@trawlme/cli 1.18.0 → 1.18.1

package/dist/index.d.ts

@@ -17,4 +17,11 @@ export declare function collectCommandNames(root: Command): string[];
 export declare function createProgram(): Command;
 /** True when this module is the process entrypoint (not merely imported by a test). */
 export declare function isEntryPoint(argv1: string | undefined, moduleUrl: string): boolean;
+/**
+ * True when the invocation is a pure `--help`/`--version` query. These must not
+ * trigger the skills auto-sync (a filesystem-mutating startup side effect) — a
+ * user running `trawl --version` never expects it to rewrite their skills dirs.
+ * (#73)
+ */
+export declare function isHelpOrVersion(argv: string[]): boolean;
 export declare function runCli(argv?: string[]): Promise<void>;

package/dist/index.js

@@ -62,8 +62,18 @@ export function createProgram() {
 export function isEntryPoint(argv1, moduleUrl) {
     return argv1 !== undefined && moduleUrl === pathToFileURL(argv1).href;
 }
+/**
+ * True when the invocation is a pure `--help`/`--version` query. These must not
+ * trigger the skills auto-sync (a filesystem-mutating startup side effect) — a
+ * user running `trawl --version` never expects it to rewrite their skills dirs.
+ * (#73)
+ */
+export function isHelpOrVersion(argv) {
+    return argv.some((a) => a === '-h' || a === '--help' || a === '-V' || a === '--version');
+}
 export async function runCli(argv = process.argv) {
-    autoUpdateInstalledSkills();
+    if (!isHelpOrVersion(argv))
+        autoUpdateInstalledSkills();
     initPostHog();
     const program = createProgram();
     registerAllowedCommands(collectCommandNames(program));

package/dist/lib/prompt.js

@@ -6,26 +6,38 @@ export async function promptPassword(prompt) {
             process.stdin.setRawMode(true);
             process.stdin.resume();
             process.stdin.setEncoding('utf8');
-            const onData = (char) => {
-                if (char === '\r' || char === '\n') {
-                    process.stdin.setRawMode(false);
-                    process.stdin.pause();
-                    process.stdin.removeListener('data', onData);
-                    process.stderr.write('\n');
-                    resolve(password);
-                }
-                else if (char === '\u0003') {
-                    // Ctrl+C
-                    process.stdin.setRawMode(false);
-                    process.stdin.pause();
-                    process.exit(1);
-                }
-                else if (char === '\u007F' || char === '\b') {
-                    // Backspace
-                    password = password.slice(0, -1);
-                }
-                else {
-                    password += char;
+            const restore = () => {
+                process.stdin.setRawMode(false);
+                process.stdin.pause();
+                process.stdin.removeListener('data', onData);
+            };
+            const onData = (chunk) => {
+                // A stdin chunk is NOT a single keystroke. Terminals deliver a paste as
+                // one chunk (Windows Terminal always chunk-pastes), and a paste that
+                // ends in a newline embeds a literal \r mid-chunk. Iterate per code
+                // point so an embedded Enter finalizes the password instead of being
+                // appended to it and hanging for a second Enter. (#73)
+                for (const char of chunk) {
+                    if (char === '\r' || char === '\n') {
+                        restore();
+                        process.stderr.write('\n');
+                        resolve(password);
+                        return; // ignore anything after the first terminator
+                    }
+                    if (char === '') {
+                        // Ctrl+C: restore the terminal and terminate the line before
+                        // exiting so the shell prompt isn't left mid-line. 130 = 128+SIGINT.
+                        restore();
+                        process.stderr.write('\n');
+                        process.exit(130);
+                    }
+                    if (char === '' || char === '\b') {
+                        // Backspace
+                        password = password.slice(0, -1);
+                    }
+                    else {
+                        password += char;
+                    }
                 }
             };
             process.stdin.on('data', onData);
@@ -36,8 +48,14 @@ export async function promptPassword(prompt) {
             // `question` callback never fires; without a `close` handler the
             // promise hangs forever and the process exits 0 without logging in.
             // Reject loudly instead. (#68)
+            //
+            // No `output` is wired to the interface: readline echoes typed input
+            // whenever its output is a TTY, so `trawl login < creds` run from a real
+            // terminal would print the password. Omitting output (and terminal:false)
+            // guarantees the secret is never echoed. The prompt itself was already
+            // written to stderr above. (#73)
             import('readline').then(({ createInterface }) => {
-                const rl = createInterface({ input: process.stdin, output: process.stdout });
+                const rl = createInterface({ input: process.stdin, terminal: false });
                 let answered = false;
                 rl.question('', (answer) => {
                     answered = true;

package/dist/lib/skills.d.ts

@@ -5,8 +5,18 @@ export declare function uninstallSkill(name: string, scope: 'user' | 'local'): s
 export declare function getInstalledVersion(name: string, scope: 'user' | 'local'): string | null;
 export declare function isSkillInstalled(name: string, scope: 'user' | 'local'): boolean;
 /**
- * Silently re-installs any skill whose installed version doesn't match the bundled one.
- * Called on CLI startup to keep skills in sync with the CLI version.
- * Never throws — failures are silent so they don't break unrelated commands.
+ * Re-installs any CLI-owned skill whose installed version doesn't match the
+ * bundled one. Called on CLI startup to keep skills in sync with the CLI
+ * version. Never throws — failures are silent so they don't break unrelated
+ * commands.
+ *
+ * Ownership guard (#73): `installSkill` does `rmSync(recursive)` on the target
+ * dir, so this MUST only ever touch dirs the CLI itself installed. Proof of
+ * ownership is a `.version` marker. A user-created `.claude/skills/<name>` dir
+ * that happens to collide with a bundled skill name carries no marker, so it is
+ * left untouched instead of being silently deleted + overwritten.
+ *
+ * Opt-out: `TRAWL_SKILLS_SYNC=0` disables auto-sync entirely (mirrors
+ * `TRAWL_TELEMETRY=0`), for users who manage their skills by hand.
  */
 export declare function autoUpdateInstalledSkills(): void;

package/dist/lib/skills.js

@@ -54,20 +54,39 @@ export function isSkillInstalled(name, scope) {
     return existsSync(join(getSkillsBase(scope), name));
 }
 /**
- * Silently re-installs any skill whose installed version doesn't match the bundled one.
- * Called on CLI startup to keep skills in sync with the CLI version.
- * Never throws — failures are silent so they don't break unrelated commands.
+ * Re-installs any CLI-owned skill whose installed version doesn't match the
+ * bundled one. Called on CLI startup to keep skills in sync with the CLI
+ * version. Never throws — failures are silent so they don't break unrelated
+ * commands.
+ *
+ * Ownership guard (#73): `installSkill` does `rmSync(recursive)` on the target
+ * dir, so this MUST only ever touch dirs the CLI itself installed. Proof of
+ * ownership is a `.version` marker. A user-created `.claude/skills/<name>` dir
+ * that happens to collide with a bundled skill name carries no marker, so it is
+ * left untouched instead of being silently deleted + overwritten.
+ *
+ * Opt-out: `TRAWL_SKILLS_SYNC=0` disables auto-sync entirely (mirrors
+ * `TRAWL_TELEMETRY=0`), for users who manage their skills by hand.
  */
 export function autoUpdateInstalledSkills() {
+    if (process.env['TRAWL_SKILLS_SYNC'] === '0')
+        return;
     try {
         const bundledVersion = getBundledSkillsVersion();
         for (const name of listBundledSkills()) {
             for (const scope of ['user', 'local']) {
                 if (!isSkillInstalled(name, scope))
                     continue;
-                if (getInstalledVersion(name, scope) === bundledVersion)
+                const installed = getInstalledVersion(name, scope);
+                // No `.version` marker → not ours → never delete it.
+                if (installed === null)
+                    continue;
+                if (installed === bundledVersion)
                     continue;
                 installSkill(name, scope);
+                // One honest line so a destructive-looking re-sync is never silent.
+                // stderr keeps stdout clean for --json consumers.
+                process.stderr.write(`trawl: re-synced skill "${name}" (${scope}) ${installed} → ${bundledVersion}\n`);
             }
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trawlme/cli",
-  "version": "1.18.0",
+  "version": "1.18.1",
   "description": "Trawl CLI — manage scraps from the terminal",
   "type": "module",
   "bin": {