agentmods.dev

local-bootstrap-cli-auth-debug

A diagnostic and repair routine for the OpenASE command-line login used in local bootstrap mode.

In plain words
What is it for?
Checking service health, inspecting local authentication state, logging in again, and verifying that the CLI can access protected OpenASE commands.
Why use it?
It addresses missing, expired, or invalid local sessions and related CSRF errors that prevent protected commands from running.

Skill for Claude CodeCodex

265 24d ago A scan 68 tokens original Apache-2.0
View the source file PacificStudio/openase
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/pacificstudio/openase/local-bootstrap-cli-auth-debug
Any agent
npx skills add PacificStudio/openase --skill local-bootstrap-cli-auth-debug
Clone the repo
git clone --depth 1 https://github.com/PacificStudio/openase

Made for: Claude Code, Codex.

Per session 68 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 768 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00068 $0.00768
Opus 5 $0.00034 $0.00384
Sonnet 5 $0.00014 $0.00154
Haiku 4.5 $0.00007 $0.00077

Measured 2d ago against content hash 33d67894afe8, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

local-bootstrap-cli-auth-debug scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/check_local_cli_auth.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- `curl -fsS http://127.0.0.1:19836/healthz`
.codex/skills/local-bootstrap-cli-auth-debug/SKILL.md · 89 lines

How it starts

The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Local Bootstrap CLI Auth Debug

Use This When

  • OpenASE is running in local bootstrap mode, not active OIDC.
  • Protected CLI commands return HUMAN_SESSION_REQUIRED, HUMAN_SESSION_INVALID, or CSRF errors.
  • You need to create, inspect, refresh, or clear the CLI human session used by typed openase commands.

Key Facts

  • CLI human session state lives at ~/.openase/human-session.json by default.
  • openase auth bootstrap login creates a fresh local bootstrap authorization, redeems it through /api/v1/auth/local-bootstrap/redeem, and stores the resulting session + CSRF for later commands.
  • Typed and raw API commands automatically reuse that stored session unless a Bearer token is provided.
  • Local bootstrap sessions are tied to the current host context; if the stored session goes stale, re-login from the same machine and shell.

Standard Flow

  1. Verify the service is healthy:
    • curl -fsS http://127.0.0.1:19836/healthz
  2. Run the non-mutating diagnostic helper:
    • .codex/skills/local-bootstrap-cli-auth-debug/scripts/check_local_cli_auth.sh
  3. If the helper reports no valid CLI human session, refresh it:
    • openase auth bootstrap login
  4. Re-check the current principal:
    • openase auth session
  5. Re-run the failing protected command.

Fast Repair Commands

openase auth bootstrap login
openase auth session
openase auth sessions list
openase auth logout
openase auth bootstrap login

Failure Patterns

  • HUMAN_SESSION_REQUIRED
    • The CLI has no usable stored local human session.
    • Fix: run openase auth bootstrap login.
  • HUMAN_SESSION_INVALID
    • The stored session file exists, but the cookie is expired, revoked, or no longer matches the current request context.
    • Fix: openase auth logout then openase auth bootstrap login.
  • CSRF_TOKEN_INVALID or CSRF_ORIGIN_FORBIDDEN
    • The CLI session is present but the request is missing valid CSRF state or origin context.
    • Fix: refresh the stored session with openase auth bootstrap login, then retry from the same machine.
  • LOCAL_BOOTSTRAP_DISABLED
    • The instance is no longer in local bootstrap mode.
    • Stop and switch to the OIDC/browser auth path instead of retrying this skill.

Read the full file on GitHub · 89 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 89 lines · 68 tokens per session scan A 33d67894afe8

Subscribe to this mod's changes

local-bootstrap-cli-auth-debug is a skill published in the GitHub repository PacificStudio/openase (265 stars, last pushed 24d ago), licensed Apache-2.0. It adds 68 tokens to every session and 768 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Debuggingagentaisoftware-engineering
Related

Other skills, from other repositories

aisee:init

初始化、审计并优化 OpenSpec/Aisee 项目配置。仅适用于已使用或准备接入 OpenSpec 的项目；用于创建或修复 AGENTS.md、openspec/project.md、aisee/memory/、最小 Aisee docs 目录，并在当前支持的 Codex hook target 下安装项目级 hooks；检查 hook 机制兼容性、OpenSpec 状态机、baseline 迁移入口与项目技术架构边界。触发词包括 aisee:init、aisee-init、初始化项目配置、优化 AGENTS.md、配置 Codex hooks、OpenSpec 配置审计。.

AISEE-LAB/aisee-plugin · 134 tokens

aisee:srs

通过结构化对话充分澄清软件类业务需求，并生成规划级详细的需求规格说明书（SRS）。当用户想写需求文档、澄清产品范围、整理业务目标/用户角色/业务能力/业务流程/业务规则/权限/非目标，或为 aisee:change-plan 准备稳定输入时使用。适用于 App、小程序、Web、桌面软件、后端/API 服务、CLI 工具、定时任务/异步任务等软件项目。SRS 应写到足够支持后续拆 change 和编写 change 内容，但不要写成接口设计、数据库设计、技术方案、视觉设计、硬件架构、固件设计或开发任务。.

AISEE-LAB/aisee-plugin · 159 tokens

aisee:change-author

按当前 schema 的模板，为单个已确认 OpenSpec change 详细生成或补全文档。用于任何 schema 下的 schema-aware authoring：逐文档写清目标、范围、行为、约束、风险、验证和实施顺序，减少开发、评审和验证阶段的误解与漏项。不拆 change 边界、不重新选择 schema、不写代码；只处理 schema 声明的文档并保持跨文档一致。.

AISEE-LAB/aisee-plugin · 103 tokens

aisee:change-plan

将已确认需求、轻量修复、技术调研或项目事实映射为可独立交付的 OpenSpec changes，并为每个 change 选择合适 schema。用于规划 change 边界、依赖顺序、并行关系和 /opsx:new 命令；不重新做业务模块划分，不重新生成需求，不默认套用 app schema。.

AISEE-LAB/aisee-plugin · 87 tokens

aisee:image-object

对象级图片处理与素材提取工作流。用于从单张图片中分离对象、基于图片提取素材、去背景、生成或修正 mask、点选/框选分割、透明切图、导出带背景/圆角/padding 的素材变体、背景修补、生成图层包和维护单图 source.json workspace 时触发。不要用于参考图生成、StyleSpec、全局视觉规范、Figma 写入或前端实现。.

AISEE-LAB/aisee-plugin · 110 tokens

aisee:reflect

复盘当前会话并把可复用经验沉淀为项目内可审查资产。用于会话结束复盘、总结“这次学到了什么”、提炼团队约定、发现可转成新 skill 的重复流程、审查现有 skill 的缺口、记录 workflow fix，或用户明确说 reflect、aisee:reflect、aisee-reflect、复盘、沉淀、保存经验、转成技能、优化技能、总结本次协作时触发。长会话中如果出现多轮纠错、重复工具链、稳定偏好或可复用流程，也应主动建议使用本技能。.

AISEE-LAB/aisee-plugin · 144 tokens