stitchkit 0.44.1 → 0.46.0

package/dist/{index-mvjyq9h9.js → index-62pqb23z.js}

@@ -1,10 +1,8 @@
 import {
+  isWithinDir,
   jsonSchemaFields,
   toJsonSchema
-} from "./index-frfyw9fa.js";
-import {
-  isWithinDir
-} from "./index-x3fcszf8.js";
+} from "./index-yxpe3phd.js";
 import {
   AppError,
   STITCH_ERROR_STATUS,
@@ -17,7 +15,7 @@ import {
   runWithRequestContext,
   safeJsonParse,
   validateDeclaredOutput
-} from "./index-yh0p5ddn.js";
+} from "./index-5s8b7z6q.js";
 
 // src/tools/coerce.ts
 import { z } from "zod";
@@ -30,6 +28,24 @@ function needsJsonCoercion(schema) {
   }
   return false;
 }
+function acceptsRawString(schema) {
+  const type = schema._zod.def.type;
+  if (type === "string" || type === "template_literal")
+    return true;
+  if (schema instanceof z.ZodLiteral) {
+    return schema.def.values.some((value) => typeof value === "string");
+  }
+  if (schema instanceof z.ZodEnum) {
+    return schema.options.some((value) => typeof value === "string");
+  }
+  if (schema instanceof z.ZodOptional || schema instanceof z.ZodNullable || schema instanceof z.ZodDefault) {
+    return acceptsRawString(schema.unwrap());
+  }
+  if (schema instanceof z.ZodUnion) {
+    return schema.def.options.some((option) => acceptsRawString(option));
+  }
+  return false;
+}
 function matchingVariant(union, value) {
   const disc = union.def.discriminator;
   const tag = value[disc];
@@ -52,6 +68,8 @@ function coerceValue(value, schema) {
   }
   let current = value;
   if (typeof current === "string" && needsJsonCoercion(schema)) {
+    if (acceptsRawString(schema))
+      return current;
     try {
       current = safeJsonParse(current);
     } catch {
@@ -574,15 +592,21 @@ async function runToolMethod(method, toolName, rawArgs, context, hooks, lifecycl
   const startedAt = Date.now();
   let hookContext = context;
   const finish = async (result, thrown) => {
-    await hooks?.afterToolCall?.({
-      toolName,
-      args: rawArgs,
-      result,
-      durationMs: Date.now() - startedAt,
-      context: hookContext,
-      endpoint: method,
-      ...thrown !== undefined && { error: thrown }
-    });
+    try {
+      await hooks?.afterToolCall?.({
+        toolName,
+        args: rawArgs,
+        result,
+        durationMs: Date.now() - startedAt,
+        context: hookContext,
+        endpoint: method,
+        ...thrown !== undefined && { error: thrown }
+      });
+    } catch (hookError) {
+      try {
+        console.error("[stitchkit] afterToolCall hook failed:", hookError);
+      } catch {}
+    }
     return result;
   };
   let beforeRan = false;
@@ -615,7 +639,9 @@ async function runToolMethod(method, toolName, rawArgs, context, hooks, lifecycl
           endpoint: method
         });
       } catch (hookErr) {
-        console.error("[stitchkit] onToolError hook failed:", hookErr);
+        try {
+          console.error("[stitchkit] onToolError hook failed:", hookErr);
+        } catch {}
       }
     }
     return finish(toolResultFromError(err), err);
@@ -994,8 +1020,14 @@ function formatToolError(result, toolName, errorHint) {
 
 // src/tools/cli-args.ts
 import { z as z5 } from "zod";
+var NUMERIC_VALUE = /^-(\d+\.?\d*|\.\d+)$/;
 var BOOL_OPTIONS = new Set(["json", "wait", "quiet", "dry-run", "help"]);
 var VALUE_OPTIONS = new Set(["wait-timeout", "output-dir"]);
+var RESERVED_CLI_OPTIONS = new Set([...BOOL_OPTIONS, ...VALUE_OPTIONS]);
+
+class CliArgumentError extends Error {
+  name = "CliArgumentError";
+}
 function unwrap(field) {
   if (field instanceof z5.ZodOptional || field instanceof z5.ZodNullable || field instanceof z5.ZodDefault) {
     return unwrap(field.unwrap());
@@ -1021,31 +1053,71 @@ function classify(field) {
     return "string";
   return "other";
 }
-function describeSchemaFields(schema) {
-  const fields = new Map;
-  if (!(schema instanceof z5.ZodObject))
-    return fields;
-  for (const [name, raw] of Object.entries(schema.shape)) {
-    const base = unwrap(raw);
-    const kind = classify(base);
-    if (kind === "array" && base instanceof z5.ZodArray) {
-      fields.set(name, { kind, elementKind: classify(unwrap(base.element)) });
-    } else {
-      fields.set(name, { kind });
+function mergeField(fields, name, info) {
+  const existing = fields.get(name);
+  if (!existing) {
+    fields.set(name, info);
+    return;
+  }
+  if (existing.kind === info.kind)
+    return;
+  if (existing.kind === "boolean" || info.kind === "boolean") {
+    fields.set(name, { kind: "boolean" });
+    return;
+  }
+  fields.set(name, { kind: "other" });
+}
+function collectSchemaFields(schema, fields) {
+  const base = unwrap(schema);
+  if (base instanceof z5.ZodObject) {
+    for (const [name, raw] of Object.entries(base.shape)) {
+      const fieldBase = unwrap(raw);
+      const kind = classify(fieldBase);
+      if (kind === "array" && fieldBase instanceof z5.ZodArray) {
+        mergeField(fields, name, { kind, elementKind: classify(unwrap(fieldBase.element)) });
+      } else {
+        mergeField(fields, name, { kind });
+      }
     }
+    return;
+  }
+  if (base instanceof z5.ZodUnion) {
+    for (const option of base.def.options)
+      collectSchemaFields(option, fields);
+    return;
   }
+  if (base instanceof z5.ZodIntersection) {
+    collectSchemaFields(base.def.left, fields);
+    collectSchemaFields(base.def.right, fields);
+    return;
+  }
+}
+function describeSchemaFields(schema) {
+  const fields = new Map;
+  if (schema)
+    collectSchemaFields(schema, fields);
   return fields;
 }
-function parseBool(value) {
+var TRUE_WORDS = new Set(["true", "1", "yes", "on"]);
+var FALSE_WORDS = new Set(["false", "0", "no", "off"]);
+function parseReservedBool(name, value) {
   const v = value.toLowerCase();
-  if (v === "false" || v === "0" || v === "no" || v === "off")
+  if (TRUE_WORDS.has(v))
+    return true;
+  if (FALSE_WORDS.has(v))
     return false;
-  return true;
+  throw new CliArgumentError(`--${name} expects a boolean (true/false), got "${value}"`);
 }
 function coerceScalar(kind, value) {
   switch (kind) {
-    case "boolean":
-      return parseBool(value);
+    case "boolean": {
+      const v = value.toLowerCase();
+      if (TRUE_WORDS.has(v))
+        return true;
+      if (FALSE_WORDS.has(v))
+        return false;
+      return value;
+    }
     case "number": {
       const n = Number(value);
       return value.trim() !== "" && !Number.isNaN(n) ? n : value;
@@ -1090,8 +1162,10 @@ function coerceField(info, values) {
   return coerceScalar(info.kind, last);
 }
 function setNested(target, path, value) {
-  if (path.some(isUnsafeKey))
-    return;
+  const unsafe = path.find(isUnsafeKey);
+  if (unsafe !== undefined) {
+    throw new CliArgumentError(`Unsafe option path segment "${unsafe}"`);
+  }
   let node = target;
   for (let i = 0;i < path.length - 1; i++) {
     const key = path[i];
@@ -1110,7 +1184,7 @@ function setNested(target, path, value) {
   if (leaf !== undefined)
     node[leaf] = value;
 }
-function parseCliArgs(argv, schema) {
+function parseCliArgs(argv, schema, config = {}) {
   const options = {
     json: false,
     wait: false,
@@ -1118,50 +1192,11 @@ function parseCliArgs(argv, schema) {
     dryRun: false,
     help: false
   };
-  const rest = [];
-  for (let i = 0;i < argv.length; i++) {
-    const tok = argv[i];
-    if (tok === undefined)
-      continue;
-    if (tok === "-h") {
-      options.help = true;
-      continue;
-    }
-    if (tok.startsWith("--")) {
-      const eq = tok.indexOf("=");
-      const name = eq >= 0 ? tok.slice(2, eq) : tok.slice(2);
-      const inline = eq >= 0 ? tok.slice(eq + 1) : undefined;
-      if (BOOL_OPTIONS.has(name)) {
-        const on = inline === undefined ? true : parseBool(inline);
-        if (name === "dry-run")
-          options.dryRun = on;
-        else if (name === "json")
-          options.json = on;
-        else if (name === "wait")
-          options.wait = on;
-        else if (name === "quiet")
-          options.quiet = on;
-        else if (name === "help")
-          options.help = on;
-        continue;
-      }
-      if (VALUE_OPTIONS.has(name)) {
-        const value = inline ?? argv[++i];
-        if (value !== undefined) {
-          if (name === "wait-timeout") {
-            const n = Number(value);
-            if (!Number.isNaN(n))
-              options.waitTimeout = n;
-          } else if (name === "output-dir") {
-            options.outputDir = value;
-          }
-        }
-        continue;
-      }
-    }
-    rest.push(tok);
-  }
   const fields = describeSchemaFields(schema);
+  for (const name of config.knownFields ?? []) {
+    if (!fields.has(name))
+      fields.set(name, { kind: "other" });
+  }
   const flags = new Map;
   const boolFlags = new Map;
   const positionals = [];
@@ -1172,34 +1207,88 @@ function parseCliArgs(argv, schema) {
     else
       flags.set(name, [value]);
   };
-  for (let i = 0;i < rest.length; i++) {
-    const tok = rest[i];
+  let optionsEnded = false;
+  for (let i = 0;i < argv.length; i++) {
+    const tok = argv[i];
     if (tok === undefined)
       continue;
-    if (!tok.startsWith("--")) {
+    if (!optionsEnded && tok === "--") {
+      optionsEnded = true;
+      continue;
+    }
+    if (optionsEnded || !tok.startsWith("-") || tok === "-") {
       positionals.push(tok);
       continue;
     }
+    if (tok === "-h") {
+      options.help = true;
+      continue;
+    }
+    if (!tok.startsWith("--")) {
+      throw new CliArgumentError(`Unknown option "${tok}"`);
+    }
     const eq = tok.indexOf("=");
     const name = eq >= 0 ? tok.slice(2, eq) : tok.slice(2);
     let value = eq >= 0 ? tok.slice(eq + 1) : undefined;
+    if (name.length === 0)
+      throw new CliArgumentError("Invalid empty option name");
+    if (BOOL_OPTIONS.has(name)) {
+      const enabled = value === undefined ? true : parseReservedBool(name, value);
+      if (name === "dry-run")
+        options.dryRun = enabled;
+      else if (name === "json")
+        options.json = enabled;
+      else if (name === "wait")
+        options.wait = enabled;
+      else if (name === "quiet")
+        options.quiet = enabled;
+      else
+        options.help = enabled;
+      continue;
+    }
+    if (VALUE_OPTIONS.has(name)) {
+      const next = argv[i + 1];
+      value = value ?? next;
+      if (value === undefined || value.startsWith("-") && !NUMERIC_VALUE.test(value)) {
+        throw new CliArgumentError(`--${name} requires a value`);
+      }
+      if (eq < 0)
+        i++;
+      if (name === "wait-timeout") {
+        const timeout = Number(value);
+        if (!Number.isFinite(timeout) || timeout <= 0) {
+          throw new CliArgumentError("--wait-timeout must be a positive number");
+        }
+        options.waitTimeout = timeout;
+      } else {
+        options.outputDir = value;
+      }
+      continue;
+    }
     if (value === undefined && name.startsWith("no-") && fields.get(name.slice(3))?.kind === "boolean") {
       boolFlags.set(name.slice(3), false);
       continue;
     }
+    const unsafeSegment = name.split(".").find(isUnsafeKey);
+    if (unsafeSegment !== undefined) {
+      throw new CliArgumentError(`Unsafe option name "--${name}"`);
+    }
     const info = fields.get(name);
+    const rootName = name.split(".")[0] ?? name;
+    if (!fields.has(rootName) && !config.allowUnknown) {
+      throw new CliArgumentError(`Unknown option "--${name}"`);
+    }
     if (value === undefined) {
       if (info?.kind === "boolean") {
         boolFlags.set(name, true);
         continue;
       }
-      const next = rest[i + 1];
-      if (next !== undefined && !next.startsWith("--")) {
+      const next = argv[i + 1];
+      if (next !== undefined && (!next.startsWith("-") || NUMERIC_VALUE.test(next))) {
         value = next;
         i++;
       } else {
-        boolFlags.set(name, true);
-        continue;
+        throw new CliArgumentError(`--${name} requires a value`);
       }
     }
     pushFlag(name, value);
@@ -1216,19 +1305,36 @@ function parseCliArgs(argv, schema) {
     if (value !== undefined)
       toolArgs[key] = coerceField(fields.get(key), [value]);
   }
+  if (pi < positionals.length) {
+    throw new CliArgumentError(`Unexpected positional argument "${positionals[pi]}"`);
+  }
   for (const [key, value] of boolFlags) {
-    if (isUnsafeKey(key))
-      continue;
     toolArgs[key] = value;
   }
+  const dottedRoots = new Map;
+  for (const key of flags.keys()) {
+    const dot = key.indexOf(".");
+    if (dot > 0)
+      dottedRoots.set(key.slice(0, dot), key);
+  }
+  for (const [root, dotted] of dottedRoots) {
+    if (flags.has(root)) {
+      throw new CliArgumentError(`--${root} conflicts with --${dotted} — pass one form, not both`);
+    }
+  }
   for (const [key, values] of flags) {
     if (key.includes(".")) {
-      setNested(toolArgs, key.split("."), looseCoerce(values[values.length - 1] ?? ""));
+      if (values.length > 1) {
+        throw new CliArgumentError(`--${key} was passed ${values.length} times`);
+      }
+      setNested(toolArgs, key.split("."), looseCoerce(values[0] ?? ""));
       continue;
     }
-    if (isUnsafeKey(key))
-      continue;
-    toolArgs[key] = coerceField(fields.get(key), values);
+    const info = fields.get(key);
+    if (values.length > 1 && info !== undefined && info.kind !== "array" && info.kind !== "other") {
+      throw new CliArgumentError(`--${key} was passed ${values.length} times`);
+    }
+    toolArgs[key] = coerceField(info, values);
   }
   return { toolArgs, options };
 }
@@ -1415,47 +1521,71 @@ function isPrivateIp(ip) {
   }
   return false;
 }
-async function assertPublicUrl(url) {
-  assertHttpUrl(url);
-  const host = url.hostname.replace(/^\[|\]$/g, "");
-  if (!host)
-    throw new Error("refusing to fetch a URL with no host");
-  if (isIP(host)) {
-    if (isPrivateIp(host))
-      throw new Error("refusing to fetch a private address");
-    return;
-  }
-  if (NUMERIC_HOST.test(host)) {
-    throw new Error("refusing to fetch a non-canonical numeric host");
+function raceWithAbort(promise, signal) {
+  if (signal.aborted) {
+    promise.catch(() => {
+      return;
+    });
+    return Promise.reject(signal.reason ?? new Error("aborted"));
+  }
+  return new Promise((resolve, reject) => {
+    const onAbort = () => reject(signal.reason ?? new Error("aborted"));
+    signal.addEventListener("abort", onAbort, { once: true });
+    promise.then((value) => {
+      signal.removeEventListener("abort", onAbort);
+      resolve(value);
+    }, (error) => {
+      signal.removeEventListener("abort", onAbort);
+      reject(error);
+    });
+  });
+}
+async function assertPublicUrl(url, signal) {
+  await resolvePublicAddress(url, signal);
+}
+async function fetchGuarded(start, allowPrivate, options = {}) {
+  const timeoutMs = options.timeoutMs ?? 15000;
+  const bodyTimeoutMs = options.bodyTimeoutMs ?? 120000;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new Error("timeoutMs must be positive");
   }
-  if (host === "localhost" || host.endsWith(".local") || host.endsWith(".internal")) {
-    throw new Error("refusing to fetch an internal host");
+  if (!Number.isFinite(bodyTimeoutMs) || bodyTimeoutMs <= 0) {
+    throw new Error("bodyTimeoutMs must be positive");
   }
-  const records = await lookup(host, { all: true });
-  for (const record of records) {
-    if (isPrivateIp(record.address)) {
-      throw new Error("refusing to fetch a host that resolves to a private address");
+  const controller = new AbortController;
+  const signal = options.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal;
+  const headerTimer = setTimeout(() => {
+    controller.abort(new Error(`fetch did not produce response headers within ${timeoutMs}ms`));
+  }, timeoutMs);
+  headerTimer.unref?.();
+  let settled = false;
+  try {
+    let url = start;
+    for (let hop = 0;hop <= MAX_REDIRECTS; hop++) {
+      if (allowPrivate)
+        assertHttpUrl(url);
+      else
+        await assertPublicUrl(url, signal);
+      const res = await fetch(url, { redirect: "manual", signal });
+      const location = res.status >= 300 && res.status < 400 ? res.headers.get("location") : null;
+      if (location === null) {
+        settled = true;
+        clearTimeout(headerTimer);
+        const bodyTimer = setTimeout(() => {
+          controller.abort(new Error(`fetch body was not consumed within ${bodyTimeoutMs}ms`));
+        }, bodyTimeoutMs);
+        bodyTimer.unref?.();
+        return res;
+      }
+      await res.body?.cancel();
+      url = new URL(location, url);
     }
+    throw new Error("too many redirects");
+  } finally {
+    if (!settled)
+      clearTimeout(headerTimer);
   }
 }
-async function fetchGuarded(start, allowPrivate) {
-  let url = start;
-  for (let hop = 0;hop <= MAX_REDIRECTS; hop++) {
-    if (allowPrivate)
-      assertHttpUrl(url);
-    else
-      await assertPublicUrl(url);
-    const res = await fetch(url, { redirect: "manual" });
-    if (res.status < 300 || res.status >= 400)
-      return res;
-    const location = res.headers.get("location");
-    if (!location)
-      return res;
-    await res.body?.cancel();
-    url = new URL(location, url);
-  }
-  throw new Error("too many redirects");
-}
 async function resolvePublicAddress(url, signal) {
   assertHttpUrl(url);
   const host = url.hostname.replace(/^\[|\]$/g, "");
@@ -1473,12 +1603,8 @@ async function resolvePublicAddress(url, signal) {
   if (host === "localhost" || host.endsWith(".local") || host.endsWith(".internal")) {
     throw new Error("refusing to fetch an internal host");
   }
-  const records = await Promise.race([
-    lookup(host, { all: true }),
-    new Promise((_resolve, reject) => {
-      signal.addEventListener("abort", () => reject(signal.reason), { once: true });
-    })
-  ]);
+  const pending = lookup(host, { all: true });
+  const records = signal ? await raceWithAbort(pending, signal) : await pending;
   for (const record2 of records) {
     if (isPrivateIp(record2.address)) {
       throw new Error("refusing to fetch a host that resolves to a private address");
@@ -1501,8 +1627,8 @@ async function fetchPinnedDocument(start, options) {
   if (!Number.isInteger(maxRedirects) || maxRedirects < 0) {
     throw new Error("maxRedirects must be a non-negative integer");
   }
+  const signal = AbortSignal.timeout(options.timeoutMs);
   for (let hop = 0;hop <= maxRedirects; hop++) {
-    const signal = AbortSignal.timeout(options.timeoutMs);
     if (options.requireHttps && url.protocol !== "https:") {
       throw new Error("document URL and every redirect must use https");
     }
@@ -1704,12 +1830,7 @@ function renderTopHelp(name, version, tools) {
 }
 function renderCommandHelp(name, command, tool) {
   const lines = [tool.method.desc, "", `Usage: ${name} ${command} [args] [--flags]`, ""];
-  let fields = [];
-  try {
-    fields = jsonSchemaFields(tool.presentationSchema);
-  } catch {
-    lines.push("(arguments: pass a JSON object — this command has a complex schema)", "");
-  }
+  const fields = jsonSchemaFields(tool.presentationSchema);
   if (fields.length > 0) {
     lines.push("Arguments:");
     const width = Math.max(...fields.map((f) => f.name.length));
@@ -1725,11 +1846,12 @@ function renderCommandHelp(name, command, tool) {
 `;
 }
 var DEFAULT_DOWNLOAD_MAX_BYTES = 100 * 1024 * 1024;
-async function downloadResults(files, dir, stderr, quiet, allowPrivate, maxBytes) {
+async function downloadResults(files, dir, stderr, quiet, allowPrivate, maxBytes, timeoutMs) {
   const root = resolve(dir);
+  let succeeded = true;
   for (const file of files) {
     try {
-      const res = await fetchGuarded(new URL(file.url), allowPrivate);
+      const res = await fetchGuarded(new URL(file.url), allowPrivate, { timeoutMs });
       if (!res.ok)
         throw new Error(`HTTP ${res.status}`);
       const buffer = await readCapped(res, maxBytes);
@@ -1741,10 +1863,12 @@ async function downloadResults(files, dir, stderr, quiet, allowPrivate, maxBytes
         stderr(`saved ${target} (${(buffer.length / 1024).toFixed(0)}KB)
 `);
     } catch (err) {
+      succeeded = false;
       stderr(`failed to download ${file.url}: ${err instanceof Error ? err.message : String(err)}
 `);
     }
   }
+  return succeeded;
 }
 async function createCli(config) {
   const stdout = config.stdout ?? ((text) => void process.stdout.write(text));
@@ -1759,6 +1883,13 @@ async function createCli(config) {
   for (const service of services) {
     for (const mountable of collectTools(service, "CLI")) {
       assertUniqueToolName(mountable.name, tools.has(mountable.name), "CLI command");
+      if (mountable.name === "help" || mountable.name === "version") {
+        throw new Error(`[stitchkit] CLI command "${mountable.name}" is reserved`);
+      }
+      const conflicting = jsonSchemaFields(mountable.presentationSchema).map((field) => field.name).filter((name) => RESERVED_CLI_OPTIONS.has(name));
+      if (conflicting.length > 0) {
+        throw new Error(`[stitchkit] CLI command "${mountable.name}" declares reserved option field(s): ${conflicting.join(", ")}`);
+      }
       tools.set(mountable.name, mountable);
     }
   }
@@ -1786,7 +1917,40 @@ async function createCli(config) {
 `);
     return exit(1);
   }
-  const { toolArgs, options } = parseCliArgs(commandArgv, tool.argumentSchema);
+  const beforeSeparator = commandArgv.indexOf("--") === -1 ? commandArgv : commandArgv.slice(0, commandArgv.indexOf("--"));
+  if (beforeSeparator.includes("--help") || beforeSeparator.includes("-h")) {
+    stdout(renderCommandHelp(config.name, command, tool));
+    return exit(0);
+  }
+  let parsed;
+  try {
+    parsed = parseCliArgs(commandArgv, tool.argumentSchema, {
+      allowUnknown: config.passthrough?.[command] !== undefined,
+      knownFields: jsonSchemaFields(tool.presentationSchema).map((field) => field.name)
+    });
+  } catch (error) {
+    if (!(error instanceof CliArgumentError))
+      throw error;
+    stderr(`${error.message}
+`);
+    return exit(2);
+  }
+  const { toolArgs, options } = parsed;
+  if (options.wait && !config.wait?.[command]) {
+    stderr(`--wait is not configured for command "${command}"
+`);
+    return exit(2);
+  }
+  if (options.waitTimeout !== undefined && !options.wait) {
+    stderr(`--wait-timeout requires --wait
+`);
+    return exit(2);
+  }
+  if (options.outputDir !== undefined && !config.download) {
+    stderr(`--output-dir is not configured for this CLI
+`);
+    return exit(2);
+  }
   if (options.help) {
     stdout(renderCommandHelp(config.name, command, tool));
     return exit(0);
@@ -1834,8 +1998,9 @@ async function createCli(config) {
 `)
     });
   }
+  let downloadsOk = true;
   if (options.outputDir && result.ok && config.download) {
-    await downloadResults(config.download(result.data), options.outputDir, stderr, options.quiet, config.allowPrivateDownloadHosts ?? false, config.maxDownloadBytes ?? DEFAULT_DOWNLOAD_MAX_BYTES);
+    downloadsOk = await downloadResults(config.download(result.data), options.outputDir, stderr, options.quiet, config.allowPrivateDownloadHosts ?? false, config.maxDownloadBytes ?? DEFAULT_DOWNLOAD_MAX_BYTES, config.downloadTimeoutMs);
   }
   const exitCode = emitResult(result, { stdout, stderr }, {
     json: options.json,
@@ -1843,7 +2008,7 @@ async function createCli(config) {
     errorHint: config.errorHint,
     exitCodes: { ...DEFAULT_EXIT_CODES, ...config.exitCodes }
   });
-  return exit(exitCode);
+  return exit(downloadsOk ? exitCode : 1);
 }
 function safeInputSchema(tool) {
   return tool.presentationSchema;