fix: post install hook code review agent fixes

Author: KartikJha

.goreleaser.yml

@@ -52,6 +52,8 @@ brews:
       (bash_completion/"auth0").write `#{bin}/auth0 completion bash`
       (fish_completion/"auth0.fish").write `#{bin}/auth0 completion fish`
       (zsh_completion/"_auth0").write `#{bin}/auth0 completion zsh`
+
+      system "#{bin}/auth0", "ai", "skills", "post-install-hook"
     caveats: "Thanks for installing the Auth0 CLI"
 
 scoops:
@@ -68,4 +70,4 @@ scoops:
     description: Build, manage and test your Auth0 integrations from the command line
     license: MIT
     skip_upload: true
-    post_install: ["Write-Host 'Thanks for installing the Auth0 CLI'"]
+    post_install: ["Write-Host 'Thanks for installing the Auth0 CLI'", "& auth0 ai skills post-install-hook"]

internal/ai/skills/download.go

@@ -141,8 +141,8 @@ func checkGitVersion() error {
 	return nil
 }
 
-// fetchCommitSHA fetches the latest commit SHA for ref from the GitHub API.
-func fetchCommitSHA(ref string) (string, error) {
+// FetchCommitSHA fetches the latest commit SHA for ref from the GitHub API.
+func FetchCommitSHA(ref string) (string, error) {
 	req, err := http.NewRequest(http.MethodGet, agentSkillsAPI+ref, nil)
 	if err != nil {
 		return "", err
@@ -274,7 +274,7 @@ func fetchToTempFile(url, pattern, label string) (*os.File, int64, error) {
 
 // downloadViaTarGz fetches the commit SHA first, then downloads and extracts the tar.gz archive.
 func downloadViaTarGz(targetDir, ref string) (string, error) {
-	sha, err := fetchCommitSHA(ref)
+	sha, err := FetchCommitSHA(ref)
 	if err != nil {
 		return "", err
 	}
@@ -299,7 +299,7 @@ func downloadViaTarGz(targetDir, ref string) (string, error) {
 
 // downloadViaZip fetches the commit SHA first, then downloads and extracts the ZIP archive.
 func downloadViaZip(targetDir, ref string) (string, error) {
-	sha, err := fetchCommitSHA(ref)
+	sha, err := FetchCommitSHA(ref)
 	if err != nil {
 		return "", err
 	}

internal/ai/skills/download_test.go

@@ -252,7 +252,7 @@ func TestFetchCommitSHA(t *testing.T) {
 
 	t.Run("returns SHA from valid response", func(t *testing.T) {
 		setHTTPClient(t, shaResponse("abc123def456"))
-		sha, err := fetchCommitSHA("main")
+		sha, err := FetchCommitSHA("main")
 		require.NoError(t, err)
 		assert.Equal(t, "abc123def456", sha)
 	})
@@ -261,14 +261,14 @@ func TestFetchCommitSHA(t *testing.T) {
 		setHTTPClient(t, func(_ *http.Request) (*http.Response, error) {
 			return &http.Response{StatusCode: http.StatusForbidden, Body: io.NopCloser(strings.NewReader(""))}, nil
 		})
-		_, err := fetchCommitSHA("main")
+		_, err := FetchCommitSHA("main")
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "403")
 	})
 
 	t.Run("returns error when SHA field is empty", func(t *testing.T) {
 		setHTTPClient(t, shaResponse(""))
-		_, err := fetchCommitSHA("main")
+		_, err := FetchCommitSHA("main")
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "empty SHA")
 	})
@@ -277,15 +277,15 @@ func TestFetchCommitSHA(t *testing.T) {
 		setHTTPClient(t, func(_ *http.Request) (*http.Response, error) {
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(strings.NewReader("not json"))}, nil
 		})
-		_, err := fetchCommitSHA("main")
+		_, err := FetchCommitSHA("main")
 		require.Error(t, err)
 	})
 
 	t.Run("returns error on request failure", func(t *testing.T) {
 		setHTTPClient(t, func(_ *http.Request) (*http.Response, error) {
 			return nil, errors.New("network error")
 		})
-		_, err := fetchCommitSHA("main")
+		_, err := FetchCommitSHA("main")
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "github API request failed")
 	})
@@ -298,7 +298,7 @@ func TestFetchCommitSHA(t *testing.T) {
 			body, _ := json.Marshal(map[string]string{"sha": "abc123"})
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(bytes.NewReader(body))}, nil
 		})
-		_, err := fetchCommitSHA("main")
+		_, err := FetchCommitSHA("main")
 		require.NoError(t, err)
 		assert.Equal(t, "Bearer test-token-xyz", capturedAuth)
 	})
@@ -311,7 +311,7 @@ func TestFetchCommitSHA(t *testing.T) {
 			body, _ := json.Marshal(map[string]string{"sha": "abc123"})
 			return &http.Response{StatusCode: http.StatusOK, Body: io.NopCloser(bytes.NewReader(body))}, nil
 		})
-		_, err := fetchCommitSHA("main")
+		_, err := FetchCommitSHA("main")
 		require.NoError(t, err)
 		assert.Empty(t, capturedAuth)
 	})

internal/cli/root.go

@@ -89,8 +89,8 @@ func buildRootCmd(cli *cli) *cobra.Command {
 			cli.configureRenderer()
 
 			if cmd.CommandPath() != "auth0 ai skills post-install-hook" && !skillsSentinelExists() {
-				fmt.Fprintln(os.Stdout, skillsInstallTip)
-				writeSkillsSentinel()
+				fmt.Fprintln(os.Stderr, skillsInstallTip)
+				// writeSkillsSentinel()
 			}
 
 			if !commandRequiresAuthentication(cmd.CommandPath()) {

internal/cli/skills.go

@@ -17,7 +17,7 @@ import (
 
 const (
 	skillsSentinelPath = ".config/auth0/agents/.post-install-ran"
-	skillsInstallTip   = "Run 'auth0 ai skills install' any time to set up Auth0 skills for your AI assistant."
+	skillsInstallTip   = "Tip: run 'auth0 ai skills install' to set up Auth0 skills for your AI assistant."
 
 	skillsPluginRepo = "https://github.com/auth0/agent-skills"
 	skillsPluginRef  = "main"
@@ -86,8 +86,8 @@ func postInstallHookCmd(cli *cli) *cobra.Command {
 			}
 
 			if !iostream.IsInputTerminal() || !iostream.IsOutputTerminal() {
-				fmt.Fprintln(os.Stdout, skillsInstallTip)
-				writeSkillsSentinel()
+				fmt.Fprintln(os.Stderr, skillsInstallTip)
+				// writeSkillsSentinel()
 				return nil
 			}
 
@@ -109,22 +109,26 @@ func postInstallHookCmd(cli *cli) *cobra.Command {
 
 			if err := survey.AskOne(prompt, &choice); err != nil {
 				// User pressed Ctrl+C or closed the terminal — skip gracefully.
-				fmt.Fprintln(os.Stdout, skillsInstallTip)
-				writeSkillsSentinel()
+				fmt.Fprintln(os.Stderr, skillsInstallTip)
+				// writeSkillsSentinel()
 				return nil
 			}
 
-			writeSkillsSentinel()
-
 			switch choice {
 			case choiceAuto:
-				return runInstallFast(cli)
+				if err := runInstallFast(cli); err != nil {
+					return err
+				}
 			case choiceManual:
-				return runInstallInteractive(cli)
+				if err := runInstallInteractive(cli); err != nil {
+					return err
+				}
 			default:
-				fmt.Fprintln(os.Stdout, skillsInstallTip)
+				fmt.Fprintln(os.Stderr, skillsInstallTip)
+				return nil
 			}
 
+			writeSkillsSentinel()
 			return nil
 		},
 	}
@@ -205,16 +209,20 @@ func runInstallFast(_ *cli) error {
 }
 
 // downloadSkillsIfNeeded downloads the skills plugin if the lock file is absent or
-// records a different commit SHA than the remote. Returns the commit SHA in use.
+// the local commit SHA differs from the remote HEAD of main. Returns the commit SHA in use.
 func downloadSkillsIfNeeded(targetDir, lockPath string) (string, error) {
+	remoteSHA, err := skills.FetchCommitSHA(skillsPluginRef)
+	if err != nil {
+		return "", fmt.Errorf("fetch remote commit SHA: %w", err)
+	}
+
 	lock, err := skills.ReadLock(lockPath)
 	if err != nil {
 		return "", fmt.Errorf("read lock file: %w", err)
 	}
 
-	if lock != nil && lock.CommitSHA != "" {
-		// Already installed — reuse the cached SHA.
-		return lock.CommitSHA, nil
+	if lock != nil && lock.CommitSHA == remoteSHA {
+		return remoteSHA, nil
 	}
 
 	return skills.DownloadPlugin(targetDir, skillsPluginRef)
@@ -223,7 +231,7 @@ func downloadSkillsIfNeeded(targetDir, lockPath string) (string, error) {
 // runInstallInteractive runs the full interactive install flow.
 // Skills install customization coming soon.
 func runInstallInteractive(_ *cli) error {
-	fmt.Fprintln(os.Stdout, "Skills install customization coming soon.")
-	fmt.Fprintln(os.Stdout, skillsInstallTip)
+	fmt.Fprintln(os.Stderr, "Skills install customization coming soon.")
+	fmt.Fprintln(os.Stderr, skillsInstallTip)
 	return nil
 }