manage-accounts

Files (3)

• SKILL.md
• openai.yaml · agents/
• provider-modes.md · references/

SKILL.md (first lines)

# Manage accounts

Use the `elegy-accounts` MCP tools. Treat account metadata, grants, leases, and request status as safe agent data. Treat credentials, OAuth codes, browser sessions, and provider tokens as broker-only data.

## Resolve access

1. State the concrete purpose and smallest named operations required by the downstream tool, such as `dns.records.read` or `deployments.create`.
2. Call `account_require` with provider, purpose, operations, and an account ID only when the user already selected one.
3. If an account is available, call `account_request_access`. Never widen operations to avoid a later approval.
4. If interaction is required, call `account_discover` and explain the runtime provider-pack choices. Use `account_present` with the request ID so Account Center opens at the exact durable checkpoint. Fall back to `account_open_center` only when there is no request yet.
5. If no suitable account exists and creation is appropriate, call `account_request_creation` with purpose and user constraints. Use `account_attention_list` to recover durable work. Poll only when useful with `account_request_status`; do not busy-wait.
6. Continue the original task only after the request reports approved/connected and the downstream provider tool accepts the capability.

For bundled GitHub and Cloudflare reads, use the typed `elegy-account-actions` tools after account resolution. The action host reuses an active read grant, requests one durable approval when needed, and keeps the credential and lease inside the broker. Never ask the user to reconnect merely because a new Codex session started.

## Human checkpoints

Stop automation and hand control to the person for CAPTCHA, MFA, terms, payment, KYC/identity verification, ambiguous plans, unexpected pages, or provider consent. Explain exactly what is waiting and how the agent will resume. Never click through, accept, solve, or bypass these boundaries without the user's direct action where policy permits.

## Browser discovery

Describe Brave discovery as "continue with your signed-in browser." It is an unverified hint until the broker validates provider identity. Never claim that Elegy imports saved passwords or cookies. Never ask the user to paste a password, session cookie, OAuth code, refresh token, or API token into chat. When a provider requires a limited token, direct capture to Account Center or the Elegy Brave extension.

## Multiple accounts and revocation

When more than one identity matches, show sanitized provider identities and ask the user to select; do not guess. Use `account_revoke_grant` when requested or when access is no longer needed. Use `account_audit_list` to explain a decision or failure without requesting secret diagnostics.

Read [references/provider-modes.md](references/provider-modes.md) only when choosing between connection methods. Pack authors use [the provider-pack contract](../../docs/provider-packs.md).

From Sofreshx/Elegy, Apache-2.0.

More from Sofreshx/Elegy