# Interactive Login

Log a CLI in with a browser/device-code flow (aws sso, gh, glab, gcloud, …) and save...

- Repository: https://github.com/yc-software/qm (15597 stars)
- Category: DevOps
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add yc-software/qm --skill interactive-login -g -a claude-code -y`
Codex: `npx skills add yc-software/qm --skill interactive-login -g -a codex -y`
Cursor: `npx skills add yc-software/qm --skill interactive-login -g -a cursor -y`
Gemini CLI: `npx skills add yc-software/qm --skill interactive-login -g -a gemini-cli -y`

## Description

Log a CLI in with a browser/device-code flow (aws sso, gh, glab, gcloud, …) and save the result to the keychain so later commands can request it through execute.credentials.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Interactive login

Nothing captures logins for you. Every login runs in a fresh temporary home and is saved
to the keychain with the script shipped with this skill. Never log in against the real
`$HOME`, and never treat a token or config already in `$HOME` as a usable login: only a
keychain handle is. Use the same explicit `sandbox_id` for the skill read, login,
and save-login commands so the temporary home and save script stay on one computer.

1. Make a fresh directory and start the login with `execute(background:true)` with every config
   location pointed into it. Copy in any config the CLI needs first (for AWS, the
   `[profile …]`/`[sso-session …]` blocks in `.aws/config`); everything under that
   directory becomes the saved login.

   ```bash
   d=$(mktemp -d) && echo "$d"
   in_d() { env HOME="$d" XDG_CONFIG_HOME="$d/.config" XDG_DATA_HOME="$d/.local/share" XDG_STATE_HOME="$d/.local/state" XDG_CACHE_HOME="$d/.cache" "$@"; }
   in_d aws sso login --profile work --use-device-code --no-browser
   in_d gh auth login --hostname github.com --git-protocol https --web
   in_d glab auth login --hostname gitlab.com --web
   in_d gcloud auth login --no-launch-browser
   ```

   Use the CLI's device-code mode (AWS needs `--use-device-code`); a browser flow only
   completes on the same machine.

2. Relay the verification URL and code from the job output. Answer any prompt with
   `background` action `send_input`. Use its `watch` or `poll` action with the returned
   `process_id`; never stop the job while the person is approving.

3. When it exits successfully, save the directory with the script under the absolute
   directory the skill read reported:

   ```bash
   node <skill dir>/scripts/save-login.mjs aws "$d" --label "work (123456789012)"
   ```

The rest: https://github.com/yc-software/qm/blob/HEAD/skills-seed/interactive-login/SKILL.md