[ENG-5115] 0.8.1: Meshy CLI 0.7.3+, two-step sign-in for remote chat

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "meshy-3d-agent",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Generate 3D models, textures, and images, rig and animate characters, and prepare models for 3D printing with the Meshy AI API.",
   "author": {
     "name": "Meshy",

.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "meshy-3d-agent",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Generate 3D models, textures, and images, rig and animate characters, and prepare models for 3D printing with the Meshy AI API.",
   "author": {
     "name": "Meshy"

.github/workflows/validate-skills.yml

@@ -41,7 +41,7 @@ jobs:
           echo "MESHY_CLI_BIN=$RUNNER_TEMP/meshy-cli/node_modules/meshy-cli/dist/index.js" >> "$GITHUB_ENV"
 
       # Covers auth, runner, generation and printing contracts. The runner test runs the
-      # documented `npm exec --package=meshy-cli@0.7` entry point, so it reaches the npm
+      # documented `npm exec --package=meshy-cli@0.7.3` entry point, so it reaches the npm
       # registry; every API call in the suite stays on loopback with synthetic credentials.
       - name: Isolated CLI contract tests (no live API)
         run: node --test tests/*.test.mjs

CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## [0.8.1] - 2026-10-30
+
+### Changed
+
+- Meshy CLI 0.7.3 or later (still the `meshy-cli@0.7` range). 0.7.3 keeps the device code out of
+  `auth login --no-wait`, which the two-step sign-in below relies on.
+- The temporary package names `meshy-cli@0.7.3` exactly: `npm exec` with the `0.7` range kept
+  reusing whichever 0.7.x it had cached first (0.7.1 on a machine that ran it before). The global
+  install keeps the range and resolves the newest 0.7.x.
+- The runner installs the CLI at most once: a version still too old afterwards means the
+  registry the machine uses lags npm, and the agent reports that instead of looping.
+
+### Added
+
+- Remote chat sign-in. A user on a phone, talking to the agent through a chat bot, never saw the
+  link while the login waited in the same turn. Setup now signs in across two turns:
+  `meshy auth login --device --no-wait` returns the link (code included) and a flow id, the agent
+  ends the turn with it, and `meshy auth login --device-flow FLOW_ID` finishes on the user's
+  reply. A host whose question tool reaches the user (dsh's `ask_user_question`) can wait in the
+  same turn instead. Contract test against the published CLI.
+- A host with a file-delivery tool (dsh's `present`) also gets the delivered model through it.
+
 ## [0.8.0] - 2026-10-30
 
 ### Changed

INSTALL.md

@@ -21,7 +21,7 @@ If Node.js is missing or older, stop and ask the user to install a current Node.
 meshy --version
 ```
 
-- It prints 0.7.1 or a later 0.7.x: keep it. The skills are written for 0.7, and another minor
+- It prints 0.7.3 or a later 0.7.x: keep it. The skills are written for 0.7, and another minor
   version can change flags and output.
 - It prints an older version, or there is no `meshy`: install the newest 0.7.x.
 
@@ -30,7 +30,7 @@ npm install -g meshy-cli@0.7
 ```
 
 - It prints 0.8 or newer: do not downgrade it, since something else may rely on it. Use the
-  temporary 0.7 package `npm exec --yes --package=meshy-cli@0.7 -- meshy …` as `meshy` in the
+  temporary package `npm exec --yes --package=meshy-cli@0.7.3 -- meshy …` as `meshy` in the
   steps below.
 
 If the global install is refused (permissions, a managed machine), leave it and use the same

README.md

@@ -1,8 +1,8 @@
 # Meshy 3D Agent
 
 Meshy skills for creating digital assets and preparing 3D prints. All three skills drive
-**Meshy CLI 0.7** (0.7.1 or later, `meshy`) on **Node.js 22.12+**. They are instructions and references only —
-no bundled runtime scripts. Current release: **0.8.0**.
+**Meshy CLI 0.7** (0.7.3 or later, `meshy`) on **Node.js 22.12+**. They are instructions and references only —
+no bundled runtime scripts. Current release: **0.8.1**.
 
 ## Let your agent install it
 
@@ -33,7 +33,7 @@ Two more things worth knowing:
 - **The agent installs the CLI.** With Node 22.12+ and no `meshy` (or an older one), it runs
   `npm install -g meshy-cli@0.7`. Where a global install is not allowed, or a newer CLI is
   already installed, it runs the pinned package temporarily instead
-  (`npm exec --yes --package=meshy-cli@0.7 -- meshy …`).
+  (`npm exec --yes --package=meshy-cli@0.7.3 -- meshy …`).
 - **Local print work needs no account.** Rescaling an OBJ or opening a 3MF in a slicer runs
   entirely on your machine — no login, no balance check, no credits.
 

scripts/validate_skills.py

@@ -10,13 +10,13 @@
 
 ROOT = Path(__file__).resolve().parent.parent
 SKILLS = ("meshy-3d-generation", "meshy-3d-printing", "meshy-openclaw")
-VERSION = "0.8.0"
+VERSION = "0.8.1"
 # The Meshy CLI the skills are written for: any 0.7.x from MIN_CLI. Package specs use the range.
 CLI = "0.7"
-MIN_CLI = "0.7.1"
+MIN_CLI = "0.7.3"
 LINK = re.compile(r"\[[^\]]*\]\(([^)]+)\)")
 # The pinned temporary-package runner documented in setup.md; recipes stay written as `meshy ...`.
-RUNNER = ["npm", "exec", "--yes", f"--package=meshy-cli@{CLI}", "--"]
+RUNNER = ["npm", "exec", "--yes", f"--package=meshy-cli@{MIN_CLI}", "--"]
 # Written paths are placeholders resolved from the user's request, never a hardcoded directory.
 WORKSPACE_FLAGS = ("--workspace", "WORKSPACE")
 
@@ -97,9 +97,10 @@ def validate_skill(folder):
     require(markdown <= reachable, f"{folder}: unreachable documents {markdown - reachable}")
     # The first-run contract each skill must be able to answer on its own.
     setup = (folder / "references" / "setup.md").read_text()
-    for needle in (f"npm exec --yes --package=meshy-cli@{CLI} -- meshy", "auth login --device", "--region cn", "./meshy_output", "WORKSPACE", "JOB_DIR"):
+    for needle in (f"npm exec --yes --package=meshy-cli@{MIN_CLI} -- meshy", "auth login --device", "--region cn", "./meshy_output", "WORKSPACE", "JOB_DIR"):
         require(needle in setup, f"{folder}: setup.md does not document {needle!r}")
-    require("--no-wait" not in re.sub(r"Do not use `--no-wait`[^.]*\.", "", setup), f"{folder}: setup.md must not use the device-secret login mode")
+    # --no-wait only in the two-step sign-in, which resumes by flow_id (CLI 0.7.3 no longer prints the device code).
+    require("--no-wait" not in setup or "--device-flow FLOW_ID" in setup, f"{folder}: --no-wait without the --device-flow resume")
     delivery = (folder / "references" / "delivery.md").read_text()
     for needle in ("thumbnail.primary", "docs.meshy.ai/en/api/pricing", "--dry-run", "_meta.json"):
         require(needle in delivery, f"{folder}: delivery.md does not document {needle!r}")

skills/meshy-3d-generation/SKILL.md

@@ -2,12 +2,12 @@
 name: meshy-3d-generation
 description: "Generates and edits digital 3D assets with the Meshy CLI: text-to-3D and image-to-3D models, texturing, remeshing and LODs, UV unwrapping, format conversion (GLB, FBX, OBJ, USDZ, STL, 3MF, Blender), rigging, animation, motion clips from text and reference images. Use when the user asks to make, texture, rig, animate or convert a 3D model or game asset. For physical 3D printing use meshy-3d-printing."
 license: MIT
-compatibility: "Needs Node.js 22.12+ and the Meshy CLI 0.7.x, 0.7.1 or later (npm install -g meshy-cli@0.7); network access to the Meshy API."
+compatibility: "Needs Node.js 22.12+ and the Meshy CLI 0.7.x, 0.7.3 or later (npm install -g meshy-cli@0.7); network access to the Meshy API."
 ---
 
 # Meshy 3D Generation
 
-Use Meshy CLI **0.7** (0.7.1 or later) to turn the user's request into a delivered asset. Completion means
+Use Meshy CLI **0.7** (0.7.3 or later) to turn the user's request into a delivered asset. Completion means
 saving the requested files in the requested location, inspecting an available preview, and
 finishing any project integration the user requested. Login or task submission alone is not
 completion. Choose the shortest suitable pipeline and reuse existing assets for follow-ups.
@@ -29,13 +29,14 @@ existing GLB needs no extra format conversion. Use command help when parameters
 ## First use and authorization
 
 Before the first command run `meshy --version`; no need to ask. When `meshy` is missing or
-older than 0.7.1, install the newest 0.7.x with `npm install -g meshy-cli@0.7` and say so in
+older than 0.7.3, install the newest 0.7.x with `npm install -g meshy-cli@0.7` and say so in
 one line; Setup covers a refused install and a CLI of 0.8 or newer. Reuse a verified session. If login is
 needed, follow Setup and run `auth login --device` (adding `--region cn` for a user in mainland
 China) in a persistent tool session. Show its
 verification URL and user code in **commentary/progress, not a final answer**. Await that same
 session in this turn until it exits, verify `auth status`, then continue the original request.
-A background process cannot resume a finished turn; do not require a "done" chat message.
+A background process cannot resume a finished turn; do not require a "done" chat message, except in
+Setup's two-step sign-in for a user on a remote chat (a phone through a chat bot).
 Browser approval stays with the user; credentials never belong in chat.
 
 ## Execution boundaries

skills/meshy-3d-generation/references/delivery.md

@@ -99,7 +99,9 @@ Deliver four things, every time:
 
 1. **The model file**, at the path the user asked for, written as a plain path in backticks.
    Do not present it as a clickable link: hosts open such links in a text/preview pane that
-   cannot render a binary mesh, and it looks broken. Offer the next real action instead —
+   cannot render a binary mesh, and it looks broken. A host with a tool that delivers files to the
+   user (dsh's `present`) gets the model through that tool as well, so it opens from the
+   conversation. Offer the next real action instead —
    reveal it in the file manager (`open -R <path>` on macOS, `explorer /select,<path>` on
    Windows), open it in a local 3D tool, or wire it into the project.
 2. **The preview**, shown inline when one exists, or an explicit note that none does.

skills/meshy-3d-generation/references/setup.md

@@ -2,7 +2,7 @@
 
 Shared by the generation and print workflows. Three things are settled before any job
 starts: **how to run the CLI**, **whether a session already exists**, and **where files go**.
-The supported CLI is **0.7.x, from 0.7.1,** on **Node.js 22.12 or newer**. No Python, request wrapper or
+The supported CLI is **0.7.x, from 0.7.3,** on **Node.js 22.12 or newer**. No Python, request wrapper or
 separate token store is involved.
 
 Contents: 1 runner · 2 reuse a session · 3 first login · 4 where files go · 5 one session
@@ -17,26 +17,29 @@ meshy --version
 
 | Observation | What to do |
 |---|---|
-| `meshy --version` prints 0.7.1 or a later 0.7.x | run `meshy` |
-| no `meshy` command, or a version older than 0.7.1 | install the newest 0.7.x (below), then run `meshy` |
-| 0.8 or newer | keep it, since something else may rely on it, and run the temporary 0.7 package |
+| `meshy --version` prints 0.7.3 or a later 0.7.x | run `meshy` |
+| no `meshy` command, or a version older than 0.7.3 | install the newest 0.7.x (below), then run `meshy` |
+| 0.8 or newer | keep it, since something else may rely on it, and run the temporary package |
 | no Node.js, or Node older than 22.12 | stop and report it: the user installs Node.js 22.12+ |
 
 ```bash
 npm install -g meshy-cli@0.7
 ```
 
-Check and install without asking first; say in one line that you are installing it. Never use `sudo` or change system policy: when the
-install is refused (permissions, a managed machine, a sandbox), use the temporary 0.7 package
+Check and install without asking first; say in one line that you are installing it. Install at
+most once: when `meshy --version` still reports a version older than 0.7.3 afterwards, the
+registry this machine uses lags npm, so report that instead of installing again. Never use `sudo`
+or change system policy: when the install is refused (permissions, a managed machine, a sandbox), use the temporary package
 instead. It runs the same CLI without installing anything: put `npm exec --yes
---package=meshy-cli@0.7 --` in front of the same arguments, and the exit code and the JSON on
+--package=meshy-cli@0.7.3 --` in front of the same arguments, and the exit code and the JSON on
 stdout are forwarded unchanged. Recipes are written as `meshy …`; example:
 
 ```bash
-npm exec --yes --package=meshy-cli@0.7 -- meshy auth status --format json --no-update-check
+npm exec --yes --package=meshy-cli@0.7.3 -- meshy auth status --format json --no-update-check
 ```
 
-The first such call downloads the package into the npm cache; later calls reuse it. On Windows
+The first such call downloads the package into the npm cache; later calls reuse it. It names an
+exact version because `npm exec` keeps reusing whatever matching version it cached first. On Windows
 both commands go through `npm.cmd`. A missing `npm` with a working Node.js means the host
 stripped npm: report that and ask the user to install the CLI themselves.
 
@@ -138,12 +141,35 @@ Failure branches — each is a different recovery, so read the error rather than
 - **`device_flow_not_supported`**: this API host has no device endpoint. Ask the user to run
   `meshy auth login` in their own desktop terminal (loopback + browser), or to store their own
   key with `meshy auth login --with-key <key>` privately. Never ask for the key in chat.
-- **Host cannot keep a process alive at all**: fall back to the user running the login command
-  in their own terminal, then re-check `auth status` and resume. This is the only case where a
-  manual terminal step is acceptable.
+- **Host cannot keep a process alive at all**: use the two-step sign-in below.
 
-Do not use `--no-wait`: its JSON contains a `device_code`, which is a bearer secret. Do not use
-`--manual` from an agent — it prompts on stdin for a pasted code. Never show a token, a device
+### Remote chat: sign in across two turns
+
+When the user talks to you through a chat bridge from another device (a phone in QQ, WeChat,
+Slack or Telegram), progress messages may arrive late or only when the turn ends, so a link shown
+while the login waits never reaches them. Sign in in two steps instead (add `--region cn` to the
+first for the China site):
+
+```bash
+meshy auth login --device --no-wait --format json --no-update-check
+```
+
+It returns at once with `result.verification_url` (the code is already in the link),
+`result.user_code` and `result.flow_id`. Keep FLOW_ID in your notes and end the turn with the link
+and the code: ask the user to open it in the phone's own browser rather than the chat app's (an
+in-app browser may not keep the sign-in), approve, and reply when done. When they reply:
+
+```bash
+meshy auth login --device-flow FLOW_ID --format json --no-update-check
+```
+
+It waits while the approval is still pending, saves the session and prints
+`result.status: "logged_in"`; verify `auth status` and continue the original request. An expired
+or unknown flow means running step one again. A host whose question tool reaches the user
+(dsh's `ask_user_question` is forwarded by its chat bridges) can instead ask with the link and
+wait for the answer in the same turn, then run step two.
+
+Do not use `--manual` from an agent — it prompts on stdin for a pasted code. Never show a token, a device
 code or a signed URL to the user or copy one into chat or a file: task results and sidecars
 carry signed URLs, so report paths and task IDs instead of pasting them.
 

skills/meshy-3d-generation/references/troubleshooting.md

@@ -11,11 +11,11 @@ timeout · deleting a task · local files.
 
 ## Runner problems
 
-- **`meshy: command not found`** or **a version older than 0.7.1**: install the newest 0.7.x as
-  Setup describes. If the install is refused, use the temporary 0.7 package
-  (`npm exec --yes --package=meshy-cli@0.7 -- meshy …`) and carry on with the same job.
+- **`meshy: command not found`** or **a version older than 0.7.3**: install the newest 0.7.x as
+  Setup describes. If the install is refused, use the temporary package
+  (`npm exec --yes --package=meshy-cli@0.7.3 -- meshy …`) and carry on with the same job.
 - **A global 0.8 or newer** answers `--version`. Do not uninstall or downgrade it; use the
-  temporary 0.7 package for this work and mention the mismatch once.
+  temporary package for this work and mention the mismatch once.
 - **Node older than 22.12** fails the CLI's own runtime gate. Report the required version and the
   installed one; do not try to relax it or run an older CLI.
 - **`npm exec` cannot reach the registry**: report the network/proxy error. A cached package

skills/meshy-3d-printing/SKILL.md

@@ -2,12 +2,12 @@
 name: meshy-3d-printing
 description: "Generates and prepares models for physical 3D printing with the Meshy CLI: white and multicolor prints (3MF, STL, OBJ), printability analysis and repair, splitting into parts, Creative Lab products such as figures, lamps and keychains, sizing, and slicer handoff (Bambu Studio, OrcaSlicer, PrusaSlicer, Cura). Use when the user wants something 3D-printed or asks for print or slicer files."
 license: MIT
-compatibility: "Needs Node.js 22.12+ and the Meshy CLI 0.7.x, 0.7.1 or later (npm install -g meshy-cli@0.7); network access to the Meshy API."
+compatibility: "Needs Node.js 22.12+ and the Meshy CLI 0.7.x, 0.7.3 or later (npm install -g meshy-cli@0.7); network access to the Meshy API."
 ---
 
 # Meshy 3D Printing
 
-Use Meshy CLI **0.7** (0.7.1 or later) to deliver the requested print files at the intended size, with
+Use Meshy CLI **0.7** (0.7.3 or later) to deliver the requested print files at the intended size, with
 analysis/repair results where applicable and a slicer handoff when requested. This skill is
 self-contained. Ordinary digital assets belong to meshy-3d-generation.
 
@@ -48,13 +48,14 @@ local dimension check cannot establish full printability.
 ## Cloud authorization
 
 Before the first command run `meshy --version`; no need to ask. When `meshy` is missing or
-older than 0.7.1, install the newest 0.7.x with `npm install -g meshy-cli@0.7` and say so in
+older than 0.7.3, install the newest 0.7.x with `npm install -g meshy-cli@0.7` and say so in
 one line; Setup covers a refused install and a CLI of 0.8 or newer. Local-only work stops at runner setup.
 Cloud work reuses a verified session. If login is needed, keep `auth login --device` running (with `--region cn` for a
 user in mainland China),
 show its URL and user code in **commentary/progress, never a final answer**, and await the
 same tool session in this turn. After it exits, verify `auth status` and resume the print job.
-Do not ask for a "done" message or credentials in chat; Setup has the host wait procedure.
+Never ask for credentials in chat, nor for a "done" message except in Setup's two-step sign-in for a
+user on a remote chat (a phone through a chat bot); Setup has the host wait procedure.
 
 ## Printing-specific constraints
 

skills/meshy-3d-printing/references/delivery.md

@@ -99,7 +99,9 @@ Deliver four things, every time:
 
 1. **The model file**, at the path the user asked for, written as a plain path in backticks.
    Do not present it as a clickable link: hosts open such links in a text/preview pane that
-   cannot render a binary mesh, and it looks broken. Offer the next real action instead —
+   cannot render a binary mesh, and it looks broken. A host with a tool that delivers files to the
+   user (dsh's `present`) gets the model through that tool as well, so it opens from the
+   conversation. Offer the next real action instead —
    reveal it in the file manager (`open -R <path>` on macOS, `explorer /select,<path>` on
    Windows), open it in a local 3D tool, or wire it into the project.
 2. **The preview**, shown inline when one exists, or an explicit note that none does.