@amdahl/cli 0.2.2 → 0.2.3

package/README.md

@@ -105,7 +105,7 @@ amdahl keys list
 amdahl keys revoke <id|prefix> [--yes] [--no-browser]
 amdahl workspace list | amdahl workspace use <profile>
 amdahl install claude-code|codex|cursor [--print] [--force]
-amdahl skills add <publisher>/<skill> [-g] [--agents] [--force] [--site <origin>]
+amdahl skills add <publisher>/<skill> [-g] [--agents] [--force] [--accept-warning] [--site <origin>]
 ```
 
 Global flags: `--profile`, `--api-url`, `--api-key`, `--json`, `--no-color`,
@@ -164,6 +164,39 @@ Code. Without flags it says on stderr where the skill went. `-y` (`--yes`)
 adds it to this project without asking. Neither replaces a different copy
 without `--force`.
 
+amdahl.ai's AI security review flags some skills. A flagged skill's index
+entry carries an `x-amdahl-warning` field. `skills add` prints it before it
+writes anything: the skill, the sentence from the skill page, and the page's
+link.
+
+```
+Warning: amdahl.ai's security review flagged amdahl/call-prep.
+  Flagged: it may send your data somewhere else (line 14), and 2 more. Read it before you install.
+  See what was flagged: https://amdahl.ai/skills/amdahl/call-prep
+```
+
+In a terminal, it then asks `Install this skill?` in the same kind of menu.
+The marker starts on "Cancel", which writes nothing and exits 0. "Install
+anyway" goes on as usual. With `-y`, `--json` or no terminal, it does not
+install the skill. It does not ask an agent either, even in a terminal: when
+`CLAUDECODE` or `CURSOR_AGENT` is set, it does not install. It says to show
+the warning to the person, and exits 9. Once they agree, run the same
+command again with `--accept-warning`: it prints the warning and installs. With `--json`, the result or the refusal
+carries the warning as `warning`, with `result`, `flagged`, `line`, `text`
+and `page`.
+
+It treats every field of the warning as untrusted. It turns line breaks in
+the sentence into spaces, removes control, escape and format characters, and
+cuts the sentence at 300 characters. It keeps `line` only as a positive
+integer, and `flagged` only as a plain id.
+
+The site sends the field only for a flagged skill. So when the field is
+there but `skills add` cannot read it (it is not an object, its `result` is
+not `warn` or `fail`, or it has no sentence), the skill is still flagged. It
+prints the sentence "amdahl.ai flagged this skill. This version of the CLI
+could not read why." and holds the install the same way. Only a missing
+field, or `null`, means no warning.
+
 It reads the skill's index,
 `https://amdahl.ai/skills/<publisher>/<skill>/.well-known/agent-skills/index.json`
 ([Agent Skills Discovery](https://schemas.agentskills.io/discovery/0.2.0/schema.json)
@@ -274,6 +307,7 @@ code shown in the terminal; then the key is printed once and stored nowhere.
 | 6 | rate limited or quota (429) |
 | 7 | approval denied, expired or locked out |
 | 8 | network or 5xx |
+| 9 | `skills add` did not install a skill amdahl.ai's security review flagged: no terminal to ask, `-y`, `--json` or an agent ran it, and no `--accept-warning` (nothing was written) |
 | 130 | stopped with Ctrl+C at a question (nothing was written) |
 
 ## Development

package/dist/amdahl.js

@@ -7547,6 +7547,8 @@ var EXIT = {
   rateLimited: 6,
   denied: 7,
   network: 8,
+  /** `skills add` would install a skill amdahl.ai's security review flagged, with no terminal to ask and no --accept-warning. */
+  flagged: 9,
   cancelled: 130
 };
 var CliError = class extends Error {
@@ -7555,13 +7557,16 @@ var CliError = class extends Error {
   hint;
   /** Technical detail for `--json` only, kept out of the plain message. */
   detail;
-  constructor(code, message2, exit, hint, detail) {
+  /** More fields for `--json` only, printed beside `ok` and `error`. */
+  data;
+  constructor(code, message2, exit, hint, detail, data) {
     super(message2);
     this.name = "CliError";
     this.code = code;
     this.exit = exit;
     this.hint = hint;
     this.detail = detail;
+    this.data = data;
   }
 };
 function usageError(message2, hint) {
@@ -7637,6 +7642,7 @@ var COMMAND_OPTIONS = {
     global: { type: "boolean", short: "g" },
     agents: { type: "boolean" },
     force: { type: "boolean" },
+    "accept-warning": { type: "boolean" },
     site: { type: "string" }
   }
 };
@@ -7720,12 +7726,17 @@ Commands:
   keys revoke <id|prefix> [--yes] [--no-browser]
   workspace list | workspace use <profile>
   install claude-code|codex|cursor [--print] [--force]
-  skills add <publisher>/<skill> [-y] [-g] [--agents] [--force] [--site <origin>]
+  skills add <publisher>/<skill> [-y] [-g] [--agents] [--force] [--accept-warning] [--site <origin>]
            In a terminal it asks one question: this project (Enter) or every project.
            -y        add without asking, to this project
            -g        every project (~/.claude/skills), not just this one
            --agents  also .agents/skills, for Codex, Cursor and other agents
            --force   replace a different copy of the skill already there
+           --accept-warning
+                     install a skill that amdahl.ai's security review flagged,
+                     after printing the warning. Without it, a terminal asks
+                     (Cancel or Install anyway); -y, --json or no terminal
+                     stops (exit 9)
 
 Global options:
   --profile <name>   Use a saved profile (default: AMDAHL_PROFILE, then the default profile)
@@ -9491,6 +9502,80 @@ function nextStep(ctx, targets, seen) {
   return `Open a new ${joinNames(names, "or")} chat ${where} to use it.`;
 }
 
+// src/commands/skills-warning.ts
+var WARNING_FIELD = "x-amdahl-warning";
+var MAX_WARNING_CHARS = 300;
+var BREAK_RE = /[\t\n\v\f\r\u0085\u2028\u2029]/g;
+var UNSAFE_RE = /[\p{Cc}\p{Cf}\p{Cs}]/gu;
+var CHECK_ID_RE = /^[a-z][a-z0-9_]{0,39}$/;
+function warningText(raw) {
+  const clean = raw.replace(BREAK_RE, " ").replace(UNSAFE_RE, "").replace(/ {2,}/g, " ").trim();
+  const chars = Array.from(clean);
+  if (chars.length <= MAX_WARNING_CHARS) return clean;
+  return `${chars.slice(0, MAX_WARNING_CHARS - 3).join("").trimEnd()}...`;
+}
+var UNREADABLE_WARNING = Object.freeze({
+  result: "warn",
+  flagged: null,
+  line: null,
+  text: "amdahl.ai flagged this skill. This version of the CLI could not read why."
+});
+function readWarning(raw) {
+  if (raw === void 0 || raw === null) return void 0;
+  if (typeof raw !== "object" || Array.isArray(raw)) return { ...UNREADABLE_WARNING };
+  const { result, flagged, line, text } = raw;
+  if (result !== "warn" && result !== "fail") return { ...UNREADABLE_WARNING };
+  const sentence = typeof text === "string" ? warningText(text) : "";
+  if (!sentence) return { ...UNREADABLE_WARNING };
+  return {
+    result,
+    flagged: typeof flagged === "string" && CHECK_ID_RE.test(flagged) ? flagged : null,
+    line: typeof line === "number" && Number.isSafeInteger(line) && line > 0 ? line : null,
+    text: sentence
+  };
+}
+function skillPage(site, ref) {
+  return `${site}/skills/${ref.publisher}/${ref.skill}`;
+}
+function warningJson(warning, site, ref) {
+  return { ...warning, page: skillPage(site, ref) };
+}
+function canAsk(ctx) {
+  return !ctx.nonInteractive && ctx.io.stdoutIsTTY && !ctx.out.json && ctx.flags.yes !== true && runningAgent(ctx) === null;
+}
+async function confirmWarning(ctx, ref, site, warning) {
+  const { out } = ctx;
+  const host = new URL(site).host;
+  const name = `${ref.publisher}/${ref.skill}`;
+  const head = warning.result === "fail" ? `${name} failed ${host}'s security review.` : `${host}'s security review flagged ${name}.`;
+  out.info([out.bold(`Warning: ${head}`), `  ${warning.text}`, `  See what was flagged: ${skillPage(site, ref)}`].join("\n"));
+  if (ctx.flags["accept-warning"] === true) {
+    out.info("Installing it anyway, because of --accept-warning.");
+    return true;
+  }
+  if (!canAsk(ctx)) {
+    throw new CliError(
+      "skill_flagged",
+      `Did not install ${name}, because the security review flagged it. Nothing was written.`,
+      EXIT.flagged,
+      "Show this warning to the person you are working for. Once they agree, run the same command again with --accept-warning.",
+      void 0,
+      { warning: warningJson(warning, site, ref) }
+    );
+  }
+  out.info("");
+  let pick;
+  try {
+    pick = await ctx.io.select("Install this skill?", ["Cancel", "Install anyway"], { initial: 0, color: out.color });
+  } catch (err) {
+    if (err instanceof PromptCancelled) throw new CliError("cancelled", "Stopped. Nothing was written.", EXIT.cancelled);
+    throw err;
+  }
+  if (pick === 1) return true;
+  out.info("Cancelled. Nothing was written.");
+  return false;
+}
+
 // src/commands/skills.ts
 var DEFAULT_SKILLS_SITE = "https://amdahl.ai";
 var LOOPBACK = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
@@ -9501,7 +9586,7 @@ var MAX_SKILL_BYTES = 64 * 1024;
 var MAX_ARCHIVE_BYTES = 4 * 1024 * 1024;
 var DIGEST_RE = /^sha256:([0-9a-f]{64})$/i;
 var FRONT_MATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---[ \t]*(?:\r?\n|$)/;
-var USAGE2 = "Usage: amdahl skills add <publisher>/<skill> [-y] [-g] [--agents] [--force] [--site <origin>]";
+var USAGE2 = "Usage: amdahl skills add <publisher>/<skill> [-y] [-g] [--agents] [--force] [--accept-warning] [--site <origin>]";
 function normaliseSite(raw) {
   let url;
   try {
@@ -9618,12 +9703,14 @@ function readIndex(body, indexUrl, ref, site) {
   if (!url) throw bad(`gives ${ref.skill} no file URL`);
   if (url.origin !== site) throw bad(`points ${ref.skill} at ${url.origin}, not ${site}`);
   const version = typeof entry.version === "string" ? printable(entry.version) : "";
+  const warning = readWarning(entry[WARNING_FIELD]);
   return {
     type,
     url: url.href,
     sha256: digest[1].toLowerCase(),
     description: typeof entry.description === "string" ? entry.description : "",
-    ...version ? { version } : {}
+    ...version ? { version } : {},
+    ...warning ? { warning } : {}
   };
 }
 function checkDigest(body, fileUrl, sha256) {
@@ -9720,6 +9807,11 @@ async function skillsAdd(ctx, args) {
   if (guided) ctx.io.stderr("OK\n\n");
   const { entry, payload, meta } = fetched;
   const { url, sha256 } = entry;
+  const { warning } = entry;
+  if (warning) {
+    if (!await confirmWarning(ctx, ref, site, warning)) return EXIT.ok;
+    if (guided) ctx.out.info("");
+  }
   const agent = runningAgent(ctx);
   let targets;
   let seen = [];
@@ -9749,7 +9841,15 @@ async function skillsAdd(ctx, args) {
     (f) => f.action === "unchanged" ? `Already up to date: ${f.path}` : `${f.action === "wrote" ? "Wrote" : "Replaced"} ${f.path}${count}`
   );
   if (contents && plan.some((f) => f.action !== "unchanged")) lines.push(...contents.map((p) => `  ${p}`));
-  const result = { ok: true, publisher: ref.publisher, skill: ref.skill, url, digest: `sha256:${sha256}`, files: plan };
+  const result = {
+    ok: true,
+    publisher: ref.publisher,
+    skill: ref.skill,
+    url,
+    digest: `sha256:${sha256}`,
+    files: plan,
+    ...warning ? { warning: warningJson(warning, site, ref) } : {}
+  };
   if (guided) {
     const changed = plan.filter((f) => f.action !== "unchanged");
     const done = changed.length > 0 ? `Done. Added to ${skillsFolders(ctx, changed)}.` : `Already up to date in ${skillsFolders(ctx, plan)}.`;
@@ -9828,7 +9928,7 @@ async function workspaceUse(ctx, args) {
 }
 
 // src/version.ts
-var VERSION = "0.2.2";
+var VERSION = "0.2.3";
 
 // src/main.ts
 var COMMANDS = {
@@ -9879,7 +9979,7 @@ async function runCli(argv, io) {
       const error = { code: e.code, message: e.message };
       if (e.hint) error.hint = e.hint;
       if (e.detail) error.detail = e.detail;
-      io.stdout(`${JSON.stringify({ ok: false, error })}
+      io.stdout(`${JSON.stringify({ ...e.data, ok: false, error })}
 `);
     } else {
       io.stderr(`${e.code === "cancelled" ? "" : "Error: "}${e.message}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amdahl/cli",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "type": "module",
   "description": "The amdahl command line: sign in, check setup, optimize messages, manage API keys, connect MCP clients.",
   "license": "Apache-2.0",