Detect outdated skills, modify version command triggers by brandonc · Pull Request #92 · hashicorp/tfctl-cli

brandonc · 2026-07-26T15:50:56Z

Description

A few different 0.4.0 cleanups:

tfctl, tfctl --version, tfctl -v, tfctl version all run the hidden version subcommand, which now does the checkpoint rendering.
main.go now does a sweep of installed SKILL.md files that may have been installed by previous versions and migrates them to the latest version if necessary.
SHA256 hashes for each releases' skill file are embedded in the binary using make prepare-release
main.go reorganized a bit for simplicity
harness exec no longer accepts values "all" and "reversible", making all resources explicit. I think this will be easier to understand.
harness install no longer requires auth setup first
Used the resource registry to determine destroyability for execsession instead of a separate list.
Expanded the resource registry to include a lot more resources.

Example Output

PR Checklist

Run npx changie new or install changie to prepare a new changelog entry for the next set of release notes.
Ensure any command changes are sensitive to these global flags:
- --json — Force machine readable output to stdout. Does not apply to stderr.
- --markdown — Force markdown output to stdout. Does not apply to stderr.
- --dry-run — Don't make any actual writes or other mutations. Describe what would have changed to stderr.
- --quiet — Only render essential content.
Get the logging interface from the context and add debug logging for interesting conditions and nonfatal situations.
Run make gen/screenshot if the root command output changes.
Add the Autocomplete field to positional arguments and flags to assist shell autocomplete.

PCI review checklist

I have documented a clear reason for, and description of, the change I am making.
If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
If applicable, I've documented the impact of any changes to security controls.

Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

Invoked whenever banner is shown or --version is used

Don't show auth status warning when using --quiet

If an installed skill is from a known agent + prior release, tfctl will now migrate it to the latest embedded skill.

shwetamurali · 2026-07-28T21:23:59Z

+				} else {
+					// This is not a match for any known skill and should not be migrated, but
+					// may be outdated.
+					migrationResult <- &MigrationResult{


A user-customized skill is not a migration failure but the caller in main.go logs this as logger.Error("Failed to migrate skill", ...). Either we shouldn't emit a result here or add a field to distinguish skipping cuz its unknown" from actually failed to write, rn every user who edited their SKILL.md gets an error in --debug output

shwetamurali · 2026-07-28T21:25:53Z

-	defer targetFile.Close()
+	defer file.Close()
+
+	tempFile, err := os.CreateTemp("", fmt.Sprintf("SKILL-%s-*", version.Name))


Empty string dir means os.TempDir() which is usually /tmp so if the target path is on a different filesystem, os.Rename fails on Linux. Could use os.CreateTemp(filepath.Dir(path), ...) instead

Also os.Rename is called while tempFile is still open. Can u rename an open file? I think on windows u cant, u may need tempFile.Close() before calling rename

shwetamurali · 2026-07-28T21:33:04Z

+
+			found, ok := resource.ByName(grant)
+			if !ok {
+				warnings = append(warnings, fmt.Sprintf("unknown resource type %q in --allow-delete; it may still be honored", grant))


Does AllowsDelete not automatically deny this at runtime for unknown types? I know we went over this in our call but it seems like the first loop only matches if the strings are equal which they wouldn't be right?

Which loop? I think the permissions for unknown types works because I smoke tested it:

my bad, i misread

shwetamurali · 2026-07-28T21:33:39Z

 	// The result must be sorted and free of duplicates for deterministic
 	// completion output.
-	assert.True(t, sort.StringsAreSorted(got), "completions must be sorted")
+	assert.True(t, slices.IsSorted(got), "completions must be sorted")


shd we remove this assertion on sorting since the registry resources arent sorted anymore?

shwetamurali · 2026-07-28T21:34:35Z

+	@if [ -z "$(VERSION)" ]; then echo "VERSION is not set"; exit 1; fi
+	@echo $(VERSION) > $(VERSION_FILE)
+	@echo "Updated $(VERSION_FILE) to $(VERSION)"
+	@echo "v$(VERSION) $$(sha256sum $(SKILL_EMBEDDED) | cut -d' ' -f1)" >> $(SKILL_HASHES)


sha256sum doesn't exist on macOS does that matter?

Good call out. I thought it was built in. I'll use shasum -a 256

shwetamurali · 2026-07-28T21:38:49Z

a few higher level comments:

If a user upgrades tfctl, runs tfctl get workspaces, and their skill file changes they have no idea cuz success is only logged at Debug level. Would we wanna at minimum, print one line to stderr on success that tells them we migrated the skills? Also, do we really want to write to local files during a read only API call?
Shd we do smth similar to HOMEBREW_NO_AUTO_UPDATE such as an env var TFCTL_SKIP_MIGRATE=1 to disable auto migration?
If a user wants to know what the skill update actually changed there's no diff or link to release notes, should we point them somwhere? For example, "Migrated .bob/skills/tfctl/SKILL.md from v0.3.0. See https://github.com/hashicorp/tfctl-cli/blob/v0.4.0/CHANGELOG.md".

shwetamurali · 2026-07-28T21:40:04Z

+}
+
+// WaitForMigration waits for the migration process to complete and returns all MigrationResults.
+func WaitForMigration() []MigrationResult {


If installSkillToPath hangs the CLI hangs at exit with no timeout. The context passed to MigrateInstalled is the shutdown context, but nothing in the migration code checks ctx.Done(). Can we add a select with a deadline, or a hard timeout to aboid hanging indefinitely?

- allow context cancelation while migrating skills - don't migrate when --dry-run is used - allow --argument=true form of arguments when checking global args - use `shasum -a 256` instead of `sha256sums` in Makefile because it's more portable - remove some unneeded code

This fixes a corner case where the symlink could change after it's resolved but before the target was overwritten

brandonc · 2026-07-29T02:26:53Z

@shwetamurali I think I addressed all feedback. Thanks!

brandonc added 19 commits July 24, 2026 11:24

Add release Makefile targets

d75bdab

make gen/openapi

0279959

harness exec permissions tightening, expand types

051f833

update harness exec language/docs

a2bc6c3

fix non-banner commands like --autocomplete-install

00bec7c

refactor move banner to own command

c6ff2dd

replace cksum usage with compatible go util

e2273b7

detect and alert about any outdated skill files

b16f785

Invoked whenever banner is shown or --version is used

lint fixes

3b79662

version command, outdated skill check

24436b8

run version command for no args

5b3b2ea

fix lint warnings, add versioncmd tests

7aa71ec

secvuln: bump kin-openapi to v0.145.0

c767b85

refactor: replace crc32 with sha256sum

2170259

allow -v and -version for version command

59bb7b8

output newline before new version notice

6d8ed73

Don't show auth status warning when using --quiet

known hashes of existing skills

efa547c

feature: just upgrade outdated skills

cf76b8c

If an installed skill is from a known agent + prior release, tfctl will now migrate it to the latest embedded skill.

updates unreleased notes

4241949

shwetamurali reviewed Jul 28, 2026

View reviewed changes

Comment thread skills/install.go Outdated

shwetamurali reviewed Jul 28, 2026

View reviewed changes

brandonc added 3 commits July 28, 2026 20:00

fix: MatchesKnownVersions accepts a resolved path

8c24e6c

This fixes a corner case where the symlink could change after it's resolved but before the target was overwritten

reword and reformat harness exec delete warning

7ad078c

adds provider-sets to registry

b1ea424

brandonc mentioned this pull request Jul 29, 2026

Add Provider Sets support to tfctl #91

Closed

8 tasks

fix: prepare-release field order

dcecb6e

shwetamurali approved these changes Jul 29, 2026

View reviewed changes

brandonc merged commit c3b7c8f into main Jul 29, 2026
2 checks passed

brandonc deleted the TF-39526-detect-skill-md-drift-and-prompt-users-to-re-install branch July 29, 2026 17:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Detect outdated skills, modify version command triggers - #92

Detect outdated skills, modify version command triggers#92
brandonc merged 24 commits into
mainfrom
TF-39526-detect-skill-md-drift-and-prompt-users-to-re-install

brandonc commented Jul 26, 2026 •

edited

Loading

Uh oh!

shwetamurali Jul 28, 2026

Uh oh!

shwetamurali Jul 28, 2026

Uh oh!

Uh oh!

shwetamurali Jul 28, 2026

Uh oh!

brandonc Jul 29, 2026

Uh oh!

shwetamurali Jul 29, 2026

Uh oh!

shwetamurali Jul 28, 2026

Uh oh!

shwetamurali Jul 28, 2026

Uh oh!

brandonc Jul 28, 2026

Uh oh!

shwetamurali commented Jul 28, 2026

Uh oh!

shwetamurali Jul 28, 2026

Uh oh!

brandonc commented Jul 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

brandonc commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Example Output

PR Checklist

PCI review checklist

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

shwetamurali commented Jul 28, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

brandonc commented Jul 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

brandonc commented Jul 26, 2026 •

edited

Loading