What problem does it solve? Manually copying API tokens into terminals leaks secrets through shell history, screenshots, and scrollback buffers. This Skill connects a machine to a session-viz workspace using an RFC 8252 browser sign-in flow with PKCE, so no token is ever typed, pasted, or displayed in the terminal. ## Core Features & Use Cases - Browser-based OAuth flow: Mints a code verifier, opens the consent screen in the browser, and exchanges the returned code for a token over a loopback listener bound to 127.0.0.1. - Scoped tokens: Requests a contrib scope (person-blind aggregates, any member) by default or a collab scope (identity-bearing vaults and MCP, admins only) via a flag. - Verified, permissioned storage: Validates the token against the server before writing it to a config.json file with mode 0600 in a 0700 directory, with fallback paths for sandboxed harnesses via SESSION_VIZ_HOME. - Use Case: A developer installs the session-viz plugin on a new laptop and runs the setup command; a browser opens, they approve the consent screen, and the machine is connected without ever handling a credential. ## Quick Start Run the qsetup script with node to open the browser sign-in and connect this machine to your session-viz workspace.