happyskills 0.6.0 → 0.7.1

package/CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.7.1] - 2026-03-06
+
+### Fixed
+- Fix `uninstall` incorrectly orphaning all user-installed skills — `find_orphans` now treats `__root__` as a protected requester, so only skills that were installed solely as transitive dependencies are pruned
+
+## [0.7.0] - 2026-03-06
+
+### Added
+- Add `--json --browser` combined flags to `login` command for single-command authentication — returns already-logged-in status or launches the browser flow and returns the result as JSON, eliminating the two-step check-then-login dance
+
+### Changed
+- Change `login_device` expired-token handling from `process.exit()` to a thrown error so callers (including `--json` mode) can handle it gracefully
+
 ## [0.6.0] - 2026-03-06
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "happyskills",
-	"version": "0.6.0",
+	"version": "0.7.1",
 	"description": "Package manager for AI agent skills",
 	"license": "SEE LICENSE IN LICENSE",
 	"author": "Nicolas Dao <nic@cloudlesslabs.com> (https://cloudlesslabs.com)",

package/src/commands/login.js

@@ -22,7 +22,8 @@ Options:
 Examples:
   happyskills login
   happyskills login --browser
-  happyskills login --password`
+  happyskills login --password
+  happyskills login --json --browser    Check status or authenticate (for automation)`
 
 const prompt = (question) => new Promise((resolve) => {
 	const rl = readline.createInterface({ input: process.stdin, output: process.stderr })
@@ -120,8 +121,33 @@ const run = (args) => catch_errors('Login failed', async () => {
 			const email = payload?.email || 'unknown'
 			const username = payload?.['cognito:username'] || payload?.sub || 'unknown'
 			print_json({ data: { status: 'already_logged_in', username, email } })
+			return
+		}
+
+		// Not logged in — check if browser flow requested
+		if (!args.flags.browser) {
+			print_json({ error: { code: 'INTERACTIVE_REQUIRED', message: 'Login requires browser interaction. Run `happyskills login --json --browser` to authenticate.', exit_code: EXIT_CODES.ERROR } })
+			process.exit(EXIT_CODES.ERROR)
+			return
+		}
+
+		// --json --browser: run browser flow, return JSON result
+		const [errors] = await run_browser_flow()
+		if (errors) {
+			print_json({ error: { code: 'AUTH_FAILED', message: errors[0]?.message || 'Browser login failed', exit_code: EXIT_CODES.ERROR } })
+			process.exit(EXIT_CODES.ERROR)
+			return
+		}
+
+		// Browser flow succeeded — read saved token
+		const [, new_token] = await load_token()
+		if (new_token) {
+			const payload = decode_jwt_payload(new_token.id_token)
+			const email = payload?.email || 'unknown'
+			const username = payload?.['cognito:username'] || payload?.sub || 'unknown'
+			print_json({ data: { status: 'logged_in', username, email } })
 		} else {
-			print_json({ error: { code: 'INTERACTIVE_REQUIRED', message: 'Login requires browser interaction. Run `happyskills login --browser` manually.', exit_code: EXIT_CODES.ERROR } })
+			print_json({ error: { code: 'AUTH_FAILED', message: 'Login flow completed but token could not be loaded', exit_code: EXIT_CODES.ERROR } })
 			process.exit(EXIT_CODES.ERROR)
 		}
 		return

package/src/commands/login_device.js

@@ -45,7 +45,7 @@ const run_browser_flow = () => catch_errors('Browser login failed', async () =>
 			const api_err = token_err.find(err => err.error_code)
 			if (api_err?.error_code === 'EXPIRED_TOKEN') {
 				spinner.fail('Authorization expired. Please run `happyskills login` again.')
-				process.exit(EXIT_CODES.ERROR)
+				throw new Error('Authorization expired. Please run `happyskills login` again.')
 			}
 			// Transient error — keep polling
 			continue

package/src/engine/uninstaller.js

@@ -9,11 +9,8 @@ const find_orphans = (skills, removed_skill) => {
 	const orphans = []
 	for (const [name, data] of Object.entries(skills)) {
 		if (name === removed_skill) continue
-		if (!data.requested_by || data.requested_by.length === 0) {
-			orphans.push(name)
-			continue
-		}
-		const remaining = data.requested_by.filter(r => r !== removed_skill && skills[r])
+		const requested_by = data.requested_by || []
+		const remaining = requested_by.filter(r => r === '__root__' || (r !== removed_skill && skills[r]))
 		if (remaining.length === 0) {
 			orphans.push(name)
 		}

package/src/engine/uninstaller.test.js

@@ -87,12 +87,12 @@ describe('find_orphans', () => {
 		assert.ok(result.includes('acme/auth'))
 	})
 
-	it('treats __root__ like any other requester (not in skills map)', () => {
+	it('protects skills installed by the user (requested_by includes __root__)', () => {
 		const skills = {
 			'acme/deploy': { requested_by: ['__root__'] }
 		}
-		// __root__ is not a key in skills, so deploy is considered orphaned
+		// __root__ marks a user-installed (root) package — should never be orphaned
 		const result = find_orphans(skills, 'acme/other')
-		assert.ok(result.includes('acme/deploy'))
+		assert.ok(!result.includes('acme/deploy'))
 	})
 })

package/src/integration/cli.test.js

@@ -340,6 +340,32 @@ describe('CLI — --json: success responses use { data } envelope', () => {
 			fs.rmSync(tmp_xdg, { recursive: true, force: true })
 		}
 	})
+
+	it('login --json --browser with stored credentials returns already_logged_in', () => {
+		const tmp_xdg = make_tmp()
+		try {
+			const creds_dir = path.join(tmp_xdg, 'happyskills')
+			fs.mkdirSync(creds_dir, { recursive: true })
+			const payload = { email: 'test@example.com', 'cognito:username': 'testuser', sub: 'test-sub-123' }
+			const fake_jwt = `eyJhbGciOiJSUzI1NiJ9.${Buffer.from(JSON.stringify(payload)).toString('base64url')}.fakesig`
+			fs.writeFileSync(path.join(creds_dir, 'credentials.json'), JSON.stringify({
+				id_token: fake_jwt,
+				access_token: 'fake-access',
+				refresh_token: 'fake-refresh',
+				expires_in: 3600,
+				stored_at: new Date().toISOString()
+			}, null, '\t'))
+			const { stdout, code } = run(['login', '--json', '--browser'], { XDG_CONFIG_HOME: tmp_xdg })
+			assert.strictEqual(code, 0)
+			const out = parse_json_output(stdout, 'login --json --browser with credentials')
+			assert.ok('data' in out)
+			assert.strictEqual(out.data.status, 'already_logged_in')
+			assert.strictEqual(out.data.username, 'testuser')
+			assert.strictEqual(out.data.email, 'test@example.com')
+		} finally {
+			fs.rmSync(tmp_xdg, { recursive: true, force: true })
+		}
+	})
 })
 
 // ─── --json flag: existing commands use { data } envelope ─────────────────────