@ahood/cli 0.2.0 → 0.2.2

package/README.md

@@ -39,7 +39,7 @@ For CI or any non-interactive environment, set `AHOOD_TOKEN` instead of running
 | `ahood logout` | Removes the stored token. |
 | `ahood whoami [--json]` | Reports whether your stored token still authenticates. |
 | `ahood search <query> [--json] [--limit <n>]` | Search published skills. |
-| `ahood view <owner>/<skill> [--json] [--web]` | Show a single skill's details without installing it, or open its page in a browser. |
+| `ahood view <owner>/<skill> [--json] [--web]` (alias: `show`) | Show a single skill's details -- tags, license, homepage, repository, dates, etc. -- without installing it, or open its page in a browser. |
 | `ahood list-mine [--json]` | List your own skills, public and private, with their visibility and download/star counts. |
 | `ahood add <owner>/<skill>[@version]` | Install into `.claude/skills/<owner>/<skill>/`, pinned in `.claude/skills.lock.json`. |
 | `ahood update [<owner>/<skill> ...]` | Move the lockfile pin(s) forward to the latest version. One skill failing to update doesn't stop the rest. |
@@ -63,6 +63,6 @@ Run `ahood help`, `ahood help <command>`, or `ahood <command> --help` for the sa
 | `2` | Usage or validation error (bad arguments, or the server rejected the request as invalid) |
 | `4` | Authentication required or rejected (not logged in, or the token was refused) |
 | `5` | Not found |
-| `6` | Network/transport error |
+| `6` | Network/transport error, or an upstream server (5xx) error |
 
 Full reference, including personal API tokens, CI usage, the public REST API, and the MCP server: **https://ahood.vercel.app/docs**

package/dist/commands/view.js

@@ -39,11 +39,22 @@ export async function view(args) {
         console.log(JSON.stringify(detail));
         return;
     }
-    console.log(`${owner}/${detail.slug} (${detail.visibility})`);
-    console.log(detail.name);
+    const field = (label, value) => console.log(`  ${label.padEnd(13)}${value}`);
+    console.log(`${detail.owner}/${detail.slug}`);
+    field("name:", detail.name);
     if (detail.tagline)
-        console.log(detail.tagline);
-    console.log(`${detail.downloads_count} downloads, ${detail.stars_count} stars`);
-    console.log(detail.skill_versions ? `latest version: ${detail.skill_versions.version}` : "no published version");
+        field("tagline:", detail.tagline);
+    field("tags:", detail.tags.length > 0 ? detail.tags.join(", ") : "-");
+    field("license:", detail.license ?? "-");
+    field("visibility:", detail.visibility);
+    field("homepage:", detail.homepage ?? "-");
+    field("repository:", detail.repository ?? "-");
+    field("version:", detail.skill_versions ? detail.skill_versions.version : "no published version");
+    field("downloads:", String(detail.downloads_count));
+    field("stars:", String(detail.stars_count));
+    field("created:", detail.created_at);
+    field("updated:", detail.updated_at);
+    if (detail.is_starred !== null)
+        field("starred:", detail.is_starred ? "yes" : "no");
     console.log(url);
 }

package/dist/exit-code.js

@@ -0,0 +1,26 @@
+import { ApiError, NetworkError } from "./http.js";
+// A hung/black-holed connection throws undici's generic TypeError("fetch
+// failed") -- http.ts wraps that into NetworkError so it gets its own exit
+// code here, distinct from a server-returned ApiError. Kept in its own
+// module (rather than inline in index.ts) so it's importable in tests
+// without triggering index.ts's unconditional top-level main() call.
+export function exitCodeFor(error) {
+    if (error instanceof ApiError) {
+        if (error.status === 401 || error.status === 403)
+            return 4;
+        if (error.status === 404)
+            return 5;
+        // A 5xx is an upstream/server-side failure, not something wrong with the
+        // request -- previously fell through to 2 ("usage/validation error"),
+        // which told scripts/agents to fix their input when the actual problem
+        // was on the server (ahood-cli#31). Treated like a network/transport
+        // failure (6) since neither is something retrying with different input
+        // would fix.
+        if (error.status >= 500)
+            return 6;
+        return 2;
+    }
+    if (error instanceof NetworkError)
+        return 6;
+    return 1;
+}

package/dist/help.js

@@ -17,7 +17,7 @@ export const COMMANDS_HELP = [
     },
     {
         usage: "ahood view <owner>/<skill> [--json] [--web]",
-        desc: "Show a single skill's details without installing it.",
+        desc: "Show a single skill's details (tags, license, homepage, repository, dates, etc.) without installing it. Alias: ahood show.",
         flags: [
             "--json   Emit the raw skill object instead of formatted lines.",
             "--web    Open the skill's page in your browser instead of printing.",
@@ -89,8 +89,10 @@ export const COMMANDS_HELP = [
         examples: ["ahood completion bash >> ~/.bashrc"],
     },
 ];
+const COMMAND_ALIASES = { show: "view" };
 export function findCommandHelp(command) {
-    return COMMANDS_HELP.find((c) => c.usage.startsWith(`ahood ${command} `) || c.usage === `ahood ${command}`);
+    const resolved = COMMAND_ALIASES[command] ?? command;
+    return COMMANDS_HELP.find((c) => c.usage.startsWith(`ahood ${resolved} `) || c.usage === `ahood ${resolved}`);
 }
 export function formatCommandHelp(entry) {
     const lines = [entry.usage, "", entry.desc];
@@ -118,7 +120,8 @@ export function formatHelp() {
         "Run `ahood --version` to print the installed CLI version.",
         "",
         "Exit codes: 0 success, 1 general error, 2 usage/validation error,",
-        "            4 authentication required or rejected, 5 not found, 6 network/transport error.",
+        "            4 authentication required or rejected, 5 not found,",
+        "            6 network/transport error or upstream server (5xx) error.",
         "",
         "Full reference: https://ahood.vercel.app/docs",
     ].join("\n");

package/dist/http.js

@@ -36,6 +36,23 @@ export async function apiFetch(path, init = {}) {
         throw new NetworkError(`Request to ${getApiUrl()}${path} failed (${message}${cause})`);
     }
 }
+const MAX_ERROR_MESSAGE_LENGTH = 500;
+// Defense in depth (ahood-cli#31): the API is expected to never forward a raw
+// upstream error body (an HTML block page from a proxy/WAF, a giant stack
+// trace, etc.) into `error`, but this CLI shouldn't trust that unconditionally
+// -- a regression on any endpoint would otherwise dump multi-KB infra details
+// straight to a user's terminal. Anything HTML-shaped or implausibly long for
+// a normal error string is replaced with a short, safe summary instead.
+function sanitizeErrorMessage(message) {
+    const looksLikeHtml = /<!DOCTYPE|<html[\s>]/i.test(message);
+    if (!looksLikeHtml && message.length <= MAX_ERROR_MESSAGE_LENGTH)
+        return message;
+    // No preview of the raw content: an HTML-shaped body's first bytes are
+    // exactly where infra details (e.g. a Cloudflare block page's title, Ray
+    // ID) live, so a "helpful" excerpt would leak the same details this
+    // exists to suppress. Length alone is safe to report.
+    return `Request failed with an unexpected, oversized, or HTML-shaped error response (${message.length} bytes) -- this usually means an upstream proxy/WAF failure, not a problem with your request.`;
+}
 export async function apiJson(path, init = {}) {
     const res = await apiFetch(path, init);
     if (!res.ok) {
@@ -44,7 +61,7 @@ export async function apiJson(path, init = {}) {
         // rather than crashing on `body.error` of something that isn't an object.
         const body = await res.json().catch(() => undefined);
         const message = body && typeof body === "object" && typeof body.error === "string"
-            ? body.error
+            ? sanitizeErrorMessage(body.error)
             : `Request failed with status ${res.status}`;
         throw new ApiError(res.status, message);
     }

package/dist/index.js

@@ -15,7 +15,8 @@ import { star, unstar } from "./commands/star.js";
 import { view } from "./commands/view.js";
 import { completion } from "./commands/completion.js";
 import { formatHelp, formatCommandHelp, findCommandHelp } from "./help.js";
-import { ApiError, NetworkError } from "./http.js";
+import { ApiError } from "./http.js";
+import { exitCodeFor } from "./exit-code.js";
 import { CLI_NAME, CLI_VERSION } from "./version.js";
 const COMMANDS = {
     login: () => login(),
@@ -33,6 +34,7 @@ const COMMANDS = {
     star,
     unstar,
     view,
+    show: view, // alias -- "ahood show" is the name issue #30 proposed; same command as "view"
     completion,
 };
 function levenshtein(a, b) {
@@ -60,21 +62,6 @@ function closestCommand(input) {
     }
     return bestDistance <= 2 ? best : undefined;
 }
-// A hung/black-holed connection throws undici's generic TypeError("fetch
-// failed") -- http.ts wraps that into NetworkError so it gets its own exit
-// code here, distinct from a server-returned ApiError.
-function exitCodeFor(error) {
-    if (error instanceof ApiError) {
-        if (error.status === 401 || error.status === 403)
-            return 4;
-        if (error.status === 404)
-            return 5;
-        return 2;
-    }
-    if (error instanceof NetworkError)
-        return 6;
-    return 1;
-}
 async function main() {
     const [command, ...args] = process.argv.slice(2);
     if (command === "--version" || command === "-v") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ahood/cli",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "CLI for ahood, a registry for installing and publishing Claude Code skills.",
   "license": "MIT",
   "homepage": "https://github.com/AlexKay28/ahood-cli",