at-zentao

ZenTao Bug/Task Workflow

Secure CLI boundary

This Skill bundles scripts/zentao-cli.mjs. Resolve the Skill root as the directory containing this SKILL.md, then run the script with Node using its resolved path from any working directory:

node <skill-root>/scripts/zentao-cli.mjs <command>

The script is the only component allowed to read ZenTao configuration, exchange credentials for a token, send authenticated requests, or inspect raw error responses. Run it directly without reading or copying its source into the conversation. Never read ~/.agent-tools/config.jsonc, print ZenTao env vars, call the token endpoint, or construct a ZenTao Token header yourself.

The CLI emits only sanitized JSON. Treat a nonzero exit as a stopped ZenTao operation and report its safe error, message, and optional HTTP status. Do not work around the CLI with curl when authentication or an endpoint fails.

Configuration

The CLI reads the global ~/.agent-tools/config.jsonc, or $AGENT_TOOLS_HOME/config.jsonc when AGENT_TOOLS_HOME is set. It never reads repository-level configuration. Basic configuration:

{
  "zentao": {
    "url": "https://zentao.example.com",
    "account": "user",
    "password": "your-password"
  }
}

To avoid storing the password in the file, use "password": { "env": "ZENTAO_PASSWORD" } and set that environment variable. Direct env overrides are ZENTAO_URL, ZENTAO_ACCOUNT, and ZENTAO_PASSWORD. ZENTAO_TOKEN may be used instead of password exchange; it is accepted only from the environment.

When configuration is missing, tell the user which file to edit and show the template above. Never ask them to paste a password or token into chat, and do not edit or inspect the file after they add credentials. Ask them to say "done", then validate with:

node <skill-root>/scripts/zentao-cli.mjs doctor

Report only whether the connection succeeded and whether authentication used token or account-password.