dreamina-canvas-cli-auth

Dreamina Canvas CLI Auth Task

This Skill owns the user-facing authorization workflow of the Dreamina Canvas CLI (official guide §3): the standard five-step login flow, the six auth subcommands and when each applies, and the account self-check that closes the loop.

Credential-security internals — local vs server identity semantics, token handling red lines, profile isolation mechanics, refresh-window rules — are owned by dreamina-canvas-cli-auth. This Skill applies that workflow through the local auth-state reference.

When to use

The user asks to log in to Dreamina / authorize / log in again / log out / check the account.
An agent/script environment needs the non-interactive login + device code + wait flow.
A later command returned exit 11 (login required or session expired).

When not to use

For credential-security details (token red lines, profile mechanics) — read Authentication status specification.
For installing the CLI — that is dreamina-canvas-cli-setup.
For any generation task — the task skills, after auth succeeds.

All handoffs stay inside this package; install any missing skill with npx skills add full-aigc-skills/dreamina-skills --skill <skill-name>.

Standard login flow (Guide §3, five steps)

Run dreamina-canvas auth login。
Open the authorization entry point provided by the terminal or Agent in the browser.
Complete login and authorization following the on-page prompts.
Return to the terminal and wait for the command to complete.
Run dreamina-canvas auth account to perform a login self-check.

Command selection

Command	Purpose	When to use
`auth login`	Start the browser authorization flow	TTY interactive environment
`auth login --force`	Clear the current login state and reauthorize	Switching accounts or a corrupted login state
`--non-interactive auth login`	Return the authorization information and then end immediately	Agent / script environment
`auth wait --device-code <code>`	Continue waiting for an already-initiated authorization (default maximum 10 minutes)	Continued waiting in conjunction with non-interactive login
`auth account`	Server-side account self-check	The closing loop after every login; the only trustworthy evidence of "logged in"
`auth status`	Local login state	Troubleshooting only;cannot be used alone as login evidence
`auth refresh`	Refresh login credentials	When credentials need renewal (only within the refresh window)
`auth logout`	Log out	Clear the local login state of the current profile

Key points for the Agent environment (see Authentication status specification）：

After non-interactive login returns a device code,do not poll login in place; hand the authorization entry point to the user, and use auth wait --device-code <code> to continue waiting.
--timeout defaults to 10 minutes;--timeout 0 polls only once.

Operation contract

Item	Standard
Input and preconditions	Profile and the authentication operation requested by the user
Side effects	login/refresh/logout change the authentication state; account/status are read-only
Output handoff	Account query results or a pending challenge; credentials do not enter the handoff
Recovery rules	Continue waiting for the same device authorization; on permission denial, do not automatically loop login

Workflow

(装好后) → login（按环境选子命令）→ 用户浏览器授权 → wait 续等
  → auth account 自检 → 报告账号 → 交接后续任务技能

1. Select and run the login command

TTY：auth login。Agent：--non-interactive auth login → obtain a device code → present the authorization URL to the user.

2. Wait for authorization

auth wait --device-code <code>; after the timeout, call the same code again to continue waiting (the unfinished authorization is still within its validity period).

3. Verify with the server

dreamina-canvas --format json auth account

Only auth account(from the server's perspective) can prove "logged in";auth status reads only local files and may not match the server.

4. Report and hand off

Report the account recognized by the server (handle the user identifier according to the privacy rules of Authentication status specification ), then hand off to the subsequent task skill.

Re-authentication & logout

Login state invalid (exit 11) → auth login or --force to log in again, and retry the original command with the same identity.
Switch account → auth login --force(clear the current state and then reauthorize).
Log out → auth logout; credential renewal is done only within the refresh window auth refresh, and is not called speculatively.

Failure → recovery

Symptom	Next step
exit 11	After reauthorization, retry with the same identity.
`auth account` does not match the expected account	First confirm `--profile`; to switch accounts use `--force`。
Authorization page won't open	Give the full authorization URL to the user to open manually; if it still fails, report back using the four-piece set.
wait timeout	wait again with the same device code; if authorization has expired, log in again.

What this Skill will not do

Persist, print, or log tokens, cookies, signed URLs, or device codes beyond the active flow (red lines in the local Authentication State Specification).
Run any paid command from this Skill.
Duplicate the credential-security contract.

Policy

Invocation requires:

Confirmed installation of dreamina-canvas
The login/re-login/logout intent is explicit

Forbids:

Persisting OAuth tokens, cookies, signed URLs, or credentials
Running paid generation from this Skill
Treating auth status alone as proof of login

Default prompt:

Guide §3 flow: pick the login subcommand for the environment (non-interactive + auth wait for agents), never loop on login, verify with auth account (server truth, not auth status), --force to switch accounts. Token red lines live in the local Authentication State Specification.

For authentication state, --profile isolation, and recovery, see Authentication State Specification。Never persist or echo tokens; auth status is local, auth account is server-recognized proof of login.

Progressive disclosure (read on demand)

When you need details on the authentication state machine, profile isolation, and token red lines, read Authentication State Specification; when you need the state machine expanded, read Authentication State Machine。
When you need to choose among the seven subcommands by environment (TTY / Agent), read Command Guide。
When you need to determine inputs/outputs, states, and authorization points, read Workflow Contract。
When you encounter exit 11, account mismatch, or wait timeout, read Error Recovery。
For pre-delivery self-check, read Acceptance Checklist。

Non-applicability and boundaries

Not applicable to installation, canvas creation, or media generation. When a valid account already exists and you only need to execute a task, do not log in repeatedly; permission denials should be reported as business limitations, not bypassed by logging in again.

Only read the account and asset information necessary for the current operation; do not store, log, or output access tokens, cookies, or temporary signed links.

Gotchas

Check exit codes and structured errors; do not infer stage completion from terminal prompts.
After the user completes authorization, report the result explicitly; on failure, retain the original error and next step.
Verify local availability, server-side authentication, and business permissions separately.