Skip to content
cccskills
FreePublished on GitHub

local-bootstrap-cli-auth-debug

Diagnose and repair OpenASE CLI access in local bootstrap mode. Use when protected `openase` commands fail because the CLI is missing a local human session, has a stale `~/.openase/human-session.json`, is missing CSRF state, or needs a fresh `openase auth bootstrap login`.

The English summary is being prepared. Showing the original description.

PacificStudio/openase269 stars(GitHub 269 + cccskills 0)

Run score Not tested

See how to install

Files included (2)

  • SKILL.md3.0 KB
  • scripts/check_local_cli_auth.sh1.0 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Local Bootstrap CLI Auth Debug

Use This When

  • OpenASE is running in local bootstrap mode, not active OIDC.
  • Protected CLI commands return HUMAN_SESSION_REQUIRED, HUMAN_SESSION_INVALID, or CSRF errors.
  • You need to create, inspect, refresh, or clear the CLI human session used by typed openase commands.

Key Facts

  • CLI human session state lives at ~/.openase/human-session.json by default.
  • openase auth bootstrap login creates a fresh local bootstrap authorization, redeems it through /api/v1/auth/local-bootstrap/redeem, and stores the resulting session + CSRF for later commands.
  • Typed and raw API commands automatically reuse that stored session unless a Bearer token is provided.
  • Local bootstrap sessions are tied to the current host context; if the stored session goes stale, re-login from the same machine and shell.

Standard Flow

  1. Verify the service is healthy:
    • curl -fsS http://127.0.0.1:19836/healthz
  2. Run the non-mutating diagnostic helper:
    • .codex/skills/local-bootstrap-cli-auth-debug/scripts/check_local_cli_auth.sh
  3. If the helper reports no valid CLI human session, refresh it:
    • openase auth bootstrap login
  4. Re-check the current principal:
    • openase auth session
  5. Re-run the failing protected command.

Fast Repair Commands

openase auth bootstrap login
openase auth session
openase auth sessions list
openase auth logout
openase auth bootstrap login

Failure Patterns

  • HUMAN_SESSION_REQUIRED
    • The CLI has no usable stored local human session.
    • Fix: run openase auth bootstrap login.
  • HUMAN_SESSION_INVALID
    • The stored session file exists, but the cookie is expired, revoked, or no longer matches the current request context.
    • Fix: openase auth logout then openase auth bootstrap login.
  • CSRF_TOKEN_INVALID or CSRF_ORIGIN_FORBIDDEN
    • The CLI session is present but the request is missing valid CSRF state or origin context.
    • Fix: refresh the stored session with openase auth bootstrap login, then retry from the same machine.
  • LOCAL_BOOTSTRAP_DISABLED
    • The instance is no longer in local bootstrap mode.
    • Stop and switch to the OIDC/browser auth path instead of retrying this skill.

Useful Overrides

  • Alternate session file:
    • --session-file /tmp/openase-human-session.json
    • OPENASE_HUMAN_SESSION_FILE=/tmp/openase-human-session.json
  • Manual session injection:
    • OPENASE_HUMAN_SESSION_TOKEN=...
    • OPENASE_HUMAN_CSRF_TOKEN=...
  • Alternate API base:
    • OPENASE_API_URL=http://127.0.0.1:19836/api/v1

Files

  • Skill helper:
    • .codex/skills/local-bootstrap-cli-auth-debug/scripts/check_local_cli_auth.sh
  • Default stored state:
    • ~/.openase/human-session.json

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

auto-harness

Free

Diagnose and strengthen a repository's harness layer: AGENTS.md rules, knowledge layout, architecture boundaries, lint and type gates, API and generated-client contracts, test scaffolding, structured logging, and technical-debt tracking. Use when Codex needs to audit drift-prone semantics that are repeated across code, docs, schemas, generated artifacts, frontend/backend boundaries, or CI, then design or implement guardrails with progressive disclosure and zero-tolerance contract checks.

The English summary is being prepared. Showing the original description.

PacificStudio/openase269Updated Aug 9, 2026

commit

Free

Create a well-formed git commit from current changes using session history for rationale and summary; use when asked to commit, prepare a commit message, or finalize staged work.

The English summary is being prepared. Showing the original description.

PacificStudio/openase269Updated Aug 9, 2026

commit

Free

Write concise Conventional Commit messages that match the actual scope of the change.

The English summary is being prepared. Showing the original description.

PacificStudio/openase269Updated Aug 9, 2026

create-pr

Free

Prepare a crisp pull request summary with scope, validation, and rollout notes.

The English summary is being prepared. Showing the original description.

PacificStudio/openase269Updated Aug 9, 2026

deep-interview

Free

Clarify ambiguous requests with a focused, Socratic interview before planning or implementation.

The English summary is being prepared. Showing the original description.

PacificStudio/openase269Updated Aug 9, 2026

deploy-coolify-review-env

Free

Create or update a branch-scoped Coolify review environment with one command, and delete it with one command. Use when a ticket must deploy a preview before human review, while keeping the workflow simple and fast.

The English summary is being prepared. Showing the original description.

PacificStudio/openase269Updated Aug 9, 2026

See all skills by PacificStudio

Report a problem with this skill