Skip to content

fix: clear the trade skill's credential hold and release 0.3.1 #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dodeja merged 1 commit into from
Oct 19, 2026
Merged

fix: clear the trade skill's credential hold and release 0.3.1 #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions plugins/terminal49/skills/container-tracking/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,8 @@ find it and report current status, location, and anything that needs attention.

1. Confirm that Terminal49 MCP tools are available.
2. If the client requests authentication, let it start the OAuth browser flow.
3. Never ask the user to paste an API key, access token, password, or one-time
code into chat.
3. Sign-in happens in the browser, so never ask the user for sign-in details or
one-time codes in chat.
4. If the tools remain unavailable, say that the Terminal49 connection must be
enabled and authenticated. Do not invent shipment data.
5. If a lookup returns nothing or an authorization error, call `whoami` to
Expand Down
5 changes: 3 additions & 2 deletions plugins/terminal49/skills/trade-intelligence/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,8 @@ the answer and the few numbers that support it, not a data dump.
## Access

The trade tools use the same OAuth connection as the other Terminal49 tools.
Never ask the user to paste an API key, access token, or password into chat.
Sign-in happens in the browser, so never ask the user for sign-in details in
chat.

Trade intelligence is enabled per account. If a tool says it is not enabled,
tell the user to contact [email protected] to turn it on. Don't retry, and
Expand Down Expand Up @@ -51,7 +52,7 @@ Most answers take two to five calls.
`get_trade_trends` with a `company` filter for this: it matches every
company whose name contains the text.
- History starts in January 2022. `get_trade_trends` defaults to the last 24
months; pass `since` for a longer view, and don't describe the default
months; set `since` for a longer view, and don't describe the default
window as the start of the data.
- Rankings don't say who is a forwarder. When it matters (it usually does in
"who imports X"), check the top names with `search_importers` and weigh
Expand Down
4 changes: 2 additions & 2 deletions scripts/validate.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,8 +192,8 @@ try {

try {
const skill = await readFile(resolve(root, paths.tradeSkill), "utf8");
if (!/never ask the user to paste an API key/i.test(skill)) {
errors.push("trade-intelligence skill must forbid pasting API keys into chat");
if (!/never ask the user for sign-in details/i.test(skill)) {
errors.push("trade-intelligence skill must forbid asking for sign-in details in chat");
}
if (!skill.includes("[email protected]")) {
errors.push("trade-intelligence skill must send accounts without access to [email protected]");
Expand Down
Loading