chore: drop the skills OAuth scopes the API no longer defines - #98
Merged
Merged
Conversation
nominal#2912 removed the skills API and cli#95 removed the skill commands; the sign-in flow still asked for skills:delete/read/write. Nothing consumes them, so the consent screen lists three scopes that do nothing. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
![coreplane-switchboard[bot]](https://avatars.githubusercontent.com/u/264571901?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM: Clean 3-line removal of dead skills:* OAuth scopes; no remaining references anywhere in the codebase.
Verdict: approve — clean, correct dead-scope removal.
- The diff removes exactly
skills:delete,skills:read,skills:writefromDEFAULT_SCOPESinsrc/auth/oauth.ts; neighbours and the.join(' ')are untouched. - Verified
grep -rn "skills:"across src/test/README turns up nothing — the only remainingDEFAULT_SCOPESuses (auth URL param and device flow body) just consume the joined string, so no code depends on the removed entries. - Existing tokens keep their issued scope string, as the PR notes; no migration concern.
- No
docs/reference/specs/in this repo, no tests touched — nothing to check there.
No findings.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
Author
|
Release receipt — shipped in v0.2.35 (cut-release 34919367274, release 34919411832, both green). Published |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The CLI's sign-in still asked for three
skills:*OAuth scopes for an API that no longer exists. This removes them from the consent request.What & why
nominal#2912 removed the skills API and cli#95 removed the
skillcommands, but the scope list in the OAuth flow keptskills:delete,skills:readandskills:write. Nothing in the CLI reads them, so the consent screen shows three scopes that grant nothing. Flagged by the review on #95 as a follow-up.Tour
1. The scope list
Three entries gone from the requested scopes; the neighbours are unchanged. Existing stored tokens are unaffected, they keep whatever scope string they were issued with.
cli/src/auth/oauth.ts
Lines 74 to 84 in e25bfb4
2. Remaining changes
None.
Validation
npm run typecheckagainst the live spec,npm run lint,npm test503 pass.grep -rn "skills:" src test README.md skill/SKILL.mdis empty.🤖 Generated with Claude Code