@ahood/cli 0.7.3 → 0.8.1

package/README.md

@@ -16,7 +16,7 @@ alice/pdf-tools        Merge, split, and compress PDFs from the command line
 bob/pdf-form-filler     Fill PDF form fields from a JSON or CSV data source
 
 $ ahood skill add alice/pdf-tools
-Installed alice/pdf-tools@1.4.0 to .claude/skills/alice/pdf-tools
+Installed alice/pdf-tools@1.4.0 to .claude/skills/alice@pdf-tools
 ```
 
 ---
@@ -85,7 +85,7 @@ Paths `ahood` reads and writes in your project, none of which need to be gitigno
 
 | Path | What's in it |
 | --- | --- |
-| `.claude/skills/<owner>/<skill>/` | Installed skill files. |
+| `.claude/skills/<owner>@<skill>/` | Installed skill files. |
 | `.claude/agents/<owner>@<skill>.md` | An installed agent, as a single file (`@` owner/skill separator, since Claude Code's own subagent loader scans `.claude/agents/*.md` flat, non-recursively). |
 | `.claude/skills.lock.json` | Exact installed version + checksum per skill or agent, written by `add`/`update`, read by every install to verify integrity. |
 
@@ -116,7 +116,7 @@ description: Merge, split, and compress PDFs from the command line
 ...
 
 $ ahood skill add alice/pdf-tools@1.4.0
-Installed alice/pdf-tools@1.4.0 to .claude/skills/alice/pdf-tools
+Installed alice/pdf-tools@1.4.0 to .claude/skills/alice@pdf-tools
 ```
 </details>
 
@@ -216,7 +216,7 @@ Sharing is additive -- it doesn't change `alice/pdf-tools`'s own public/private
 | `ahood skill add <owner>/<skill>[@version]` | Install a skill into .claude/skills/, pinned in the lockfile. |
 | `ahood skill update [<owner>/<skill> ...] [--dry-run] [--json]` | Move the lockfile pin(s) forward to the latest version, for one skill or all installed skills at once. |
 | `ahood skill outdated [<owner>/<skill> ...] [--json]` | Read-only staleness check comparing current and latest versions (with changelog) for installed skills. |
-| `ahood skill remove <owner>/<skill>` | Uninstall and unpin a skill (local only). |
+| `ahood skill remove <owner>/<skill> [--yes]` | Uninstall and unpin a skill (local only, prompts for confirmation unless --yes is passed). |
 | `ahood skill edit <owner>/<skill> [--tagline] [--tags] [--license] [--visibility] [--homepage] [--repository]` | Update a skill you own, changing only the flags you pass. |
 | `ahood skill unpublish <owner>/<skill>[@version] [--yes]` | Delete a skill from the registry for every consumer, or yank a single version, not just your local install (prompts for confirmation unless --yes is passed). |
 | `ahood skill star <owner>/<skill>` | Star a skill. |
@@ -235,12 +235,25 @@ Sharing is additive -- it doesn't change `alice/pdf-tools`'s own public/private
 | `ahood group members <group> [--json]` | List a group's members and their role (owner-only visible to members). |
 | `ahood group invite-link <group> [--json]` | Create (or regenerate) a shareable invite link for a group you own. |
 | `ahood group join <invite-url-or-token>` | Join a group using an invite link or its raw token. |
-| `ahood group remove-member <group> <username>` | Remove a member from a group you own. |
-| `ahood group leave <group>` | Leave a group you belong to. |
+| `ahood group remove-member <group> <username> [--yes]` | Remove a member from a group you own (prompts for confirmation unless --yes is passed). |
+| `ahood group leave <group> [--yes]` | Leave a group you belong to (prompts for confirmation unless --yes is passed). |
 | `ahood group delete <group> [--yes]` | Permanently delete a group you own (prompts for confirmation unless --yes is passed). |
+
+### Snap
+
+| Command | What it does |
+| --- | --- |
+| `ahood snap create <content> [--tags tag1,tag2] [--json]` | Capture a new private snap, from an argument or piped stdin. |
+| `ahood snap list [--json] [--limit <n>]` | List your own snaps, most recent first. |
+| `ahood snap search <query> [--json] [--limit <n>]` | Search your own snaps by content. |
+| `ahood snap show <id> [--json]` | Print a single snap's full content. |
+| `ahood snap remove <id> [--yes]` | Permanently delete a snap (prompts for confirmation unless --yes is passed). |
+| `ahood snap share <id> [--json]` | Mint (or return the existing) shareable link for a snap. |
+| `ahood snap unshare <id> [--yes]` | Revoke a snap's share link (the snap itself is untouched; prompts for confirmation unless --yes is passed). |
+| `ahood snap tags <id> [tag1,tag2,...] [--json]` | Replace a snap's tags (omit the tag list, or pass an empty one, to clear all tags). |
 <!-- COMMANDS_TABLE_END -->
 
-Run `ahood --help`, `ahood skill --help`, `ahood group --help`, or `ahood <command> --help` (also `ahood help <command>` / `ahood help skill <verb>` / `ahood help group <verb>`) for the same reference — including per-command flags and examples — directly in your terminal. `ahood --version` prints the installed CLI version.
+Run `ahood --help`, `ahood skill --help`, `ahood group --help`, `ahood snap --help`, or `ahood <command> --help` (also `ahood help <command>` / `ahood help skill <verb>` / `ahood help group <verb>` / `ahood help snap <verb>`) for the same reference — including per-command flags and examples — directly in your terminal. `ahood --version` prints the installed CLI version.
 
 ## Exit codes
 

package/dist/commands/add.js

@@ -3,15 +3,21 @@ import { mkdirSync, renameSync, rmSync, rmdirSync, writeFileSync, readFileSync,
 import { basename, dirname, join, resolve, sep } from "node:path";
 import * as tarStream from "tar-stream";
 import { gunzipSync } from "node:zlib";
-import { apiFetch, apiJson } from "../http.js";
+import { apiFetch, apiJson, ApiError, sanitizeErrorMessage } from "../http.js";
 import { LOCKFILE_PATH, parseOwnerSkillVersion, skillDir, agentPath, AGENTS_ROOT, MCP_CONFIG_PATH } from "../spec.js";
-import { readLockfile, writeLockfileEntry, withLock, writeJsonFileAtomic } from "../lockfile.js";
+import { readLockfile, withLock, writeJsonFileAtomic, writeLockfileEntryVerifyingChecksum, LockfileChecksumConflictError, } from "../lockfile.js";
 import { promptSecret } from "../secret-prompt.js";
 import { UsageError } from "../usage-error.js";
 const USAGE = "Usage: ahood skill add <owner>/<skill>[@version]";
 const MAX_DOWNLOAD_BYTES = 50 * 1024 * 1024; // 50 MB compressed
 const MAX_EXTRACTED_BYTES = 200 * 1024 * 1024; // 200 MB decompressed
 const MAX_ENTRY_COUNT = 10_000;
+// Shared wording for the checksum-pin tamper-detection guard, used both by
+// the early unlocked fast-fail check in add() and by the real,
+// concurrency-safe enforcement at each write site below (ahood-cli#101).
+function checksumConflictMessage(key, meta, existing) {
+    return `Refusing to install ${key}@${meta.version}: its checksum (${meta.checksum_sha256}) does not match the one already pinned in the lockfile (${existing.checksum_sha256}) for this exact version. If you trust this change, remove ${key}'s lockfile entry first.`;
+}
 // GET /api/v1/skills/{owner}/{skill}/versions/{version} matches the version
 // string with an exact .eq() (verified live against this branch's route) --
 // there is no "latest" literal in skill_versions.version, so requesting
@@ -319,7 +325,9 @@ function summarizeConflictingEntry(entry) {
 // raw TypeError, and would let `"mcpServers": []` pass the collision check
 // silently (an array's numeric-index write is then dropped entirely by
 // JSON.stringify), reporting a successful install that wrote nothing.
-function readMcpConfig() {
+// Exported so remove.ts/update.ts can read the same validated shape when
+// deciding whether it's safe to touch an mcp entry (ahood-cli#169).
+export function readMcpConfig() {
     if (!existsSync(MCP_CONFIG_PATH))
         return { mcpServers: {} };
     let parsed;
@@ -355,18 +363,24 @@ function assertNoCollision(fileContents, owner, skill) {
             `Remove it manually first if you want to reinstall ${owner}/${skill}.`);
     }
 }
-async function installMcpEntry(owner, skill, meta, buffer) {
+// Extracts server.json, validates its shape, and resolves every secret
+// environment variable it declares (prompting only for ones not already
+// set in the shell) -- the part of installing an mcp entry that's identical
+// whether this is a fresh `add` or an `update` moving an existing pin
+// forward. Exported so update.ts's real mcp-update path (ahood-cli#169)
+// re-resolves secrets the same way a fresh install does, instead of
+// duplicating this parsing/prompting logic.
+export async function resolveMcpServerConfig(buffer) {
     const content = await extractSingleFileContent(buffer, "server.json");
     const manifest = JSON.parse(content.toString("utf-8"));
     // Validate the manifest's shape (unsupported registry_type/runtime_hint,
-    // or neither a single 'packages' nor a single 'remotes' entry) and check
-    // for an existing .mcp.json collision BEFORE prompting for any secret --
-    // an install that's going to be refused anyway must not first cost the
-    // user a masked secret prompt. buildMcpServerConfig is called here with an
-    // empty env purely to run its validation/throw; the result is discarded
-    // and rebuilt below once secretEnv is known.
+    // or neither a single 'packages' nor a single 'remotes' entry) BEFORE
+    // prompting for any secret -- an install/update that's going to be
+    // refused anyway must not first cost the user a masked secret prompt.
+    // buildMcpServerConfig is called here with an empty env purely to run its
+    // validation/throw; the result is discarded and rebuilt below once
+    // secretEnv is known.
     buildMcpServerConfig(manifest, {});
-    assertNoCollision(readMcpConfig(), owner, skill);
     const envVars = manifest.packages?.[0]?.environment_variables ?? [];
     const secretEnv = {};
     for (const variable of envVars) {
@@ -383,6 +397,29 @@ async function installMcpEntry(owner, skill, meta, buffer) {
             : await promptSecret(`${sanitizeForTerminal(variable.name)} (${sanitizeForTerminal(variable.description)}): `);
     }
     const serverConfig = buildMcpServerConfig(manifest, secretEnv);
+    return { manifest, serverConfig };
+}
+// Fingerprint of exactly what ahood wrote into .mcp.json's mcpServers.<skill>
+// entry, stored in the lockfile alongside the version/checksum pin. Lets
+// remove/update (ahood-cli#169) tell "the on-disk entry is still exactly
+// what I last installed" from "something (the user, another tool) has since
+// hand-edited it" -- without this, a real (not just warned-about) removal
+// or update risks silently discarding an intentional local edit, the same
+// class of risk assertNoCollision below exists to prevent on a *fresh*
+// install. JSON.stringify's key order matches insertion order for a plain
+// object, and JSON.parse's key order matches source-text order -- so this
+// is stable between the object this process just built and the same object
+// read back from disk later, as long as nothing reorders keys in between.
+export function hashMcpServerConfig(config) {
+    return createHash("sha256").update(JSON.stringify(config)).digest("hex");
+}
+async function installMcpEntry(owner, skill, meta, buffer) {
+    // Check for an existing .mcp.json collision BEFORE resolving secrets --
+    // matches resolveMcpServerConfig's own "don't cost the user a prompt for
+    // something that's going to be refused anyway" reasoning, just for the
+    // collision check specifically rather than the manifest-shape check.
+    assertNoCollision(readMcpConfig(), owner, skill);
+    const { serverConfig } = await resolveMcpServerConfig(buffer);
     // Read-modify-write under an advisory lock, mirroring lockfile.ts's own
     // writeLockfileEntry: .mcp.json sits right next to the lockfile and can
     // hold other servers' secrets, so it gets the same protection against a
@@ -398,9 +435,122 @@ async function installMcpEntry(owner, skill, meta, buffer) {
         fileContents.mcpServers[skill] = serverConfig;
         writeJsonFileAtomic(MCP_CONFIG_PATH, fileContents);
     });
-    writeLockfileEntry(LOCKFILE_PATH, `${owner}/${skill}`, { version: meta.version, checksum_sha256: meta.checksum_sha256 });
+    const mcpKey = `${owner}/${skill}`;
+    try {
+        writeLockfileEntryVerifyingChecksum(LOCKFILE_PATH, mcpKey, {
+            version: meta.version,
+            checksum_sha256: meta.checksum_sha256,
+            mcp_config_hash: hashMcpServerConfig(serverConfig),
+        });
+    }
+    catch (error) {
+        if (!(error instanceof LockfileChecksumConflictError))
+            throw error;
+        // Roll back the .mcp.json merge above under the same lock pattern --
+        // re-read+delete rather than assuming nothing else changed it since.
+        withLock(MCP_CONFIG_PATH, () => {
+            const fileContents = readMcpConfig();
+            delete fileContents.mcpServers[skill];
+            writeJsonFileAtomic(MCP_CONFIG_PATH, fileContents);
+        });
+        throw new Error(checksumConflictMessage(mcpKey, meta, error.existing));
+    }
     console.log(`Installed ${owner}/${skill}@${meta.version} into ${MCP_CONFIG_PATH} as "${skill}"`);
-    if (Object.keys(secretEnv).length > 0) {
+    // Only the npm+npx package path ever carries secrets into `env` (headers
+    // on a remote entry are static per v1's scope, per buildMcpServerConfig) --
+    // checking the final serverConfig's own `env` key (rather than threading
+    // secretEnv out of resolveMcpServerConfig separately) means this warning
+    // can never drift from what was actually written to disk.
+    if (serverConfig.env && Object.keys(serverConfig.env).length > 0) {
+        console.warn(`WARNING: ${MCP_CONFIG_PATH} now contains one or more secret values in plaintext -- do not commit it to version control.`);
+    }
+}
+// Re-runs the mcp install flow for an already-installed entry, moving its
+// lockfile pin forward -- update.ts's real mcp-update path (ahood-cli#169).
+// Unlike installMcpEntry, "the entry already exists" is expected here (it's
+// the very entry being updated), so the safety check is inverted: rather
+// than refusing because something's already there, this refuses UNLESS the
+// on-disk entry's fingerprint still matches what was recorded at the last
+// install/update -- same posture as assertNoCollision, applied to "is this
+// still mine to touch" instead of "is this mine to create". If the entry is
+// missing entirely, there's nothing to protect -- write fresh (self-heals a
+// lockfile pin whose .mcp.json entry was deleted by hand without going
+// through `ahood skill remove`). If it's present but doesn't match (or no
+// fingerprint was ever recorded, e.g. an entry installed before this field
+// existed), refuse rather than silently overwrite a possibly-intentional
+// local edit.
+export async function updateMcpEntry(owner, skill, meta, currentEntry) {
+    const key = `${owner}/${skill}`;
+    const recordedHash = currentEntry?.mcp_config_hash;
+    const fileContents = readMcpConfig();
+    const mcpServers = fileContents.mcpServers;
+    const existingOnDisk = Object.prototype.hasOwnProperty.call(mcpServers, skill) ? mcpServers[skill] : undefined;
+    // Both refusal messages below point at manually editing .mcp.json, not
+    // `ahood skill remove` -- remove refuses to delete an entry under
+    // exactly these same two conditions (no recorded fingerprint, or a
+    // fingerprint mismatch), so telling the user to "remove then add" would
+    // send them into a sequence where remove leaves the entry in place *and*
+    // clears the lockfile pin, and the follow-up add then fails on the very
+    // same entry as a collision -- pin gone, credential still live, no CLI
+    // path forward. Editing .mcp.json by hand and then running `add` is the
+    // only sequence that actually resolves the state.
+    if (existingOnDisk !== undefined) {
+        if (recordedHash === undefined) {
+            throw new Error(`Cannot verify ${key}'s .mcp.json entry matches what ahood last installed (no recorded fingerprint) -- delete the "${skill}" entry from mcpServers in .mcp.json by hand, then run \`ahood skill add ${key}\` to reinstall and enable automatic updates going forward.`);
+        }
+        if (hashMcpServerConfig(existingOnDisk) !== recordedHash) {
+            throw new Error(`${key}'s .mcp.json entry appears to have been modified since install -- refusing to overwrite it. Delete the "${skill}" entry from mcpServers in .mcp.json by hand, then run \`ahood skill add ${key}\` to reinstall.`);
+        }
+    }
+    const buffer = await downloadVerifiedArchive(owner, skill, meta);
+    const { serverConfig } = await resolveMcpServerConfig(buffer);
+    // Read-modify-write under an advisory lock, mirroring installMcpEntry's
+    // own pattern. Re-checks the fingerprint here too (not just above) since
+    // arbitrary time may have passed since the pre-check -- the download, and
+    // any secret prompt inside resolveMcpServerConfig -- during which another
+    // process could have changed the entry.
+    let previousOnDisk;
+    withLock(MCP_CONFIG_PATH, () => {
+        const fresh = readMcpConfig();
+        const freshServers = fresh.mcpServers;
+        const freshExisting = Object.prototype.hasOwnProperty.call(freshServers, skill) ? freshServers[skill] : undefined;
+        if (freshExisting !== undefined && (recordedHash === undefined || hashMcpServerConfig(freshExisting) !== recordedHash)) {
+            throw new Error(`${key}'s .mcp.json entry changed while updating -- refusing to overwrite it. Re-run \`ahood skill update ${key}\` if this was unexpected.`);
+        }
+        previousOnDisk = freshExisting;
+        freshServers[skill] = serverConfig;
+        writeJsonFileAtomic(MCP_CONFIG_PATH, fresh);
+    });
+    try {
+        writeLockfileEntryVerifyingChecksum(LOCKFILE_PATH, key, {
+            version: meta.version,
+            checksum_sha256: meta.checksum_sha256,
+            mcp_config_hash: hashMcpServerConfig(serverConfig),
+        });
+    }
+    catch (error) {
+        if (!(error instanceof LockfileChecksumConflictError))
+            throw error;
+        // Roll back the .mcp.json overwrite above under the same lock pattern,
+        // restoring the entry to what it was before this update touched it --
+        // not deleting it, unlike installMcpEntry's rollback: unless this was
+        // the self-heal-a-missing-entry case (previousOnDisk undefined), there
+        // WAS a working entry here before this update began.
+        withLock(MCP_CONFIG_PATH, () => {
+            const fileContents = readMcpConfig();
+            const mcpServers = fileContents.mcpServers;
+            if (previousOnDisk === undefined) {
+                delete mcpServers[skill];
+            }
+            else {
+                mcpServers[skill] = previousOnDisk;
+            }
+            writeJsonFileAtomic(MCP_CONFIG_PATH, fileContents);
+        });
+        throw new Error(checksumConflictMessage(key, meta, error.existing));
+    }
+    console.log(`Updated ${key} to ${meta.version}`);
+    if (serverConfig.env && Object.keys(serverConfig.env).length > 0) {
         console.warn(`WARNING: ${MCP_CONFIG_PATH} now contains one or more secret values in plaintext -- do not commit it to version control.`);
     }
 }
@@ -412,8 +562,14 @@ async function installMcpEntry(owner, skill, meta, buffer) {
 export async function downloadVerifiedArchive(owner, skill, meta) {
     const downloadRes = await apiFetch(`/api/v1/skills/${encodeURIComponent(owner)}/${encodeURIComponent(skill)}/download?version=${encodeURIComponent(meta.version)}`, { headers: { "X-Ahood-Source": "cli" }, redirect: "follow" });
     if (!downloadRes.ok) {
-        const body = await downloadRes.text().catch(() => "");
-        throw new Error(`Download failed with status ${downloadRes.status}${body ? `: ${body}` : ""}`);
+        // Same host as every other apiJson call, so this must throw ApiError
+        // (not a plain Error) to get the right exitCodeFor mapping (401/404/5xx),
+        // and route the body through sanitizeErrorMessage -- an unsanitized WAF/
+        // proxy HTML page would otherwise dump straight to the terminal here,
+        // exactly what that function exists to prevent elsewhere (ahood-cli#102).
+        const rawBody = await downloadRes.text().catch(() => "");
+        const body = rawBody ? sanitizeErrorMessage(rawBody) : "";
+        throw new ApiError(downloadRes.status, `Download failed with status ${downloadRes.status}${body ? `: ${body}` : ""}`);
     }
     const buffer = await readBoundedBody(downloadRes, MAX_DOWNLOAD_BYTES);
     const actualChecksum = createHash("sha256").update(buffer).digest("hex");
@@ -433,10 +589,15 @@ export async function add(args) {
     // with; if a later fetch of the "same" version disagrees, either the
     // published artifact changed after being pinned or the registry response
     // was tampered with in transit -- either way this is not something to
-    // silently accept and overwrite.
+    // silently accept and overwrite. This early, UNLOCKED read is a fast-fail
+    // optimization only (skip an entire download for the common, non-
+    // concurrent case) -- it provides no real guarantee under concurrent
+    // installs. The actual enforcement is the locked, read-check-write
+    // writeLockfileEntryVerifyingChecksum call at each write site below
+    // (ahood-cli#101).
     const existingEntry = readLockfile(LOCKFILE_PATH)[key];
     if (existingEntry && existingEntry.version === meta.version && existingEntry.checksum_sha256 !== meta.checksum_sha256) {
-        throw new Error(`Refusing to install ${key}@${meta.version}: its checksum (${meta.checksum_sha256}) does not match the one already pinned in the lockfile (${existingEntry.checksum_sha256}) for this exact version. If you trust this change, remove ${key}'s lockfile entry first.`);
+        throw new Error(checksumConflictMessage(key, meta, existingEntry));
     }
     if (meta.yanked_at) {
         console.warn(`WARNING: ${key}@${meta.version} has been yanked. Installing anyway.`);
@@ -458,7 +619,15 @@ export async function add(args) {
         mkdirSync(AGENTS_ROOT, { recursive: true });
         const destPath = agentPath(owner, skill);
         writeFileSync(destPath, content);
-        writeLockfileEntry(LOCKFILE_PATH, key, { version: meta.version, checksum_sha256: meta.checksum_sha256 });
+        try {
+            writeLockfileEntryVerifyingChecksum(LOCKFILE_PATH, key, { version: meta.version, checksum_sha256: meta.checksum_sha256 });
+        }
+        catch (error) {
+            if (!(error instanceof LockfileChecksumConflictError))
+                throw error;
+            rmSync(destPath, { force: true });
+            throw new Error(checksumConflictMessage(key, meta, error.existing));
+        }
         console.log(`Installed ${key}@${meta.version} to ${destPath}`);
         return;
     }
@@ -466,12 +635,21 @@ export async function add(args) {
         await installMcpEntry(owner, skill, meta, buffer);
         return;
     }
-    // Owner-namespaced on disk, mirroring npm's node_modules/@scope/package.
+    // Flat, owner@skill-joined directory name so Claude Code's own one-level-deep
+    // project-skill scan actually discovers it (see skillDir's comment in spec.ts).
     const destDir = skillDir(owner, skill);
     await extractFreshVersion(buffer, destDir);
-    writeLockfileEntry(LOCKFILE_PATH, key, {
-        version: meta.version,
-        checksum_sha256: meta.checksum_sha256,
-    });
+    try {
+        writeLockfileEntryVerifyingChecksum(LOCKFILE_PATH, key, {
+            version: meta.version,
+            checksum_sha256: meta.checksum_sha256,
+        });
+    }
+    catch (error) {
+        if (!(error instanceof LockfileChecksumConflictError))
+            throw error;
+        rmSync(destDir, { recursive: true, force: true });
+        throw new Error(checksumConflictMessage(key, meta, error.existing));
+    }
     console.log(`Installed ${key}@${meta.version} to ${destDir}`);
 }

package/dist/commands/group.js

@@ -8,8 +8,8 @@ const LIST_USAGE = "Usage: ahood group list [--json]";
 const MEMBERS_USAGE = "Usage: ahood group members <group> [--json]";
 const INVITE_LINK_USAGE = "Usage: ahood group invite-link <group> [--json]";
 const JOIN_USAGE = "Usage: ahood group join <invite-url-or-token>";
-const REMOVE_MEMBER_USAGE = "Usage: ahood group remove-member <group> <username>";
-const LEAVE_USAGE = "Usage: ahood group leave <group>";
+const REMOVE_MEMBER_USAGE = "Usage: ahood group remove-member <group> <username> [--yes]";
+const LEAVE_USAGE = "Usage: ahood group leave <group> [--yes]";
 const DELETE_USAGE = "Usage: ahood group delete <group> [--yes]";
 // Creates a group (caller becomes owner). Follows edit.ts's convention of
 // requiring the positional argument first, since --description takes a
@@ -115,10 +115,22 @@ export async function joinGroup(args) {
 // "remove yourself"). No flags today, so plain positional filtering is
 // unambiguous.
 export async function removeMember(args) {
+    const yes = args.includes("--yes");
     const positional = args.filter((a) => !a.startsWith("--"));
     const [slug, username] = positional;
     if (!slug || !username)
         throw new UsageError(REMOVE_MEMBER_USAGE);
+    // Mirrors deleteGroup's confirm-before-destroy pattern (CLAUDE.md:
+    // "Destructive commands ... prompt for confirmation unless --yes is
+    // passed") -- a typo'd username here instantly removes the wrong member
+    // with no other command to undo it (ahood-cli#99).
+    const confirmed = yes
+        ? true
+        : await confirm(`Remove ${username} from ${slug}? Type "yes" to confirm: `);
+    if (!confirmed) {
+        console.log("Aborted.");
+        return;
+    }
     await apiJson(`/api/v1/groups/${encodeURIComponent(slug)}/members/${encodeURIComponent(username)}`, { method: "DELETE" });
     console.log(`Removed ${username} from ${slug}.`);
 }
@@ -134,9 +146,18 @@ async function getOwnUsername() {
 // handles both cases identically (DELETE .../members/{username} with your
 // own username removes you, same as an owner removing someone else).
 export async function leaveGroup(args) {
+    const yes = args.includes("--yes");
     const slug = args.find((a) => !a.startsWith("--"));
     if (!slug)
         throw new UsageError(LEAVE_USAGE);
+    // Same confirm-before-destroy gate as removeMember -- an accidentally
+    // re-run `leave` drops you from a private group with no other command to
+    // undo it (ahood-cli#99).
+    const confirmed = yes ? true : await confirm(`Leave ${slug}? Type "yes" to confirm: `);
+    if (!confirmed) {
+        console.log("Aborted.");
+        return;
+    }
     const username = await getOwnUsername();
     await apiJson(`/api/v1/groups/${encodeURIComponent(slug)}/members/${encodeURIComponent(username)}`, { method: "DELETE" });
     console.log(`Left ${slug}.`);

package/dist/commands/init.js

@@ -29,7 +29,7 @@ function normalizeToSlug(name) {
 // documented Claude Code skill format: YAML frontmatter delimited by `---`
 // lines, with a `name` and a `description` field -- the same shape every
 // real SKILL.md in this ecosystem uses (see e.g. any installed skill under
-// .claude/skills/<owner>/<skill>/SKILL.md). Keeping to exactly those two
+// .claude/skills/<owner>@<skill>/SKILL.md). Keeping to exactly those two
 // fields, rather than inventing extra ones, means nothing here needs
 // updating just because publish.ts's own validation happens to be looser
 // today.

package/dist/commands/list.js

@@ -15,6 +15,10 @@ export async function listSkills(args = []) {
         return;
     }
     for (const skill of skills) {
-        console.log(`${skill.profiles.username}/${skill.slug} (${skill.visibility}) - ${skill.name}${skill.tagline ? `: ${skill.tagline}` : ""} (${skill.downloads_count} downloads, ${skill.stars_count} stars)`);
+        // profiles comes from a server-side join that can plausibly be null for
+        // an individual row -- degrade that one row instead of crashing the
+        // whole command (ahood-cli#106).
+        const username = skill.profiles?.username ?? "(unknown)";
+        console.log(`${username}/${skill.slug} (${skill.visibility}) - ${skill.name}${skill.tagline ? `: ${skill.tagline}` : ""} (${skill.downloads_count} downloads, ${skill.stars_count} stars)`);
     }
 }

package/dist/commands/login.js

@@ -21,7 +21,6 @@ export async function login() {
     while (Date.now() < deadline) {
         await sleep(2000);
         let res;
-        let body;
         try {
             // Poll against the CONFIGURED API host (getApiUrl()), not a URL derived
             // from the server-supplied verification_url -- that field is only ever
@@ -29,15 +28,33 @@ export async function login() {
             // or redirected registry response can't point this at a host that
             // then harvests the device code and hands back an attacker's token.
             res = await apiFetchWithTimeout(`/api/v1/auth/cli/device/${encodeURIComponent(code)}`);
+        }
+        catch (error) {
+            // A THROWN fetch (DNS blip, dropped socket) is transient by nature, and
+            // this loop runs for up to ten minutes while a human walks to their
+            // browser -- one bad network moment must not kill a login that is
+            // about to succeed. The deadline is untouched, so this cannot loop
+            // forever.
+            console.error(`Polling failed (${error instanceof Error ? error.message : String(error)}); retrying...`);
+            continue;
+        }
+        // Checked BEFORE res.json(): these are terminal statuses regardless of
+        // body shape, so a non-JSON body on them (e.g. a proxy/WAF error page --
+        // the same threat class sanitizeErrorMessage guards against elsewhere)
+        // must fail fast here instead of throwing inside the try below and being
+        // swallowed as "transient, retry" for up to ten minutes (ahood-cli#104).
+        if (res.status === 410 || res.status === 404) {
+            throw new Error("This login was cancelled or expired. Run `ahood login` again.");
+        }
+        let body;
+        try {
             body = (await res.json());
         }
         catch (error) {
-            // A THROWN fetch (DNS blip, dropped socket, a body that isn't JSON) is
-            // transient by nature, and this loop runs for up to ten minutes while a
-            // human walks to their browser -- one bad network moment must not kill
-            // a login that is about to succeed. HTTP *statuses* are still decided
-            // below; only the transport failure is retried. The deadline is
-            // untouched, so this cannot loop forever.
+            // A genuinely malformed/non-JSON body on a non-terminal status (e.g. a
+            // transient 502 while still pending) is the same kind of transient
+            // blip a thrown fetch above is -- retry rather than fail the whole
+            // login.
             console.error(`Polling failed (${error instanceof Error ? error.message : String(error)}); retrying...`);
             continue;
         }
@@ -46,9 +63,6 @@ export async function login() {
             console.log("Logged in.");
             return;
         }
-        if (res.status === 410 || res.status === 404) {
-            throw new Error("This login was cancelled or expired. Run `ahood login` again.");
-        }
         // status === "pending" -- keep polling.
     }
     throw new Error("Login timed out. Run `ahood login` again.");

package/dist/commands/publish.js

@@ -42,6 +42,10 @@ const USAGE = "Usage: ahood skill publish <owner>/<skill>@<version> [--path <dir
 //   .npmrc / .yarnrc.yml / .netrc / .pypirc -- package-manager/network auth
 //                tokens (npm_..., ghp_...) that don't match the server
 //                scanner's regexes either.
+//   .envrc    -- direnv's own file, commonly holding `export`ed secrets,
+//                exact-matched (not a `.env` prefix match -- "rc" makes it a
+//                distinct name, not a `.env.*` variant) since it doesn't
+//                match the server scanner's regexes either (ahood-cli#97).
 //   id_rsa / id_ed25519 / id_ecdsa / id_dsa (+ .pub) / .ssh -- SSH keys.
 //   .aws / .docker -- cloud and registry credentials.
 //   .DS_Store -- noise.
@@ -53,6 +57,7 @@ const EXCLUDED_NAMES = new Set([
     ".yarnrc.yml",
     ".netrc",
     ".pypirc",
+    ".envrc",
     ".ssh",
     ".aws",
     ".docker",

package/dist/commands/read.js

@@ -46,5 +46,11 @@ export async function read(args) {
     // Plain mode prints the raw content verbatim -- no formatting/labels/
     // trailing decoration -- since the whole point is fast/pipeable access to
     // the exact prompt text (e.g. piping into a file or another tool).
-    console.log(content);
+    // process.stdout.write, not console.log: console.log unconditionally
+    // appends its own "\n", so a well-formed SKILL.md that already ends in one
+    // (the normal case) came out with a second, spurious trailing blank line --
+    // a real, reported round-trip mismatch between "ahood skill read" and the
+    // source file, even though the registry itself stores/serves the content
+    // byte-exact (ahood-cli#90).
+    process.stdout.write(content);
 }