@ahood/cli 0.9.0 → 0.10.1

package/dist/commands/update.js

@@ -2,10 +2,9 @@ import { LOCKFILE_PATH, parseOwnerSkill } from "../spec.js";
 import { readLockfile } from "../lockfile.js";
 import { add, fetchVersionMeta, readMcpConfig, updateMcpEntry } from "./add.js";
 import { UsageError } from "../usage-error.js";
+import { assertKind, isCliKind, KINDS, localInstalledKind, strictKind } from "../kinds.js";
 const USAGE = "Usage: ahood skill update [<owner>/<skill> ...] [--dry-run] [--json]";
-async function previewSkill(ownerSlashSkill, currentVersion) {
-    const { owner, skill } = parseOwnerSkill(ownerSlashSkill, USAGE);
-    const meta = await fetchVersionMeta(owner, skill, "latest");
+function toPreview(ownerSlashSkill, currentVersion, meta) {
     const upToDate = currentVersion === meta.version;
     return {
         skill: ownerSlashSkill,
@@ -55,7 +54,7 @@ function padRow(cells, widths) {
 // Prints a side-by-side current/latest table for every previewed skill, then
 // -- for only the skills that actually have an update available -- the
 // changelog for the version they'd move to. Nothing here touches disk or the
-// network beyond the read-only resolution already done in previewSkill().
+// network beyond the read-only resolution already done by the caller before toPreview().
 function printDryRunTable(previews) {
     const header = ["SKILL", "CURRENT", "LATEST", "STATUS"];
     const rows = previews.map((p) => [
@@ -78,7 +77,30 @@ function printDryRunTable(previews) {
         console.log(p.changelog_md ? p.changelog_md : "(no changelog available)");
     }
 }
-export async function update(args) {
+// Kind scoping for update/outdated (ahood-cli#172). Returns true when `key`
+// should be skipped as out of scope, throws when it must be refused, and
+// returns false when it is in scope.
+//
+//   explicit target, wrong kind -> refused (counts as that entry's failure)
+//   no-arg run, wrong kind      -> silently out of scope: `ahood agent update`
+//                                  only ever considers installed agents
+//   no-arg run, kind unknown    -> skipped with a warning rather than guessed
+//                                  into (or out of) the run
+function outOfScope(scope, key, actual, implicit) {
+    const kind = strictKind(scope);
+    if (kind === undefined || actual === kind)
+        return false;
+    if (!implicit) {
+        assertKind(scope, key, actual, "update", "update");
+        return false; // unreachable: assertKind throws for every actual !== kind
+    }
+    if (!isCliKind(actual)) {
+        console.warn(`WARNING: skipping ${key} -- the registry did not report a kind ahood can match against ${KINDS[kind].plural}.`);
+    }
+    return true;
+}
+export async function update(args, scope) {
+    const kind = strictKind(scope);
     const dryRun = args.includes("--dry-run");
     const jsonOutput = args.includes("--json");
     if (jsonOutput && !dryRun) {
@@ -86,9 +108,23 @@ export async function update(args) {
     }
     const targets = args.filter((a) => a !== "--dry-run" && a !== "--json");
     const lockfile = readLockfile(LOCKFILE_PATH);
-    const skillKeys = targets.length > 0 ? targets : Object.keys(lockfile);
+    const implicit = targets.length === 0;
+    let skillKeys = implicit ? Object.keys(lockfile) : targets;
+    if (implicit && kind) {
+        // A cheap local pre-filter so a pin this project's own files already
+        // show to be another kind costs no request (and can't fail the run).
+        // Unknown footprints stay in and are settled by the registry's answer.
+        skillKeys = skillKeys.filter((key) => {
+            const parts = key.split("/");
+            if (parts.length !== 2)
+                return true; // let the loop report the bad key as before
+            const local = localInstalledKind(parts[0], parts[1], lockfile[key]);
+            return local === undefined || local === kind;
+        });
+    }
+    const noneMessage = kind ? `No installed ${KINDS[kind].plural} to update.` : "No installed skills to update.";
     if (skillKeys.length === 0) {
-        console.log("No installed skills to update.");
+        console.log(noneMessage);
         return;
     }
     if (dryRun) {
@@ -99,7 +135,11 @@ export async function update(args) {
         const failures = [];
         for (const key of skillKeys) {
             try {
-                previews.push(await previewSkill(key, lockfile[key]?.version ?? null));
+                const { owner, skill } = parseOwnerSkill(key, USAGE);
+                const meta = await fetchVersionMeta(owner, skill, "latest");
+                if (outOfScope(scope, key, meta.kind, implicit))
+                    continue;
+                previews.push(toPreview(key, lockfile[key]?.version ?? null, meta));
             }
             catch (error) {
                 const message = error instanceof Error ? error.message : String(error);
@@ -120,6 +160,7 @@ export async function update(args) {
         return;
     }
     const failures = [];
+    let inScope = 0;
     for (const ownerSlashSkill of skillKeys) {
         if (!lockfile[ownerSlashSkill]) {
             // Reachable two ways: an explicitly-named skill that was never
@@ -141,6 +182,9 @@ export async function update(args) {
             // mcp-update support) instead.
             const { owner, skill } = parseOwnerSkill(ownerSlashSkill, USAGE);
             const meta = await fetchVersionMeta(owner, skill, "latest");
+            if (outOfScope(scope, ownerSlashSkill, meta.kind, implicit))
+                continue;
+            inScope++;
             if (meta.kind === "mcp") {
                 const currentEntry = lockfile[ownerSlashSkill];
                 if (currentEntry && currentEntry.version === meta.version && mcpEntryIsIntact(skill)) {
@@ -168,7 +212,12 @@ export async function update(args) {
                 await updateMcpEntry(owner, skill, meta, currentEntry);
                 continue;
             }
-            await add([ownerSlashSkill]); // no @version -- resolves to latest again
+            // no @version -- resolves to latest again. A strict scope is passed on so
+            // add() re-checks the kind it resolves itself before writing anything.
+            if (kind)
+                await add([ownerSlashSkill], scope);
+            else
+                await add([ownerSlashSkill]);
         }
         catch (error) {
             // One skill being removed/yanked/unreachable must not stop every other
@@ -178,6 +227,9 @@ export async function update(args) {
             failures.push(ownerSlashSkill);
         }
     }
+    if (implicit && kind && inScope === 0 && failures.length === 0) {
+        console.log(noneMessage);
+    }
     if (failures.length > 0) {
         console.error(`${failures.length} of ${skillKeys.length} skill(s) failed to update: ${failures.join(", ")}`);
         process.exitCode = 1;

package/dist/commands/versions.js

@@ -1,6 +1,7 @@
 import { apiJson } from "../http.js";
 import { parseOwnerSkill } from "../spec.js";
 import { UsageError } from "../usage-error.js";
+import { ensureRemoteKind } from "../kinds.js";
 const USAGE = "Usage: ahood skill versions <owner>/<skill> [--json]";
 function formatSize(bytes) {
     if (bytes < 1024)
@@ -18,12 +19,13 @@ export async function listSkillVersions(owner, skill) {
     const { versions } = await apiJson(`/api/v1/skills/${encodeURIComponent(owner)}/${encodeURIComponent(skill)}/versions`);
     return versions ?? [];
 }
-export async function versions(args) {
+export async function versions(args, scope) {
     const jsonOutput = args.includes("--json");
     const spec = args.find((a) => !a.startsWith("--"));
     if (!spec)
         throw new UsageError(USAGE);
     const { owner, skill } = parseOwnerSkill(spec, USAGE);
+    await ensureRemoteKind(scope, owner, skill, "versions", "list the versions of");
     const list = await listSkillVersions(owner, skill);
     if (jsonOutput) {
         console.log(JSON.stringify(list));

package/dist/commands/view.js

@@ -3,6 +3,7 @@ import { apiJson } from "../http.js";
 import { getApiUrl } from "../config.js";
 import { parseOwnerSkill } from "../spec.js";
 import { UsageError } from "../usage-error.js";
+import { assertKind, ensureRemoteKind } from "../kinds.js";
 const USAGE = "Usage: ahood skill view <owner>/<skill> [--json] [--web]";
 // Spawned with argv as an array (not a shell string), so a crafted owner/skill
 // can never inject shell syntax -- and both segments are already restricted
@@ -26,7 +27,7 @@ function openBrowser(url) {
 export async function viewSkill(owner, skill) {
     return apiJson(`/api/v1/skills/${encodeURIComponent(owner)}/${encodeURIComponent(skill)}`);
 }
-export async function view(args) {
+export async function view(args, scope) {
     const jsonOutput = args.includes("--json");
     const web = args.includes("--web");
     const spec = args.find((a) => !a.startsWith("--"));
@@ -35,10 +36,12 @@ export async function view(args) {
     const { owner, skill } = parseOwnerSkill(spec, USAGE);
     const url = `${getApiUrl()}/${owner}/${skill}`;
     if (web) {
+        await ensureRemoteKind(scope, owner, skill, "view", "open");
         openBrowser(url);
         return;
     }
     const detail = await viewSkill(owner, skill);
+    assertKind(scope, `${owner}/${skill}`, detail.kind, "view", "show");
     if (jsonOutput) {
         console.log(JSON.stringify(detail));
         return;

package/dist/commands/whoami.js

@@ -4,14 +4,22 @@ import { resolveToken } from "../credentials.js";
 // still authenticate?", which is already settled by the time this runs.
 // A failure here (network blip, an otherwise-valid token hitting a 500 on
 // this specific route, etc.) must never turn a successful auth check into a
-// command failure -- so every error is swallowed and callers fall back to
-// the plain "Authenticated..." message instead.
+// command failure -- so most errors are swallowed and callers fall back to
+// the plain "Authenticated..." message instead. The one exception is a 404,
+// which carries a `provisioning` flag worth reading rather than discarding:
+// see ProfileOutcome above.
 async function fetchProfile() {
     try {
-        return await apiJson("/api/v1/profile");
+        const profile = await apiJson("/api/v1/profile");
+        return { profile };
     }
-    catch {
-        return undefined;
+    catch (error) {
+        if (error instanceof ApiError && error.status === 404) {
+            const body = error.body;
+            const provisioning = !!body && typeof body === "object" && body.provisioning === true;
+            return { profileStatus: provisioning ? "provisioning" : "not_found" };
+        }
+        return {};
     }
 }
 // Pure auth-status check: no console output, no process.exitCode -- callers
@@ -38,13 +46,13 @@ export async function checkAuth() {
         await apiJson("/api/v1/auth/tokens");
         // A session-backed caller (only reachable if this ever runs against a
         // cookie-bearing client) -- the token list came back.
-        const profile = await fetchProfile();
-        return { authenticated: true, mode: "session", profile };
+        const profileOutcome = await fetchProfile();
+        return { authenticated: true, mode: "session", ...profileOutcome };
     }
     catch (error) {
         if (error instanceof ApiError && error.status === 403) {
-            const profile = await fetchProfile();
-            return { authenticated: true, mode: "token", profile };
+            const profileOutcome = await fetchProfile();
+            return { authenticated: true, mode: "token", ...profileOutcome };
         }
         if (error instanceof ApiError && error.status === 401) {
             return { authenticated: false, reason: "invalid_token" };
@@ -89,6 +97,39 @@ export async function whoami(args = []) {
         process.exitCode = 1;
         return;
     }
+    const asToken = result.mode === "token";
+    if (result.profileStatus === "not_found") {
+        // Distinct from "provisioning" below: the server saw a 404 for this
+        // caller's profile and did NOT flag it as the expected provisioning
+        // window (ahood#340) -- authentication is genuinely fine (we got this
+        // far), but something about the account's profile is actually wrong
+        // rather than merely not-created-yet. Exit 5 ("Not found"), the same
+        // code exitCodeFor() already gives an ApiError 404 elsewhere -- this is
+        // that same class of failure, just decided locally since checkAuth()
+        // never throws.
+        if (wantsJson)
+            console.log(JSON.stringify({ authenticated: true, mode: result.mode, profileStatus: "not_found" }));
+        else {
+            console.error(`Authenticated${asToken ? " with a personal API token" : ""}, but no profile was found for this account -- ` +
+                "this is not the usual just-signed-up delay, so something is actually wrong. Try `ahood login` again, and " +
+                "if it keeps happening, contact support.");
+        }
+        process.exitCode = 5;
+        return;
+    }
+    if (result.profileStatus === "provisioning") {
+        // The expected, self-resolving window between signup and the profile
+        // row being created (ahood#336, ahood#340) -- not a failure of any kind,
+        // so this stays exit 0. "Refresh this page" (the web copy's hint) makes
+        // no sense here; re-running the command is the CLI-native equivalent.
+        if (wantsJson)
+            console.log(JSON.stringify({ authenticated: true, mode: result.mode, profileStatus: "provisioning" }));
+        else {
+            console.log(`Authenticated${asToken ? " with a personal API token" : ""}. Your account is still being set up -- ` +
+                "this finishes on its own and needs nothing from you. Run `ahood whoami` again in a bit to see your profile.");
+        }
+        return;
+    }
     if (wantsJson) {
         console.log(JSON.stringify({ authenticated: true, mode: result.mode, ...result.profile }));
         return;

package/dist/config.js

@@ -1,5 +1,10 @@
 import { UsageError } from "./usage-error.js";
-const DEFAULT_API_URL = "https://ahood.vercel.app";
+// www.ahood.dev since ahood#661: production Clerk only accepts ahood.dev
+// origins, so web pages on the old host redirect here. The API still answers on
+// https://ahood.vercel.app (CLIs <= 0.10.0 default to it), so an override naming
+// that legacy host is official too and isn't warned about.
+const DEFAULT_API_URL = "https://www.ahood.dev";
+const LEGACY_API_URL = "https://ahood.vercel.app";
 let warnedAboutOverride = false;
 // AHOOD_API_URL is trusted with the bearer token on every request (see
 // http.ts's apiFetch), so a scheme/host is validated rather than accepted
@@ -29,7 +34,7 @@ export function getApiUrl() {
     if (url.protocol !== "https:" && !(url.protocol === "http:" && isLocalHost)) {
         throw new UsageError(`AHOOD_API_URL must use https:// (http:// is only allowed for localhost/test hosts); got "${configured}".`);
     }
-    if (trimmed !== DEFAULT_API_URL && !warnedAboutOverride) {
+    if (trimmed !== DEFAULT_API_URL && trimmed !== LEGACY_API_URL && !warnedAboutOverride) {
         console.error(`warning: using non-default API endpoint from AHOOD_API_URL: ${trimmed}`);
         warnedAboutOverride = true;
     }