contract-cli Auth

This skill guides you on how to use the login and identity switching capabilities of

contract-cli

in this repository, while maintaining consistency with the current implementation.

Scope of Application

Initialize local
```
profile
```
for the first time
Log in as
```
user
```
using OAuth authorization code + PKCE
Enter
```
app_id/app_secret
```
as
```
bot
```
identity
View or clean up local identity status
Switch default business identity
Troubleshoot local persistence issues of
```
config.json
```
and
```
secrets.json
```

Implementation Sources

internal/cli/app.go
internal/cli/auth_provider.go\信息设备hes intrinsically输水 received_for铁片〞+更快_(方)](#)
internal/config/store.go
internal/config/secrets.go

Configuration Initialization

Before first use, you must execute:

bash

contract-cli config add --env dev

The current implementation only has the

dev

environment built-in, with the default profile named

contract-group

. This command will:

Discover well-known metadata
Save MCP server / resource / OAuth server configurations
Initialize
```
default_identity
```
to
```
user
```

Identity Model

Two identities are maintained under the same profile:

Identity	Command	Local Storage	Current Implementation
`user`	`contract-cli auth login --as user`	`profiles.<name>.identities.user.token`	OAuth login implemented
`bot`	`contract-cli auth login --as bot`	`profiles.<name>.identities.bot` + `secrets.json`	Credential entry and `tenant_access_token` exchange implemented

There is also an additional default identity pointer:

```
profiles.<name>.default_identity
```
Modified by
```
contract-cli auth use --as user|bot
```
Automatically switches to the corresponding identity after successful
```
auth login --as ...
```

Quick Workflow

user

bash

contract-cli config add --env dev
contract-cli auth login --as user
contract-cli auth status --as user

Behavior Constraints:

```
user
```
login automatically registers
```
client_id
```
Uses authorization code mode + PKCE
Starts a local callback service, with the callback URL from
```
redirect_url
```
in the profile
Automatically opens the browser by default; use
```
--no-open-browser
```
to only print the link
Writes to
```
identities.user.token
```
after successful login

bot

bash

contract-cli auth login --as bot --app-id "<app_id>" --app-secret "<app_secret>"
contract-cli auth status --as bot

Credentials can also be provided via environment variables:

bash

export CONTRACT_CLI_BOT_APP_ID="<app_id>"
export CONTRACT_CLI_BOT_APP_SECRET="<app_secret>"
contract-cli auth login --as bot

The runtime is also compatible with legacy variables

DEMOCLI_BOT_APP_ID

DEMOCLI_BOT_APP_SECRET

, but new configurations will uniformly use

CONTRACT_CLI_*

going forward.

Credential priority is fixed as:

Command-line arguments
Environment variables
Locally saved credentials

Behavior Constraints:

```
bot
```
login first saves
```
app_id/app_secret
```
, then calls
```
tenant_access_token/internal
```
to exchange for token
```
app_secret
```
is not written to
```
config.json
```
Writes to
```
identities.bot.token
```
after successful token exchange
If token exchange fails, the new credentials are retained, but the default identity will not be switched to
```
bot
```
Switches
```
default_identity=bot
```
after successful login

Status, Logout and Switching

View Status

bash

contract-cli auth status --as user
contract-cli auth status --as bot

Rules:

When
```
--as
```
is not passed,
```
auth status
```
defaults to viewing
```
user
```
```
user
```
shows
```
authorized
```
or
```
unauthorized
```

bot

shows

authorized

expired

configured

unconfigured

bot

status displays

Token Endpoint

Token Protocol: tenant_access_token/internal

and expiration time (if available)

Logout

bash

contract-cli auth logout --as user
contract-cli auth logout --as bot

Rules:

```
logout --as user
```
only clears
```
user.token
```

logout --as贴近_ya 弹 counts \  #... MoreAGMs regardlessCalculate

only clears

bot.token

, retaining

app_id/app_secret

and corresponding secret

When
```
--as
```
is not passed,
```
auth logout
```
defaults to handling
```
user
```

Switch Default Identity

bash

contract-cli auth use --as user
contract-cli auth use --as bot

Rules:

This command only modifies
```
default_identity
```
Does not re-login
Does not verify that the target identity has obtained a token

Local Files

Default paths are as follows; if

CONTRACT_CLI_CONFIG_DIR

is set, it will be changed to that directory:

```
~/.contract-cli/config.json
```
```
~/.contract-cli/secrets.json
```

The runtime is also compatible with the legacy

DEMOCLI_CONFIG_DIR

and historical default directory

~/.democli

for smooth reading of existing local login states.

Storage Constraints:

```
config.json
```
saves profile, identity metadata and tokens
```
secrets.json
```
only saves
```
app_secret
```
of bot
```
user.token
```
and
```
bot.token
```
are stored separately and not shared
Legacy flat OAuth fields are automatically migrated to
```
identities.user
```

Security Rules

Prohibit plaintext output of
```
app_secret
```
,
```
access_token
```
,
```
refresh_token
```
in terminals or documents
Do not describe bot logout as "deleting credentials"; the current implementation only clears tokens, not
```
app_id/app_secret
```
Do not let users mistakenly think that
```
default_identity
```
affects the default target of
```
auth status
```
or
```
auth logout
```
; these commands still default to
```
user
```
when
```
--as
```
is not passed
When writing or cleaning up local credentials, first confirm that the operation is performed on the current profile

Troubleshooting

user identity is not configured

: Execute

contract-cli config add --env dev

first

Browser does not open automatically: Use
```
--no-open-browser
```
instead and manually access the printed authorization link
Callback timeout: Check if the port corresponding to
```
redirect_url
```
can be listened to; increase
```
--timeout
```
if necessary

Incomplete bot credentials: Fill in

--app-id/--app-secret

or set

CONTRACT_CLI_BOT_APP_ID/CONTRACT_CLI_BOT_APP_SECRET

Bot login prompts missing

bot_token_endpoint

: Indicates the profile is outdated; re-run

contract-cli config add --env dev --name <profile>

Bot status shows
```
expired
```
: Re-execute
```
contract-cli auth login --as bot
```
",

auth

NPX Install

Tags

SKILL.md Content (Chinese)

contract-cli Auth

Scope of Application

Implementation Sources

Configuration Initialization

Identity Model

Quick Workflow

`user`
Login

`bot`
Login

Status, Logout and Switching

View Status

Logout

Switch Default Identity

Local Files

Security Rules

Troubleshooting

auth

NPX Install

Tags

SKILL.md Content (Chinese)

contract-cli Auth

Scope of Application

Implementation Sources

Configuration Initialization

Identity Model

Quick Workflow

user Login

bot Login

Status, Logout and Switching

View Status

Logout

Switch Default Identity

Local Files

Security Rules

Troubleshooting

`user`
Login

`bot`
Login