/sigcli

name: sigcli
description: Guide Claude to use SigCLI correctly — check auth, login, get credentials, configure providers, and onboard new websites. Trigger when using sig commands, editing ~/.sig/config.yaml, or needing authenticated API access.

SigCLI

Reference for using SigCLI correctly. Prevents common mistakes like inventing flags, using redacted output, or misconfiguring providers.

Constraints

These are the most common mistakes. Read them FIRST.

1. **`sig get` MUST use `--no-redaction` to get usable values.** Without it, output is `****`. This is the #1 mistake. 2. **Never invent commands.** The ONLY commands are: `init`, `doctor`, `login`, `logout`, `get`, `request`, `status`, `providers`, `rename`, `remove`, `remote`, `sync`, `watch`, `proxy`, `run`, `completion`. 3. **Never invent flags.** See Command Reference below for exact flags per command. 4. **Never invent config fields.** There is NO `requiredCookies`, `loginUrl`, `cookies`, `headers`, `authUrl`, `token`, `credentials`, or `session` field. See Provider Config Schema for the exact list. 5. **`sig login` two forms:**

• `sig login <provider>` — provider already configured in config.yaml
• `sig login https://example.com` — auto-provision (creates provider automatically). Use `--as` for a meaningful name: `sig login https://example.com --as example`

6. **`sig run` output is redacted.** It injects `SIG_<PROVIDER>_<KEY>` env vars into the child process, but redacts them in stdout. Use `env | grep SIG_` inside the child to discover var names. 7. **`sig get --format` only accepts:** `json`, `header`, `value`. Not `cookie-jar`, `env`, `raw`, etc. 8. **Provider config `extract` and `apply` are ARRAYS** (list of objects), not single objects. 9. **Don't modify existing provider configs** unless explicitly asked by the user.

Command Reference

| Command | Usage | Key Flags | | ------------ | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | `init` | `sig init` | `--remote`, `--yes`, `--force` | | `doctor` | `sig doctor` | — | | `login` | `sig login <provider>` | `--as <id>`, `--strategy oauth2`, `--token-url`, `--client-id`, `--client-secret`, `--scope`, `--mode auto\|headless\|visible`, `--network-proxy` | | `logout` | `sig logout [provider]` | — | | `get` | `sig get <provider>` | `--format json\|header\|value`, `--no-redaction` | | `request` | `sig request <url>` | `--method`, `--body`, `--header "K: V"`, `--format json\|body\|headers` | | `status` | `sig status [provider]` | `--format json\|yaml\|table\|plain` | | `providers` | `sig providers` | `--format json\|yaml\|table\|plain` | | `rename` | `sig rename <old> <new>` | — | | `remove` | `sig remove <provider>` | `--keep-config`, `--force` | | `remote` | `sig remote add\|remove\|list` | **add:** `<name> <host>` `--user`, `--path`, `--ssh-key` | | `sync` | `sig sync push\|pull [remote]` | `--provider`, `--force` | | `watch` | `sig watch add\|remove\|set-interval` | **add:** `<provider>` `--auto-sync` | | `proxy` | `sig proxy start\|stop\|status\|trust` | **start:** `--port` | | `run` | `sig run [providers...] -- <cmd>` | `--expand-cookies`, `--mount <path>`, `--mount-format env\|json` | | `completion` | `sig completion <shell>` | bash, zsh, fish |

Global: `--verbose`, `--help`

Common Patterns

Check if auth is valid

sig status <provider>
# Look for "valid": true in JSON output

Get credentials for use

# JSON with headers (most common)
sig get <provider> --no-redaction

# Just the cookie/token string
sig get <provider> --no-redaction --format value

# Inject into another command
sig run <provider> -- <command>

Login when expired

``