interactive-login

# Interactive login Nothing captures logins for you. Every login runs in a fresh temporary home and is saved to the keychain with the script shipped with this skill. Never log in against the real `$HOME`, and never treat a token or config already in `$HOME` as a usable login: only a keychain handle is. Use the same explicit `sandbox_id` for the skill read, login, and save-login commands so the temporary home and save script stay on one computer. 1. Make a fresh directory and start the login with `execute(background:true)` with every config location pointed into it. Copy in any config the CLI needs first (for AWS, the `[profile …]`/`[sso-session …]` blocks in `.aws/config`); everything under that directory becomes the saved login. ```bash d=$(mktemp -d) && echo "$d" in_d() { env HOME="$d" XDG_CONFIG_HOME="$d/.config" XDG_DATA_HOME="$d/.local/share" XDG_STATE_HOME="$d/.local/state" XDG_CACHE_HOME="$d/.cache" "$@"; } in_d aws sso login --profile work --use-device-code --no-browser in_d gh auth login --hostname github.com --git-protocol https --web in_d glab auth login --hostname gitlab.com --web in_d gcloud auth login --no-launch-browser ``` Use the CLI's device-code mode (AWS needs `--use-device-code`); a browser flow only completes on the same machine. 2. Relay the verification URL and code from the job output. Answer any prompt with `background` action `send_input`. Use its `watch` or `poll` action with the returned `process_id`; never stop the job while the person is approving. 3. When it exits successfully, save the directory with the script under the absolute directory the skill read reported: ```bash node <skill dir>/scripts/save-login.mjs aws "$d" --label "work (123456789012)" ``` The script uploads only the files under that directory, removes the directory, and prints the credential handle. It also removes a directory that holds no usable login. Never remove the directory yourself; if the save fails, run the script again. Saving the same service again replaces that entry in place: its id, handle, owner and grants stay the same. 4. Use the login only by naming the handle in `credentials` on `execute` (including `background:true`), including to check that it works. The files are staged in a private home for that command or job, and refreshes the CLI writes are saved back when it ends. Never print token files or paste their contents into the conversation. If the login fails or expires, start again from step 1 with a new directory.