requestshield 0.1.2 → 0.1.3

package/README.md

@@ -1,233 +1,127 @@
 # RequestShield CLI
 
-Customer-facing command-line tool for RequestShield. The CLI lets a customer
-sign in, rotate application credentials, install the RequestShield Skill for
-Codex, and check for a newer npm release.
-
-Current package version: `0.1.2`.
+Customer-facing CLI for signing in, rotating RequestShield application keys,
+and installing the RequestShield skill for Codex or Claude.
 
 ## Requirements
 
-- Node.js 22.13 or newer when running from source, npm, or npx.
-- pnpm for local development and release builds.
-- A RequestShield customer management API.
-- Windows x64 and Inno Setup 6 when building the Windows installer.
-
-The management API defaults to `https://api.intellifend.ai`. During local
-development, set `REQUESTSHIELD_API_URL` to another API origin when needed.
-
-## Implemented commands
-
-```console
-requestshield signin
-requestshield keys create [--yes]
-requestshield agent setup --agent codex [--force]
-requestshield update check
-requestshield --help
-requestshield --version
-```
+- Node.js 22.13 or newer.
+- A customer management API implementing the contract below.
 
-The full command catalog shown by `requestshield --help` includes planned
-commands. Only the commands listed above are currently implemented.
+The API defaults to `https://api.intellifend.ai`. For development, set
+`REQUESTSHIELD_API_URL` to the management API origin.
 
-### Sign in
+## Commands
 
 ```console
 requestshield signin
-```
-
-Starts the device authorization flow. The CLI prints the verification URL and
-user code but does not open a browser automatically. After authorization, the
-session is saved in the current user's application-data directory.
-
-For CI or automation, `REQUESTSHIELD_ACCESS_TOKEN` may provide the access token.
-An environment token is never persisted by the CLI.
-
-### Create new keys
-
-```console
 requestshield keys create
+requestshield agent setup
+requestshield agent setup --codex
+requestshield agent setup --claude
 ```
 
-Asks the customer to type `ROTATE`, then atomically deactivates the previous
-credentials and creates a new `appKey` and `apiSecret`.
-
-- `appKey` identifies the application and may be used by the client integration.
-- `apiSecret` is a backend-only secret, is displayed once, and is not saved by
-  the CLI.
-- `--yes` skips the interactive confirmation and is intended for automation.
-
-Store the Secret Key in a backend secret manager immediately after creation.
+`signin` starts a device authorization flow and prints the verification URL and
+code for the customer to open manually. The returned session is stored under the user's standard
+application-data directory with permissions restricted to that user. CI may
+instead provide `REQUESTSHIELD_ACCESS_TOKEN`; environment tokens are never
+persisted.
 
-### Install the Codex Skill
+`keys create` asks for confirmation, then atomically deactivates the previous
+application credentials and creates a new `appKey` + `apiSecret`. The public
+app key and the backend-only secret are printed after success. The secret is
+not stored by the CLI and cannot be retrieved again.
 
-```console
-requestshield agent setup --agent codex
-```
-
-Installs the bundled RequestShield Skill into
-`$CODEX_HOME/skills/requestshield`, or `~/.codex/skills/requestshield` when
-`CODEX_HOME` is not set. Restart Codex or start a new task after installation.
+`agent setup` detects Codex or Claude and installs the bundled `requestshield`
+skill into `~/.agents/skills` for Codex or `~/.claude/skills` for Claude. Use
+`--codex` or `--claude` to select one directly. When both agents are detected,
+an interactive terminal asks which one to use; non-interactive callers must
+provide one of the flags. Existing content is preserved unless `--force` is
+supplied.
 
-If that Skill already exists, the command preserves it. Use `--force` to
-replace the existing copy:
+## Management API contract
 
-```console
-requestshield agent setup --agent codex --force
-```
+### Start sign-in
 
-### Check for updates
+`POST /v1/cli/signin`
 
-```console
-requestshield update check
+```json
+{
+  "client": "requestshield-cli"
+}
 ```
 
-Reads the latest `requestshield` version from the npm registry. If a newer
-version exists, the CLI displays the current and latest versions, asks the user
-to confirm with `y`, then runs:
+The response contains `deviceCode`, `userCode`, `verificationUri`,
+`expiresIn`, and `interval`.
 
-```console
-npm install --global requestshield@<latest-version>
-```
+### Poll sign-in
 
-This updater is for npm global installations and requires `node` and `npm` on
-the customer's machine. It does not replace an executable installed by the
-Windows Inno Setup installer.
+`POST /v1/cli/signin/token` with `{ "deviceCode": "..." }`.
 
-## Install and run with npm
+Pending responses use HTTP 400 with `code` set to `authorization_pending` or
+`slow_down`. A successful response contains `accessToken` and optional account
+metadata.
 
-Install globally so `requestshield` is available from any directory:
+### Rotate keys
 
-```console
-npm install --global requestshield
-requestshield --help
-```
+`POST /v1/cli/keys/rotate` with Bearer authentication and an empty JSON body.
+The response contains `appKey` and one-time `apiSecret`.
 
-Run without a global installation:
+## Development
 
 ```console
-npx --yes requestshield@0.1.2 --help
-npx --yes requestshield@0.1.2 signin
+pnpm --filter requestshield lint
+pnpm --filter requestshield typecheck
+pnpm --filter requestshield test
+pnpm --filter requestshield build
 ```
+## Quick start
 
-## Local development
+RequestShield requires Node.js 22.13 or newer.
 
-From the `requestshield-cli` directory:
+Run without installing globally:
 
 ```console
-pnpm install
-pnpm lint
-pnpm typecheck
-pnpm test
-pnpm build
-node src/main.mjs --help
-node src/main.mjs --version
+npx requestshield --help
+npx requestshield signin
+npx requestshield keys create
+npx requestshield agent setup
+npx requestshield agent setup --codex
+npx requestshield agent setup --claude
 ```
 
-`build` currently validates the syntax of all `.mjs` files. It does not create
-the standalone Windows executable.
+Pin a specific version for reproducible usage:
 
-To test the update interaction without publishing or installing anything:
-
-```powershell
-$env:REQUESTSHIELD_MOCK_LATEST_VERSION = "0.1.3"
-pnpm test:update-check:manual
-Remove-Item Env:REQUESTSHIELD_MOCK_LATEST_VERSION
-```
-
-The manual test prints `[MOCK] Would install ...`; it intentionally does not
-change the installed CLI version.
-
-## Build the standalone Windows executable
-
-The project uses Node.js Single Executable Applications (SEA). Run these steps
-from the `requestshield-cli` directory in PowerShell:
-
-```powershell
-New-Item -ItemType Directory -Force -Path .\dist | Out-Null
-pnpm exec esbuild .\src\main.mjs --bundle --platform=node --format=cjs --target=node22 --outfile=.\dist\requestshield.cjs
-node --experimental-sea-config .\sea-config.json
-Copy-Item (Get-Command node.exe).Source .\dist\requestshield.exe -Force
-pnpm exec postject .\dist\requestshield.exe NODE_SEA_BLOB .\dist\requestshield.blob --sentinel-fuse NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2
-.\dist\requestshield.exe --help
+```console
+npx requestshield@0.1.0 --help
 ```
 
-The generated file is `dist\requestshield.exe`. It contains Node.js and does
-not require Node.js to be installed on the customer's machine.
-
-## Build the Windows installer
+## Packaging the bundled skill
 
-Install Inno Setup 6, then compile the installer and pass the current package
-version explicitly:
-
-```powershell
-New-Item -ItemType Directory -Force -Path .\release | Out-Null
-& "$env:LOCALAPPDATA\Programs\Inno Setup 6\ISCC.exe" "/DAppVersion=0.1.2" "/FRequestShieldSetup-0.1.2-windows-x64" ".\installer\requestshield.iss"
-```
+The canonical RequestShield skill lives at `../skills/requestshield`, outside
+this npm package directory. The `prepack` hook temporarily copies the complete
+skill into `skills/requestshield`, and `postpack` removes that generated copy
+after npm creates the tarball. Do not edit the generated copy.
 
-The installer is written to `release\RequestShieldSetup-0.1.2-windows-x64.exe`.
-It installs `requestshield.exe` under the current user's local application-data
-directory and adds that directory to the user `PATH`. The customer must open a
-new terminal before running:
+Build and inspect a local package from this directory:
 
 ```console
-requestshield --help
+npm test
+npm run typecheck
+npm run lint
+npm pack --dry-run
 ```
 
-## Publish to npm
-
-Before publishing, update `version` in `package.json`, run the checks, and
-inspect the package contents:
+To exercise the package entry point and bundled skill, create a tarball and run
+the command through that tarball:
 
 ```console
-pnpm lint
-pnpm typecheck
-pnpm test
-pnpm pack --dry-run
-pnpm publish --access public --no-git-checks
+npm pack
+npx --yes --package=./requestshield-0.1.0.tgz requestshield agent setup --codex
 ```
 
-npm may ask for a one-time password in the interactive terminal. After
-publishing, verify the registry state:
+To automatically accept npm's installation prompt:
 
 ```console
-npm view requestshield version
-npm dist-tag ls requestshield
-npx --yes requestshield@0.1.2 --version
-```
-
-## Management API contract
-
-### Start sign-in
-
-`POST /v1/cli/signin`
-
-```json
-{
-  "client": "requestshield-cli"
-}
+npx --yes requestshield@0.1.0 --help
 ```
-
-The response contains `deviceCode`, `userCode`, `verificationUri`, `expiresIn`,
-and `interval`.
-
-### Poll sign-in
-
-`POST /v1/cli/signin/token` with `{ "deviceCode": "..." }`.
-
-Pending responses use HTTP 400 with `code` set to `authorization_pending` or
-`slow_down`. A successful response contains `accessToken` and optional account
-metadata.
-
-### Rotate keys
-
-`POST /v1/cli/keys/rotate` with Bearer authentication and an empty JSON body.
-The response contains `appKey` and the one-time `apiSecret`.
-
-## Security notes
-
-- Never place an access token or Secret Key in URLs, command arguments, logs,
-  fixtures, or committed files.
-- The CLI does not persist the Secret Key returned by `keys create`.
-- Sign the Windows executable and installer before distributing them to
-  customers, and publish a checksum through a trusted release channel.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "requestshield",
-  "version": "0.1.2",
-  "description": "Customer CLI for RequestShield.",
+  "version": "0.1.3",
+  "description": "Customer CLI for IntelliFend RequestShield.",
   "type": "module",
   "bin": {
     "requestshield": "src/main.mjs"
@@ -14,18 +14,20 @@
   "engines": {
     "node": ">=22.13"
   },
+  "scripts": {
+    "build": "node scripts/check-package.mjs",
+    "lint": "node scripts/check-package.mjs",
+    "test": "node --test",
+    "typecheck": "tsc -p jsconfig.json --noEmit",
+    "prepack": "node scripts/package-skill.mjs stage",
+    "postpack": "node scripts/package-skill.mjs clean",
+    "prepublishOnly": "npm run lint && npm run typecheck && npm test"
+  },
   "devDependencies": {
     "@types/node": "26.1.1",
     "esbuild": "^0.28.1",
     "postject": "1.0.0-alpha.6",
     "typescript": "^6.0.3"
   },
-  "license": "UNLICENSED",
-  "scripts": {
-    "build": "node scripts/check-package.mjs",
-    "lint": "node scripts/check-package.mjs",
-    "test": "node --test",
-    "test:update-check:manual": "node scripts/manual-update-check.mjs",
-    "typecheck": "tsc -p jsconfig.json --noEmit"
-  }
-}
+  "license": "UNLICENSED"
+}