Interactive login

Nothing captures logins for you. Every login runs in a fresh temporary home and is saved to the keychain with the script shipped with this skill. Never log in against the real $HOME, and never treat a token or config already in $HOME as a usable login: only a keychain handle is. Use the same explicit sandbox_id for the skill read, login, and save-login commands so the temporary home and save script stay on one computer.

1. Make a fresh directory and start the login with execute(background:true) with every config location pointed into it. Copy in any config the CLI needs first (for AWS, the [profile …]/[sso-session …] blocks in .aws/config); everything under that directory becomes the saved login.

   d=$(mktemp -d) && echo "$d"
   in_d() { env HOME="$d" XDG_CONFIG_HOME="$d/.config" XDG_DATA_HOME="$d/.local/share" XDG_STATE_HOME="$d/.local/state" XDG_CACHE_HOME="$d/.cache" "$@"; }
   in_d aws sso login --profile work --use-device-code --no-browser
   in_d gh auth login --hostname github.com --git-protocol https --web
   in_d glab auth login --hostname gitlab.com --web
   in_d gcloud auth login --no-launch-browser
   

   Use the CLI's device-code mode (AWS needs --use-device-code); a browser flow only completes on the same machine.

2. Relay the verification URL and code from the job output. Answer any prompt with background action send_input. Use its watch or poll action with the returned process_id; never stop the job while the person is approving.

3. When it exits successfully, save the directory with the script under the absolute directory the skill read reported:

   node <skill dir>/scripts/save-login.mjs aws "$d" --label "work (123456789012)"