@4pm/cli 1.12.1 → 1.14.0

package/dist/index.js

@@ -32526,8 +32526,15 @@ function compareSemver(a, b2) {
   }
   return 0;
 }
+function canonVersion(v2) {
+  const s3 = v2.trim().replace(/^v/i, "").toLowerCase();
+  const m2 = /^(\d+\.\d+\.\d+)(.*)$/.exec(s3);
+  if (!m2) return s3;
+  const suffix = m2[2].replace(/^[-+]/, "");
+  return suffix ? `${m2[1]}-${suffix}` : m2[1];
+}
 function shouldUpdateTo(current2, latest) {
-  return current2 !== latest && compareSemver(current2, latest) <= 0;
+  return canonVersion(current2) !== canonVersion(latest) && compareSemver(current2, latest) <= 0;
 }
 function runningInstallRoot() {
   return dirname2(dirname2(fileURLToPath2(import.meta.url)));
@@ -32543,16 +32550,48 @@ function readInstalledVersion() {
     return "0.0.0";
   }
 }
+var NPM_INSTALL_TIMEOUT_MS = 18e4;
+var DOWNLOAD_TIMEOUT_MS = 6e4;
+function tailReason(raw) {
+  const s3 = raw.trim();
+  return s3.length > 800 ? `\u2026${s3.slice(-800)}` : s3;
+}
 function updateViaNpm(version) {
   if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version)) {
     throw new Error(`Refusing to update: invalid version string "${version}".`);
   }
-  execSync2(`npm i -g @4pm/cli@${version}`, { stdio: "inherit" });
+  try {
+    execSync2(`npm i -g @4pm/cli@${version}`, {
+      stdio: ["ignore", "pipe", "pipe"],
+      encoding: "utf8",
+      timeout: NPM_INSTALL_TIMEOUT_MS
+    });
+  } catch (err) {
+    const e = err;
+    if (e.killed) {
+      throw new Error(`npm install timed out after ${NPM_INSTALL_TIMEOUT_MS / 1e3}s (\`npm i -g @4pm/cli@${version}\`).`);
+    }
+    const out = `${e.stderr?.toString() ?? ""}
+${e.stdout?.toString() ?? ""}`;
+    const reason = tailReason(out) || e.message || "npm install failed";
+    throw new Error(`npm install failed: ${reason}`);
+  }
 }
 async function updateViaDownload(tarballUrl, checksum, signature) {
-  const res = await fetch(tarballUrl);
-  if (!res.ok) throw new Error(`Failed to download tarball: HTTP ${res.status}`);
-  const buf = Buffer.from(await res.arrayBuffer());
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), DOWNLOAD_TIMEOUT_MS);
+  let buf;
+  try {
+    const res = await fetch(tarballUrl, { signal: controller.signal });
+    if (!res.ok) throw new Error(`Failed to download tarball: HTTP ${res.status}`);
+    buf = Buffer.from(await res.arrayBuffer());
+  } catch (err) {
+    throw new Error(
+      controller.signal.aborted ? `Downloading the update tarball timed out after ${DOWNLOAD_TIMEOUT_MS / 1e3}s.` : `Failed to download tarball: ${String(err)}`
+    );
+  } finally {
+    clearTimeout(timer);
+  }
   const actual = createHash2("sha256").update(buf).digest("hex");
   if (actual !== checksum) {
     throw new Error("Tarball checksum mismatch \u2014 aborting update (ADR-0015).");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4pm/cli",
-  "version": "1.12.1",
+  "version": "1.14.0",
   "private": false,
   "description": "4PM CLI — drives Claude/Codex CLIs on AI worker machines (Node + TypeScript)",
   "license": "LicenseRef-4PM-Source-Available",