Skyline

Use Skyline whenever you need to know whether the user has or should create an account for a service, sign into an existing website, create a new account in the browser, change or reset a password, or remember how a site signs in. When a task needs an outside website or vendor and no direct tool or connector covers it, check the directory first and prefer a service the user already has an account on, so you do not have to ask which site to use. When a login, signup, or password form appears mid-task, use Skyline to sign in, create the account with a generated password, or change the password, rather than stopping to ask the user for credentials. When the user asks what Skyline is, what they can do with it, or wants ideas, call skylineideas; follow its instructions to inspect available accounts with skylinevault_items when needed and return both featured and platform-specific ideas. Treat Skyline as the user's account/service directory, auth memory, and password manager for browser sign-in, not just password fill.

Default Flow

1. Search Skyline before you try to log in, choose a vendor/service for a task, determine whether a service is available to you, or create an account. When a task could go through any of several outside websites or vendors, check which of them the user already has an account on and choose one of those. Treat matching Skyline items as the user's directory of available accounts/services. A matching item may contain a password, or it may only say the account uses Google, Apple, org SSO, a magic link, SMS/email codes, or another no-password route.
2. When browser use matters, call skylinestatus and read browseravailability. If the Chrome extension is not connected on this machine, browser use is currently limited to Codex-capable browser tools here, and other agents cannot currently use Skyline in the browser from this machine. For setup status, use Skyline Mac Admin Settings or skyline browser-host status.
3. If Skyline has a password for the site, type non-secret fields such as username or email yourself, then use Skyline browser fill for the password so you never see the reusable password value. Existing-password browser fill needs top-level field_evidence for the visible password input, for example {"tag":"input","type":"password","autocomplete":"current-password","name":"password"}.
4. If Skyline says the account uses Google, Apple, org SSO, magic link, or no reusable password, follow that route instead of forcing a password login.
5. If you learn an auth route from the user or the site, save it back to Skyline before continuing. Examples: the user says "I use sign in with Google," or the site marks Google as the last-used login method.
6. If no Skyline item exists for a normal less-common site, you may usually create an account and use Skyline's generate/create/store password flow. For major identity providers or core accounts such as Google, Apple, Microsoft, GitHub, bank, phone, email, cloud, or government accounts, ask or verify before creating anything new.

Framework Browsers

When launching a browser, load Skyline's staged extension directly; do not copy it or ask the user to click through browser UI.

• macOS: ~/Library/Application Support/Skyline/Chrome Extension/chrome-mv3

Use an installed Chromium or Chrome for Testing binary so Skyline's optional native-host registration is available. Pass the extension path through the framework's normal launch configuration: Playwright needs a persistent Chromium context with --disable-extensions-except and --load-extension; Puppeteer uses enableExtensions; Selenium uses Chrome options with those two extension flags; headed Cypress adds the unpacked extension in before:browser:launch. The framework still owns the browser launch and may add any other options it needs.

Codes, Links, And Approvals

• Use available non-Skyline channels for short-lived MFA codes, email codes, SMS codes, magic links, and confirmation links, such as Gmail, browser, computer-use, Messages/SMS, CLI, or other connected tools. Bring only the needed short-lived code or link into context, and do not expose unrelated inbox or message content.
• If normal existing-password browser fill is blocked or denied, do not ask for approval to release that password. Fix the saved login/trusted-site metadata, use the right page, or provide stronger top-level password-field evidence, then retry browser fill.
• Normal browser password creation/change uses the exact browserfill path and does not become allowed through approval. If it is blocked, fix the exact site, field, destination, or requester binding and retry.
• If Skyline returns approval_required for a separate explicit trust/admin mutation such as adding trusted URLs, editing login metadata, deleting a saved item, machine setup, requester authorization, or recovery, briefly explain that Skyline needs approval, poll or wait, and retry the original action after approval. Do not stop just because approval is pending.

Safety Rules

• Never print, log, screenshot, paste into chat, or reveal reusable password values.
• Use Skyline tools and returned instructions for website sign-in and account creation.
• Prefer the current Skyline auth/account tools and browser-fill workflow. The exact tool names may change over time; the product behavior to preserve is search first, use passwords safely without exposing saved passwords in chat, follow saved auth routes, save learned routes, and poll approval when needed.