fix(cli): Use correct CLI command for auth login references

.changeset/fix-auth-login-command.md

@@ -0,0 +1,8 @@
+---
+"@taskless/cli": patch
+"@taskless/skills": patch
+---
+
+Fix "auth login" to use the correct CLI command
+
+Replaced bare `taskless auth login` references with the proper `npx @taskless/cli@latest auth login` invocation in skills, generated commands, CLI error messages, and rules help text. CLI error messages now dynamically detect the invoking package manager via `npm_config_user_agent`. Skills default to `npx` with a note to prefer the project's package manager.

commands/tskl/check.md

@@ -16,10 +16,12 @@ When this skill is invoked, perform a check of the codebase using the Taskless C
 
 ## Instructions
 
-1. **Read current command documentation.** Run `pnpm dlx @taskless/cli@latest help check` and read the output. Use this to understand the command's options, output format, and exit codes.
+**Package manager:** All commands below use `npx` as the default. If the project uses a different package manager (check for `pnpm-lock.yaml`, `yarn.lock`, or `bun.lockb`), prefer its equivalent: `pnpm dlx`, `yarn dlx` (Yarn Berry/2+ only), or `bunx`.
 
-2. **Invoke the CLI with JSON output.** Run `pnpm dlx @taskless/cli@latest check --json` and capture stdout.
+1. **Read current command documentation.** Run `npx @taskless/cli@latest help check` and read the output. Use this to understand the command's options, output format, and exit codes.
+
+2. **Invoke the CLI with JSON output.** Run `npx @taskless/cli@latest check --json` and capture stdout.
 
 3. **Parse the response.** Parse the JSON output with `JSON.parse()`. Use the fields described in the help output to determine success or failure and report any issues found to the user.
 
-4. **Handle errors.** If the command exits with a non-zero code or the output is not valid JSON, report the error and suggest running `pnpm dlx @taskless/cli@latest init` if configuration is missing.
+4. **Handle errors.** If the command exits with a non-zero code or the output is not valid JSON, report the error and suggest running `npx @taskless/cli@latest init` if configuration is missing.

commands/tskl/improve.md

@@ -18,19 +18,21 @@ This is a decision-making skill. You must evaluate the situation and choose the
 
 ## Instructions
 
-1. **Check authentication status.** Run `pnpm dlx @taskless/cli@latest info --json` and parse the JSON output. Check the `loggedIn` field:
+**Package manager:** All commands below use `npx` as the default. If the project uses a different package manager (check for `pnpm-lock.yaml`, `yarn.lock`, or `bun.lockb`), prefer its equivalent: `pnpm dlx`, `yarn dlx` (Yarn Berry/2+ only), or `bunx`.
+
+1. **Check authentication status.** Run `npx @taskless/cli@latest info --json` and parse the JSON output. Check the `loggedIn` field:
    - If `loggedIn` is `true`: continue with step 2 below (API-backed flow).
    - If `loggedIn` is `false`: **stop here** and invoke the `taskless-improve-rule-anonymous` skill instead. Pass along any context the user has already provided about which rule to improve and what changes they want.
 
-2. **Read current command documentation.** Run `pnpm dlx @taskless/cli@latest help rules improve` and read the output. Use this to understand the improve command's `--from` JSON fields, options, and examples.
+2. **Read current command documentation.** Run `npx @taskless/cli@latest help rules improve` and read the output. Use this to understand the improve command's `--from` JSON fields, options, and examples.
 
 3. **Inventory existing rules.** If the user has already named a specific rule, skip to that rule directly. Otherwise, scan the `.taskless/rules/` directory for `.yml` files and present a summary. For each rule, note:
    - The rule ID (filename without `.yml`)
    - The language it targets
    - The pattern it detects (from the `message`, `note`, or `rule` fields)
    - Any associated test files in `.taskless/rule-tests/`
 
-   Once a rule is selected, check for its sidecar metadata by running `pnpm dlx @taskless/cli@latest rules meta <rule-id> --json`. If metadata exists, note the `ticketId` — this is required for the iterate API.
+   Once a rule is selected, check for its sidecar metadata by running `npx @taskless/cli@latest rules meta <rule-id> --json`. If metadata exists, note the `ticketId` — this is required for the iterate API.
 
 4. **Understand the improvement request.** Ask the user what they want to improve. Gather specifics:
    - Which rule(s) are problematic?
@@ -77,7 +79,7 @@ This is a decision-making skill. You must evaluate the situation and choose the
    ### For Option A (iterate):
 
    a. **Build the JSON payload.** Create a JSON object with:
-   - `ruleId`: The ticket ID from the rule's sidecar metadata. Retrieve it by running `pnpm dlx @taskless/cli@latest rules meta <rule-id> --json` and reading the `ticketId` field. If no metadata file exists (rule was created before metadata support), fall back to using the rule filename as the identifier. Providing the ticket ID allows the API to understand the existing rule's logic and how to adjust it based on your guidance.
+   - `ruleId`: The ticket ID from the rule's sidecar metadata. Retrieve it by running `npx @taskless/cli@latest rules meta <rule-id> --json` and reading the `ticketId` field. If no metadata file exists (rule was created before metadata support), fall back to using the rule filename as the identifier. Providing the ticket ID allows the API to understand the existing rule's logic and how to adjust it based on your guidance.
    - `guidance`: A clear, specific description of what should change. Include:
      - What the rule is doing wrong
      - What it should do instead
@@ -106,7 +108,7 @@ This is a decision-making skill. You must evaluate the situation and choose the
 
    b. **Write the JSON to a temp file.** Write to `.taskless/.tmp-improve-request.json`.
 
-   c. **Invoke the CLI.** Run `pnpm dlx @taskless/cli@latest rules improve --from .taskless/.tmp-improve-request.json --json`. The command may take 30-60 seconds as it polls the API.
+   c. **Invoke the CLI.** Run `npx @taskless/cli@latest rules improve --from .taskless/.tmp-improve-request.json --json`. The command may take 30-60 seconds as it polls the API.
 
    d. **Clean up.** After the command completes (success or failure), delete `.taskless/.tmp-improve-request.json`.
 
@@ -116,19 +118,19 @@ This is a decision-making skill. You must evaluate the situation and choose the
 
    a. Note the old rule ID for deletion.
    b. Invoke the `taskless-create-rule` skill (command name `tskl:rule`) to create the replacement rule. This ensures the full enrichment workflow (examples, exclusions, confirmation) is followed.
-   c. After the new rule is generated, delete the old rule: `pnpm dlx @taskless/cli@latest rules delete <old-rule-id>`.
+   c. After the new rule is generated, delete the old rule: `npx @taskless/cli@latest rules delete <old-rule-id>`.
    d. Report results.
 
    ### For Option C (expand):
 
    a. For each new rule needed, invoke the `taskless-create-rule` skill (command name `tskl:rule`).
-   b. If any old rules are being superseded, delete them after the new rules are created: `pnpm dlx @taskless/cli@latest rules delete <old-rule-id>`.
+   b. If any old rules are being superseded, delete them after the new rules are created: `npx @taskless/cli@latest rules delete <old-rule-id>`.
    c. Report all changes.
 
 8. **Suggest testing.** After any approach, suggest running `taskless-check` to test the updated rules against the codebase.
 
 9. **Handle errors.** If the CLI fails:
    - **Authentication required**: Suggest the `taskless-login` skill.
-   - **Missing organization info**: Suggest running `taskless auth login` to re-authenticate.
+   - **Missing organization info**: Suggest running `npx @taskless/cli@latest auth login` to re-authenticate.
    - **Rule not found**: The ruleId may be incorrect. Check the rule's metadata or suggest creating a new rule instead.
    - **API errors**: Report the error message and suggest trying again.

commands/tskl/info.md

@@ -16,9 +16,11 @@ When this skill is invoked, verify that the Taskless CLI is reachable and report
 
 ## Instructions
 
-1. **Read current command documentation.** Run `pnpm dlx @taskless/cli@latest help info` and read the output. Use this to understand the command's output format and available options.
+**Package manager:** All commands below use `npx` as the default. If the project uses a different package manager (check for `pnpm-lock.yaml`, `yarn.lock`, or `bun.lockb`), prefer its equivalent: `pnpm dlx`, `yarn dlx` (Yarn Berry/2+ only), or `bunx`.
 
-2. **Invoke the CLI.** Run `pnpm dlx @taskless/cli@latest info` and capture stdout.
+1. **Read current command documentation.** Run `npx @taskless/cli@latest help info` and read the output. Use this to understand the command's output format and available options.
+
+2. **Invoke the CLI.** Run `npx @taskless/cli@latest info` and capture stdout.
 
 3. **Parse the response.** The CLI outputs JSON to stdout. Parse it with `JSON.parse()` and extract the fields described in the help output. Key fields to report:
    - `version`: The version of the Taskless CLI.
@@ -42,7 +44,7 @@ When this skill is invoked, verify that the Taskless CLI is reachable and report
    - Suggest checking network connectivity and that npm/pnpm is available.
    - Show the raw error output if available.
 
-6. **Report if Upgrade is Required** If any installed skill is not current, include a note that an upgrade is recommended. Offer to run `pnpm dlx @taskless/cli@latest init` for them to reinitialize with the latest skills.
+6. **Report if Upgrade is Required** If any installed skill is not current, include a note that an upgrade is recommended. Offer to run `npx @taskless/cli@latest init` for them to reinitialize with the latest skills.
 
 ## Example Output
 

commands/tskl/login.md

@@ -18,6 +18,8 @@ When this skill is invoked, explain the authentication process and provide the C
 
 ## Instructions
 
-1. **Read current command documentation.** Run `pnpm dlx @taskless/cli@latest help auth login` and read the output. Use this to understand the login flow, credential storage, and alternatives.
+**Package manager:** All commands below use `npx` as the default. If the project uses a different package manager (check for `pnpm-lock.yaml`, `yarn.lock`, or `bun.lockb`), prefer its equivalent: `pnpm dlx`, `yarn dlx` (Yarn Berry/2+ only), or `bunx`.
+
+1. **Read current command documentation.** Run `npx @taskless/cli@latest help auth login` and read the output. Use this to understand the login flow, credential storage, and alternatives.
 
 2. **Present the login command and explain the process.** Using the information from the help output, display the command the user should run in their terminal and explain what will happen (device flow, credential storage, environment variable alternative).

commands/tskl/logout.md

@@ -18,6 +18,8 @@ When this skill is invoked, explain how to remove saved authentication and provi
 
 ## Instructions
 
-1. **Read current command documentation.** Run `pnpm dlx @taskless/cli@latest help auth logout` and read the output. Use this to understand what the command does, credential storage location, and any caveats.
+**Package manager:** All commands below use `npx` as the default. If the project uses a different package manager (check for `pnpm-lock.yaml`, `yarn.lock`, or `bun.lockb`), prefer its equivalent: `pnpm dlx`, `yarn dlx` (Yarn Berry/2+ only), or `bunx`.
+
+1. **Read current command documentation.** Run `npx @taskless/cli@latest help auth logout` and read the output. Use this to understand what the command does, credential storage location, and any caveats.
 
 2. **Present the logout command and explain what it does.** Using the information from the help output, display the command the user should run and explain the effects (credential removal, environment variable note).

commands/tskl/rule.md

@@ -18,11 +18,13 @@ Your goal is to produce the best possible rule by enriching the user's initial d
 
 ## Instructions
 
-1. **Check authentication status.** Run `pnpm dlx @taskless/cli@latest info --json` and parse the JSON output. Check the `loggedIn` field:
+**Package manager:** All commands below use `npx` as the default. If the project uses a different package manager (check for `pnpm-lock.yaml`, `yarn.lock`, or `bun.lockb`), prefer its equivalent: `pnpm dlx`, `yarn dlx` (Yarn Berry/2+ only), or `bunx`.
+
+1. **Check authentication status.** Run `npx @taskless/cli@latest info --json` and parse the JSON output. Check the `loggedIn` field:
    - If `loggedIn` is `true`: continue with step 2 below (API-backed flow).
    - If `loggedIn` is `false`: **stop here** and invoke the `taskless-create-rule-anonymous` skill instead. Pass along any context the user has already provided about the rule they want to create.
 
-2. **Read current command documentation.** Run `pnpm dlx @taskless/cli@latest help rules create` and read the output. Use this to understand the command's `--from` JSON fields, options, and examples.
+2. **Read current command documentation.** Run `npx @taskless/cli@latest help rules create` and read the output. Use this to understand the command's `--from` JSON fields, options, and examples.
 
 3. **Gather the rule description.** Even if the user provided a description with their command, you MUST ask clarifying questions before proceeding. Do NOT skip to rule generation. Ask what specific code pattern should be flagged, with concrete examples. This becomes the `prompt` field (required).
 
@@ -82,13 +84,13 @@ Your goal is to produce the best possible rule by enriching the user's initial d
    }
    ```
 
-8. **Invoke the CLI.** Run `pnpm dlx @taskless/cli@latest rules create --from .taskless/.tmp-rule-request.json --json`. The command may take 30-60 seconds as it polls the API.
+8. **Invoke the CLI.** Run `npx @taskless/cli@latest rules create --from .taskless/.tmp-rule-request.json --json`. The command may take 30-60 seconds as it polls the API.
 
 9. **Clean up.** After the command completes (success or failure), delete the `.taskless/.tmp-rule-request.json` file.
 
-10. **Report the results.** When the CLI completes, show the generated file paths and suggest running `taskless-check` to test the new rule. The CLI also writes sidecar metadata to `.taskless/rule-metadata/<rule-id>.yml` containing the `ticketId` used for future iterations. You can retrieve this with `pnpm dlx @taskless/cli@latest rules meta <rule-id> --json`.
+10. **Report the results.** When the CLI completes, show the generated file paths and suggest running `taskless-check` to test the new rule. The CLI also writes sidecar metadata to `.taskless/rule-metadata/<rule-id>.yml` containing the `ticketId` used for future iterations. You can retrieve this with `npx @taskless/cli@latest rules meta <rule-id> --json`.
 
 11. **Handle errors.** If the CLI fails:
     - **Authentication required**: Suggest the `taskless-login` skill.
-    - **Missing organization info**: Suggest running `taskless auth login` to re-authenticate.
+    - **Missing organization info**: Suggest running `npx @taskless/cli@latest auth login` to re-authenticate.
     - **API errors**: Report the error message and suggest trying again.

packages/cli/src/api/rules.ts

@@ -1,5 +1,6 @@
 import type { paths } from "../generated/api";
 import { createApiClient } from "./client";
+import { getCliPrefix } from "../util/package-manager";
 
 // --- Types extracted from the generated schema ---
 
@@ -56,7 +57,7 @@ export async function submitRule(
           "",
           "- Verify that your local `origin` remote points to the intended GitHub repository.",
           "- Confirm that your GitHub user/organization has access to that repository.",
-          "- If you recently changed access or remotes, try re-authenticating with `taskless auth login`.",
+          `- If you recently changed access or remotes, try re-authenticating with \`${getCliPrefix()} auth login\`.`,
         ].join("\n")
       );
     }
@@ -65,7 +66,7 @@ export async function submitRule(
       errorData.error === "organization_not_found"
     ) {
       throw new Error(
-        "Organization not found. Try running `taskless auth login` to re-authenticate."
+        `Organization not found. Try running \`${getCliPrefix()} auth login\` to re-authenticate.`
       );
     }
     throw new Error(
@@ -133,7 +134,7 @@ export async function iterateRule(
       errorData.error === "organization_not_found"
     ) {
       throw new Error(
-        "Organization not found. Try running `taskless auth login` to re-authenticate."
+        `Organization not found. Try running \`${getCliPrefix()} auth login\` to re-authenticate.`
       );
     }
     throw new Error(`Iterate request failed (HTTP ${String(response.status)})`);

packages/cli/src/auth/identity.ts

@@ -1,6 +1,7 @@
 import { getToken } from "./token";
 import { decodeOrgId } from "./jwt";
 import { resolveRepositoryUrl } from "../util/git-remote";
+import { getCliPrefix } from "../util/package-manager";
 
 export interface Identity {
   token: string;
@@ -19,14 +20,14 @@ export async function resolveIdentity(cwd: string): Promise<Identity> {
   const token = await getToken(cwd);
   if (!token) {
     throw new Error(
-      "Authentication required. Run `taskless auth login` to authenticate."
+      `Authentication required. Run \`${getCliPrefix()} auth login\` to authenticate.`
     );
   }
 
   const orgId = decodeOrgId(token);
   if (orgId === undefined) {
     throw new Error(
-      "Your auth token is missing organization info. Run `taskless auth login` to re-authenticate."
+      `Your auth token is missing organization info. Run \`${getCliPrefix()} auth login\` to re-authenticate.`
     );
   }
 

packages/cli/src/auth/token.ts

@@ -5,6 +5,7 @@ import { join } from "node:path";
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 
 import { addToGitignore } from "../filesystem/gitignore";
+import { getCliPrefix } from "../util/package-manager";
 
 const PER_REPO_AUTH_FILE = ".env.local.json";
 
@@ -117,8 +118,7 @@ function warnIfLegacyToken(): void {
   if (existsSync(legacyPath)) {
     legacyWarningShown = true;
     console.error(
-      "Notice: Found legacy global auth at %s. Global tokens are no longer used. Run `taskless auth login` to authenticate for this repository.",
-      legacyPath
+      `Notice: Found legacy global auth at ${legacyPath}. Global tokens are no longer used. Run \`${getCliPrefix()} auth login\` to authenticate for this repository.`
     );
   }
 }

packages/cli/src/help/rules-create.txt

@@ -5,7 +5,7 @@ API for generation, and writes the resulting rule and test files to
 .taskless/rules/ and .taskless/rule-tests/.
 
 Prerequisites:
-  Run `taskless auth login` to authenticate first.
+  Run `npx @taskless/cli@latest auth login` to authenticate first.
   Your repository must have a GitHub origin remote.
 
 Usage:

packages/cli/src/help/rules-improve.txt

@@ -5,7 +5,7 @@ it to the Taskless API, and writes the updated rule and test files to
 .taskless/rules/ and .taskless/rule-tests/.
 
 Prerequisites:
-  Run `taskless auth login` to authenticate first.
+  Run `npx @taskless/cli@latest auth login` to authenticate first.
   Your repository must have a GitHub origin remote.
 
 Usage:

packages/cli/src/util/package-manager.ts

@@ -0,0 +1,20 @@
+/**
+ * Detect the package manager that invoked the CLI from the
+ * npm_config_user_agent environment variable and return the
+ * appropriate `dlx`-style prefix for error messages.
+ *
+ * Falls back to `npx` when detection is not possible.
+ */
+export function getCliPrefix(): string {
+  const ua = process.env.npm_config_user_agent ?? "";
+  if (ua.startsWith("pnpm/")) return "pnpm dlx @taskless/cli@latest";
+  if (ua.startsWith("yarn/")) {
+    const major = Number.parseInt(ua.slice("yarn/".length), 10);
+    if (Number.isFinite(major) && major >= 2) {
+      return "yarn dlx @taskless/cli@latest";
+    }
+    return "npx @taskless/cli@latest";
+  }
+  if (ua.startsWith("bun/")) return "bunx @taskless/cli@latest";
+  return "npx @taskless/cli@latest";
+}