ISS-8131: Fold device-flow auth into the pixee-auth skill - #91
Open
dunningdan wants to merge 3 commits into
Open
ISS-8131: Fold device-flow auth into the pixee-auth skill#91dunningdan wants to merge 3 commits into
dunningdan wants to merge 3 commits into
Conversation
Adds a coding-agent skill covering `pixee o11y login/token/status/logout` — the device-flow authentication to a Pixee deployment's observability stack and the per-user bearer tokens used to query VictoriaMetrics/Logs/Traces over HTTP. Distinct from `pixee-auth` (the REST API token). Also lists it in the README. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016Y4oU4W5LfteyHBVQZLGM5
dunningdan
marked this pull request as ready for review
July 21, 2026 15:21
The CLI collapsed `pixee o11y *` into `pixee auth *` (pixee-cli-private#37) because the device-flow token is not observability-only — the same credential authorizes the platform REST API. This repo had the same duplication one layer up: a `pixee-o11y` skill alongside the existing `pixee-auth` skill, for what is now a single command group. Gilday suggested renaming `skills/pixee-o11y` -> `skills/pixee-auth`, but that directory already exists and documents the API-key credential. Renaming would have collided; merging is the coherent version of the same instruction. - Fold the device-flow content into `skills/pixee-auth/SKILL.md`: a table contrasting the two credentials (per-user OAuth vs the deployment's shared API key) and when to reach for each, the four subcommands, and the fact that the device flow needs no browser on the CLI's own host — so it works over SSH. - Delete `skills/pixee-o11y/`. - Drop the claim that the two credentials "do not interchange". Since the Authentik provider was generalized (pixee-enterprise-server#3940) the device-flow token is accepted by the REST API too, so that framing is stale. - Correct the credential-resolution list: it omitted the global `--token` flag, which does override PIXEE_TOKEN and stored config for every subcommand (see src/index.ts in pixee-cli-private) — the skill claimed it applied only to `auth login`. - Bump the skill to 1.1.0 and rewrite the README entry. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BH3r86Ky1Z8gBVAR3yEsw4
nahsra
approved these changes
Jul 27, 2026
dunningdan
changed the title
The CLI unified the auth group on `--server` (pixee-cli-private#37): `auth` was the only command group where a positional argument named a deployment rather than the object of the verb. Update every example, and correct the credential-resolution section, which described the positional as overriding everything else. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BH3r86Ky1Z8gBVAR3yEsw4
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
/towards ISS-8131
Documents the CLI's new per-user device-flow authentication for coding agents, by folding it into the existing
pixee-authskill rather than shipping a second auth skill.Why a merge and not a new skill
This PR originally added
skills/pixee-o11y, on the framing that observability auth was a separate credential frompixee auth. Two things changed that:pixee o11y *intopixee auth *(pixee/pixee-cli-private#37) — one credential, two surfaces.skills/pixee-o11y→skills/pixee-auth. That directory already exists and documents the API-key credential, so a literal rename would have collided. Merging is the coherent version of the same instruction.What the merged skill covers
login(both paths),token,status,logout./o11y/logs/metrics/traces endpoints.skills/pixee-o11y/is deleted and the README entry rewritten; the skill is bumped to1.1.0.Two corrections to pre-existing content
Both were already wrong in
pixee-auth/SKILL.mdbefore this PR:--tokenflag, asserting it applied only toauth login.src/index.tsdeclares--tokenglobally and it overridesPIXEE_TOKENand stored config for every subcommand.Not corrected — needs a second pair of eyes
The skill tells users to get the API key from "the admin console's API Tokens page." The PES docs (
api-access.md) andkots/config.yamlboth describe it as a single global system key under the KOTS admin console's Config → Basic Settings ("Enable Pixee API key"). "API Tokens page" looks wrong, but I could not rule out a separate User Platform surface, so I left the wording alone rather than guess in a public skill.Dependency
Merge alongside the CLI release that ships
pixee auth login | token | status | logout.🤖 Generated with Claude Code
https://claude.ai/code/session_01BH3r86Ky1Z8gBVAR3yEsw4