@aicraftalchemy/aca 0.0.33 → 0.0.34

package/cli-wrapper.cjs

@@ -12,6 +12,11 @@ const fs = require('node:fs')
 const binDir = path.join(__dirname, 'bin')
 const isWin = process.platform === 'win32'
 const bin = path.join(binDir, isWin ? 'aca.exe' : 'aca')
+// Version of the binary currently in bin/ — written by install.cjs on install
+// and kept current by applyStagedUpdate below. Lets the launcher detect a
+// stale binary without paying a --version spawn on every start.
+const stampFile = path.join(binDir, '.aca-bin-version')
+const pkgVersion = require('./package.json').version
 
 /**
  * Apply a staged auto-update. The running binary downloads a new version to
@@ -25,6 +30,10 @@ const bin = path.join(binDir, isWin ? 'aca.exe' : 'aca')
 function applyStagedUpdate() {
   const marker = path.join(binDir, '.aca-pending-version')
   if (!fs.existsSync(marker)) return
+  // The marker holds the staged version string (written by autoUpdater);
+  // capture it before the swap so the stamp can track what bin/ now contains.
+  let stagedVersion = null
+  try { stagedVersion = fs.readFileSync(marker, 'utf8').trim() } catch {}
   const acaPending = path.join(binDir, isWin ? 'aca.exe.pending' : 'aca.pending')
   if (!fs.existsSync(acaPending)) {
     // Marker without a binary — stale/partial. Clear it and move on.
@@ -46,6 +55,9 @@ function applyStagedUpdate() {
     swap(isWin ? 'aca.exe' : 'aca')
     swap(isWin ? 'rg.exe' : 'rg')
     try { fs.rmSync(marker, { force: true }) } catch {}
+    if (stagedVersion) {
+      try { fs.writeFileSync(stampFile, stagedVersion) } catch {}
+    }
   } catch (err) {
     // Swap failed (e.g. transient FS error) — leave the pending files in place
     // so the next launch retries; fall through and run the current binary.
@@ -84,10 +96,62 @@ function selfHealBinary() {
   }
 }
 
+/**
+ * Refresh a STALE binary. On upgrade npm replaces the package directory, but
+ * when install scripts are blocked (allowScripts policy, `--ignore-scripts`)
+ * the postinstall never runs — and a surviving old bin/ means `aca` silently
+ * keeps launching the previous version forever. The stamp written by
+ * install.cjs (and kept current by applyStagedUpdate) says what bin/ holds;
+ * if it's OLDER than package.json, re-run the installer. Never downgrade: the
+ * auto-updater may legitimately have advanced the binary past the npm
+ * version. Best-effort — if the refresh fails (e.g. offline), warn and run
+ * the existing binary rather than dead-ending the user.
+ */
+function refreshStaleBinary() {
+  let stamped = null
+  try { stamped = fs.readFileSync(stampFile, 'utf8').trim() } catch {}
+  // A malformed stamp would compare as NaN (treated as equal) and block
+  // refresh forever — treat it as missing so the probe below recovers it.
+  if (stamped && !/^\d+\.\d+\.\d+$/.test(stamped)) stamped = null
+  if (!stamped) {
+    // Pre-stamp install: ask the binary itself once and record the answer.
+    const probe = spawnSync(bin, ['--version'], { encoding: 'utf8', timeout: 15000 })
+    const m = /(\d+\.\d+\.\d+)/.exec(probe.stdout || '')
+    if (m) {
+      stamped = m[1]
+      try { fs.writeFileSync(stampFile, stamped) } catch {}
+    }
+  }
+  const cmpVersions = (a, b) => {
+    const pa = a.split('.').map(Number)
+    const pb = b.split('.').map(Number)
+    for (let i = 0; i < 3; i++) {
+      const d = (pa[i] || 0) - (pb[i] || 0)
+      if (d) return d
+    }
+    return 0
+  }
+  if (stamped && cmpVersions(stamped, pkgVersion) >= 0) return
+  const installer = path.join(__dirname, 'install.cjs')
+  if (!fs.existsSync(installer)) return
+  console.error(
+    `ACA: refreshing binary ${stamped ? `v${stamped}` : '(unknown version)'} → v${pkgVersion} (install scripts were skipped)…`,
+  )
+  const r = spawnSync(process.execPath, [installer], { stdio: ['ignore', 2, 2] })
+  if (r.error || r.status !== 0) {
+    console.error(
+      'ACA: binary refresh failed; continuing with the existing binary.' +
+        '\nRetry with:  npm install -g @aicraftalchemy/aca',
+    )
+  }
+}
+
 applyStagedUpdate()
 
 if (!fs.existsSync(bin)) {
   selfHealBinary()
+} else {
+  refreshStaleBinary()
 }
 
 const result = spawnSync(bin, process.argv.slice(2), { stdio: 'inherit' })

package/install.cjs

@@ -100,6 +100,12 @@ async function main() {
   writeReplacing(dest, bin)
   if (process.platform !== 'win32') fs.chmodSync(dest, 0o755)
 
+  // Stamp the installed version. cli-wrapper compares this against its own
+  // package.json to detect a STALE binary — the case where npm upgraded the
+  // package but skipped this script (allowScripts policy / --ignore-scripts),
+  // leaving an old binary that would otherwise run forever.
+  fs.writeFileSync(path.join(binDir, '.aca-bin-version'), VERSION)
+
   // Also fetch the sibling ripgrep binary. `bun build --compile` does not embed
   // ripgrep, so ACA resolves this `rg` next to itself at runtime — it powers
   // Grep, Glob, and @-mention file search. Best-effort: a failure here must not

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aicraftalchemy/aca",
-  "version": "0.0.33",
+  "version": "0.0.34",
   "description": "ACA — agentic coding CLI. Any model, any provider (Claude, Gemini, OpenAI, NVIDIA, Groq, Cerebras, OpenRouter, Hugging Face). Developed by Aicraftalchemy.",
   "license": "UNLICENSED",
   "bin": {