@ahood/cli 0.8.1 → 0.8.2

package/dist/commands/add.js

@@ -370,7 +370,23 @@ function assertNoCollision(fileContents, owner, skill) {
 // forward. Exported so update.ts's real mcp-update path (ahood-cli#169)
 // re-resolves secrets the same way a fresh install does, instead of
 // duplicating this parsing/prompting logic.
-export async function resolveMcpServerConfig(buffer) {
+// `existingEnv` carries forward the secret values already sitting in the
+// entry being updated, so a routine `ahood skill update` doesn't re-prompt
+// for a credential the user has already supplied. Only ever passed by
+// updateMcpEntry, and only from an entry whose fingerprint it has just
+// verified -- i.e. proven to be ahood's own unmodified entry, not something
+// hand-edited or written by another tool.
+//
+// `allowNonTtyPrompt` (default true, preserving `echo secret | ahood skill
+// add ...` for a fresh install the user explicitly asked for) is false on
+// the update path: `ahood skill update` with no arguments walks EVERY locked
+// entry, so a prompt there is never something the caller aimed at. Left
+// interactive, an unattended update would hang on an idle pipe with no
+// timeout -- against this CLI's "must never hang" rule -- or, worse, silently
+// bank the first line of unrelated piped input (`echo y | ahood skill
+// update`) as the credential and fingerprint over it.
+export async function resolveMcpServerConfig(buffer, options = {}) {
+    const { existingEnv, allowNonTtyPrompt = true } = options;
     const content = await extractSingleFileContent(buffer, "server.json");
     const manifest = JSON.parse(content.toString("utf-8"));
     // Validate the manifest's shape (unsupported registry_type/runtime_hint,
@@ -392,9 +408,22 @@ export async function resolveMcpServerConfig(buffer) {
         // (per the design spec), which uses `if (process.env.AHOOD_TOKEN)`
         // specifically so an empty-string env var falls through to the real
         // source instead of silently installing an empty secret.
-        secretEnv[variable.name] = fromEnv
-            ? fromEnv
-            : await promptSecret(`${sanitizeForTerminal(variable.name)} (${sanitizeForTerminal(variable.description)}): `);
+        if (fromEnv) {
+            secretEnv[variable.name] = fromEnv;
+            continue;
+        }
+        // Ordered after the env var deliberately: exporting the variable stays
+        // the way to rotate a credential during an update, rather than being
+        // shadowed by the stale value already on disk.
+        const carriedForward = existingEnv?.[variable.name];
+        if (carriedForward) {
+            secretEnv[variable.name] = carriedForward;
+            continue;
+        }
+        if (!allowNonTtyPrompt && !process.stdin.isTTY) {
+            throw new Error(`${sanitizeForTerminal(variable.name)} is required by ${sanitizeForTerminal(manifest.name)} but is not set, and there is no terminal to prompt on -- export ${sanitizeForTerminal(variable.name)} and re-run.`);
+        }
+        secretEnv[variable.name] = await promptSecret(`${sanitizeForTerminal(variable.name)} (${sanitizeForTerminal(variable.description)}): `);
     }
     const serverConfig = buildMcpServerConfig(manifest, secretEnv);
     return { manifest, serverConfig };
@@ -413,6 +442,25 @@ export async function resolveMcpServerConfig(buffer) {
 export function hashMcpServerConfig(config) {
     return createHash("sha256").update(JSON.stringify(config)).digest("hex");
 }
+// Pulls the `env` map out of an .mcp.json entry read off disk, so an update
+// can carry its secrets forward (see resolveMcpServerConfig's `existingEnv`).
+// Written defensively -- the entry is `unknown` here, and only a string value
+// is usable as a credential -- even though the caller has already fingerprint-
+// verified it, so that a shape this function can't read degrades into a
+// prompt rather than a crash.
+function readMcpEntryEnv(entry) {
+    if (typeof entry !== "object" || entry === null)
+        return undefined;
+    const env = entry.env;
+    if (typeof env !== "object" || env === null)
+        return undefined;
+    const result = {};
+    for (const [name, value] of Object.entries(env)) {
+        if (typeof value === "string")
+            result[name] = value;
+    }
+    return result;
+}
 async function installMcpEntry(owner, skill, meta, buffer) {
     // Check for an existing .mcp.json collision BEFORE resolving secrets --
     // matches resolveMcpServerConfig's own "don't cost the user a prompt for
@@ -503,7 +551,13 @@ export async function updateMcpEntry(owner, skill, meta, currentEntry) {
         }
     }
     const buffer = await downloadVerifiedArchive(owner, skill, meta);
-    const { serverConfig } = await resolveMcpServerConfig(buffer);
+    // Reuse the secrets already in the entry rather than re-prompting for
+    // them. Safe to trust specifically because the fingerprint check above has
+    // just proven this is ahood's own unmodified entry; in the self-heal case
+    // (no entry on disk at all) there's nothing to carry forward and a genuine
+    // prompt is correct.
+    const existingEnv = readMcpEntryEnv(existingOnDisk);
+    const { serverConfig } = await resolveMcpServerConfig(buffer, { existingEnv, allowNonTtyPrompt: false });
     // Read-modify-write under an advisory lock, mirroring installMcpEntry's
     // own pattern. Re-checks the fingerprint here too (not just above) since
     // arbitrary time may have passed since the pre-check -- the download, and
@@ -529,25 +583,43 @@ export async function updateMcpEntry(owner, skill, meta, currentEntry) {
         });
     }
     catch (error) {
-        if (!(error instanceof LockfileChecksumConflictError))
-            throw error;
         // Roll back the .mcp.json overwrite above under the same lock pattern,
         // restoring the entry to what it was before this update touched it --
         // not deleting it, unlike installMcpEntry's rollback: unless this was
         // the self-heal-a-missing-entry case (previousOnDisk undefined), there
         // WAS a working entry here before this update began.
-        withLock(MCP_CONFIG_PATH, () => {
-            const fileContents = readMcpConfig();
-            const mcpServers = fileContents.mcpServers;
-            if (previousOnDisk === undefined) {
-                delete mcpServers[skill];
-            }
-            else {
-                mcpServers[skill] = previousOnDisk;
-            }
-            writeJsonFileAtomic(MCP_CONFIG_PATH, fileContents);
-        });
-        throw new Error(checksumConflictMessage(key, meta, error.existing));
+        //
+        // Runs for EVERY lockfile failure, not just a checksum conflict. A
+        // rethrow-before-rollback here left .mcp.json holding the new config
+        // while the lockfile kept the old version and old mcp_config_hash, after
+        // which the fingerprint never matches again and both `update` and
+        // `remove` permanently refuse -- the exact dead end the comments above
+        // exist to prevent, reachable from nothing worse than withLock's 5s
+        // timeout against a concurrent ahood, or an EACCES/ENOSPC on the write.
+        try {
+            withLock(MCP_CONFIG_PATH, () => {
+                const fileContents = readMcpConfig();
+                const mcpServers = fileContents.mcpServers;
+                if (previousOnDisk === undefined) {
+                    delete mcpServers[skill];
+                }
+                else {
+                    mcpServers[skill] = previousOnDisk;
+                }
+                writeJsonFileAtomic(MCP_CONFIG_PATH, fileContents);
+            });
+        }
+        catch {
+            // The rollback can fail for the same reason the write did (lock still
+            // contended, disk still full). Warn rather than throw: the original
+            // error below is the more actionable one, and masking it with this
+            // one would hide why the update failed in the first place.
+            console.warn(`WARNING: could not roll back ${MCP_CONFIG_PATH} after ${key}'s update failed -- its mcpServers."${skill}" entry may be on the new version while ${LOCKFILE_PATH} still pins the old one. Delete that entry by hand and run \`ahood skill add ${key}\` to reinstall.`);
+        }
+        if (error instanceof LockfileChecksumConflictError) {
+            throw new Error(checksumConflictMessage(key, meta, error.existing));
+        }
+        throw error;
     }
     console.log(`Updated ${key} to ${meta.version}`);
     if (serverConfig.env && Object.keys(serverConfig.env).length > 0) {

package/dist/commands/snap.js

@@ -212,6 +212,14 @@ export async function unshareSnap(args) {
 export async function tagsSnap(args) {
     const jsonOutput = args.includes("--json");
     const positionals = args.filter((a) => a !== "--json");
+    // Reject stray "--" flags rather than folding them into the tag list
+    // (parseSearchQuery in flags.ts does the same). Without this, the natural
+    // mistake `snap tags <id> --tags a,b` -- natural because `snap create`
+    // really does spell it `--tags a,b` -- silently PATCHed the tag set to
+    // ["--tags a", "b"], and `snap tags --yes <id>` used "--yes" as the id.
+    const unknownFlag = positionals.find((a) => a.startsWith("--"));
+    if (unknownFlag)
+        throw new UsageError(`Unknown flag: ${unknownFlag}\n${TAGS_USAGE}`);
     const id = positionals[0];
     if (!id)
         throw new UsageError(TAGS_USAGE);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ahood/cli",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "CLI for ahood, a registry for installing and publishing Claude Code skills.",
   "license": "MIT",
   "homepage": "https://github.com/AlexKay28/ahood-cli",