All notable changes to the codeguilds CLI are documented here.
- Transparent token refresh — expired access tokens are now refreshed automatically using the stored
refresh_tokenbefore every authenticated request; users no longer need to re-runcodeguilds loginafter a session expires CODEGUILDS_REGISTRY_URLenv var — override the Supabase registry URL for self-hosted or staging environments
- HTTPS enforcement —
CODEGUILDS_WEB_URLenv var must usehttps://; plainhttp://is rejected with a warning (localhost and 127.0.0.1 are allowed for local dev) - Network error sanitization — fetch errors no longer leak the full URL (including package slug) into error output; replaced with a generic connectivity message
- 401 session clearing — a 401 response from the API automatically clears the local auth file so stale tokens do not persist
- Missing
expclaim treated as expired —isTokenExpirednow returnstrue(notfalse) when the JWT payload has noexpfield
codeguilds --versionnow reads version dynamically frompackage.json(was hardcoded)- Various small stability fixes
codeguilds collection list— browse featured collections from the registrycodeguilds collection info <slug>— show collection details and package listcodeguilds collection install <slug>— install all packages in a collection with confirmation prompt (--yesflag to skip)
- Anonymous CLI event tracking (
search,info,uninstall) — command type + package slug only, no personal data codeguilds logoutcommand to clear saved credentials
clearAuth()now deletes the auth file instead of writing{}(fixes "Already logged in" after logout)- CLI search strips PostgREST glob characters from user input
- Initial npm release
codeguilds install <slug>— installs MCP servers, skills, agents, hooks, and CLAUDE.md templates; placement driven byinstall_configfrom registrycodeguilds uninstall <slug>— removes package and undoes config changescodeguilds search <query>— search registry from terminalcodeguilds list— show installed packages (reads from.codeguilds-lock.json)codeguilds info <slug>— show package detailscodeguilds login/codeguilds logout— browser OAuth flow, credentials stored in~/.codeguilds/auth.json--projectflag for project-local installs--strategyflag for CLAUDE.md template merge (append / prepend / replace)- Filename validation blocking path traversal before any file write
- MCP config inference from GitHub
package.jsonwhen registry entry has noinstall_config