1234npm install -g @sigcli/cli

# or without global install:
npx @sigcli/cli sig --help

12345678# 1. Create config (interactive)
sig init

# 2. Sign in — opens a real browser, captures cookies automatically
sig login https://jira.example.com

# 3. Confirm it worked
sig status my-jira

12345678# Discover what variables are available
sig run my-jira -- env | grep SIG_

# Run any command with credentials injected
sig run my-jira -- curl https://jira.example.com/api/me

# Run a Python script
sig run my-jira -- python fetch_issues.py

123456789101112131415# Start the proxy daemon
sig proxy start

# Trust the CA certificate (first time only)
sig proxy trust    # prints the CA cert path — add it to your OS trust store

# Set the proxy env vars
export HTTP_PROXY=http://127.0.0.1:7891
export HTTPS_PROXY=http://127.0.0.1:7891

# Now any HTTP client automatically gets credentials injected
curl https://jira.example.com/rest/api/2/myself

# When done
sig proxy stop

12345678# Simple GET request
sig request https://jira.example.com/rest/api/2/myself

# POST with body
sig request https://api.example.com/data --method POST --body '{"key": "value"}'

# Just the response body
sig request https://api.example.com/me --format body

1sig proxy start && export HTTP_PROXY=http://127.0.0.1:7891 HTTPS_PROXY=http://127.0.0.1:7891

1sig request https://api.example.com/me --format body

1sig run my-jira -- bash -c 'curl -H "Cookie: $SIG_MY_JIRA_COOKIE" https://jira.example.com/api/me'

1234# Redacted by default
sig get my-jira
# Raw values (use with caution)
sig get my-jira --no-redaction

12345sig init                    # interactive setup
sig init --remote           # headless / CI / remote machine
sig init --yes              # accept all defaults, skip prompts
sig init --force            # overwrite existing config
sig init --channel chrome   # use a specific browser (chrome|msedge|chromium)

1sig doctor

123456789101112131415161718192021sig run [provider...] -- <cmd>

# Discover available SIG_<PROVIDER>_* variables
sig run my-jira -- env | grep SIG_MY_JIRA_

# Run with credentials injected
sig run my-jira -- python fetch_issues.py
sig run my-jira -- node export_board.js

# Multiple providers at once
sig run provider-a provider-b -- python cross_tool.py

# No providers — inject all valid credentials
sig run -- python script.py

# Expand individual cookies as SIG_<PROVIDER>_COOKIE_<NAME>=value
sig run my-jira --expand-cookies -- python script.py

# Write credentials to a .env file (auto-deleted after child exits)
sig run my-jira --mount .env -- node app.js
sig run my-jira --mount creds.json --mount-format json -- node app.js

12345678910111213141516171819202122232425262728293031sig login <url>

# Browser SSO (opens browser automatically)
sig login https://jira.example.com

# Force native CDP mode (bypasses anti-bot detection on X, Reddit, etc.)
sig login https://x.com --mode cdp

# Force headless only (fastest, but blocked by some sites)
sig login https://jira.example.com --mode headless

# Custom provider ID
sig login https://jira.example.com --as my-jira

# API token / Personal Access Token (no browser)
sig login https://jira.example.com --token <your-pat>

# Cookies copied from browser DevTools → Network → Copy as cURL
sig login https://jira.example.com --cookie "SESSION=abc123; csrf_token=xyz"

# HTTP Basic auth
sig login https://jira.example.com --username alice --password hunter2

# Force a specific strategy
sig login https://jira.example.com --strategy cookie
sig login https://jira.example.com --strategy oauth2
sig login https://jira.example.com --strategy api-token
sig login https://jira.example.com --strategy basic

# Skip stored credential check, go straight to browser
sig login https://jira.example.com --force

12sig logout my-jira         # clear one provider
sig logout                   # clear all credentials

12345sig get my-jira                        # JSON map (default)
sig get my-jira --format json          # structured JSON
sig get my-jira --format header        # HTTP header string
sig get my-jira --format value         # raw value only
sig get jira.example.com                  # by URL

12345678sig request <url>

sig request https://jira.example.com/api/me
sig request https://jira.example.com/api/issues/123 --format body
sig request https://jira.example.com/api/issues   --method POST   --body '{"title":"Bug","status":"open"}'   --header "Content-Type: application/json"
sig request <url> --format json     # full response (status, headers, body)
sig request <url> --format body     # body only
sig request <url> --format headers  # response headers only

123sig status                       # all providers
sig status my-jira              # one provider
sig status --format json         # machine-readable

12sig providers                    # table view
sig providers --format json      # machine-readable

1sig rename my-jira my-service   # rename provider ID

123sig remove my-jira              # remove provider + credentials
sig remove my-jira --keep-config  # clear credentials only
sig remove my-jira --force        # skip confirmation

12345sig remote add prod ssh://deploy@ci.example.com
sig remote add prod ci.example.com --user deploy --ssh-key ~/.ssh/id_rsa --path ~/.sig
sig remote remove prod
sig remote list
sig remote list --format json

1234sig sync push prod               # push all credentials to remote
sig sync pull prod               # pull credentials from remote
sig sync push prod --provider my-jira   # sync one provider only
sig sync push --force            # overwrite on conflict

1234sig watch add my-jira           # add to watch list
sig watch add my-jira --auto-sync prod   # auto-sync after refresh
sig watch remove my-jira        # remove from watch list
sig watch set-interval 1h       # change default interval

12345678910sig proxy start                  # start daemon (default port 7891)
sig proxy start --port 8080      # use custom port
sig proxy stop                   # stop daemon
sig proxy status                 # show running state, port, env var hints
sig proxy trust                  # print CA cert path + OS trust instructions

# Usage: point any tool at the proxy
export HTTP_PROXY=http://127.0.0.1:7891
export HTTPS_PROXY=http://127.0.0.1:7891
curl https://jira.example.com/api/me   # credentials injected automatically

12345678910# Example: inject xoxc token from localStorage as form body parameter
providers:
  app-slack:
    # ... domains, strategy, etc.
    proxy:
      inject:
        - in: body           # header | body | query
          action: set         # set | append | remove
          name: token
          from: credential.localStorage.xoxc-token

1234567watch:
  interval: 5m           # check interval (default: 5m)
  providers:
    jira:
      autoSync:            # optional: sync to remotes after refresh
        - dev-server
    ms-teams:

123456789101112sig proxy trust                  # show CA cert path + instructions

# macOS
sudo security add-trusted-cert -d -r trustRoot \
  -k /Library/Keychains/System.keychain ~/.sig/proxy/ca.crt

# Ubuntu/Debian
sudo cp ~/.sig/proxy/ca.crt /usr/local/share/ca-certificates/sigcli-proxy.crt
sudo update-ca-certificates

# Per-command (no system trust)
curl --cacert ~/.sig/proxy/ca.crt https://api.example.com

123sig completion bash >> ~/.bashrc
sig completion zsh >> ~/.zshrc
sig completion fish > ~/.config/fish/completions/sig.fish

12345678910111213141516# Always present (example: provider "my-jira")
SIG_MY_JIRA_PROVIDER          # provider ID: "my-jira"
SIG_MY_JIRA_CREDENTIAL_TYPE   # credential type: cookie | bearer | api-key | basic

# Bearer / OAuth2 token
SIG_MY_JIRA_TOKEN             # raw token value, e.g. "eyJ..."
SIG_MY_JIRA_AUTH_HEADER       # complete Authorization header value

# Cookie credentials
SIG_MY_JIRA_COOKIE            # full cookie string, e.g. "SESSION=abc; ..."

# With --expand-cookies: individual cookies
SIG_MY_JIRA_COOKIE_SESSION=abc123
SIG_MY_JIRA_COOKIE_CSRF_TOKEN=xyz

1234567891011import os

# Python script run via: sig run my-jira -- python fetch.py
token = os.environ.get("SIG_MY_JIRA_TOKEN")
cookie = os.environ.get("SIG_MY_JIRA_COOKIE")
auth_type = os.environ.get("SIG_MY_JIRA_CREDENTIAL_TYPE")

if auth_type == "cookie":
    headers = {"Cookie": cookie}
elif auth_type == "bearer":
    headers = {"Authorization": f"Bearer {token}"}

1234567891011# ~/.sig/config.yaml

mode: browser          # browser | browserless
browserChannel: chrome # chrome | msedge | chromium (default: chromium)

providers:
  my-jira:
    url: https://jira.example.com
    strategy: cookie
    requiredCookies:
      - SESSION

1234567891011providers:
  <provider-id>:
    url: <base-url>              # required: URL to match
    strategy: cookie|oauth2|api-token|basic
    requiredCookies:             # wait until these cookies appear
      - SESSION
    cookiePaths:                 # extra paths for path-scoped cookies
      - /wiki
    forceVisible: true           # always open visible browser (default: false)
    waitUntil: networkidle       # load event: load|domcontentloaded|networkidle
    ttl: 8h                      # credential TTL (e.g. 1h, 8h, 7d)

1sig login https://jira.example.com --strategy cookie

1sig login https://jira.example.com --strategy oauth2

1sig login https://jira.example.com --token <your-pat>

1sig login https://jira.example.com --username alice --password hunter2

1234# Which adapter to use?
# → Developer laptop with display: playwright (default)
# → Attach to open Chrome: chrome-cdp
# → Headless CI / remote server: browserless mode + sig sync pull

1npm install @sigcli/sdk

12345678910import { SigClient } from '@sigcli/sdk';

const sig = new SigClient();

// Get credential headers
const headers = await sig.getHeaders('my-jira');
const response = await fetch('https://jira.example.com/api/me', { headers });

// Or use sig.request() directly
const result = await sig.request('https://jira.example.com/api/issues/123');

1pip install sigcli-sdk

12345678910from sigcli import SigClient

sig = SigClient()

# Get headers
headers = sig.get_headers("my-jira")
response = requests.get("https://jira.example.com/api/me", headers=headers)

# Or use sig.request() directly
result = sig.request("https://jira.example.com/api/issues/123")

1234567891011121314# Recommended: sig run keeps credentials out of agent context
sig run my-jira -- python fetch_issues.py
sig run my-jira -- node export_sprint.js

# Alternative: sig proxy for daemons / tools that only read proxy env vars
sig proxy start
export HTTP_PROXY=http://127.0.0.1:7891 HTTPS_PROXY=http://127.0.0.1:7891
# now any tool that respects proxy env vars gets credentials injected

# Discovery: find out what SIG_<PROVIDER>_* vars are available
sig run my-jira -- env | grep SIG_MY_JIRA_

# Alternative: sig request (credentials stay internal)
sig request https://jira.example.com/api/me

12345# Always check before logging in — avoid unnecessary browser launches
sig status my-jira --format json
# exit 0 + "valid": true  → credentials ready, skip login
# exit 3                  → no credentials, run sig login
# exit 0 + expired        → sig logout my-jira && sig login https://jira.example.com

12345678# Install all skills (auto-detects your agent)
./skills/install.sh

# Or pick an agent
./skills/install.sh --agent cursor

# List what's installed
./skills/install.sh --list

1mkdir -p skills/my-service/scripts

12345678910111213141516171819202122232425262728293031323334353637---
name: my-service
description: 'Interact with My Service — create, list, and update items.
  Use this skill when the user mentions My Service, items, or tasks.'
---

# My Service

Create, list, and update items via My Service REST API.

## Authentication

| Provider     | Type   | Login Command                          |
|------------- |--------|----------------------------------------|
| `my-service` | cookie | `sig login https://my-service.example.com/` |

**Run scripts:**
```bash
sig run my-service -- python3 scripts/list_items.py \
  --cookie "$SIG_MY_SERVICE_COOKIE"
```

## Scripts

### list_items.py
List items from the API.
```
--cookie TEXT    Auth cookie (from sig run)
--limit  INT    Max results (default: 20)
--query  TEXT   Filter by keyword (optional)
```

## Error Handling
| Code | Meaning                  | Fix                              |
|------|--------------------------|----------------------------------|
| 401  | Session expired          | `sig login <url>`                |
| 429  | Rate limited             | Wait and retry                   |

12345678910111213141516171819202122232425262728#!/usr/bin/env python3
"""List items from My Service API."""
import argparse, json, sys, requests

BASE = "https://my-service.example.com/api/v1"

def list_items(cookie, query=None, limit=20):
    headers = {"Cookie": cookie} if cookie else {}
    params = {"limit": limit}
    if query:
        params["q"] = query
    resp = requests.get(f"{BASE}/items", headers=headers, params=params, timeout=15)
    resp.raise_for_status()
    return {"items": resp.json().get("items", []), "count": len(resp.json().get("items", []))}

def main():
    p = argparse.ArgumentParser()
    p.add_argument("--cookie", default="")
    p.add_argument("--query")
    p.add_argument("--limit", type=int, default=20)
    args = p.parse_args()
    try:
        json.dump(list_items(args.cookie, args.query, args.limit), sys.stdout, indent=2)
    except requests.HTTPError as e:
        json.dump({"error": f"HTTP_{e.response.status_code}"}, sys.stdout, indent=2)

if __name__ == "__main__":
    main()

12345678910111213141516"""Tests for my-service/scripts/list_items.py"""
import re, responses
from test_helpers import load_script

mod = load_script("my-service", "list_items")

class TestListItems:
    @responses.activate
    def test_basic_list(self):
        responses.get(
            url=re.compile(r"https://my-service\.example\.com/api/v1/items"),
            json={"items": [{"id": 1, "name": "Task A"}]},
        )
        result = mod.list_items("session=abc", limit=10)
        assert result["count"] == 1
        assert result["items"][0]["name"] == "Task A"

1234# Add to skills/install.sh ALL_SKILLS list, then:
./skills/install.sh
# Test:
cd skills && python -m pytest my-service/tests/ -v

12345678910111213141516# 1. On the headless server — set browserless mode
sig init --remote

# 2. On the laptop — add the remote
sig remote add prod ssh://deploy@ci.example.com
# or with explicit options:
sig remote add prod ci.example.com --user deploy --ssh-key ~/.ssh/id_rsa

# 3. Push all credentials to the server
sig sync push prod

# 4. Push a single provider
sig sync push prod --provider my-jira

# 5. On the server — use immediately, no browser needed
sig run my-jira -- python deploy.py

12sig sync pull prod                # pull all
sig sync pull prod --force        # overwrite on conflict

123# On laptop: refresh my-jira every hour and auto-push to prod
sig watch add my-jira --auto-sync prod
sig watch start --interval 1h

123456# Exit codes
0   Success
1   GENERAL_ERROR       — invalid args or unexpected failure
2   PROVIDER_NOT_FOUND  — URL/ID doesn't match any configured provider
3   CREDENTIAL_NOT_FOUND — no stored credentials → run sig login
4   REMOTE_NOT_FOUND    — SSH remote not configured → run sig remote add

1234567891011121314151617181920212223242526CREDENTIAL_EXPIRED        # token/cookie expired, refresh failed
                          # fix: sig logout <p> && sig login <url>

CREDENTIAL_TYPE_MISMATCH  # wrong credential type for provider
                          # fix: re-login with --strategy <name>

REFRESH_FAILED            # OAuth2 refresh token rejected
                          # fix: sig logout <p> && sig login <url>

BROWSER_LAUNCH_ERROR      # playwright-core not installed or no browser
                          # fix: sig doctor; install playwright-core

BROWSER_TIMEOUT           # browser auth took too long
                          # fix: retry; if CAPTCHA/MFA ensure visible mode

BROWSER_UNAVAILABLE       # machine is in browserless mode
                          # fix: use --token/--cookie or sig sync pull

CONFIG_ERROR              # malformed ~/.sig/config.yaml
                          # fix: sig doctor to validate

SYNC_CONFLICT             # local/remote credentials differ
                          # fix: sig sync pull --force

STORAGE_ERROR             # cannot read/write credential files
                          # fix: check permissions on ~/.sig/credentials/