promptdock 1.0.1 → 1.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Prompt Dock, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -53,10 +53,29 @@ Install options: `-g/--global` (per-user dir), `--target <tool>`, `--dir <path>`
 | `kimi` | `.kimi/skills/<slug>/` | `~/.kimi/skills/<slug>/` | experimental |
 | `openai` (OpenAI/GPT) | `.openai/skills/<slug>/` | `~/.openai/skills/<slug>/` | experimental |
 
-Tools detected in your project (or home dir with `-g`) float to the top of the
-picker and are preselected. `--dir <path>` installs anywhere. After installing,
-**restart/reopen the tool** — most agents only scan skills at session start
-(Claude Code: start a *new* session, then type `/<slug>`).
+Interactively, `install` asks **two** questions:
+
+1. **Which tool** — tools already set up (in either scope) float to the top,
+   tagged with where they were found; the first is preselected.
+2. **This directory or your user account** — shown as the two real destination
+   paths, preselecting whichever scope the tool is already set up in.
+
+Both prompts (and every confirm) are **arrow-key driven**: `↑`/`↓` to move
+(`j`/`k` and `^p`/`^n` work too), `Enter` or `Space` to select, `Esc` to cancel
+(`Ctrl-C` exits `130`, the shell convention). Yes/No confirms also take **`y`
+and `n` directly** — they commit immediately, never fall through to a default.
+**Typing a number still works** — it moves the highlight as you type, `Enter`
+confirms, `Backspace` edits. A pipe or CI session never prompts at all (pass
+`--target`/`--dir` + `-y`); a terminal without raw-mode/ANSI support
+(`TERM=dumb`) gets the plain numbered reader.
+
+Shortcuts: `-g` answers question 2 up front (per-user install, no prompt);
+`--target <tool>` answers question 1; `--dir <path>` answers both and installs
+anywhere. `-y` and non-interactive sessions never prompt and stay
+**project-local** unless `-g` is passed.
+
+After installing, **restart/reopen the tool** — most agents only scan skills at
+session start (Claude Code: start a *new* session, then type `/<slug>`).
 
 ## CI / non-interactive use
 
@@ -107,8 +126,29 @@ path is re-validated before any write; a failed check aborts **all-or-nothing**
 | 4 | integrity (sha mismatch, unsafe manifest path, receipt schema) |
 | 5 | filesystem (permissions, disk space, non-empty directory) |
 | 6 | network |
+| 130 | interrupted (`Ctrl-C` during an interactive prompt; `Esc` — a deliberate in-UI cancel — exits 1) |
 
-Every named error links `https://promptdock.ai/docs/cli/errors#<code>`.
+Every named error links `https://promptdock.ai/docs/cli/errors#<code>`. That page
+lists every code with what happened, why, and what to do.
+
+## Package compatibility
+
+This CLI carries its own **install-safety limits** — how many files it will write and how
+much it will download for one skill. They exist so a compromised server cannot fill your
+disk or write outside the target directory, and they are deliberately far above anything
+the platform accepts, so a normal skill never comes near them.
+
+Occasionally a skill is published that is larger than the version of the CLI you have.
+When that happens you get, for **that skill only**:
+
+```
+"Big Skill" needs promptdock CLI 1.2.0 or newer — you are on 1.0.1.
+  Update: npx promptdock@latest install …
+```
+
+It exits `3` (denied), not `4` (integrity) — the package is fine, your CLI is just older
+than it. Your login, your other installs and `promptdock update` are unaffected;
+`promptdock update` skips that one skill and continues with the rest.
 
 ## Notes
 
@@ -118,3 +158,16 @@ Every named error links `https://promptdock.ai/docs/cli/errors#<code>`.
   Review is a screening step, not a warranty — read what you install.
 - Skills are plain files on your machine after install; premium gates access,
   not copying.
+
+## License
+
+[MIT](./LICENSE) © Prompt Dock, Inc.
+
+Scope: the MIT license covers **this package (`packages/cli/`) only** — the CLI
+client source published to npm. It does not cover the PromptDock service, the
+website, or the rest of the repository, which are proprietary.
+
+It also does not cover **the skills you install**. Those are third-party content
+licensed by their authors under the
+[PromptDock Terms](https://promptdock.ai/terms) — installing a skill grants you
+access to use it, not the rights this MIT license grants over the CLI itself.

package/dist/api.js

@@ -1,12 +1,41 @@
+import { DEFAULT_API_BASE } from "./config.js";
 import { CliError, EXIT, networkError } from "./errors.js";
-/** Origin of a Location header, for the "set PROMPTDOCK_API_BASE to …" hint. */
-function originOf(location) {
+/**
+ * The redirect target may only become an ACTIONABLE hint when it is trustworthy
+ * (review CRITICAL): a 3xx can come from a captive portal, hijacked DNS, or a
+ * MITM proxy, and the old hint rendered its Location verbatim as a
+ * copy-pasteable `PROMPTDOCK_API_BASE=<attacker origin>` instruction — the
+ * commit that fixed redirect-STRIPS-Authorization had introduced
+ * redirect-HANDS-OVER-Authorization. Trust rule: https only, AND the same
+ * registrable domain as the origin we were already talking to (apex↔www and
+ * sibling subdomains pass; anything else gets the STATIC default hint).
+ */
+function trustedRedirectOrigin(location, baseUrl) {
     try {
-        return new URL(location).origin;
+        const to = new URL(location);
+        if (to.protocol !== "https:")
+            return null;
+        const base = new URL(baseUrl);
+        const tail = (h) => h.split(".").slice(-2).join(".");
+        if (tail(to.hostname) !== tail(base.hostname))
+            return null;
+        return to.origin;
     }
     catch {
-        return null; // relative Location — can't name an origin, fall back to the default
+        return null; // relative/unparseable Location — never actionable
+    }
+}
+/** Strip control chars (incl. ESC) before a server-supplied string reaches the
+ *  terminal — a Location carrying ANSI sequences could rewrite what the user
+ *  sees (review find). */
+function sanitizeForTerminal(s) {
+    let out = "";
+    for (const ch of s) {
+        const c = ch.codePointAt(0) ?? 0;
+        if (c >= 0x20 && c !== 0x7f && !(c >= 0x80 && c <= 0x9f))
+            out += ch;
     }
+    return out.slice(0, 200);
 }
 export class Api {
     ctx;
@@ -53,8 +82,13 @@ export class Api {
         // ctx.fetch directly and must keep following them — storage hands out redirects.
         if (res.status >= 300 && res.status < 400) {
             const to = res.headers.get("location") ?? "(no location header)";
-            throw new CliError(`${this.baseUrl} redirected to ${to} — the API must be called on its canonical origin, because a redirect drops the request body and the login token.`, EXIT.NETWORK, {
-                hint: `set PROMPTDOCK_API_BASE to the redirect target, e.g. PROMPTDOCK_API_BASE=${originOf(to) ?? "https://www.promptdock.ai"}`,
+            throw new CliError(`${this.baseUrl} redirected to ${sanitizeForTerminal(to)} — the API must be called on its canonical origin, because a redirect drops the request body and the login token.`, EXIT.NETWORK, {
+                // An UNTRUSTED target (cross-domain / non-https — a captive portal or
+                // MITM can mint a 3xx) gets the STATIC known-good hint, never its own
+                // origin echoed back as an instruction. DEFAULT_API_BASE is imported,
+                // not re-typed: the hardcoded literal here was a second copy of the
+                // exact constant whose staleness caused the original apex outage.
+                hint: `set PROMPTDOCK_API_BASE to the canonical origin, e.g. PROMPTDOCK_API_BASE=${trustedRedirectOrigin(to, this.baseUrl) ?? DEFAULT_API_BASE}`,
                 footer: "api",
             });
         }

package/dist/auth.js

@@ -30,8 +30,14 @@ export async function deviceFlowLogin(ctx, baseUrl, opts) {
             ctx.io.out("(if the page didn't open, paste the URL into your browser)");
         }
         ctx.io.out("");
-        const deadline = ctx.now() + Math.max(1, start.expires_in) * 1000;
-        let intervalSecs = Math.max(0, Number(start.interval) || 0);
+        // Clamp through Number.isFinite (review find): a missing/renamed numeric in
+        // the start response made `deadline` NaN, and `remainMs <= 0` is FALSE for
+        // NaN — an infinite countdown spin. A malformed numeric now degrades to the
+        // protocol defaults instead of hanging the login.
+        const expiresIn = Number(start.expires_in);
+        const deadline = ctx.now() + (Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : 600) * 1000;
+        const interval0 = Number(start.interval);
+        let intervalSecs = Number.isFinite(interval0) && interval0 > 0 ? interval0 : 5;
         poll: for (;;) {
             if (ctx.now() >= deadline)
                 break poll; // local expiry — restart below
@@ -61,7 +67,22 @@ export async function deviceFlowLogin(ctx, baseUrl, opts) {
                     footer: "access_denied",
                 });
             }
-            break poll; // expired_token (or unknown) — restart below
+            if (verb === "expired_token")
+                break poll; // genuine expiry — restart below
+            // NOT an RFC verb (review find): the wrapper's own limiter answers this
+            // route in the app ENVELOPE ({error:{code,…}} — e.g. rate_limited when
+            // several devs share one NAT), and a 500 arrives enveloped too. Both used
+            // to collapse into "expired" → a restart → "login timed out", hiding the
+            // real cause. Surface the truth instead of calling it a timeout.
+            const env = Api.envelope(res.body);
+            if (env) {
+                const retryAfter = Number(res.headers.get("retry-after"));
+                const wait = env.code === "rate_limited" && Number.isFinite(retryAfter) && retryAfter > 0
+                    ? ` — retry in ~${Math.ceil(retryAfter)}s`
+                    : "";
+                throw new CliError(`login failed: ${env.message}${wait}`, res.status >= 500 ? EXIT.NETWORK : EXIT.DENIED, { footer: "api" });
+            }
+            break poll; // genuinely unrecognized body — restart below
         }
         clearCountdown(ctx);
         restarts += 1;

package/dist/commands/install.d.ts

@@ -1,2 +1,9 @@
 import type { CliContext } from "../context.js";
+import { type SkillRef } from "../ref.js";
 export declare function runInstall(ctx: CliContext, positionals: string[], flags: Record<string, string | boolean>): Promise<void>;
+type PickedTarget = {
+    id: string;
+    dir: string;
+};
+export declare function resolveTarget(ctx: CliContext, flags: Record<string, string | boolean>, ref: SkillRef): Promise<PickedTarget>;
+export {};

package/dist/commands/install.js

@@ -8,7 +8,7 @@ import { ensureAuth } from "../auth.js";
 import { CliError, EXIT, usageError } from "../errors.js";
 import { checkInstallResponse, performInstall } from "../installer.js";
 import { formatRef, parseSkillRef } from "../ref.js";
-import { detectTargets, nextStepLine, targetById, targetInstallDir, TARGETS, } from "../registry.js";
+import { detectionLabel, detectTargets, detectTargetsAnyScope, nextStepLine, scopeChoices, targetById, targetInstallDir, TARGETS, } from "../registry.js";
 import { readReceipt } from "../receipts.js";
 import { colors, confirm, formatBytes, promptSelect } from "../ui.js";
 import { assertInstallable } from "../verdicts.js";
@@ -27,7 +27,7 @@ export async function runInstall(ctx, positionals, flags) {
     const c = colors(ctx.env, ctx.io.isTTY);
     const { api } = await ensureAuth(ctx);
     const resolve = await api.request("GET", `/api/v1/cli/skills/resolve?ref=${encodeURIComponent(refString)}`);
-    assertInstallable(resolve, refString);
+    assertInstallable(resolve, refString, ctx.version);
     if (typeof resolve.version_id !== "string" || typeof resolve.skill_id !== "string") {
         throw new CliError("malformed resolve response — update the CLI and retry", EXIT.DENIED, {
             footer: "verdict",
@@ -102,7 +102,7 @@ export async function runInstall(ctx, positionals, flags) {
         }
         for (const line of summary)
             ctx.io.out(line);
-        const go = await confirm(ctx.io, isUpdate ? "Update?" : "Install?", true);
+        const go = await confirm(ctx.io, isUpdate ? "Update?" : "Install?", true, c);
         if (!go) {
             ctx.io.out("Cancelled — nothing installed.");
             return;
@@ -144,9 +144,47 @@ export async function runInstall(ctx, positionals, flags) {
     ctx.io.out(`${c.green("✓")} ${isUpdate ? "Updated" : "Installed"} "${resp.skill.title}" v${resp.skill.version} → ${picked.dir}`);
     ctx.io.out(nextStepLine(picked.id, resp.skill.slug));
 }
-async function resolveTarget(ctx, flags, ref) {
-    const global = flags.global === true;
+/**
+ * Project-vs-global, asked AFTER the tool is known so the two options can be
+ * shown as their real destination paths rather than an abstraction.
+ *
+ * Never prompts when the answer is already settled: `-g` IS the answer, and
+ * `-y`/non-TTY runs are contractually promptless (they keep the flag default,
+ * project-local). So the prompt appears exactly when a human is present and
+ * scope is genuinely unstated — which is where it used to be skipped silently.
+ */
+async function resolveScope(ctx, def, ref, opts) {
+    if (opts.scopeGiven || opts.yes || !ctx.io.isTTY)
+        return opts.global;
+    const { choices, preselect } = scopeChoices(def, {
+        cwd: ctx.cwd,
+        home: ctx.home,
+        slug: ref.slug,
+    });
+    // Standing in $HOME, "this project" and "global" are the SAME directory —
+    // a two-row prompt showing one path twice reads as a bug (review find).
+    // The answer is settled: skip the question.
+    if (choices[0].dir === choices[1].dir)
+        return opts.global;
+    // Display dirs ~-abbreviated: full absolute paths wrap a stock 80-col
+    // terminal, and a wrapped line desyncs the picker's in-place repaint.
+    // The RETURNED dir stays absolute — only the label is shortened.
+    const tildify = (d) => (d.startsWith(ctx.home) ? `~${d.slice(ctx.home.length)}` : d);
+    const idx = await promptSelect(ctx.io, `Install ${def.label} skill in this directory or for your user account?`, choices.map((c) => `${c.label.padEnd(14)} ${tildify(c.dir)}${c.detected ? "  (detected)" : ""}`), preselect, colors(ctx.env, ctx.io.isTTY));
+    return choices[idx].global;
+}
+// Exported for the wiring tests: the pure path maths lives in registry.ts, but
+// the ORDER and CONDITIONS of the two prompts are what regressed before (the
+// registry always supported global; this function simply never asked).
+export async function resolveTarget(ctx, flags, ref) {
+    // `-g` is an explicit answer to the scope question; its absence is NOT an
+    // answer, it just means "unstated" (which is why we now ask instead of
+    // defaulting silently to project-local).
+    const scopeGiven = flags.global === true;
+    const global = scopeGiven;
+    const yes = flags.yes === true;
     if (typeof flags.dir === "string") {
+        // An explicit path IS the scope — nothing left to ask.
         const dir = isAbsolute(flags.dir) ? flags.dir : resolvePath(ctx.cwd, flags.dir);
         return { id: "custom", dir };
     }
@@ -155,16 +193,24 @@ async function resolveTarget(ctx, flags, ref) {
         if (!def) {
             throw usageError(`unknown --target "${flags.target}"`, `known targets: ${TARGETS.map((t) => t.id).join(", ")} (or use --dir <path>)`);
         }
+        // --target picks the TOOL, not the scope: an interactive run still asks.
+        const useGlobal = await resolveScope(ctx, def, ref, { scopeGiven, global, yes });
         return {
             id: def.id,
-            dir: targetInstallDir(def, { cwd: ctx.cwd, home: ctx.home, global, slug: ref.slug }),
+            dir: targetInstallDir(def, {
+                cwd: ctx.cwd,
+                home: ctx.home,
+                global: useGlobal,
+                slug: ref.slug,
+            }),
         };
     }
-    const detected = detectTargets({ cwd: ctx.cwd, home: ctx.home, global });
     if (!ctx.io.isTTY)
         throw usageError(NON_TTY_TARGET_HINT);
-    if (flags.yes === true) {
+    if (yes) {
         // -y skips the PICKER only, and only when detection is unambiguous (D-UX11).
+        // Scope is known here (the flag), so this stays single-scope detection.
+        const detected = detectTargets({ cwd: ctx.cwd, home: ctx.home, global });
         const found = detected.filter((t) => t.detected);
         if (found.length === 1) {
             return {
@@ -176,16 +222,17 @@ async function resolveTarget(ctx, flags, ref) {
             ? "-y needs a detectable target and none was found — pass --target <tool> or --dir <path>"
             : `-y needs an unambiguous target and ${found.length} tools were detected — pass --target <tool> or --dir <path>`);
     }
-    const scopeNote = global ? " (global)" : "";
+    // Interactive: TOOL first, then SCOPE. Detection spans both scopes here
+    // because the scope is not yet chosen.
+    const detected = detectTargetsAnyScope({ cwd: ctx.cwd, home: ctx.home });
     const options = detected.map((t) => {
-        const dir = targetInstallDir(t, { cwd: ctx.cwd, home: ctx.home, global, slug: ref.slug });
-        const tags = [t.detected ? "(detected)" : null, t.experimental ? "(experimental)" : null]
+        const tags = [detectionLabel(t), t.experimental ? "(experimental)" : null]
             .filter(Boolean)
             .join(" ");
-        return `${t.label.padEnd(16)} ${dir}${tags ? `  ${tags}` : ""}`;
+        return `${t.label.padEnd(16)}${tags ? ` ${tags}` : ""}`;
     });
-    options.push("Custom path…      (type any directory)");
-    const idx = await promptSelect(ctx.io, `Where should this skill be installed?${scopeNote}`, options, 0);
+    options.push("Custom path…     (type any directory)");
+    const idx = await promptSelect(ctx.io, "Which tool is this skill for?", options, 0, colors(ctx.env, ctx.io.isTTY));
     if (idx === options.length - 1) {
         const answer = (await ctx.io.question("Directory: ")).trim();
         if (!answer)
@@ -193,9 +240,15 @@ async function resolveTarget(ctx, flags, ref) {
         return { id: "custom", dir: isAbsolute(answer) ? answer : resolvePath(ctx.cwd, answer) };
     }
     const chosen = detected[idx];
+    const useGlobal = await resolveScope(ctx, chosen, ref, { scopeGiven, global, yes });
     return {
         id: chosen.id,
-        dir: targetInstallDir(chosen, { cwd: ctx.cwd, home: ctx.home, global, slug: ref.slug }),
+        dir: targetInstallDir(chosen, {
+            cwd: ctx.cwd,
+            home: ctx.home,
+            global: useGlobal,
+            slug: ref.slug,
+        }),
     };
 }
 function dirIsNonEmpty(dir) {

package/dist/commands/lifecycle.js

@@ -70,7 +70,7 @@ export async function runUninstall(ctx, positionals, flags) {
         if (flags.yes !== true) {
             if (!ctx.io.isTTY)
                 throw usageError("confirmation needed in a non-interactive session", "re-run with -y");
-            const go = await confirm(ctx.io, `Uninstall ${receipt.ref} from ${item.dir}?`, false);
+            const go = await confirm(ctx.io, `Uninstall ${receipt.ref} from ${item.dir}?`, false, c);
             if (!go) {
                 ctx.io.out("Skipped.");
                 continue;
@@ -138,6 +138,17 @@ function removeReceiptOwned(dir, receipt) {
     }
 }
 /* ── update ─────────────────────────────────────────────────────────────────── */
+/**
+ * Errors no later item can recover from either — these still abort the batch.
+ *
+ * USAGE means the invocation itself is wrong (a confirmation needed in a non-interactive
+ * session), so every subsequent item would fail identically. AUTH means the token is gone.
+ * Everything else — an integrity refusal, an over-fuse package, a network blip on one
+ * download — is this item's problem and the next item deserves its turn.
+ */
+function isFatalForBatch(err) {
+    return err instanceof CliError && (err.exitCode === EXIT.USAGE || err.exitCode === EXIT.AUTH);
+}
 export async function runUpdate(ctx, positionals, flags) {
     const c = colors(ctx.env, ctx.io.isTTY);
     const checkOnly = flags.check === true;
@@ -159,7 +170,7 @@ export async function runUpdate(ctx, positionals, flags) {
         let resolved;
         try {
             resolved = await api.request("GET", `/api/v1/cli/skills/resolve?ref=${encodeURIComponent(receipt.ref)}`);
-            assertInstallable(resolved, receipt.ref);
+            assertInstallable(resolved, receipt.ref, ctx.version);
         }
         catch (err) {
             const reason = err instanceof CliError ? err.message : String(err);
@@ -193,7 +204,7 @@ export async function runUpdate(ctx, positionals, flags) {
         if (flags.yes !== true) {
             if (!ctx.io.isTTY)
                 throw usageError("confirmation needed in a non-interactive session", "re-run with -y (or use --check)");
-            const go = await confirm(ctx.io, `Update ${receipt.ref} v${receipt.version} → v${toVersion}?`, true);
+            const go = await confirm(ctx.io, `Update ${receipt.ref} v${receipt.version} → v${toVersion}?`, true, c);
             if (!go) {
                 report.push({ ref: receipt.ref, dir: item.dir, from: receipt.version, to: toVersion, status: "skipped", reason: "declined" });
                 continue;
@@ -201,18 +212,43 @@ export async function runUpdate(ctx, positionals, flags) {
         }
         if (typeof resolved.skill_id !== "string" || typeof resolved.version_id !== "string")
             continue;
-        const respRaw = await api.request("POST", `/api/v1/cli/skills/${resolved.skill_id}/install`, { version_id: resolved.version_id });
-        const resp = checkInstallResponse(respRaw);
-        await performInstall(ctx, api, {
-            resp,
-            targetDir: item.dir,
-            targetId: item.targetId,
-            refString: receipt.ref,
-            prior: receipt,
-        });
-        report.push({ ref: receipt.ref, dir: item.dir, from: receipt.version, to: resp.skill.version, status: "updated" });
-        if (!json)
-            ctx.io.out(`${c.green("✓")} ${receipt.ref}: v${receipt.version} → v${resp.skill.version}`);
+        /**
+         * ⚠️ THE INSTALL MUST BE INSIDE THE PER-ITEM CATCH TOO, or "one bad package skips and
+         * the rest continue" is false for the population that matters.
+         *
+         * The catch above wraps only resolve + `assertInstallable` — and `assertInstallable`
+         * is exactly what OLDER CLIs do not have. On those, the only thing that refuses an
+         * over-fuse package is `assertSafeManifest`, deep inside `performInstall`, i.e. out
+         * here beyond the guard. So the CliError propagated out of the loop and killed the
+         * whole run: one oversized skill in a directory of twenty aborted the other nineteen.
+         * That is the population the package-scoped `min_cli_version` design exists to serve,
+         * so the guarantee was false precisely where it was load-bearing.
+         *
+         * Genuinely fatal classes still propagate — a usage error or a newer-schema receipt
+         * is not something the next item can recover from either.
+         */
+        try {
+            const respRaw = await api.request("POST", `/api/v1/cli/skills/${resolved.skill_id}/install`, { version_id: resolved.version_id });
+            const resp = checkInstallResponse(respRaw);
+            await performInstall(ctx, api, {
+                resp,
+                targetDir: item.dir,
+                targetId: item.targetId,
+                refString: receipt.ref,
+                prior: receipt,
+            });
+            report.push({ ref: receipt.ref, dir: item.dir, from: receipt.version, to: resp.skill.version, status: "updated" });
+            if (!json)
+                ctx.io.out(`${c.green("✓")} ${receipt.ref}: v${receipt.version} → v${resp.skill.version}`);
+        }
+        catch (err) {
+            if (isFatalForBatch(err))
+                throw err;
+            const reason = err instanceof CliError ? err.message : String(err);
+            report.push({ ref: receipt.ref, dir: item.dir, from: receipt.version, to: toVersion, status: "skipped", reason });
+            if (!json)
+                ctx.io.out(`${c.yellow("!")} ${receipt.ref}: ${reason}`);
+        }
     }
     if (json)
         ctx.io.out(JSON.stringify({ results: report }));

package/dist/commands/login.js

@@ -34,12 +34,41 @@ export async function runLogin(ctx, flags) {
 export async function runLogout(ctx) {
     const config = loadConfig(ctx.home);
     const had = typeof config.token === "string";
+    // REVOKE server-side FIRST (review CRITICAL: logout used to delete one copy
+    // of a 90-day sliding bearer and merely mention the Settings page — a
+    // security control named after ending a session that could not end it).
+    // Self-scoped: DELETE /cli/tokens/current kills exactly the presented token.
+    // Best-effort — offline logout must still clear local state, but a failed
+    // revoke is a WARNING, not a footnote.
+    let revoked = false;
+    if (had) {
+        try {
+            const api = new Api(ctx, resolveApiBase(ctx.env, config), config.token);
+            const res = await api.raw("DELETE", "/api/v1/cli/tokens/current");
+            revoked = res.status >= 200 && res.status < 300;
+        }
+        catch {
+            revoked = false;
+        }
+    }
     if (had) {
         delete config.token;
+        // api_base travels WITH the token (they are a pair — see config.ts): logout
+        // returns the client to the known-good default, so a hostile or stale
+        // origin set earlier does not survive the trust reset (review find).
+        delete config.api_base;
         saveConfig(ctx.home, config, ctx.platform);
     }
-    ctx.io.out(had ? "Logged out (local token removed)." : "Not logged in — nothing to remove.");
-    ctx.io.out("To invalidate the session server-side too: promptdock.ai → Settings → Account → CLI sessions → Revoke.");
+    if (!had) {
+        ctx.io.out("Not logged in — nothing to remove.");
+    }
+    else if (revoked) {
+        ctx.io.out("Logged out — the session was revoked server-side and the local token removed.");
+    }
+    else {
+        ctx.io.out("Logged out (local token removed).");
+        ctx.io.err("warning: could not revoke the session server-side (offline?). The token stays valid until it expires — revoke it at promptdock.ai → Settings → Account → CLI sessions.");
+    }
     if (ctx.env.PROMPTDOCK_TOKEN) {
         ctx.io.out("note: PROMPTDOCK_TOKEN is set in this environment and still authenticates requests.");
     }

package/dist/config.js

@@ -79,12 +79,45 @@ const trimBase = (s) => s.replace(/\/+$/, "");
 // so the token and the origin are a PAIR. Storing the token without its origin means
 // the next run sends a staging token to the default origin and 401s. The apex-pinning
 // problem that motivated the idea is handled by LEGACY_API_BASES below instead.
+/** Loopback hosts — the ONE carve-out from the TLS floor (local dev + the test
+ *  mock servers). Everything else that receives the bearer must be https. */
+function isLoopbackHost(host) {
+    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+}
+/**
+ * THE TLS FLOOR (review find): every resolved base carries a 90-day bearer in
+ * an Authorization header, and nothing previously constrained the scheme — a
+ * stored `http://` origin (written once by a plaintext invocation, or by the
+ * api.ts redirect hint before it was hardened) was honoured forever, silently.
+ * Enforced on the env override AND the stored value: a config written by an
+ * older or hostile release must not survive an upgrade. Throws — a plaintext
+ * API base is a misconfiguration to fix, never something to quietly use.
+ */
+function assertSecureBase(base, source) {
+    let u;
+    try {
+        u = new URL(base);
+    }
+    catch {
+        throw new CliError(`${source === "env" ? "PROMPTDOCK_API_BASE" : "the stored api_base"} is not a valid URL: set it to an origin like https://www.promptdock.ai`, EXIT.USAGE);
+    }
+    if (u.username || u.password || u.search || u.hash) {
+        throw new CliError(`${source === "env" ? "PROMPTDOCK_API_BASE" : "the stored api_base"} must be a bare origin (no credentials, query, or fragment)`, EXIT.USAGE);
+    }
+    if (u.protocol !== "https:" && !(u.protocol === "http:" && isLoopbackHost(u.hostname))) {
+        throw new CliError(`${source === "env" ? "PROMPTDOCK_API_BASE" : "the stored api_base"} is ${u.protocol}// — the CLI sends your login token on every request, so only https:// (or http://localhost for dev) is allowed. ` +
+            (source === "config"
+                ? "Run `promptdock logout`, then log in again against the https origin."
+                : "Set PROMPTDOCK_API_BASE to the https origin."), EXIT.USAGE);
+    }
+    return base;
+}
 export function resolveApiBase(env, config) {
     if (env.PROMPTDOCK_API_BASE)
-        return trimBase(env.PROMPTDOCK_API_BASE);
+        return assertSecureBase(trimBase(env.PROMPTDOCK_API_BASE), "env");
     const stored = typeof config.api_base === "string" ? trimBase(config.api_base) : null;
     // Drop a base a broken release pinned here; anything else the user set is honoured.
     if (stored && !LEGACY_API_BASES.has(stored))
-        return stored;
+        return assertSecureBase(stored, "config");
     return trimBase(DEFAULT_API_BASE);
 }

package/dist/context.d.ts

@@ -1,3 +1,4 @@
+import type { Key } from "./select-keys.js";
 /**
  * argv joined for the `X-Promptdock-Cli-Args` header, with bearer tokens removed.
  *
@@ -21,6 +22,24 @@ export type CliIo = {
     isTTY: boolean;
     /** readline question (TTY only — callers must gate on isTTY) */
     question: (prompt: string) => Promise<string>;
+    /**
+     * Raw keypress stream for the arrow-key picker. OPTIONAL by design: when it is
+     * absent, `promptSelect` falls back to the numbered reader built on `question`.
+     * That keeps one code path for every environment that cannot do raw mode — a
+     * piped stdin, a CI runner, a dumb terminal, and every test fake — without
+     * those callers needing to know the picker exists.
+     *
+     * Returns an unsubscribe that MUST restore the previous terminal mode.
+     */
+    rawKeys?: (onKey: (key: Key) => void) => () => void;
+    /** Live terminal dimensions — the picker clamps line width to `columns`
+     *  (wrapped lines desync the in-place repaint) and falls back to the
+     *  numbered reader when the frame exceeds `rows`. Optional: fakes and
+     *  non-TTY contexts omit it and the picker assumes 80x24. */
+    size?: () => {
+        rows: number;
+        columns: number;
+    };
 };
 export type CliContext = {
     io: CliIo;