@wix/himalaya-cli 0.1113.0 → 0.1115.0

package/guides/himi-mcp.md

@@ -74,16 +74,27 @@ runs a session with it.
 | `himi_progress` | Read or add to the build journal the owner follows. |
 | `himi_preview_start` / `_status` / `_stop` | The live preview — see below. |
 | `himi_whoami` | Which account the stored sign-in belongs to. |
+| `himi_login` | Open a browser window where the user signs in to Wix, so publishing works with no terminal. It returns the sign-in link at once; call it again to see whether the sign-in finished. |
 | `himi_push` | Publish a **draft**: private to the owner, viewable by preview link and in Himi Player, not live. |
 | `himi_share`, `himi_preview_links` | Share links for a published release. |
 
 Each tool acts on the agent's workspace folder unless it is given a `dir`.
 
-**What the tools will not do:** sign in, make a release live, build store binaries, touch secrets,
-write to a site's CMS, or create a Wix site. Those spend money, handle credentials, or change what
-real users see, so they stay commands a person runs. Publishing needs a sign-in first — run
-`himi login --browser` in a terminal; the server never asks for or handles a credential. A tool
-input that starts with `-` is refused, so nothing can be passed through to a flag no tool offers.
+**File tools, for hosts that cannot edit files.** `himi mcp --with-files` adds `himi_list_apps`,
+`himi_list_files`, `himi_read_file`, `himi_write_files` and `himi_delete_files`. The Claude Desktop
+Extension uses them, because Claude Desktop chat has no file editing of its own. They follow the
+hosted connector's shapes, act only inside the workspace folder (checked on the real path, so a
+symlink cannot lead out of it), and never touch `.git`, `node_modules` or `dist`. When the host names
+no workspace, `HIMI_WORKSPACE` sets the folder. Coding agents edit files themselves, so the flag is
+off by default.
+
+**What the tools will not do:** make a release live, build store binaries, touch secrets, write to a
+site's CMS, or create a Wix site. Those spend money, handle credentials, or change what real users
+see, so they stay commands a person runs. Publishing needs a sign-in first: `himi_login` opens the
+browser sign-in for the user, or run `himi login --browser` in a terminal. Either way the server
+never asks for or sees a credential — the browser hands a scoped token to a separate `himi login`
+process, which stores it on this machine. A tool input that starts with `-` is refused, so nothing
+can be passed through to a flag no tool offers.
 
 ## See the app inside your IDE
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1113.0",
+  "version": "0.1115.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -67,5 +67,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "3271c06d75a812e01e41d371fafbd76ca27b6b97a36f6bb255c56d91"
+  "falconPackageHash": "19c38309340f59147c2cb6f97746d920feacc058a4c256331d9f4422"
 }