authlisted

**This skill never installs anything.** It opens a browser, receives a key, checks it against the instance, and writes it to one file. It does not install packages, start services, or touch the user's shell profile. A memory plugin that runs installers is a trust failure. ## Step 0 — resolve the binary No environment variable carries this plugin's path under Codex. Codex lists each skill with the absolute path of its `SKILL.md`; **this file** is at `<plugin-root>/skills/auth/SKILL.md`, so the binary is two directories above it: ``` <plugin-root>/bin/auth.mjs ``` Resolve that to an absolute path from this file's own location and use it in every command below. Do not write `${CLAUDE_PLUGIN_ROOT}`: Codex sets no plugin-root variable of any spelling, so the shell expands it to nothing and `node /bin/auth.mjs` fails with ENOENT — on the one skill a user reaches for when nothing else works. ## What it produces Two values, which are the whole of the plugin's setup: | Setting | Value | | --- | --- | | `endpoint` | the user's Mubit instance URL, e.g. `https://api.mubit.ai` | | `apiKey` | a key of the form `mbt_...` | They land in `<data-dir>/credentials.json`, owner-only (mode 600). That is the same directory the Claude Code plugin uses, deliberately: the two share one memory of a project, so they share one credential too. It survives plugin updates, so this is a once-per-machine step rather than a once-per-release one. **Which directory that is, is not a fixed path.** A host