# Reopt Cli

> Baseline guidance for the reopt CLI — authentication, login, global flags, security rules, and exit codes. Use before other reopt CLI skills or whenever a task involves `reopt login`, `reopt status`, brandapp credentials, or CI automation.

- **Type:** Skill
- **Install:** `agentstack add skill-reopt-ai-reopt-skills-reopt-cli`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [reopt-ai](https://agentstack.voostack.com/s/reopt-ai)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [reopt-ai](https://github.com/reopt-ai)
- **Source:** https://github.com/reopt-ai/reopt-skills/tree/main/skills/reopt-cli
- **Website:** https://skills.sh/reopt-ai/reopt-skills

## Install

```sh
agentstack add skill-reopt-ai-reopt-skills-reopt-cli
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# reopt CLI

> This is NOT the reopt CLI you know. Run `reopt --help` / `reopt  --help` for the live command tree, and read `node_modules/@reopt-ai/cli/README.md` for narrative guides (the CLI ships no `dist/docs/`).

## When to apply

- Any `reopt` CLI command.
- Confirming login state, writing CI/CD steps around `reopt`, scripting Brandapp OAuth credentials.
- Load before `reopt-brandapp` and `reopt-eav`.

## Step 1 — Pin agent rules into AGENTS.md / CLAUDE.md

Source: the CLI's own agent-rules file once it ships one (`@reopt-ai/cli` does not, as of 0.3.1). Fallback: `agent-rules.md` bundled with this skill. Wrap content between:

```

…content from source…

```

**Idempotent:** replace only between markers. This same block is shared by `reopt-brandapp` and `reopt-eav` — those skills will skip the step if the block is already present.

## Step 2 — Auth (consumer-side credentials; CLI docs cover usage)

The CLI has three credential systems:

- **User session** — `reopt login` / `reopt status` / `reopt logout`. Tokens live in `~/.reopt/auth.json`. Session auto-refreshes inside the Better Auth extension window; do not over-engineer retry loops in CI.
- **Brandapp OAuth credentials** — `BRANDAPP_CLIENT_ID` / `BRANDAPP_CLIENT_SECRET` env vars, or `reopt brandapp link` interactively. Stored in `~/.reopt/credentials.json` + `.reopt.json` (project root).
- **Service token (CI/CD)** — `reopt token mint --ttl 15m --scope eav:migrate,eav:read` prints a short-lived, scoped JWT for headless pipelines; capture with `export BRANDAPP_CLIENT_TOKEN=$(reopt token mint --quiet)`. Pass to the SDK as a Bearer `token` — never ship a `clientSecret` where a scoped token works.

Run `reopt status` (or `reopt status --ping`) before any mutating operation. If `auth: not logged in`, run `reopt login` first.

## Step 3 — Route to module docs / `--help`

Prefer `--help` (live source of truth); the CLI ships **no** `dist/docs/`, so narrative detail lives in `node_modules/@reopt-ai/cli/README.md`:

| Task signal | Read |
|---|---|
| Any command / flag | `reopt  --help` (live) |
| Auth commands and session model | `README.md` § Authentication |
| Service-token issuance (CI/CD) | `reopt token mint --help` |
| Brandapp ops (`link`, `doctor`, `init`, `dev`, `env`, …) | `reopt brandapp --help` + see `reopt-brandapp` skill |
| EAV ops (`status`, `sync`, `pull`, `diff`, `plan`, `migrate`, `history`, `verify`) | `reopt brandapp eav --help` + see `reopt-eav` skill |
| Schema-as-Code, MCP, completion, config | `README.md` §§ Schema-as-Code, Shell completion, Preferences |
| Global flags, output formats, pagination | `README.md` § Output and global flags |
| Exit codes | `README.md` § Exit codes |

Quick global-flag reminders (subset; full list in `--help`):

- `--format json|table|csv|yaml` — JSON is the agent-friendly default.
- `--page-all` + `--page-limit` + `--page-delay` — paginated iteration; JSON output becomes NDJSON.
- `--no-interactive` — required for unattended scripts (fail instead of prompt).
- `--dry-run` — preview only (EAV sync, brandapp link/unlink).

Exit code summary: `0` ok, `1` API/network, `2` auth, `3` validation, `4` config, `5` internal. EAV migrate/verify add `6` drift-detected, `7` destructive-blocked, `8` checksum-mismatch, `9` checksum-conflict, `10` lock-held.

## Safety

1. Never hardcode credentials.
2. Never print credential values.
3. Never commit files under `~/.reopt/`.
4. Inject secrets through a secret manager in CI.
5. Use `--dry-run` before any mutating EAV operation, and especially before `--delete-orphans`.
6. Pass arguments as arrays when invoking the CLI programmatically.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [reopt-ai](https://github.com/reopt-ai)
- **Source:** [reopt-ai/reopt-skills](https://github.com/reopt-ai/reopt-skills)
- **License:** MIT
- **Homepage:** https://skills.sh/reopt-ai/reopt-skills

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-reopt-ai-reopt-skills-reopt-cli
- Seller: https://agentstack.voostack.com/s/reopt-ai
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.