@ahood/cli 0.1.0 → 0.2.0

package/dist/commands/publish.js

@@ -1,8 +1,33 @@
-import { readFileSync, existsSync } from "node:fs";
+import { existsSync, lstatSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { pack } from "tar-stream";
 import { createGzip } from "node:zlib";
-import { apiJson } from "../http.js";
+import { apiJson, ApiError } from "../http.js";
+import { flagValue } from "../flags.js";
+import { parseOwnerSkill, SEMVER_RE } from "../spec.js";
+// Processing (decompress/validate/checksum/scan/upload) now happens in a
+// background workflow, not inline in versions/complete's response (server
+// issue #120) -- complete returns 202 immediately, so this polls
+// GET .../versions/{version} (which now returns {status, failure_reason}
+// even for a non-published row) until the version leaves 'processing'.
+const POLL_INTERVAL_MS = 1500;
+const POLL_TIMEOUT_MS = 120_000;
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function pollVersionStatus(owner, skill, version) {
+    const path = `/api/v1/skills/${encodeURIComponent(owner)}/${encodeURIComponent(skill)}/versions/${encodeURIComponent(version)}`;
+    const deadline = Date.now() + POLL_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+        const result = await apiJson(path);
+        if (result.status !== "processing")
+            return result;
+        await sleep(POLL_INTERVAL_MS);
+    }
+    throw new Error(`Still processing after ${POLL_TIMEOUT_MS / 1000}s -- check \`ahood view ${owner}/${skill}\` later for the result.`);
+}
+const USAGE = "Usage: ahood publish <owner>/<skill>@<version> [--path <dir>] [--name <text>] [--tagline <text>] [--tags <comma,separated>] [--license <id>] [--homepage <url>] [--repository <url>]\n" +
+    "   or: ahood publish <path> --owner <owner> --slug <skill> --version <x.y.z>";
 // Matched by ENTRY NAME at every depth, not by path prefix, so a nested
 // `vendor/thing/.git` is skipped the same as a top-level one. Not a
 // .gitignore parser (out of scope) -- just the fixed set of names that must
@@ -13,17 +38,31 @@ import { apiJson } from "../http.js";
 //                32+ hex) do not match.
 //   node_modules -- never part of a skill, and megabytes of it.
 //   .env / .env.* -- the single most likely place a real secret lives.
+//   .npmrc / .yarnrc.yml / .netrc / .pypirc -- package-manager/network auth
+//                tokens (npm_..., ghp_...) that don't match the server
+//                scanner's regexes either.
+//   id_rsa / id_ed25519 / id_ecdsa / id_dsa (+ .pub) / .ssh -- SSH keys.
+//   .aws / .docker -- cloud and registry credentials.
 //   .DS_Store -- noise.
-const EXCLUDED_NAMES = new Set([".git", "node_modules", ".DS_Store"]);
+const EXCLUDED_NAMES = new Set([
+    ".git",
+    "node_modules",
+    ".DS_Store",
+    ".npmrc",
+    ".yarnrc.yml",
+    ".netrc",
+    ".pypirc",
+    ".ssh",
+    ".aws",
+    ".docker",
+]);
+const EXCLUDED_PREFIXES = [".env", "id_rsa", "id_ed25519", "id_ecdsa", "id_dsa"];
 function isExcluded(name) {
     if (EXCLUDED_NAMES.has(name))
         return true;
-    if (name === ".env" || name.startsWith(".env."))
-        return true;
-    return false;
+    return EXCLUDED_PREFIXES.some((prefix) => name === prefix || name.startsWith(`${prefix}.`));
 }
 async function tarGzDirectory(dir) {
-    const { readdirSync, statSync } = await import("node:fs");
     const tar = pack();
     const gzip = createGzip();
     const chunks = [];
@@ -33,11 +72,19 @@ async function tarGzDirectory(dir) {
                 continue;
             const fullPath = join(current, entry);
             const relPath = prefix ? `${prefix}/${entry}` : entry;
-            const stat = statSync(fullPath);
+            // lstat, not stat -- following a symlink here would pack whatever it
+            // points at (anywhere on disk, or a parent directory causing unbounded
+            // recursion) under an innocuous-looking name, completely bypassing the
+            // exclusion list above, which only ever matches by name.
+            const stat = lstatSync(fullPath);
+            if (stat.isSymbolicLink()) {
+                console.warn(`WARNING: skipping symlink, not publishing it: ${relPath}`);
+                continue;
+            }
             if (stat.isDirectory()) {
                 addDir(fullPath, relPath);
             }
-            else {
+            else if (stat.isFile()) {
                 tar.entry({ name: relPath, size: stat.size }, readFileSync(fullPath));
             }
         }
@@ -51,36 +98,99 @@ async function tarGzDirectory(dir) {
         tar.pipe(gzip);
     });
 }
+function parsePublishArgs(args) {
+    const pathFlag = flagValue(args, "--path");
+    let owner = flagValue(args, "--owner");
+    let skill = flagValue(args, "--slug");
+    let version = flagValue(args, "--version");
+    const name = flagValue(args, "--name");
+    const tagline = flagValue(args, "--tagline");
+    const tags = flagValue(args, "--tags");
+    const license = flagValue(args, "--license");
+    const homepage = flagValue(args, "--homepage");
+    const repository = flagValue(args, "--repository");
+    let legacyPath;
+    const first = args[0];
+    if (first && !first.startsWith("--")) {
+        if (first.includes("/") && first.includes("@")) {
+            // Primary form: ahood publish <owner>/<skill>@<version>
+            const parsed = parseOwnerSkill(first.slice(0, first.lastIndexOf("@")), USAGE);
+            owner = owner ?? parsed.owner;
+            skill = skill ?? parsed.skill;
+            version = version ?? first.slice(first.lastIndexOf("@") + 1);
+        }
+        else {
+            // Legacy form: ahood publish <path> --owner ... --slug ... --version ...
+            legacyPath = first;
+        }
+    }
+    if (!owner || !skill || !version)
+        throw new Error(USAGE);
+    if (!SEMVER_RE.test(version)) {
+        throw new Error(`--version must be a semver like 1.2.3 (got "${version}").\n${USAGE}`);
+    }
+    return { owner, skill, version, path: pathFlag ?? legacyPath ?? ".", name, tagline, tags, license, homepage, repository };
+}
+// Creates the skill under the caller's own account when versions/init 404s
+// -- skill creation is CLI-only now (there is no separate `ahood create`;
+// publish creates on first use). --name is required for this path since
+// createSkill requires a name; --tagline/--tags/--license/--homepage/
+// --repository are optional and only used here, never applied to an
+// already-existing skill.
+async function createSkillForPublish(owner, skill, opts) {
+    if (!opts.name) {
+        throw new Error(`${owner}/${skill} doesn't exist yet -- pass --name to create it as part of this publish (e.g. --name "My Skill").`);
+    }
+    const body = { slug: skill, name: opts.name };
+    if (opts.tagline !== undefined)
+        body.tagline = opts.tagline;
+    if (opts.tags !== undefined)
+        body.tags = opts.tags.split(",").map((t) => t.trim()).filter(Boolean);
+    if (opts.license !== undefined)
+        body.license = opts.license;
+    if (opts.homepage !== undefined)
+        body.homepage = opts.homepage;
+    if (opts.repository !== undefined)
+        body.repository = opts.repository;
+    const created = await apiJson("/api/v1/skills", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+    });
+    // POST /api/v1/skills always creates under the authenticated caller's own
+    // account -- it never reads an owner from the request body. If the caller
+    // typed a different owner segment than their own username, the created
+    // skill lives at a path that doesn't match what they asked to publish to.
+    if (created.owner !== owner) {
+        throw new Error(`Created ${created.owner}/${created.slug}, but this publish targeted "${owner}/${skill}" -- skills ` +
+            `are always created under your own account (${created.owner}). Retry with: ` +
+            `ahood publish ${created.owner}/${skill}@<version>.`);
+    }
+    console.log(`Created ${created.owner}/${created.slug} -- publishing its first version now.`);
+}
+async function initVersion(owner, skill, version, packageSizeBytes, createOpts) {
+    const path = `/api/v1/skills/${encodeURIComponent(owner)}/${encodeURIComponent(skill)}/versions/init`;
+    const body = JSON.stringify({ version, package_size_bytes: packageSizeBytes });
+    try {
+        return await apiJson(path, { method: "POST", headers: { "Content-Type": "application/json" }, body });
+    }
+    catch (error) {
+        if (!(error instanceof ApiError) || error.status !== 404)
+            throw error;
+        await createSkillForPublish(owner, skill, createOpts);
+        // Retry exactly once. If this ALSO 404s (e.g. a race, or the create
+        // silently didn't take), let that error propagate rather than looping.
+        return await apiJson(path, { method: "POST", headers: { "Content-Type": "application/json" }, body });
+    }
+}
 export async function publish(args) {
-    const path = args[0] ?? ".";
+    const { owner, skill, version, path, name, tagline, tags, license, homepage, repository } = parsePublishArgs(args);
     const skillMdPath = join(path, "SKILL.md");
     if (!existsSync(skillMdPath)) {
         throw new Error(`No SKILL.md found at ${skillMdPath} -- publish must point at a skill folder's root.`);
     }
-    // A real ahood CLI would parse owner/slug/version/name out of SKILL.md
-    // frontmatter or a companion manifest -- this MVP takes them as explicit
-    // flags, matching how `versions/init`'s API itself requires them
-    // separately from the archive. Kept simple: --slug, --owner, --version are
-    // required; metadata creation (POST /skills) is assumed already done via
-    // the web UI or a prior publish -- this command only pushes a NEW VERSION
-    // of an existing skill, matching the ADR's "publish tars, calls
-    // versions/init -> upload -> versions/complete" description exactly (it
-    // does not create the skill's top-level metadata row).
-    const ownerIndex = args.indexOf("--owner");
-    const slugIndex = args.indexOf("--slug");
-    const versionIndex = args.indexOf("--version");
-    const owner = ownerIndex >= 0 ? args[ownerIndex + 1] : undefined;
-    const slug = slugIndex >= 0 ? args[slugIndex + 1] : undefined;
-    const version = versionIndex >= 0 ? args[versionIndex + 1] : undefined;
-    if (!owner || !slug || !version) {
-        throw new Error("Usage: ahood publish <path> --owner <owner> --slug <skill> --version <x.y.z>");
-    }
     const archive = await tarGzDirectory(path);
-    const init = await apiJson(`/api/v1/skills/${owner}/${slug}/versions/init`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ version, package_size_bytes: archive.length }),
-    });
+    const init = await initVersion(owner, skill, version, archive.length, { name, tagline, tags, license, homepage, repository });
     // TS's lib.dom BodyInit (in scope here since tsconfig has no explicit
     // "lib" override, so DOM is included alongside the Node types) type-checks
     // Buffer/Uint8Array against `Uint8Array<ArrayBuffer>` specifically as of
@@ -92,13 +202,24 @@ export async function publish(args) {
     // restriction. Asserting through BodyInit here, rather than reshaping
     // tsconfig's "lib" for the whole package, keeps this fix local to the one
     // call site.
-    const putRes = await fetch(init.upload_url, { method: "PUT", body: archive });
-    if (!putRes.ok)
-        throw new Error(`Upload failed with status ${putRes.status}`);
-    const complete = await apiJson(`/api/v1/skills/${owner}/${slug}/versions/complete`, {
+    const putRes = await fetch(init.upload_url, {
+        method: "PUT",
+        body: archive,
+        signal: AbortSignal.timeout(120_000),
+    });
+    if (!putRes.ok) {
+        const body = await putRes.text().catch(() => "");
+        throw new Error(`Upload failed with status ${putRes.status}${body ? `: ${body}` : ""} (version_id: ${init.version_id}, retry with the same command once the underlying issue is fixed).`);
+    }
+    await apiJson(`/api/v1/skills/${encodeURIComponent(owner)}/${encodeURIComponent(skill)}/versions/complete`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ version_id: init.version_id }),
     });
-    console.log(`Published ${owner}/${slug}@${complete.version} (${complete.status})`);
+    console.log(`Uploaded ${owner}/${skill}@${version} -- processing...`);
+    const result = await pollVersionStatus(owner, skill, version);
+    if (result.status === "failed") {
+        throw new Error(`Publish failed: ${result.failure_reason ?? "unknown reason"}`);
+    }
+    console.log(`Published ${owner}/${skill}@${result.version} (${result.status})`);
 }

package/dist/commands/remove.js

@@ -1,25 +1,30 @@
-import { rmSync, rmdirSync, readdirSync, existsSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, readdirSync, rmSync, rmdirSync } from "node:fs";
+import { dirname } from "node:path";
 import { removeLockfileEntry } from "../lockfile.js";
+import { LOCKFILE_PATH, parseOwnerSkill, skillDir } from "../spec.js";
+const USAGE = "Usage: ahood remove <owner>/<skill>";
 export async function remove(args) {
     const spec = args[0];
     if (!spec)
-        throw new Error("Usage: ahood remove <owner>/<skill>");
-    const [owner, skill] = spec.split("/");
-    if (!owner || !skill)
-        throw new Error("Usage: ahood remove <owner>/<skill>");
-    // Must mirror add.ts's owner-namespaced destDir exactly -- keyed on the
-    // slug alone, `remove bob/utils` deleted alice/utils' files.
-    const dir = join(".claude", "skills", owner, skill);
-    if (existsSync(dir))
+        throw new Error(USAGE);
+    const { owner, skill } = parseOwnerSkill(spec, USAGE);
+    const key = `${owner}/${skill}`;
+    const dir = skillDir(owner, skill);
+    const dirExisted = existsSync(dir);
+    if (dirExisted)
         rmSync(dir, { recursive: true, force: true });
     // Sweep the owner directory once it holds nothing, so uninstalling an
     // owner's last skill doesn't leave an empty namespace folder behind (npm
     // does the same with node_modules/@scope). Guarded on emptiness, so another
     // skill by the same owner is never touched.
-    const ownerDir = join(".claude", "skills", owner);
+    const ownerDir = dirname(dir);
     if (existsSync(ownerDir) && readdirSync(ownerDir).length === 0)
         rmdirSync(ownerDir);
-    removeLockfileEntry(join(".claude", "skills.lock.json"), spec);
-    console.log(`Removed ${spec}`);
+    const hadLockfileEntry = removeLockfileEntry(LOCKFILE_PATH, key);
+    if (!dirExisted && !hadLockfileEntry) {
+        console.error(`${key} was not installed -- nothing to remove.`);
+        process.exitCode = 1;
+        return;
+    }
+    console.log(`Removed ${key}`);
 }

package/dist/commands/search.js

@@ -1,14 +1,35 @@
 import { apiJson } from "../http.js";
+import { flagValue } from "../flags.js";
+const USAGE = "Usage: ahood search <query> [--json] [--limit <n>]";
 export async function search(args) {
-    const query = args.join(" ");
+    const jsonOutput = args.includes("--json");
+    const limit = flagValue(args, "--limit");
+    const queryParts = args.filter((a, i) => a !== "--json" && a !== "--limit" && args[i - 1] !== "--limit");
+    const unknownFlag = queryParts.find((a) => a.startsWith("--"));
+    if (unknownFlag)
+        throw new Error(`Unknown flag: ${unknownFlag}\n${USAGE}`);
+    const query = queryParts.join(" ");
     if (!query)
-        throw new Error("Usage: ahood search <query>");
-    const { skills } = await apiJson(`/api/v1/skills?q=${encodeURIComponent(query)}`);
+        throw new Error(USAGE);
+    if (limit !== undefined && (!/^\d+$/.test(limit) || Number(limit) < 1)) {
+        throw new Error(`--limit must be a positive integer (got "${limit}").\n${USAGE}`);
+    }
+    const qs = new URLSearchParams({ q: query });
+    if (limit !== undefined)
+        qs.set("limit", limit);
+    const { skills } = await apiJson(`/api/v1/skills?${qs}`);
+    if (jsonOutput) {
+        console.log(JSON.stringify(skills));
+        return;
+    }
     if (skills.length === 0) {
         console.log("No skills found.");
         return;
     }
     for (const skill of skills) {
-        console.log(`${skill.profiles.username}/${skill.slug} — ${skill.name}${skill.tagline ? `: ${skill.tagline}` : ""} (${skill.downloads_count} downloads)`);
+        console.log(`${skill.profiles.username}/${skill.slug} - ${skill.name}${skill.tagline ? `: ${skill.tagline}` : ""} (${skill.downloads_count} downloads)`);
+    }
+    if (limit !== undefined && skills.length >= Number(limit)) {
+        console.log(`(showing up to ${limit} results -- pass a higher --limit for more)`);
     }
 }

package/dist/commands/star.js

@@ -1,26 +1,23 @@
 import { apiJson } from "../http.js";
+import { parseOwnerSkill } from "../spec.js";
 // Mirrors POST/DELETE /api/v1/skills/{owner}/{skill}/star -- both are
 // idempotent server-side (POST upserts on the stars table's
 // unique(skill_id, user_id) constraint with ignoreDuplicates, DELETE just
 // deletes any matching row), so starring an already-starred skill or
 // unstarring one you never starred is a no-op 200, not an error.
 export async function star(args) {
-    const spec = args[0];
-    if (!spec)
-        throw new Error("Usage: ahood star <owner>/<skill>");
-    const [owner, skill] = spec.split("/");
-    if (!owner || !skill)
-        throw new Error("Usage: ahood star <owner>/<skill>");
-    await apiJson(`/api/v1/skills/${owner}/${skill}/star`, { method: "POST" });
+    const USAGE = "Usage: ahood star <owner>/<skill>";
+    const { owner, skill } = parseOwnerSkill(args[0] ?? "", USAGE);
+    await apiJson(`/api/v1/skills/${encodeURIComponent(owner)}/${encodeURIComponent(skill)}/star`, {
+        method: "POST",
+    });
     console.log(`Starred ${owner}/${skill}.`);
 }
 export async function unstar(args) {
-    const spec = args[0];
-    if (!spec)
-        throw new Error("Usage: ahood unstar <owner>/<skill>");
-    const [owner, skill] = spec.split("/");
-    if (!owner || !skill)
-        throw new Error("Usage: ahood unstar <owner>/<skill>");
-    await apiJson(`/api/v1/skills/${owner}/${skill}/star`, { method: "DELETE" });
+    const USAGE = "Usage: ahood unstar <owner>/<skill>";
+    const { owner, skill } = parseOwnerSkill(args[0] ?? "", USAGE);
+    await apiJson(`/api/v1/skills/${encodeURIComponent(owner)}/${encodeURIComponent(skill)}/star`, {
+        method: "DELETE",
+    });
     console.log(`Unstarred ${owner}/${skill}.`);
 }

package/dist/commands/token.js

@@ -5,11 +5,11 @@ export async function token(args) {
         case "create":
             return tokenCreate(rest);
         case "list":
-            return tokenList();
+            return tokenList(rest);
         case "revoke":
             return tokenRevoke(rest);
         default:
-            throw new Error("Usage: ahood token create|list|revoke");
+            throw new Error("Usage: ahood token create <name>|list [--json]|revoke <id>");
     }
 }
 async function tokenCreate(args) {
@@ -32,20 +32,25 @@ async function tokenCreate(args) {
     console.log(`Created token "${result.name}": ${result.token}`);
     console.log("Copy this now -- it will not be shown again.");
 }
-async function tokenList() {
+async function tokenList(args) {
+    const jsonOutput = args.includes("--json");
     const { tokens } = await apiJson("/api/v1/auth/tokens");
+    if (jsonOutput) {
+        console.log(JSON.stringify(tokens));
+        return;
+    }
     if (tokens.length === 0) {
         console.log("No tokens.");
         return;
     }
     for (const t of tokens) {
-        console.log(`${t.id}  ${t.name}  ${t.token_prefix}…  ${t.scopes.join(",")}${t.revoked_at ? "  (revoked)" : ""}`);
+        console.log(`${t.id}  ${t.name}  ${t.token_prefix}...  ${t.scopes.join(",")}${t.revoked_at ? "  (revoked)" : ""}`);
     }
 }
 async function tokenRevoke(args) {
     const id = args[0];
     if (!id)
         throw new Error("Usage: ahood token revoke <id>");
-    await apiJson(`/api/v1/auth/tokens/${id}`, { method: "DELETE" });
+    await apiJson(`/api/v1/auth/tokens/${encodeURIComponent(id)}`, { method: "DELETE" });
     console.log(`Revoked ${id}`);
 }

package/dist/commands/unpublish.js

@@ -1,32 +1,49 @@
-import { createInterface } from "node:readline/promises";
+import { createInterface } from "node:readline";
 import { apiJson } from "../http.js";
-// Confirmation is required and has no --yes/--force bypass -- this deletes
-// the skill for every consumer who has ever `ahood add`ed it, not just the
-// local install (that's `ahood remove`). If a non-interactive/CI use case
-// shows up later, add an explicit --yes flag then; defaulting to one now
-// would make the destructive path the easy one.
-async function confirm(promptText) {
+import { parseOwnerSkill } from "../spec.js";
+const USAGE = "Usage: ahood unpublish <owner>/<skill> [--yes]";
+// On closed/non-interactive stdin, readline/promises' rl.question() promise
+// never settles -- but since nothing else keeps the event loop alive at that
+// point, the process used to exit 0 anyway once the loop drained, having
+// printed only the prompt (no "Aborted.", no deletion, no error: a silent
+// false success). The plain callback-style API is used instead specifically
+// so the "close" listener can be a reliable signal for "closed without ever
+// answering": `settled` is set synchronously inside the answer callback,
+// before rl.close() is called, so that same close doesn't self-reject.
+function confirm(promptText) {
     const rl = createInterface({ input: process.stdin, output: process.stdout });
-    try {
-        const answer = await rl.question(promptText);
-        return answer.trim().toLowerCase() === "yes";
-    }
-    finally {
-        rl.close();
-    }
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        rl.once("close", () => {
+            if (settled)
+                return;
+            settled = true;
+            reject(new Error("Confirmation was not answered (stdin closed)."));
+        });
+        rl.question(promptText, (answer) => {
+            settled = true;
+            rl.close();
+            resolve(answer.trim().toLowerCase() === "yes");
+        });
+    });
 }
 export async function unpublish(args) {
-    const spec = args[0];
+    const yes = args.includes("--yes");
+    const spec = args.find((a) => !a.startsWith("--"));
     if (!spec)
-        throw new Error("Usage: ahood unpublish <owner>/<skill>");
-    const [owner, skill] = spec.split("/");
-    if (!owner || !skill)
-        throw new Error("Usage: ahood unpublish <owner>/<skill>");
-    const confirmed = await confirm(`This will permanently delete ${owner}/${skill} for everyone who has installed it. Type "yes" to confirm: `);
+        throw new Error(USAGE);
+    const { owner, skill } = parseOwnerSkill(spec, USAGE);
+    const key = `${owner}/${skill}`;
+    // --yes bypasses the prompt for scripts/CI; otherwise a closed stdin (no
+    // TTY, no piped answer either) now throws via confirm()'s "close" handling
+    // instead of silently exiting 0 with nothing prompted, confirmed, or done.
+    const confirmed = yes
+        ? true
+        : await confirm(`This will permanently delete ${key} for everyone who has installed it. Type "yes" to confirm: `);
     if (!confirmed) {
         console.log("Aborted.");
         return;
     }
-    await apiJson(`/api/v1/skills/${owner}/${skill}`, { method: "DELETE" });
-    console.log(`Unpublished ${owner}/${skill}. Run \`ahood remove ${owner}/${skill}\` to also remove your local copy.`);
+    await apiJson(`/api/v1/skills/${encodeURIComponent(owner)}/${encodeURIComponent(skill)}`, { method: "DELETE" });
+    console.log(`Unpublished ${key}. Run \`ahood remove ${key}\` to also remove your local copy.`);
 }

package/dist/commands/update.js

@@ -1,20 +1,37 @@
+import { LOCKFILE_PATH } from "../spec.js";
 import { readLockfile } from "../lockfile.js";
 import { add } from "./add.js";
 // `update` is the only command that moves the lockfile pin forward -- `add`
 // always resolves and pins whatever version it's given (or latest, once,
 // at install time), matching the ADR's "reproducible by default" design.
 export async function update(args) {
-    const lockfile = readLockfile(".claude/skills.lock.json");
+    const lockfile = readLockfile(LOCKFILE_PATH);
     const targets = args.length > 0 ? args : Object.keys(lockfile);
     if (targets.length === 0) {
         console.log("No installed skills to update.");
         return;
     }
+    const failures = [];
     for (const ownerSlashSkill of targets) {
-        if (!lockfile[ownerSlashSkill]) {
+        if (!lockfile[ownerSlashSkill] && args.length === 0) {
+            // Only reachable when targets came from the lockfile itself, so this
+            // would mean the lockfile changed under us mid-loop -- skip, don't abort.
             console.warn(`Skipping ${ownerSlashSkill}: not currently installed.`);
             continue;
         }
-        await add([ownerSlashSkill]); // no @version -- resolves to latest again
+        try {
+            await add([ownerSlashSkill]); // no @version -- resolves to latest again
+        }
+        catch (error) {
+            // One skill being removed/yanked/unreachable must not stop every other
+            // skill in the batch from updating.
+            const message = error instanceof Error ? error.message : String(error);
+            console.error(`Failed to update ${ownerSlashSkill}: ${message}`);
+            failures.push(ownerSlashSkill);
+        }
+    }
+    if (failures.length > 0) {
+        console.error(`${failures.length} of ${targets.length} skill(s) failed to update: ${failures.join(", ")}`);
+        process.exitCode = 1;
     }
 }

package/dist/commands/view.js

@@ -0,0 +1,49 @@
+import { spawn } from "node:child_process";
+import { apiJson } from "../http.js";
+import { getApiUrl } from "../config.js";
+import { parseOwnerSkill } from "../spec.js";
+const USAGE = "Usage: ahood view <owner>/<skill> [--json] [--web]";
+// Spawned with argv as an array (not a shell string), so a crafted owner/skill
+// can never inject shell syntax -- and both segments are already restricted
+// to a safe charset by parseOwnerSkill before this ever runs.
+function openBrowser(url) {
+    try {
+        if (process.platform === "win32") {
+            spawn("cmd", ["/c", "start", "", url], { stdio: "ignore", detached: true }).unref();
+        }
+        else if (process.platform === "darwin") {
+            spawn("open", [url], { stdio: "ignore", detached: true }).unref();
+        }
+        else {
+            spawn("xdg-open", [url], { stdio: "ignore", detached: true }).unref();
+        }
+    }
+    catch {
+        console.log(`Open this URL in your browser: ${url}`);
+    }
+}
+export async function view(args) {
+    const jsonOutput = args.includes("--json");
+    const web = args.includes("--web");
+    const spec = args.find((a) => !a.startsWith("--"));
+    if (!spec)
+        throw new Error(USAGE);
+    const { owner, skill } = parseOwnerSkill(spec, USAGE);
+    const url = `${getApiUrl()}/${owner}/${skill}`;
+    if (web) {
+        openBrowser(url);
+        return;
+    }
+    const detail = await apiJson(`/api/v1/skills/${encodeURIComponent(owner)}/${encodeURIComponent(skill)}`);
+    if (jsonOutput) {
+        console.log(JSON.stringify(detail));
+        return;
+    }
+    console.log(`${owner}/${detail.slug} (${detail.visibility})`);
+    console.log(detail.name);
+    if (detail.tagline)
+        console.log(detail.tagline);
+    console.log(`${detail.downloads_count} downloads, ${detail.stars_count} stars`);
+    console.log(detail.skill_versions ? `latest version: ${detail.skill_versions.version}` : "no published version");
+    console.log(url);
+}

package/dist/commands/whoami.js

@@ -1,9 +1,17 @@
 import { ApiError, apiJson } from "../http.js";
 import { resolveToken } from "../credentials.js";
-export async function whoami() {
+export async function whoami(args = []) {
+    const wantsJson = args.includes("--json");
     const token = resolveToken();
     if (!token) {
-        console.log("Not logged in. Run `ahood login`.");
+        // Previously exited 0 here, defeating whoami's purpose as a scriptable
+        // auth check -- "no token configured at all" must fail just like "token
+        // rejected by the server" does below.
+        if (wantsJson)
+            console.log(JSON.stringify({ authenticated: false }));
+        else
+            console.error("Not logged in. Run `ahood login` (or set AHOOD_TOKEN).");
+        process.exitCode = 1;
         return;
     }
     // There is no endpoint that returns an identity for a bearer caller yet, so
@@ -16,21 +24,38 @@ export async function whoami() {
     //          being a token rather than a session. The token is valid.
     //   401 -> resolveCaller could not resolve the token at all: unknown,
     //          revoked, or expired.
+    //   anything else (network failure, 5xx, timeout) is NOT the same as an
+    //          invalid token, and is reported as its own distinct failure.
     try {
         await apiJson("/api/v1/auth/tokens");
         // A session-backed caller (only reachable if this ever runs against a
         // cookie-bearing client) -- the token list came back.
-        console.log("Authenticated.");
+        if (wantsJson)
+            console.log(JSON.stringify({ authenticated: true, mode: "session" }));
+        else
+            console.log("Authenticated.");
     }
     catch (error) {
         if (error instanceof ApiError && error.status === 403) {
-            console.log("Authenticated with a personal API token.");
+            if (wantsJson)
+                console.log(JSON.stringify({ authenticated: true, mode: "token" }));
+            else
+                console.log("Authenticated with a personal API token.");
+            return;
+        }
+        if (error instanceof ApiError && error.status === 401) {
+            if (wantsJson)
+                console.log(JSON.stringify({ authenticated: false, reason: "invalid_token" }));
+            else
+                console.error("Not authenticated -- your token is invalid or has been revoked.");
+            process.exitCode = 1;
             return;
         }
-        // 401 and anything else (network failure, 5xx) are both "we could not
-        // confirm this token works" -- exit non-zero so `ahood whoami` is
-        // usable as a scriptable auth check.
-        console.error("Not authenticated -- your token is invalid or has been revoked.");
+        const message = error instanceof Error ? error.message : String(error);
+        if (wantsJson)
+            console.log(JSON.stringify({ authenticated: null, error: message }));
+        else
+            console.error(`Could not verify your token: ${message}`);
         process.exitCode = 1;
     }
 }