent, which publishing,
-     secrets and tokens wait for. Never open Keep it yourself. Signed in,
-     `Try it:` is the inbox's Test page, with web chat, WhatsApp and
-     Instagram. Publish with `vatio publish` only when they ask.
+  4. Give them the link `vatio push` prints after `Try it:` (the inbox's
+     Test page, with web chat, WhatsApp and Instagram) with what you
+     tried. Publish with `vatio publish` only when they ask.
   5. Once they have tried it, offer to put it in the app (the web widget,
-     or the iOS, Android or Flutter SDK) with the `vatio-add-to-app` skill. A trial
-     has to be kept first.
+     or the iOS, Android or Flutter SDK) with the `vatio-add-to-app` skill.
 - **A `vatio.yml`: the agent exists.** Never `vatio init` here: it writes a
   starter agent, and pushing that replaces the real one. Work from the
   directory of the `vatio.yml` and follow **Joining an existing workspace**:
@@ -73,6 +67,21 @@ you recommend, and ask them to confirm.
   in: Vatio keeps what was deployed, not the files it came from. Do not
   `vatio init` one instead.
 
+## Claude Code permissions
+
+In Claude Code, once the agent is pushed, check the project's
+`.claude/settings.json` (in the folder Claude Code was opened in). If it has
+no `Bash(vatio *)` rule, offer once to add the block in **Auto mode** on the
+docs' Claude Code page: it lets you run `vatio` without the auto mode
+classifier refusing it, and still asks the developer before `vatio publish`,
+`vatio rollback`, `vatio secrets` and `vatio keys`. Add it only with their
+yes, merged into what the file has, never replacing it, and add no other rule.
+It matches `vatio`, so it needs the CLI installed:
+`npm install -g @vatio-ai/cli`, also only with their yes. Run each `vatio`
+command on its own, not in a pipe or after `cd … &&`, so the rule matches.
+Never edit `~/.claude/settings.json`; for `vatio share-session` point them to
+that same section.
+
 ## 3. Before you finish
 
 1. If an error or the docs left you guessing, say so:
@@ -81,11 +90,19 @@ you recommend, and ask them to confirm.
    the `vatio-share-session` skill says. It starts with
    `vatio share-session --should-ask`: if that prints `no`, say nothing.
 
-`vatio` is `npx @vatio-ai/cli` when it is not installed globally. Nothing
-asks for an account until they keep the trial (or you run `vatio login`).
-Once they have kept it, the next `vatio` command signs this terminal in: it
-opens the browser on their machine (if it doesn't, give them the link it
-prints). Tell them to sign in with the account that kept it and check that
-the code on the page matches the one the terminal printed. If the command
-times out waiting, run it again after they have signed in: it picks up the
-same sign-in page.
+`vatio` is `npx @vatio-ai/cli` when it is not installed globally. The first
+`vatio push` (or `vatio login`) signs the developer in: it opens the browser
+on their machine (if it doesn't, give them the link it prints). Tell them to
+sign in with email, Google or GitHub and check that the code on the page
+matches the one the terminal printed. If the command times out waiting, run
+it again after they have signed in: it picks up the same sign-in page.
+
+A command you hand the developer to run themselves, because a permission
+check refused it or it needs their own credentials, says
+`npx @vatio-ai/cli@latest`, never `vatio`: the `vatio` installed on their
+machine can be too old for Vatio to accept. When one command's output feeds
+another (a token into a secrets store), take it with `--json` and chain with
+`&&`, never through `grep`, so a failure stops there instead of passing on an
+empty value. If Claude Code's auto mode refused a `vatio` command and the
+project's `.claude/settings.json` has no `Bash(vatio *)` rule, also mention
+**Auto mode** on the docs' Claude Code page.

package/skills/vatio-share-session/SKILL.md

@@ -95,7 +95,10 @@ It is sent in one of two ways: the user asked for it, or you offer it because
 
    When they say they ran it, check instead of asking:
    `npx @vatio-ai/cli@latest share-session --list` marks a session that was
-   sent with `(sent #N, when)`. If it is not marked, it did not go.
+   sent with `(sent #N, when)`. If it is not marked, it did not go. To have
+   auto mode let it through next time, point them to **Auto mode** on the
+   docs' Claude Code page: it is a line in their own Claude Code settings,
+   which you do not edit.
 
 Only Claude Code sessions can be sent. In any other coding agent, do not offer
 it; when the user asks, write what happened instead: