shadok-ai 0.9.10 → 0.9.11

package/context/agents-skill/SKILL.md

@@ -135,3 +135,19 @@ The server kills the claude process when its last WS client detaches; so
 `hold` command), restarted as needed by every command. Local state:
 `~/.shadok-ai/pilotctl/<id>.json` (cwd, branch, baseSha, holderPid). Log of the
 auto-started server: `~/.shadok-ai/pilotctl/server.log`.
+
+## Authenticating a direct API call
+
+The commands above do this for you. If you call the cockpit's API yourself, send
+your session key — it is in your environment and it does not expire:
+
+```bash
+curl -sS -H "x-shadok-session-key: $SHADOK_SESSION_KEY" \
+  "http://127.0.0.1:$SHADOK_PORT/channels"
+```
+
+`$SHADOK_AUTH` (a cookie) is still accepted, but it was frozen into your
+environment at spawn and expires after a week, so never rely on it alone. A
+`401` means that header is missing — or that you were started before this
+existed, in which case nothing you hold can authenticate any more and only a
+human can fix it: ask them for *Reload agent* on your ⋯ menu.

package/context/pilot-prompt.md

@@ -38,6 +38,10 @@ Claude Code sessions in parallel. A human pilots you from a browser chat
   sessions named `sk-*`). Never kill them, and never restart the shadok-ai
   server (port 3789) — that would kill sibling sessions mid-work. Avoid
   grabbing shared ports or mutating machine-global state.
+- The cockpit exposes a local API at `http://127.0.0.1:$SHADOK_PORT`. If you
+  call it yourself, authenticate with `-H "x-shadok-session-key:
+  $SHADOK_SESSION_KEY"` — a `401` means that header is missing. (The shadok
+  skills already do this for you.)
 
 ## Language — two different rules, don't mix them up
 - **Anything you write into a repo is in English**: code comments, identifiers,

package/context/reload-skill/SKILL.md

@@ -17,3 +17,19 @@ Only your own session can be reloaded this way: it is scoped by the per-session
 key in your environment (`SHADOK_SESSION_KEY`), not by the public session id.
 Your current turn ends as the process is replaced; you come back with your
 history intact and the new prompt/skills active.
+
+## Authenticating a direct API call
+
+The commands above do this for you. If you call the cockpit's API yourself, send
+your session key — it is in your environment and it does not expire:
+
+```bash
+curl -sS -H "x-shadok-session-key: $SHADOK_SESSION_KEY" \
+  "http://127.0.0.1:$SHADOK_PORT/channels"
+```
+
+`$SHADOK_AUTH` (a cookie) is still accepted, but it was frozen into your
+environment at spawn and expires after a week, so never rely on it alone. A
+`401` means that header is missing — or that you were started before this
+existed, in which case nothing you hold can authenticate any more and only a
+human can fix it: ask them for *Reload agent* on your ⋯ menu.

package/context/scheduler-skill/SKILL.md

@@ -126,3 +126,19 @@ node scripts/schedule.mjs add --schedule daily:18:00 \
 
 After creating a schedule, confirm to the user in plain language: what it watches,
 when it runs, and that quiet runs won't cost tokens (if a check was set).
+
+## Authenticating a direct API call
+
+The commands above do this for you. If you call the cockpit's API yourself, send
+your session key — it is in your environment and it does not expire:
+
+```bash
+curl -sS -H "x-shadok-session-key: $SHADOK_SESSION_KEY" \
+  "http://127.0.0.1:$SHADOK_PORT/channels"
+```
+
+`$SHADOK_AUTH` (a cookie) is still accepted, but it was frozen into your
+environment at spawn and expires after a week, so never rely on it alone. A
+`401` means that header is missing — or that you were started before this
+existed, in which case nothing you hold can authenticate any more and only a
+human can fix it: ask them for *Reload agent* on your ⋯ menu.

package/context/secrets-skill/SKILL.md

@@ -45,3 +45,19 @@ A secret the **user typed in the chat** is already exposed — it is in the
 transcript, and in Telegram's history. Storing it does not un-expose it. Point
 them at the web Secrets panel, or Telegram's `/secret NAME value`, which deletes
 their message afterwards.
+
+## Authenticating a direct API call
+
+The commands above do this for you. If you call the cockpit's API yourself, send
+your session key — it is in your environment and it does not expire:
+
+```bash
+curl -sS -H "x-shadok-session-key: $SHADOK_SESSION_KEY" \
+  "http://127.0.0.1:$SHADOK_PORT/channels"
+```
+
+`$SHADOK_AUTH` (a cookie) is still accepted, but it was frozen into your
+environment at spawn and expires after a week, so never rely on it alone. A
+`401` means that header is missing — or that you were started before this
+existed, in which case nothing you hold can authenticate any more and only a
+human can fix it: ask them for *Reload agent* on your ⋯ menu.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shadok-ai",
-  "version": "0.9.10",
+  "version": "0.9.11",
   "main": "dist/session.js",
   "scripts": {
     "test": "node --import tsx --test test/*.ts context/*/test/*.test.mjs",