@prave/cli 1.4.2 → 1.4.4

package/dist/commands/deploy.js

@@ -1,3 +1,13 @@
+/**
+ * Multi-agent fan-out helper.
+ *
+ * This module used to back a public `prave deploy <skill>` command, but
+ * shipping that as a top-level CLI surface only duplicated what
+ * `prave install` already prompts for ("Deploy to all configured agents?
+ * [y/N]"). The standalone command was removed; `deployCommand` lives on
+ * as an internal helper that `install.ts` and `sync.ts` import to do
+ * the actual fan-out + Cursor `.mdc` rewrite.
+ */
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join } from 'node:path';

package/dist/commands/mcp-server.js

@@ -118,8 +118,16 @@ async function handleSearch(args) {
     if (args.category)
         params.set('category', args.category);
     params.set('limit', String(Math.min(20, Math.max(1, args.limit ?? 10))));
+    // The API's GET /skills returns a flat array as `data` (the
+    // controller calls `res.json(ok(skills))` with skills being
+    // `SkillSearchHit[]`). An earlier version of this MCP handler
+    // wrapped the response in `{items}` which is the shape the wizard
+    // uses, but never the public list endpoint — that mismatch silently
+    // turned every search into "No Skills matched" because `data.items`
+    // was always undefined. Normalise both shapes to stay forward-
+    // compatible with future API shifts.
     const { data } = await api.get(`/api/v1/skills?${params.toString()}`, true);
-    const items = data.items ?? [];
+    const items = Array.isArray(data) ? data : (data?.items ?? []);
     const lines = items.map((s) => `• ${s.name} (${s.slug}) — ${s.description ?? 'no description'} · ↓${s.install_count}`);
     return mcpText(lines.length
         ? `Found ${lines.length} Skill${lines.length === 1 ? '' : 's'}:\n\n${lines.join('\n')}`
@@ -139,8 +147,11 @@ async function handleWhatdoes(args) {
         .join('\n'));
 }
 async function handleMySkills() {
+    // Same shape gotcha as handleSearch — /me/skills also returns a flat
+    // array via `ok(skills)` where skills is `SkillSearchHit[]`. Normalise
+    // both shapes so a future server-side refactor doesn't break the tool.
     const { data } = await api.get('/api/v1/me/skills', true);
-    const items = data.items ?? [];
+    const items = Array.isArray(data) ? data : (data?.items ?? []);
     if (items.length === 0) {
         return mcpText('You haven\'t installed or authored any Skills yet. Try `prave_search_skills` to browse the catalogue.');
     }

package/dist/commands/run.js

@@ -47,7 +47,8 @@ const TAR_IGNORE = new Set([
 ]);
 const MAX_BUNDLE_BYTES = 20 * 1024 * 1024; // matches API + Supabase Storage cap
 const MAX_FILES = 200;
-export async function runDeployCommand(pathArg) {
+export async function runDeployCommand(pathArg, options = {}) {
+    const isUpdate = Boolean(options.updateRunSlug);
     const root = resolve(pathArg ?? process.cwd());
     const rootStat = await stat(root).catch(() => null);
     if (!rootStat?.isDirectory()) {
@@ -107,11 +108,16 @@ export async function runDeployCommand(pathArg) {
             'will prompt you for the real values during the wizard.'));
         process.exit(1);
     }
-    // 2. Mint the deploy session
-    const initSpinner = ora('Opening deploy session…').start();
+    // 2. Mint the deploy session. Update flows tag the session with
+    // the existing run's slug so the upload handler swaps that run's
+    // bundle pointer instead of creating a fresh row.
+    const initSpinner = ora(isUpdate ? `Opening update session for ${options.updateRunSlug}…` : 'Opening deploy session…').start();
     let session;
     try {
-        const { data } = await api.post('/api/v1/deploy/init', {}, true);
+        const initPath = isUpdate
+            ? `/api/v1/deploy/init?run_slug=${encodeURIComponent(options.updateRunSlug)}`
+            : '/api/v1/deploy/init';
+        const { data } = await api.post(initPath, {}, true);
         session = data.session;
         initSpinner.succeed('Session opened');
     }
@@ -178,12 +184,23 @@ export async function runDeployCommand(pathArg) {
             process.exit(1);
         }
         uploadSpinner.succeed('Upload complete');
+        // Update flow: the server already swapped the run's bundle
+        // pointer. No wizard, no browser open — just confirm + exit.
+        const parsed = safeJson(text);
+        if (isUpdate || parsed?.updated_run_slug) {
+            console.log();
+            console.log(chalk.bold(`Updated ${parsed?.updated_run_slug ?? options.updateRunSlug}.`));
+            console.log(chalk.dim('  Next scheduled fire will use the freshly-uploaded bundle.\n' +
+                '  Open the dashboard:'));
+            console.log(chalk.cyan('  ' + session.wizard_url));
+            return;
+        }
     }
     catch (err) {
         uploadSpinner.fail(`Upload failed: ${err.message}`);
         process.exit(1);
     }
-    // 5. Open the browser at the wizard
+    // 5. New-run flow: open the browser at the wizard.
     console.log();
     console.log(chalk.bold('Finish in the browser:'));
     console.log(chalk.cyan('  ' + session.wizard_url));
@@ -435,3 +452,30 @@ function safeJson(text) {
         return null;
     }
 }
+/**
+ * `prave run trigger <slug>` — fire a single ad-hoc execution outside
+ * the cron schedule. Refused with 409 when another execution is in
+ * flight (same single-flight guard the dashboard's "Run now" button
+ * uses). Returns immediately after enqueueing — tail with
+ * `prave run logs <slug>` after a few seconds.
+ */
+export async function runTriggerCommand(slug) {
+    if (!(await requireAuth('prave run trigger')))
+        return;
+    const spinner = ora(`Triggering ${slug}…`).start();
+    try {
+        await api.post(`/api/v1/runs/${encodeURIComponent(slug)}/trigger`, undefined, true);
+        spinner.succeed(`Triggered ${chalk.bold(slug)} — log will appear in a few seconds.`);
+        console.log(chalk.dim(`  Tail it with `) +
+            chalk.cyan(`prave run logs ${slug}`) +
+            chalk.dim(` (or watch the dashboard).`));
+    }
+    catch (err) {
+        if (err instanceof ApiError && err.status === 409) {
+            spinner.warn(`An execution is already in flight for ${slug} — wait for it to finish, then re-run.`);
+            return;
+        }
+        spinner.fail(err.message);
+        process.exit(1);
+    }
+}

package/dist/index.js

@@ -4,10 +4,8 @@ import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { Command } from 'commander';
 import { conflictsCommand } from './commands/conflicts.js';
-import { deployCommand } from './commands/deploy.js';
 import { diffCommand } from './commands/diff.js';
 import { docsCommand } from './commands/docs.js';
-import { exportCommand } from './commands/export.js';
 import { importCommand } from './commands/import.js';
 import { installCommand } from './commands/install.js';
 import { listCommand } from './commands/list.js';
@@ -17,13 +15,13 @@ import { mcpInstallCommand } from './commands/mcp-install.js';
 import { mcpServerCommand } from './commands/mcp-server.js';
 import { optimizeCommand } from './commands/optimize.js';
 import { overviewCommand } from './commands/overview.js';
-import { runDeployCommand, runListCommand, runLogsCommand, } from './commands/run.js';
+import { runDeployCommand, runListCommand, runLogsCommand, runTriggerCommand, } from './commands/run.js';
 import { searchCommand } from './commands/search.js';
 import { settingsCommand } from './commands/settings.js';
 import { syncCommand } from './commands/sync.js';
 import { uninstallCommand } from './commands/uninstall.js';
 import { updateCommand } from './commands/update.js';
-import { usageHookInstallCommand, usageHookUninstallCommand, usageReportCommand, usageScanCommand, usageStatusCommand, } from './commands/usage.js';
+import { usageHookInstallCommand, usageHookUninstallCommand, usageReportCommand, } from './commands/usage.js';
 import { whatdoesCommand } from './commands/whatdoes.js';
 import { whoamiCommand } from './commands/whoami.js';
 import { initAnalytics } from './lib/analytics.js';
@@ -36,12 +34,13 @@ const program = new Command()
     'Prave — Developer platform for Claude Skills.',
     '',
     '  Lifecycle: discover · install · author · sync · audit · ship.',
-    '  Targets ~/.claude/skills/ by default; multi-agent via `prave deploy`.',
+    '  Targets ~/.claude/skills/ by default; multi-agent fan-out happens at install time.',
     '',
     '  Quick start:',
     '    prave login          # device-code auth in your browser',
     '    prave search <q>     # discover community skills',
-    '    prave install <slug> # pull into ~/.claude/skills/',
+    '    prave install <slug> # pull into ~/.claude/skills/ (multi-agent prompt included)',
+    '    prave run deploy     # bundle cwd, schedule on Prave\'s sandbox',
     '    prave usage hook install   # real-time invocation tracking',
     '',
     '  Docs:    https://prave.app/docs',
@@ -97,11 +96,6 @@ program
     .option('--heavy', 'narrow to Skills above the heavy-tier threshold (>5k estimated tokens)')
     .action(listCommand);
 program.command('search <query>').description('Search public Skills').action(searchCommand);
-program
-    .command('export <slug>')
-    .description('Print or save a Skill\'s SKILL.md without installing')
-    .option('-o, --out <file>', 'write to file instead of stdout')
-    .action(exportCommand);
 program
     .command('diff <slug>')
     .description('Show local vs registry diff for an installed Skill')
@@ -135,16 +129,6 @@ program
 const usage = program
     .command('usage')
     .description('Track which Skills you actually use (powers the optimiser)');
-usage
-    .command('scan')
-    .description('Scan local Claude Code transcripts and report invocations to Prave')
-    .option('--since <window>', 'override the watermark, e.g. "7d" or "12h"')
-    .option('--quiet', 'log a one-liner instead of a spinner')
-    .action(usageScanCommand);
-usage
-    .command('status')
-    .description('Diagnose hook health, recent event counts, and most-used Skills')
-    .action(usageStatusCommand);
 usage
     .command('report')
     .description('Internal: invoked by the Claude Code PostToolUse / UserPromptSubmit hook (reads stdin)')
@@ -159,12 +143,6 @@ hook
     .command('uninstall')
     .description('Remove the Prave-managed hook from ~/.claude/settings.json')
     .action(usageHookUninstallCommand);
-program
-    .command('deploy <skillname>')
-    .description('Deploy a Skill to every configured agent (Claude Code, Codex, Cursor, Gemini, Cline, Amp). Free plan deploys to Claude Code only; Pro and Max deploy across all six. The skill must already exist locally — use `prave install` first or point to a SKILL.md folder.')
-    .option('--agent <agent>', 'restrict deploy to a single agent (claude-code | codex | cursor | gemini | cline | amp)')
-    .option('--dry-run', 'log every destination path but write nothing — preview before committing')
-    .action(deployCommand);
 program
     .command('mcp-server')
     .description('Run the Prave MCP server over stdio. Wire into Claude Desktop / Cursor MCP / Continue.dev via { "command": "npx", "args": ["-y", "@prave/cli", "mcp-server"] }. Exposes search, install, audit, my-skills, whatdoes as MCP tools.')
@@ -181,6 +159,10 @@ run
     .command('deploy [path]')
     .description('Bundle the current directory (or `path`), upload it to Prave, and open the browser wizard to pick the schedule + agent.')
     .action((path) => runDeployCommand(path));
+run
+    .command('update <slug> [path]')
+    .description("Re-upload the bundle for an existing run. Same flow as `deploy`, but the run's schedule, agent and env vars stay intact — only the project files swap.")
+    .action((slug, path) => runDeployCommand(path, { updateRunSlug: slug }));
 run
     .command('list')
     .description('List your scheduled runs with next-fire time + last status.')
@@ -189,6 +171,10 @@ run
     .command('logs <slug>')
     .description('Print the latest execution log for a scheduled run.')
     .action(runLogsCommand);
+run
+    .command('trigger <slug>')
+    .description('Fire a one-shot execution outside the cron schedule. Refused with 409 if another execution is already in flight. Tail with `prave run logs <slug>` afterwards.')
+    .action(runTriggerCommand);
 program
     .command('mcp install')
     .alias('mcp-install')
@@ -209,14 +195,12 @@ program
         '',
         'Discover & install',
         '  prave search <q>                   # public skill search',
-        '  prave install <slug> [--no-deps]   # install into ~/.claude/skills/',
+        '  prave install <slug> [--no-deps]   # install into ~/.claude/skills/ (multi-agent prompt included)',
         '  prave uninstall <slug>             # remove a local skill',
         '  prave list [--remote] [--verbose]  # what is installed (or remote)',
-        '  prave export <slug> -o file.md     # dump SKILL.md without installing',
         '',
         'Authoring & sync',
         '  prave import [--upload --public]   # publish ~/.claude/skills/ to Prave',
-        '  prave deploy <skill> [--agent x]   # mirror to other agents',
         '  prave sync                         # pull every installed update',
         '  prave update [slug] [--dry-run]    # diff + pull outdated skills',
         '  prave diff <slug>                  # local vs registry diff',
@@ -231,14 +215,14 @@ program
         'Usage tracking (Pro+)',
         '  prave usage hook install           # real-time PostToolUse hook',
         '  prave usage hook uninstall',
-        '  prave usage scan [--since 7d]      # transcript scanner',
-        '  prave usage status                 # hook health + recent counts',
         '',
         'Settings',
         '  prave settings                     # configure agents + paths',
         '',
         'Runs (scheduled cron on Prave)',
         '  prave run deploy                   # bundle cwd, upload, open wizard',
+        '  prave run update <slug>            # re-upload bundle for an existing run',
+        '  prave run trigger <slug>           # fire one execution outside the cron',
         '  prave run list                     # your scheduled runs',
         '  prave run logs <slug>              # tail latest execution log',
         '',

package/dist/lib/api.js

@@ -15,39 +15,68 @@ export class ApiError extends Error {
  * Supabase rate limiter.
  */
 let refreshing = null;
+/** One HTTP round-trip to /cli/refresh — returns null on any non-200. */
+async function callRefresh(refresh_token) {
+    try {
+        const { statusCode, body } = await request(`${CONFIG.apiUrl}/api/v1/cli/refresh`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ refresh_token }),
+        });
+        const text = await body.text();
+        if (statusCode !== 200)
+            return null;
+        const payload = JSON.parse(text);
+        if (!payload.success || !payload.data)
+            return null;
+        return payload.data;
+    }
+    catch {
+        return null;
+    }
+}
 async function refreshTokens() {
     if (refreshing)
         return refreshing;
     refreshing = (async () => {
-        const creds = await loadCredentials();
-        if (!creds?.refresh_token)
+        const initial = await loadCredentials();
+        if (!initial?.refresh_token)
             return null;
-        try {
-            const { statusCode, body } = await request(`${CONFIG.apiUrl}/api/v1/cli/refresh`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ refresh_token: creds.refresh_token }),
-            });
-            const text = await body.text();
-            if (statusCode !== 200)
-                return null;
-            const payload = JSON.parse(text);
-            if (!payload.success || !payload.data)
-                return null;
-            const next = {
-                ...creds,
-                access_token: payload.data.access_token,
-                refresh_token: payload.data.refresh_token ?? creds.refresh_token,
-                user_id: payload.data.user_id,
-                // Persist the new expiry so the next call's proactive check works.
-                expires_at: payload.data.expires_at ?? undefined,
-            };
-            await saveCredentials(next);
-            return next;
+        // First attempt: refresh with whatever's on disk right now.
+        let result = await callRefresh(initial.refresh_token);
+        let creds = initial;
+        // Supabase rotates the refresh_token on every successful refresh, so
+        // the old one is invalidated immediately. Two CLI processes can race
+        // here: the PostToolUse hook fires in the background while a
+        // foreground `prave whoami` (or anything else) is also alive. Each
+        // is its own Node process; the single-flight `refreshing` Promise
+        // only de-dupes within one process.
+        //
+        // When that race happens, the loser's stored refresh_token is now
+        // the already-used (and rejected) one. Re-read credentials.json
+        // once — if the file has moved on (another process wrote newer
+        // tokens), retry with the fresh refresh_token before giving up.
+        if (!result) {
+            const fresh = await loadCredentials();
+            if (fresh?.refresh_token &&
+                fresh.refresh_token !== initial.refresh_token) {
+                result = await callRefresh(fresh.refresh_token);
+                if (result)
+                    creds = fresh;
+            }
         }
-        catch {
+        if (!result)
             return null;
-        }
+        const next = {
+            ...creds,
+            access_token: result.access_token,
+            refresh_token: result.refresh_token ?? creds.refresh_token,
+            user_id: result.user_id,
+            // Persist the new expiry so the next call's proactive check works.
+            expires_at: result.expires_at ?? undefined,
+        };
+        await saveCredentials(next);
+        return next;
     })();
     try {
         return await refreshing;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prave/cli",
-  "version": "1.4.2",
+  "version": "1.4.4",
   "description": "Prave CLI — discover, install, version, test, and ship Claude Skills. The developer platform for the complete Skill lifecycle.",
   "type": "module",
   "keywords": [
@@ -54,7 +54,7 @@
     "ora": "^8.0.1",
     "tar": "^7.4.3",
     "undici": "^6.18.0",
-    "@prave/shared": "1.4.2"
+    "@prave/shared": "1.4.4"
   },
   "devDependencies": {
     "@types/node": "^20.12.7",

package/dist/commands/export.js

@@ -1,35 +0,0 @@
-import { writeFile } from 'node:fs/promises';
-import { api } from '../lib/api.js';
-import { loadCredentials } from '../lib/credentials.js';
-import { fetchMyPlan, formatUpgradeHint } from '../lib/plan.js';
-import { log } from '../utils/logger.js';
-/**
- * `prave export <slug>` — print or save a Skill's SKILL.md to disk
- * without touching ~/.claude/skills/. Useful for CI pipelines that want
- * to bundle Skills into other repos.
- */
-export async function exportCommand(slug, opts = {}) {
-    const session = await loadCredentials();
-    // Plan gate: export is part of the Pro+ authoring toolkit. Free can browse
-    // and install, not extract for republishing.
-    if (session) {
-        const me = await fetchMyPlan();
-        if (!me.limits.can_authoring_public && !me.limits.can_authoring_private) {
-            log.warn('Export requires the Pro plan or higher.');
-            log.dim(formatUpgradeHint('explorer'));
-            return;
-        }
-    }
-    const { data: skill } = await api.get(`/api/v1/skills/${encodeURIComponent(slug)}`, Boolean(session));
-    const content = skill.content ?? '';
-    if (!content.trim()) {
-        log.warn(`${slug} has no content`);
-        return;
-    }
-    if (opts.out) {
-        await writeFile(opts.out, content, 'utf8');
-        log.success(`Wrote ${opts.out} (${content.length} bytes)`);
-        return;
-    }
-    process.stdout.write(content);
-}