@automagik/omni 2.260430.9 → 2.260430.11

package/dist/index.js

@@ -78097,7 +78097,7 @@ var require_path = __commonJS((exports) => {
   function isAbsolute(path) {
     return path.charAt(0) === "/";
   }
-  function join14(...args) {
+  function join15(...args) {
     return normalizePath(args.join("/"));
   }
   function dirname6(path) {
@@ -78122,7 +78122,7 @@ var require_path = __commonJS((exports) => {
   exports.basename = basename6;
   exports.dirname = dirname6;
   exports.isAbsolute = isAbsolute;
-  exports.join = join14;
+  exports.join = join15;
   exports.normalizePath = normalizePath;
   exports.relative = relative;
   exports.resolve = resolve4;
@@ -98883,7 +98883,7 @@ var require_otel = __commonJS((exports, module) => {
   var { InstrumentationBase } = require_src16();
   var {
     version: PACKAGE_VERSION,
-    name: PACKAGE_NAME2
+    name: PACKAGE_NAME3
   } = require_package();
   var SUPPORTED_VERSIONS = ">=4.0.0 <6";
   var FASTIFY_HOOKS = [
@@ -98921,8 +98921,8 @@ var require_otel = __commonJS((exports, module) => {
     _requestHook = null;
     _lifecycleHook = null;
     constructor(config2) {
-      super(PACKAGE_NAME2, PACKAGE_VERSION, config2);
-      this.logger = diag.createComponentLogger({ namespace: PACKAGE_NAME2 });
+      super(PACKAGE_NAME3, PACKAGE_VERSION, config2);
+      this.logger = diag.createComponentLogger({ namespace: PACKAGE_NAME3 });
       this[kIgnorePaths] = null;
       this[kRecordExceptions] = true;
       if (config2?.recordExceptions != null) {
@@ -99376,7 +99376,7 @@ var require_instrumentation7 = __commonJS((exports) => {
   var AttributeNames = require_AttributeNames3();
   var utils4 = require_utils22();
   var PACKAGE_VERSION = "0.1.0";
-  var PACKAGE_NAME2 = "@sentry/instrumentation-fastify-v3";
+  var PACKAGE_NAME3 = "@sentry/instrumentation-fastify-v3";
   var ANONYMOUS_NAME = "anonymous";
   var hooksNamesToWrap = new Set([
     "onTimeout",
@@ -99392,7 +99392,7 @@ var require_instrumentation7 = __commonJS((exports) => {
 
   class FastifyInstrumentationV3 extends instrumentation.InstrumentationBase {
     constructor(config2 = {}) {
-      super(PACKAGE_NAME2, PACKAGE_VERSION, config2);
+      super(PACKAGE_NAME3, PACKAGE_VERSION, config2);
     }
     init() {
       return [
@@ -107256,12 +107256,12 @@ var require_instrumentation21 = __commonJS((exports) => {
   var instrumentation = require_src6();
   var core = require_cjs();
   var constants = require_constants14();
-  var PACKAGE_NAME2 = "@sentry/instrumentation-hono";
+  var PACKAGE_NAME3 = "@sentry/instrumentation-hono";
   var PACKAGE_VERSION = "0.0.1";
 
   class HonoInstrumentation extends instrumentation.InstrumentationBase {
     constructor(config2 = {}) {
-      super(PACKAGE_NAME2, PACKAGE_VERSION, config2);
+      super(PACKAGE_NAME3, PACKAGE_VERSION, config2);
     }
     init() {
       return [
@@ -114079,7 +114079,7 @@ import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "@automagik/omni",
-  version: "2.260430.9",
+  version: "2.260430.11",
   description: "LLM-optimized CLI for Omni",
   type: "module",
   bin: {
@@ -114097,7 +114097,7 @@ var package_default = {
       import: "./dist/sdk/index.js"
     }
   },
-  files: ["dist", "bin", "db"],
+  files: ["dist", "bin", "db", "scripts/postinstall-pin-version.cjs"],
   publishConfig: {
     access: "public"
   },
@@ -114108,6 +114108,7 @@ var package_default = {
     dev: "echo 'CLI package - no dev server (use: bun run ./src/index.ts <command>)'",
     typecheck: "tsc --noEmit",
     test: "bun test",
+    postinstall: "node scripts/postinstall-pin-version.cjs",
     "test:integration": "RUN_INTEGRATION_TESTS=1 bun test",
     clean: "rm -rf dist db",
     "build:server": "bun build src/bundled-server-entry.ts --outdir dist/server --entry-naming 'index.[ext]' --asset-naming '[name].[ext]' --target bun --external @anthropic-ai/claude-agent-sdk --external @snazzah/davey --external libsodium-wrappers --external opusscript --external pdf-parse --external mammoth --external exceljs",
@@ -126190,6 +126191,59 @@ function createWhereCommand() {
 init_config();
 init_output();
 
+// src/manifest-pin.ts
+import { existsSync as existsSync15, readFileSync as readFileSync10, renameSync as renameSync2, writeFileSync as writeFileSync8 } from "fs";
+import { homedir as homedir10 } from "os";
+import { join as join14 } from "path";
+var PACKAGE_NAME2 = "@automagik/omni";
+var BUN_GLOBAL_MANIFEST = join14(homedir10(), ".bun", "install", "global", "package.json");
+function pinManifestEntry(manifestPath, exactVersion) {
+  if (!existsSync15(manifestPath))
+    return false;
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync10(manifestPath, "utf-8"));
+  } catch {
+    return false;
+  }
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest))
+    return false;
+  let changed = false;
+  for (const field of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
+    const deps = manifest[field];
+    if (!deps || typeof deps !== "object" || Array.isArray(deps))
+      continue;
+    const depMap = deps;
+    const current = depMap[PACKAGE_NAME2];
+    if (typeof current !== "string")
+      continue;
+    if (!current.startsWith("^") && !current.startsWith("~"))
+      continue;
+    if (current === exactVersion)
+      continue;
+    depMap[PACKAGE_NAME2] = exactVersion;
+    changed = true;
+  }
+  if (!changed)
+    return false;
+  const tmp = `${manifestPath}.tmp.${process.pid}`;
+  try {
+    writeFileSync8(tmp, `${JSON.stringify(manifest, null, 2)}
+`, { mode: 420 });
+    renameSync2(tmp, manifestPath);
+  } catch {
+    return false;
+  }
+  return true;
+}
+function selfHealManifestPin() {
+  if (process.env.OMNI_SKIP_POSTINSTALL_PIN === "1")
+    return;
+  try {
+    pinManifestEntry(BUN_GLOBAL_MANIFEST, VERSION);
+  } catch {}
+}
+
 // src/status.ts
 init_source();
 init_config();
@@ -126781,6 +126835,7 @@ program2.configureOutput({
     originalWriteErr(str);
   }
 });
+selfHealManifestPin();
 var argv = process.argv.slice(2);
 var isRootVersionOnly = argv.length > 0 && argv.every((arg) => arg === "--version" || arg === "-V");
 if (isRootVersionOnly) {

package/dist/manifest-pin.d.ts

@@ -0,0 +1,63 @@
+/**
+ * CLI startup self-heal for the @automagik/omni semver-drift footgun.
+ *
+ * Background
+ * ----------
+ * Omni's version scheme is `2.YYMMDD.X`. The legacy scheme used 8-digit
+ * `YYYYMMDD` minors (`2.20260221.x`). Semver compares minors as integers,
+ * so `^2.260430.10` resolves to `2.20260221.1` because 20260221 > 260430.
+ *
+ * The package's own `postinstall` hook (scripts/postinstall-pin-version.cjs)
+ * tries to rewrite the global manifest from `^2.260430.10` to
+ * `2.260430.10` (exact). But bun's install lifecycle writes the final
+ * manifest entry AFTER running postinstall, so the postinstall pin gets
+ * overwritten by the original install. Empirically:
+ *
+ *     T+0  bun resolves @automagik/omni@next → 2.260430.10
+ *     T+1  bun extracts tarball
+ *     T+2  postinstall fires; rewrites manifest to "2.260430.10" ✅
+ *     T+3  bun finalizes, writes manifest "@automagik/omni": "^2.260430.10" ❌
+ *
+ * This module is the second leg: every time the omni CLI starts, it
+ * checks the global manifest and self-pins if it sees a caret/tilde
+ * range. The pin happens NATURALLY after install because the operator's
+ * very first `omni …` invocation post-install fires this code. From
+ * that point on, no range is ever in the manifest.
+ *
+ * Why not just spawn a detached subprocess from postinstall?
+ * - Race-prone: relies on guessing how long bun's manifest write takes.
+ * - Confusing in logs: a stray child process appears to outlive the
+ *   parent shell.
+ * - Less observable: the operator doesn't see what's happening.
+ *
+ * The CLI-startup approach is deterministic, observable (logs to stderr
+ * once), and idempotent (a no-op when the pin is already exact).
+ *
+ * Performance
+ * -----------
+ *  - One stat + one JSON parse on every invocation. ~1ms typical.
+ *  - When a pin needs writing, one tmp-write + rename. <5ms typical.
+ *  - Bypassed entirely when env `OMNI_SKIP_POSTINSTALL_PIN=1` is set
+ *    (same opt-out as the postinstall hook).
+ *
+ * Removal
+ * -------
+ * When the legacy `2.20260218–2.20260221` versions are deprecated /
+ * unpublished, this becomes a no-op safely. Delete the file at that
+ * point and remove the call from index.ts.
+ */
+/**
+ * Replace `"@automagik/omni": "^X.Y.Z"` with the exact version in the
+ * given manifest path. No-op when the entry is already exact, missing,
+ * or a non-range spec (file:, git+, tarball URL).
+ *
+ * Returns true when a write occurred. Exported for tests.
+ */
+export declare function pinManifestEntry(manifestPath: string, exactVersion: string): boolean;
+/**
+ * Run the self-heal on omni CLI startup. Best-effort, never throws,
+ * never blocks. Safe to call early in `index.ts` before commander
+ * parses argv.
+ */
+export declare function selfHealManifestPin(): void;
+//# sourceMappingURL=manifest-pin.d.ts.map

package/dist/manifest-pin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-pin.d.ts","sourceRoot":"","sources":["../src/manifest-pin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAUH;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CA2CpF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAO1C"}

package/dist/server/index.js

@@ -224556,7 +224556,7 @@ var init_sentry_scrub = __esm(() => {
 var require_package8 = __commonJS((exports, module) => {
   module.exports = {
     name: "@omni/api",
-    version: "2.260430.9",
+    version: "2.260430.11",
     type: "module",
     exports: {
       ".": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automagik/omni",
-  "version": "2.260430.9",
+  "version": "2.260430.11",
   "description": "LLM-optimized CLI for Omni",
   "type": "module",
   "bin": {
@@ -18,7 +18,7 @@
       "import": "./dist/sdk/index.js"
     }
   },
-  "files": ["dist", "bin", "db"],
+  "files": ["dist", "bin", "db", "scripts/postinstall-pin-version.cjs"],
   "publishConfig": {
     "access": "public"
   },
@@ -29,6 +29,7 @@
     "dev": "echo 'CLI package - no dev server (use: bun run ./src/index.ts <command>)'",
     "typecheck": "tsc --noEmit",
     "test": "bun test",
+    "postinstall": "node scripts/postinstall-pin-version.cjs",
     "test:integration": "RUN_INTEGRATION_TESTS=1 bun test",
     "clean": "rm -rf dist db",
     "build:server": "bun build src/bundled-server-entry.ts --outdir dist/server --entry-naming 'index.[ext]' --asset-naming '[name].[ext]' --target bun --external @anthropic-ai/claude-agent-sdk --external @snazzah/davey --external libsodium-wrappers --external opusscript --external pdf-parse --external mammoth --external exceljs",
@@ -50,15 +51,15 @@
     "qrcode-terminal": "^0.12.0"
   },
   "devDependencies": {
-    "@omni/api": "2.260430.8",
-    "@omni/channel-discord": "2.260430.8",
-    "@omni/channel-gupshup": "2.260430.8",
-    "@omni/channel-sdk": "2.260430.8",
-    "@omni/channel-slack": "2.260430.8",
-    "@omni/channel-telegram": "2.260430.8",
-    "@omni/channel-whatsapp": "2.260430.8",
-    "@omni/core": "2.260430.8",
-    "@omni/sdk": "2.260430.8",
+    "@omni/api": "2.260430.10",
+    "@omni/channel-discord": "2.260430.10",
+    "@omni/channel-gupshup": "2.260430.10",
+    "@omni/channel-sdk": "2.260430.10",
+    "@omni/channel-slack": "2.260430.10",
+    "@omni/channel-telegram": "2.260430.10",
+    "@omni/channel-whatsapp": "2.260430.10",
+    "@omni/core": "2.260430.10",
+    "@omni/sdk": "2.260430.10",
     "@types/node": "^22.10.3",
     "@types/qrcode-terminal": "^0.12.2",
     "typescript": "^5.7.3"

package/scripts/postinstall-pin-version.cjs

@@ -0,0 +1,187 @@
+#!/usr/bin/env node
+/**
+ * postinstall-pin-version.cjs
+ *
+ * Self-heal the global package.json caret range that triggers the
+ * "version drift back to 2.20260221.x" footgun.
+ *
+ * Background
+ * ----------
+ * Omni's version scheme is `2.YYMMDD.X` (e.g. `2.260430.7`). The legacy
+ * scheme used 8-digit YYYYMMDD minors (e.g. `2.20260221.1`). Semver
+ * compares minors numerically:
+ *
+ *     2.260430.7    →  MINOR = 260430
+ *     2.20260221.1  →  MINOR = 20260221     ← 77× larger
+ *
+ * So `^2.260430.7` in a package.json semver-resolves to
+ * `2.20260221.1` (legacy version still on the registry). Every range-
+ * resolving install (e.g. plain `bun install -g`, or any tool that
+ * re-resolves the global manifest) flips the install backward.
+ *
+ * What this script does
+ * ---------------------
+ * On every `bun add -g @automagik/omni` / `npm install -g
+ * @automagik/omni`, this postinstall runs and rewrites the
+ * `@automagik/omni` entry in the global manifest from a caret range to
+ * an exact pin (`"2.260430.7"` no `^`). That stops the drift at the
+ * source — operators don't need to remember `--exact`, and any later
+ * range-resolve sees the exact version they last installed.
+ *
+ * Where this script writes
+ * ------------------------
+ *   - `~/.bun/install/global/package.json` (bun's global manifest)
+ *   - `<npm root -g>/package.json` (only if it exists; npm's global
+ *     install layout doesn't always include this file)
+ *
+ * Hardening
+ * ---------
+ *   - Best-effort: NEVER fails the install. Any error → log to stderr
+ *     and exit 0. The install proceeds; the operator can still pin
+ *     manually.
+ *   - Idempotent: writing the same file twice is a no-op.
+ *   - Touches ONLY `@automagik/omni` — leaves other dependencies alone.
+ *   - No-op when run inside the package's own dev tree (workspace
+ *     install): we detect via the absence of the global manifest path.
+ *   - No-op when env `OMNI_SKIP_POSTINSTALL_PIN=1` (escape hatch for
+ *     CI / testers / downstream packagers who pin via their own tooling).
+ *
+ * Removal
+ * -------
+ * When the legacy `2.20260218–2.20260221` versions are deprecated or
+ * unpublished from the registry (the proper fix), this script becomes a
+ * no-op safely. It can be removed at that point.
+ */
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+
+const PACKAGE_NAME = '@automagik/omni';
+
+function log(msg) {
+  // Stderr only so JSON tooling consuming stdout stays clean.
+  process.stderr.write(`[omni postinstall] ${msg}\n`);
+}
+
+function readJson(filePath) {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+  } catch (_err) {
+    return null;
+  }
+}
+
+function writeJsonAtomic(filePath, data) {
+  const tmp = `${filePath}.tmp.${process.pid}`;
+  fs.writeFileSync(tmp, `${JSON.stringify(data, null, 2)}\n`, { mode: 0o644 });
+  fs.renameSync(tmp, filePath);
+}
+
+/**
+ * Replace `"@automagik/omni": "^X.Y.Z"` with the exact version. Returns
+ * true when a change was applied, false otherwise.
+ */
+function pinInManifest(manifestPath, exactVersion) {
+  if (!fs.existsSync(manifestPath)) return false;
+  const manifest = readJson(manifestPath);
+  if (!manifest || typeof manifest !== 'object') return false;
+
+  let changed = false;
+  for (const field of ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']) {
+    const deps = manifest[field];
+    if (!deps || typeof deps !== 'object') continue;
+    const current = deps[PACKAGE_NAME];
+    if (typeof current !== 'string') continue;
+    // Skip when already exact OR when not a caret range (e.g. a tarball
+    // URL, git ref, file: spec, or workspace marker — none of these are
+    // affected by the legacy-version-resolve-up bug).
+    if (!current.startsWith('^') && !current.startsWith('~')) continue;
+    if (current === exactVersion) continue;
+    deps[PACKAGE_NAME] = exactVersion;
+    changed = true;
+  }
+
+  if (changed) {
+    writeJsonAtomic(manifestPath, manifest);
+  }
+  return changed;
+}
+
+function getOurVersion() {
+  // package.json sits one directory up from this script (packages/cli/
+  // when running from source, or the package root when running from
+  // npm-installed tarball — same relative layout in both).
+  const pkgPath = path.resolve(__dirname, '..', 'package.json');
+  const pkg = readJson(pkgPath);
+  if (!pkg || typeof pkg.version !== 'string') return null;
+  return pkg.version;
+}
+
+function getNpmGlobalRoot() {
+  // Best-effort: shell out to npm root -g. Cap a short timeout so a
+  // hung npm doesn't block the install pipeline.
+  try {
+    const { execFileSync } = require('node:child_process');
+    const out = execFileSync('npm', ['root', '-g'], { encoding: 'utf8', timeout: 3000 });
+    return out.trim();
+  } catch {
+    return null;
+  }
+}
+
+function main() {
+  if (process.env.OMNI_SKIP_POSTINSTALL_PIN === '1') {
+    return; // operator opt-out
+  }
+
+  const ourVersion = getOurVersion();
+  if (!ourVersion) {
+    log('skipped: could not read own package version');
+    return;
+  }
+
+  const targets = [];
+
+  // bun global manifest
+  const bunGlobalManifest = path.join(os.homedir(), '.bun', 'install', 'global', 'package.json');
+  targets.push({ label: 'bun', path: bunGlobalManifest });
+
+  // npm global manifest (only if `npm` is installed)
+  const npmRoot = getNpmGlobalRoot();
+  if (npmRoot) {
+    targets.push({ label: 'npm', path: path.join(npmRoot, '..', 'package.json') });
+  }
+
+  let pinned = 0;
+  for (const target of targets) {
+    try {
+      if (pinInManifest(target.path, ourVersion)) {
+        log(`pinned ${PACKAGE_NAME} to ${ourVersion} in ${target.label} global manifest (${target.path})`);
+        pinned += 1;
+      }
+    } catch (err) {
+      // Never fail the install. Surface the reason for diagnosis but
+      // exit 0 below.
+      log(`warning: could not pin ${target.label} manifest at ${target.path}: ${err?.message ? err.message : err}`);
+    }
+  }
+
+  if (pinned === 0) {
+    // Either no global manifest had a caret entry (already pinned, or
+    // installed via a path that doesn't write to package.json), or the
+    // package isn't in any global manifest. Either way: no-op is fine.
+  }
+}
+
+try {
+  main();
+} catch (err) {
+  // Last-resort safety net. The install MUST NOT fail because of this
+  // script.
+  process.stderr.write(`[omni postinstall] unexpected error (non-fatal): ${err?.stack ? err.stack : err}\n`);
+}
+
+process.exit(0);