qsetup

Connects a machine to a session-viz workspace via browser-based OAuth sign-in.

Updated Aug 14, 2026
One-click install
npx skills add https://github.com/QSchlegel/session-viz --skill qsetup-qschlegel
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: qsetup
Source: https://github.com/QSchlegel/session-viz/tree/main/plugins/session-viz/skills/qsetup
Command: npx skills add https://github.com/QSchlegel/session-viz --skill qsetup-qschlegel

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Manually copying API tokens into terminals leaks secrets through shell history, screenshots, and scrollback buffers. This Skill connects a machine to a session-viz workspace using an RFC 8252 browser sign-in flow with PKCE, so no token is ever typed, pasted, or displayed in the terminal. ## Core Features & Use Cases - Browser-based OAuth flow: Mints a code verifier, opens the consent screen in the browser, and exchanges the returned code for a token over a loopback listener bound to 127.0.0.1. - Scoped tokens: Requests a contrib scope (person-blind aggregates, any member) by default or a collab scope (identity-bearing vaults and MCP, admins only) via a flag. - Verified, permissioned storage: Validates the token against the server before writing it to a config.json file with mode 0600 in a 0700 directory, with fallback paths for sandboxed harnesses via SESSION_VIZ_HOME. - Use Case: A developer installs the session-viz plugin on a new laptop and runs the setup command; a browser opens, they approve the consent screen, and the machine is connected without ever handling a credential. ## Quick Start Run the qsetup script with node to open the browser sign-in and connect this machine to your session-viz workspace.

Frequently Asked Questions about qsetup

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I connect my machine to a session-viz workspace?▼

Run the qsetup script with node, which opens a browser consent screen for sign-in. After you approve, the script exchanges the authorization code for a token and writes it to a local config file automatically.

How do I sign in without typing an API token in the terminal?▼

The setup uses the RFC 8252 native-app flow with PKCE: a code verifier stays in the local process while the browser handles authentication. The token arrives on disk through a loopback callback, so it is never typed, pasted, or shown.

What is the difference between contrib and collab scopes?▼

The contrib scope sends person-blind aggregate findings and can be approved by any workspace member. The collab scope covers identity-bearing vaults, task handoff, and MCP access, and requires admin approval. A collab token also works for contrib operations.

Can I use qsetup on a headless or sandboxed machine?▼

Yes. On headless machines, open the printed URL from any browser that can reach the loopback address. For sandboxed harnesses that block writes, set SESSION_VIZ_HOME to a directory inside the workspace before running setup.

Why does browser sign-in to the hosted MCP server fail?▼

The server currently issues authorization codes only to the hardcoded session-viz-cli client id, so dynamically registered clients are rejected with an unknown client_id error. The MCP OAuth path is not live yet and should be left out of setup.

Where is the session-viz token stored after setup?▼

The token is written to a config.json file with mode 0600 inside a 0700 directory, located at SESSION_VIZ_HOME, XDG_CONFIG_HOME/session-viz, or ~/.config/session-viz depending on your environment. Use the --show flag to view the config with the token redacted.