demobite 1.7.3 → 1.7.5

package/README.md

@@ -34,9 +34,11 @@ The recorder ships as a plugin of this repository. Install it once, then run its
 /demobites:setup
 ```
 
+When Claude Code asks where to install, choose **Install for you (user scope)**: the plugin follows you into every project, and the connection to your DemoBites account is made per project.
+
 Then `/demobites:record`, `/demobites:login`, `/demobites:logout` — or just ask: "record a demo of the new billing page".
 
-You can also skip the setup line: ask for a demo right after the install and the record skill sets the recorder up by itself (once per machine, no browser), asks for one "Go" before opening the approval link, and then films what you asked for. Until the project is connected, every new session opens with one line that says so.
+You can also skip the setup line: ask for a demo right after the install and the record skill sets the recorder up by itself (once per machine), tells you it is opening the approval link in your browser, opens it, and then films what you asked for. Until the project is connected, every new session opens with one line that says so.
 
 **Codex**
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "demobite",
-  "version": "1.7.3",
+  "version": "1.7.5",
   "description": "The DemoBites agentic recorder — you prompt, it films a real browser, and DemoBites turns the take into an editable demo bite.",
   "bin": {
     "demobite": "launcher/index.mjs"

package/skill/SKILL.md

@@ -11,21 +11,22 @@ All scripts live in `scripts/` beside this file. They are plain Node ESM. Requir
 
 Follow the phases in order. Never skip the storyboard approval: the human's yes on the storyboard, in the chat, is the word for the take. After that the take is delivered by itself. It becomes a bite in DemoBites without a second click, and the human watches it come in on their Demos grid (`<base>/demos`). Never send them to a preview page to approve it.
 
-## Phase 0: Auth gate, ALWAYS FIRST — with the human's word
+## Phase 0: Auth gate, ALWAYS FIRST — announced, never silent
 
 This skill does not start unauthenticated — exactly like a CLI that requires
 /login. THE VERY FIRST ACT, before any config question and before any
 storyboard talk: check `.recorder/config.json` for `api_key`.
 
-**The choreography when the key is missing (founder law, 2026-08-09 — never
-surprise the human with a browser page):**
+**The choreography when the key is missing (founder law 2026-08-09, refined
+2026-10-14 — never a browser page the human was not told about the line
+before; and no second question when they already asked for a demo):**
 
-1. TELL, don't act: "Before we record, connect this project to your
-   DemoBites account: say Go and I'll open the approval link." Then WAIT.
-   Nothing opens until the human gives the word. Keep the brief the human
-   gave: once connected, go straight on with it, never ask for it again.
-2. On their word, run `node scripts/login.mjs`. It prints the link and code,
-   opens the approval page, and polls. The human approves in their own
+1. Say: "Opening the approval link in your browser in 3 seconds, to connect
+   this project to your DemoBites account." Keep the brief the human gave: once
+   connected, go straight on with it, never ask for it again.
+2. Then, at once, run `node scripts/login.mjs`. It prints the link and code,
+   opens the approval page, and polls.
+      **The page opens in the person's OWN browser, by the command itself — never through you.** Never open the link with a browser tool, a Playwright or browser MCP, a `navigate` call or any automation: the sign-in page runs a bot check (Cloudflare Turnstile) that fails in an automated browser, and the person cannot sign in there (founder's test, 2026-10-14). If the browser did not open, give the person the address and the code from the terminal to open themselves, and keep waiting. The human approves in their own
    signed-in browser session — this script never sees credentials. The key
    lands in config (chmod 600).
 3. If their DemoBites session is signed out, the browser shows the normal

package/skill/scripts/login.mjs

@@ -101,8 +101,17 @@ console.log(`  Open:  ${verifyUrl}`);
 console.log(`  Code:  ${user_code}`);
 console.log("");
 console.log("Approve the link in your browser. If a sign-in page appears first,");
-console.log("sign in — the approval page follows with the same code. Waiting...");
+console.log("sign in — the approval page follows with the same code.");
+// A real pause before the page appears (founder 2026-10-14: "we'll open a
+// browser now to connect, in 3 seconds"): the human is told, then has three
+// counted seconds, then the page opens. Never silent, never a question.
+process.stdout.write("Opening the approval page in your browser in 3");
+for (const n of [2, 1]) { await new Promise((r) => setTimeout(r, 1000)); process.stdout.write(`… ${n}`); }
+await new Promise((r) => setTimeout(r, 1000));
+console.log("… now. Waiting for the approval...");
 if (process.platform === "darwin") spawnSync("open", [verifyUrl], { stdio: "ignore" });
+else if (process.platform === "win32") spawnSync("cmd", ["/c", "start", "", verifyUrl], { stdio: "ignore" });
+else spawnSync("xdg-open", [verifyUrl], { stdio: "ignore" });
 
 const deadline = Date.now() + (expires_in ?? 900) * 1000;
 const waitMs = Math.max(2, interval ?? 5) * 1000;