@ahood/cli 0.3.1 → 0.3.3

package/dist/commands/unpublish.js

@@ -1,7 +1,7 @@
 import { createInterface } from "node:readline";
 import { apiJson } from "../http.js";
-import { parseOwnerSkill } from "../spec.js";
-const USAGE = "Usage: ahood unpublish <owner>/<skill> [--yes]";
+import { parseOwnerSkill, parseOwnerSkillVersion } from "../spec.js";
+const USAGE = "Usage: ahood unpublish <owner>/<skill>[@version] [--yes]";
 // On closed/non-interactive stdin, readline/promises' rl.question() promise
 // never settles -- but since nothing else keeps the event loop alive at that
 // point, the process used to exit 0 anyway once the loop drained, having
@@ -27,11 +27,45 @@ function confirm(promptText) {
         });
     });
 }
+// A bare "owner/skill" has no "@" at all, so lastIndexOf("@") is -1 and this
+// is a whole-skill unpublish (preserves the exact pre-existing behavior).
+// "owner/skill@1.2.3" has an "@" at index > 0 and is a single-version yank
+// instead -- parseOwnerSkillVersion is reused rather than re-parsing "@" by
+// hand, so the same version-format validation (spec.ts's SEMVER_RE / the
+// "latest" literal) applies here as it already does for `add`/`view`.
+function isVersioned(spec) {
+    return spec.lastIndexOf("@") > 0;
+}
 export async function unpublish(args) {
     const yes = args.includes("--yes");
     const spec = args.find((a) => !a.startsWith("--"));
     if (!spec)
         throw new Error(USAGE);
+    if (isVersioned(spec)) {
+        const { owner, skill, version } = parseOwnerSkillVersion(spec, USAGE);
+        const key = `${owner}/${skill}@${version}`;
+        // Yanking is less destructive than a whole-skill delete (existing
+        // lockfile-pinned installs keep resolving/verifying against it -- see
+        // add.ts's yanked_at warning), so the prompt wording says so instead of
+        // reusing the whole-skill "permanently delete ... for everyone" text,
+        // which would overstate what actually happens here.
+        const confirmed = yes
+            ? true
+            : await confirm(`Yank ${key}? Existing installs keep working; new installs will be warned. Type "yes" to confirm: `);
+        if (!confirmed) {
+            console.log("Aborted.");
+            return;
+        }
+        // DELETE on the version resource itself (no separate /yank sub-route):
+        // the server treats this the same way whole-skill DELETE already does
+        // (a soft delete that sets a timestamp column, never removes the row),
+        // just scoped one level down to skill_versions.yanked_at/yanked_reason
+        // instead of skills.deleted_at. Mirroring that existing verb/path
+        // convention rather than inventing a new one.
+        await apiJson(`/api/v1/skills/${encodeURIComponent(owner)}/${encodeURIComponent(skill)}/versions/${encodeURIComponent(version)}`, { method: "DELETE" });
+        console.log(`Yanked ${key}. Existing lockfile pins still resolve; new installs will be warned off it.`);
+        return;
+    }
     const { owner, skill } = parseOwnerSkill(spec, USAGE);
     const key = `${owner}/${skill}`;
     // --yes bypasses the prompt for scripts/CI; otherwise a closed stdin (no

package/dist/commands/versions.js

@@ -36,5 +36,11 @@ export async function versions(args) {
         field("published:", v.created_at);
         field("size:", formatSize(v.package_size_bytes));
         field("changelog:", v.changelog_md ? v.changelog_md : "-");
+        // Marked right after the version's other details, only when the API
+        // actually flags it (issue #58) -- non-yanked versions print exactly as
+        // before, no "status:" line at all.
+        if (v.yanked_at) {
+            field("status:", v.yanked_reason ? `YANKED -- ${v.yanked_reason}` : "YANKED");
+        }
     }
 }

package/dist/help.js

@@ -79,9 +79,12 @@ export const COMMANDS_HELP = [
         examples: ['ahood edit alice/pdf-tools --tagline "Merge and split PDFs"'],
     },
     {
-        usage: "ahood unpublish <owner>/<skill> [--yes]",
-        summary: "Delete a skill from the registry for every consumer, not just your local install (prompts for confirmation unless --yes is passed).",
-        desc: "Delete a skill from the registry for every consumer (not just your local install). Prompts for a typed \"yes\" unless --yes is passed.",
+        usage: "ahood unpublish <owner>/<skill>[@version] [--yes]",
+        summary: "Delete a skill from the registry for every consumer, or yank a single version, not just your local install (prompts for confirmation unless --yes is passed).",
+        desc: "Without @version: delete a skill from the registry for every consumer (not just your local install). " +
+            "With @version (e.g. alice/foo@1.2.3): yank that single version instead of deleting the whole skill -- " +
+            "it is marked yanked, not removed. Existing lockfile pins still resolve and verify against it, but new " +
+            "installs are warned off it. Prompts for a typed \"yes\" unless --yes is passed.",
         flags: ["--yes    Skip the interactive confirmation, for scripts/CI."],
     },
     { usage: "ahood star <owner>/<skill>", summary: "Star a skill.", desc: "Star a skill." },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ahood/cli",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "CLI for ahood, a registry for installing and publishing Claude Code skills.",
   "license": "MIT",
   "homepage": "https://github.com/AlexKay28/ahood-cli",