feat: auth bootstrap --code for MCP→CLI local-execute handoff

[kentcdodds]

Intent

Implement kody-bot/cli#16: npx @kodycodes/cli auth bootstrap --code <kody_bc_…> so agents already on Kody MCP can seed CLI --local auth without a second OAuth or pasting kody_at_… into chat.

Platform contract: kentcdodds/kody#2818 / ADR 0056.

Summary

• Add auth bootstrap --code → POST /v1/tokens/bootstrap/redeem with JSON { "code" } and no Authorization header
• Persist the one-shot minted kody_at_… in a separate API-token store (keyring / 0600 file fallback), alongside kody login OAuth
• Success output confirms storage (token id, scopes, backend) and never prints the full kody_at_
• resolveLocalExecuteBearer priority: --token / KODY_API_TOKEN → stored bootstrap token → kody login OAuth → clear error (bootstrap → login → tokenCreate for CI)
• logout / status cover the stored API token; docs + skill updated
• No host MCP token scavenging (ADR 0053); kody login path unchanged

Testing

• npm run validate
• Unit tests: redeem (no Authorization), store, bearer priority, CLI success output redaction

How to exercise

# After MCP cliCredentialBootstrap → { bootstrap_code, cli_command }:
npx @kodycodes/cli auth bootstrap --code 'kody_bc_…'
npx @kodycodes/cli execute --local --code 'export default async () => ({ ok: true })'
npx @kodycodes/cli status   # shows stored API token id/scopes, not the secret

  

[kentcdodds]

bugbot run

[cursor]

Skipping Bugbot: Bugbot is disabled for this repository. Visit the Bugbot dashboard to update your settings.

[github-actions]

🎉 This PR is included in version 1.8.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀