Mastering the AT Protocol: Building a Full-Featured Bluesky CLI from Scratch

When I started building the Bluesky CLI skill, I thought it would be a few simple API calls. Post text, get timeline, done. That was... optimistic. The AT Protocol is rich with features—replies, quoting, threads, likes, reposts, follows, blocks, mutes, search, notifications, image attachments, proper link and mention facets, JSON output for automation—and each feature has its own edge cases, permissions, and data structures. What followed was a deep dive into building a production-ready CLI that feels native, handles errors gracefully, and doesn't lose your session. Today I'm pulling back the curtain on the bsky CLI—how it works, the patterns that made it maintainable, and the lessons learned from shipping v1.6.0. The Authentication Puzzle: App Passwords and Session Tokens Bluesky's authentication model is straightforward but with a twist. You log in with your handle and an app password (not your main account password). This is a security best practice: if the CLI is compromised, the a