requestshield 0.1.2 → 0.1.4

package/README.md

@@ -1,35 +1,33 @@
 # RequestShield CLI
 
-Customer-facing command-line tool for RequestShield. The CLI lets a customer
-sign in, rotate application credentials, install the RequestShield Skill for
-Codex, and check for a newer npm release.
+Customer-facing CLI for IntelliFend RequestShield. It allows customers to sign
+in, rotate application credentials, install the RequestShield Skill for Codex
+or Claude, and update an npm-installed CLI.
 
-Current package version: `0.1.2`.
+Current package version: `0.1.4`.
 
 ## Requirements
 
-- Node.js 22.13 or newer when running from source, npm, or npx.
-- pnpm for local development and release builds.
+- Node.js 22.13 or newer.
 - A RequestShield customer management API.
-- Windows x64 and Inno Setup 6 when building the Windows installer.
+- npm for local development and publishing.
 
-The management API defaults to `https://api.intellifend.ai`. During local
-development, set `REQUESTSHIELD_API_URL` to another API origin when needed.
+The management API defaults to `https://api.intellifend.ai`. Set
+`REQUESTSHIELD_API_URL` to use a different management API during development.
 
 ## Implemented commands
 
 ```console
 requestshield signin
 requestshield keys create [--yes]
-requestshield agent setup --agent codex [--force]
+requestshield agent setup [--force]
+requestshield agent setup --codex [--force]
+requestshield agent setup --claude [--force]
 requestshield update check
 requestshield --help
 requestshield --version
 ```
 
-The full command catalog shown by `requestshield --help` includes planned
-commands. Only the commands listed above are currently implemented.
-
 ### Sign in
 
 ```console
@@ -37,11 +35,11 @@ requestshield signin
 ```
 
 Starts the device authorization flow. The CLI prints the verification URL and
-user code but does not open a browser automatically. After authorization, the
-session is saved in the current user's application-data directory.
+user code without opening the browser automatically. After authorization, the
+session is stored for the current operating-system user.
 
-For CI or automation, `REQUESTSHIELD_ACCESS_TOKEN` may provide the access token.
-An environment token is never persisted by the CLI.
+For CI or automation, provide `REQUESTSHIELD_ACCESS_TOKEN`. A token supplied by
+the environment is used directly and is not persisted by the CLI.
 
 ### Create new keys
 
@@ -49,151 +47,168 @@ An environment token is never persisted by the CLI.
 requestshield keys create
 ```
 
-Asks the customer to type `ROTATE`, then atomically deactivates the previous
-credentials and creates a new `appKey` and `apiSecret`.
+Asks the customer to type `ROTATE`, then calls the management API to deactivate
+the previous credentials and create a new `appKey` and `apiSecret`.
 
-- `appKey` identifies the application and may be used by the client integration.
-- `apiSecret` is a backend-only secret, is displayed once, and is not saved by
-  the CLI.
-- `--yes` skips the interactive confirmation and is intended for automation.
+- `appKey` is the public application identifier.
+- `apiSecret` is a backend-only secret displayed once.
+- The CLI does not save the returned `apiSecret`.
+- `--yes` skips the confirmation prompt for non-interactive automation.
 
 Store the Secret Key in a backend secret manager immediately after creation.
 
-### Install the Codex Skill
+### Install the Agent Skill
+
+Let the CLI detect the installed coding agent:
 
 ```console
-requestshield agent setup --agent codex
+requestshield agent setup
 ```
 
-Installs the bundled RequestShield Skill into
-`$CODEX_HOME/skills/requestshield`, or `~/.codex/skills/requestshield` when
-`CODEX_HOME` is not set. Restart Codex or start a new task after installation.
+Or select an agent explicitly:
+
+```console
+requestshield agent setup --codex
+requestshield agent setup --claude
+```
+
+The CLI installs the Skill into:
+
+- Codex: `~/.agents/skills/requestshield`
+- Claude: `~/.claude/skills/requestshield`
 
-If that Skill already exists, the command preserves it. Use `--force` to
-replace the existing copy:
+If exactly one supported agent is detected, it is selected automatically. If
+both are detected in an interactive terminal, the CLI asks which one to use.
+If neither is detected, select one with `--codex` or `--claude`.
+
+Existing Skill content is preserved. Add `--force` to replace it:
 
 ```console
-requestshield agent setup --agent codex --force
+requestshield agent setup --codex --force
 ```
 
+Restart the selected agent or start a new task after installation.
+
 ### Check for updates
 
 ```console
 requestshield update check
 ```
 
-Reads the latest `requestshield` version from the npm registry. If a newer
-version exists, the CLI displays the current and latest versions, asks the user
-to confirm with `y`, then runs:
+Checks the npm registry for the latest `requestshield` version. When a newer
+version exists, the CLI displays the current and latest versions and asks:
+
+```text
+Update to RequestShield <version>? (y/N):
+```
+
+Entering `y` runs the equivalent of:
 
 ```console
 npm install --global requestshield@<latest-version>
 ```
 
-This updater is for npm global installations and requires `node` and `npm` on
-the customer's machine. It does not replace an executable installed by the
-Windows Inno Setup installer.
+This command requires an interactive terminal, Node.js, and npm. It updates a
+global npm installation; it does not replace a standalone Windows executable.
 
-## Install and run with npm
+## Install with npm
 
-Install globally so `requestshield` is available from any directory:
+Install globally:
 
 ```console
 npm install --global requestshield
 requestshield --help
+requestshield --version
 ```
 
-Run without a global installation:
+Run a specific version without installing globally:
 
 ```console
-npx --yes requestshield@0.1.2 --help
-npx --yes requestshield@0.1.2 signin
+npx --yes requestshield@0.1.4 --help
+npx --yes requestshield@0.1.4 signin
 ```
 
+To invoke the update command through npx, include the package name:
+
+```console
+npx --yes requestshield@0.1.4 update check
+```
+
+Do not run `npx update check`; npm interprets `update` as the name of a different
+npm package.
+
 ## Local development
 
 From the `requestshield-cli` directory:
 
 ```console
-pnpm install
-pnpm lint
-pnpm typecheck
-pnpm test
-pnpm build
+npm install
+npm run lint
+npm run typecheck
+npm test
+npm run build
 node src/main.mjs --help
 node src/main.mjs --version
 ```
 
-`build` currently validates the syntax of all `.mjs` files. It does not create
-the standalone Windows executable.
+The current `build` script validates the syntax of the `.mjs` source files. It
+does not generate a standalone executable.
 
-To test the update interaction without publishing or installing anything:
+### Test the update flow locally
+
+The manual update test mocks the registry and install operation, so it does not
+publish a package or change the installed version:
 
 ```powershell
-$env:REQUESTSHIELD_MOCK_LATEST_VERSION = "0.1.3"
-pnpm test:update-check:manual
+$env:REQUESTSHIELD_MOCK_LATEST_VERSION = "0.1.5"
+npm run test:update-check:manual
 Remove-Item Env:REQUESTSHIELD_MOCK_LATEST_VERSION
 ```
 
-The manual test prints `[MOCK] Would install ...`; it intentionally does not
-change the installed CLI version.
+After entering `y`, the test prints `[MOCK] Would install ...`.
 
-## Build the standalone Windows executable
+## Packaging the RequestShield Skill
 
-The project uses Node.js Single Executable Applications (SEA). Run these steps
-from the `requestshield-cli` directory in PowerShell:
+The canonical Skill is stored at `../skills/requestshield`. Do not maintain a
+second source copy inside this package.
 
-```powershell
-New-Item -ItemType Directory -Force -Path .\dist | Out-Null
-pnpm exec esbuild .\src\main.mjs --bundle --platform=node --format=cjs --target=node22 --outfile=.\dist\requestshield.cjs
-node --experimental-sea-config .\sea-config.json
-Copy-Item (Get-Command node.exe).Source .\dist\requestshield.exe -Force
-pnpm exec postject .\dist\requestshield.exe NODE_SEA_BLOB .\dist\requestshield.blob --sentinel-fuse NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2
-.\dist\requestshield.exe --help
-```
+Before npm creates the package, the `prepack` hook temporarily copies the
+canonical Skill to `skills/requestshield`. The `postpack` hook removes that
+generated copy after packaging.
 
-The generated file is `dist\requestshield.exe`. It contains Node.js and does
-not require Node.js to be installed on the customer's machine.
+Inspect the files that npm will publish:
 
-## Build the Windows installer
-
-Install Inno Setup 6, then compile the installer and pass the current package
-version explicitly:
-
-```powershell
-New-Item -ItemType Directory -Force -Path .\release | Out-Null
-& "$env:LOCALAPPDATA\Programs\Inno Setup 6\ISCC.exe" "/DAppVersion=0.1.2" "/FRequestShieldSetup-0.1.2-windows-x64" ".\installer\requestshield.iss"
+```console
+npm pack --dry-run
 ```
 
-The installer is written to `release\RequestShieldSetup-0.1.2-windows-x64.exe`.
-It installs `requestshield.exe` under the current user's local application-data
-directory and adds that directory to the user `PATH`. The customer must open a
-new terminal before running:
+Create a local tarball:
 
 ```console
-requestshield --help
+npm pack
 ```
 
 ## Publish to npm
 
-Before publishing, update `version` in `package.json`, run the checks, and
-inspect the package contents:
+npm does not allow an existing package version to be overwritten. Check the
+published version, merge the latest team changes, then choose a new version in
+`package.json` before publishing.
 
 ```console
-pnpm lint
-pnpm typecheck
-pnpm test
-pnpm pack --dry-run
-pnpm publish --access public --no-git-checks
+npm view requestshield version
+npm run lint
+npm run typecheck
+npm test
+npm pack --dry-run
+npm publish --access public
 ```
 
-npm may ask for a one-time password in the interactive terminal. After
-publishing, verify the registry state:
+Verify the published package:
 
 ```console
 npm view requestshield version
 npm dist-tag ls requestshield
-npx --yes requestshield@0.1.2 --version
+npx --yes requestshield@0.1.4 --version
 ```
 
 ## Management API contract
@@ -227,7 +242,5 @@ The response contains `appKey` and the one-time `apiSecret`.
 ## Security notes
 
 - Never place an access token or Secret Key in URLs, command arguments, logs,
-  fixtures, or committed files.
+  test fixtures, or committed files.
 - The CLI does not persist the Secret Key returned by `keys create`.
-- Sign the Windows executable and installer before distributing them to
-  customers, and publish a checksum through a trusted release channel.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "requestshield",
-  "version": "0.1.2",
-  "description": "Customer CLI for RequestShield.",
+  "version": "0.1.4",
+  "description": "Customer CLI for IntelliFend RequestShield.",
   "type": "module",
   "bin": {
     "requestshield": "src/main.mjs"