@buildinternet/uploads 0.27.0 → 0.28.0

package/dist/cli-brand.js

@@ -156,7 +156,10 @@ function boxLines(lines, options = {}) {
     ].join("\n");
 }
 export function formatUpdateBanner(options) {
-    return boxLines([`Update available  ${options.current} → ${options.latest}`, `npm i -g @buildinternet/uploads`], { color: options.color, tone: BRAND.accent });
+    return boxLines([`Update available  ${options.current} → ${options.latest}`, `uploads update`], {
+        color: options.color,
+        tone: BRAND.accent,
+    });
 }
 export function formatAuthBanner(options = {}) {
     return boxLines(["Sign in via browser", "uploads login"], {

package/dist/cli-catalog.js

@@ -188,6 +188,11 @@ export const ROOT_COMMANDS = [
             { name: "all", summary: "Install skills and MCP (default)" },
         ],
     },
+    {
+        name: "update",
+        summary: "Update the CLI, then refresh the agent skills + MCP registration",
+        essential: true,
+    },
     {
         name: "login",
         summary: "Sign in via browser (or an enrollment code) and save credentials",

package/dist/cli-help.js

@@ -16,6 +16,7 @@ const ESSENTIAL_ORDER = [
     "delete",
     "doctor",
     "install",
+    "update",
 ];
 /** Day-to-day commands shown on bare `uploads` / `uploads help`. */
 const ESSENTIALS = ESSENTIAL_ORDER.map((name) => {

package/dist/cli.js

@@ -12,6 +12,7 @@ import { runInvite } from "./commands/invite.js";
 import { runAdmin } from "./commands/admin-enrollment.js";
 import { runMcp } from "./commands/mcp.js";
 import { runInstall } from "./commands/install.js";
+import { runUpdate } from "./commands/update.js";
 import { runCompletion } from "./commands/completion.js";
 import { runLogout, runWhoami } from "./commands/session.js";
 import { runTelemetry } from "./commands/telemetry.js";
@@ -268,6 +269,9 @@ export async function runCli(argv) {
             case "install":
                 code = await runInstall(cmdArgs, { globals: parsed.globals, json }, showHelp);
                 break;
+            case "update":
+                code = await runUpdate(cmdArgs, { globals: parsed.globals }, showHelp);
+                break;
             case "completion":
             case "completions":
                 code = await runCompletion(cmdArgs, showHelp);

package/dist/client.d.ts

@@ -519,10 +519,18 @@ export declare function createUploadsClient(config: UploadsClientConfig): {
         id: string;
     }>;
     findGalleriesByReference(opts: FindGalleriesByReferenceOptions): Promise<GalleryListResult>;
+    /**
+     * Upsert the managed attachments comment. `resync: true` marks an
+     * explicit "make the comment state correct" call (`uploads comment`), so
+     * the server hunts for the marker — and collapses any duplicate — instead
+     * of patching its cached comment id (issue #480). Older servers ignore
+     * the field.
+     */
     upsertGithubComment(opts: {
         repo: string;
         num: number;
         kind: "pull" | "issues";
+        resync?: boolean;
     }): Promise<GithubCommentResult>;
     /**
      * Promote a workspace's branch-staged attachments into a PR's stable

package/dist/client.js

@@ -479,6 +479,13 @@ export function createUploadsClient(config) {
                 params.set("cursor", opts.cursor);
             return request("GET", galleriesBase(config) + "/by-reference?" + params);
         },
+        /**
+         * Upsert the managed attachments comment. `resync: true` marks an
+         * explicit "make the comment state correct" call (`uploads comment`), so
+         * the server hunts for the marker — and collapses any duplicate — instead
+         * of patching its cached comment id (issue #480). Older servers ignore
+         * the field.
+         */
         async upsertGithubComment(opts) {
             return request("POST", `${config.apiUrl}/v1/${encodeURIComponent(config.workspace)}/github/comment`, {
                 body: new TextEncoder().encode(JSON.stringify(opts)),

package/dist/commands/install.d.ts

@@ -1,6 +1,14 @@
 import { type GlobalFlags } from "../cli-args.js";
 import { type CommandRunner } from "../github-gh.js";
 export declare const DEFAULT_MCP_URL = "https://agents.uploads.sh/mcp";
+export interface StepResult {
+    command: string[];
+    ok: boolean;
+    skipped?: "dry-run" | "sign-in";
+    error?: string;
+    output?: string;
+}
+export declare function runStep(run: CommandRunner, command: string[]): StepResult;
 export declare function runInstall(args: string[], opts: {
     globals: GlobalFlags;
     json?: boolean;

package/dist/commands/install.js

@@ -46,7 +46,7 @@ function redactor(token) {
         return out;
     };
 }
-function runStep(run, command) {
+export function runStep(run, command) {
     try {
         const output = run(command[0], command.slice(1)).trim();
         return { command, ok: true, output: output || undefined };

package/dist/commands/update.d.ts

@@ -0,0 +1,14 @@
+import { type GlobalFlags } from "../cli-args.js";
+import { type CommandRunner } from "../github-gh.js";
+import { type InstallSource } from "../install-source.js";
+import { type UpdateStatus } from "../update-check.js";
+export interface RunUpdateOptions {
+    globals: GlobalFlags;
+    /** Injected in tests. */
+    runner?: CommandRunner;
+    /** Injected in tests; defaults to detection from this module's path. */
+    source?: InstallSource;
+    /** Injected in tests; defaults to a cache-bypassing registry check. */
+    check?: () => Promise<UpdateStatus>;
+}
+export declare function runUpdate(args: string[], opts: RunUpdateOptions, help?: boolean): Promise<number>;

package/dist/commands/update.js

@@ -0,0 +1,125 @@
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { flagBool, parseCommandArgs, UsageError } from "../cli-args.js";
+import { execRunner } from "../github-gh.js";
+import { writeCommandHelp } from "../cli-style.js";
+import { detectInstallSource } from "../install-source.js";
+import { checkForUpdate } from "../update-check.js";
+import { runInstall, runStep } from "./install.js";
+const UPDATE_HELP = `uploads update — update the CLI and refresh agent integrations
+
+Upgrades the globally installed npm package, then re-runs \`uploads install\` so
+the agent skills and the MCP registration match the new version. Skills and the
+MCP registration drift on their own, so this refreshes them even when the CLI is
+already current.
+
+Usage:
+  uploads update [options]
+
+Options:
+  --dry-run        Print the plan without running anything
+  --skip-install   Upgrade the npm package only; leave skills and MCP alone
+  --verbose        Show the output of the underlying commands
+
+Examples:
+  uploads update
+  uploads update --dry-run
+  uploads update --skip-install
+`;
+/** Why an upgrade was skipped, phrased for the user. */
+const SKIP_REASON = {
+    workspace: "this is a workspace checkout, not a global install",
+    npx: "this ran from an npx cache, which is discarded after the run",
+    unknown: "this is a local project dependency, not a global install",
+};
+function thisModulePath() {
+    const path = fileURLToPath(import.meta.url);
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return path;
+    }
+}
+function isPermissionError(message) {
+    return /EACCES|EPERM|permission denied/i.test(message);
+}
+export async function runUpdate(args, opts, help = false) {
+    const parsed = parseCommandArgs(args);
+    if (help || parsed.help) {
+        writeCommandHelp(UPDATE_HELP);
+        return 0;
+    }
+    if (parsed.positionals.length > 0) {
+        throw new UsageError(`update takes no arguments (got ${parsed.positionals[0]})`);
+    }
+    const dryRun = flagBool(parsed.flags, "--dry-run");
+    const verbose = flagBool(parsed.flags, "--verbose");
+    const skipInstall = flagBool(parsed.flags, "--skip-install");
+    const run = opts.runner ?? execRunner;
+    const source = opts.source ?? detectInstallSource(thisModulePath());
+    // ttlMs 0 bypasses the once-a-day cache: `update` must not trust yesterday's read.
+    const status = await (opts.check ?? (() => checkForUpdate({ ttlMs: 0 })))();
+    const willUpgrade = status.updateAvailable && source.kind === "global";
+    // Resolved through PATH: in the normal single-install case this is the
+    // just-upgraded binary, but with multiple `uploads` binaries on PATH it
+    // could resolve to a different, stale one. Accepted risk, not a guarantee.
+    const refreshCommand = ["uploads", "install"];
+    // --- plan ---
+    if (willUpgrade) {
+        process.stdout.write(`CLI ${status.current} → ${status.latest}\n`);
+    }
+    else if (status.updateAvailable) {
+        process.stdout.write(`CLI ${status.current} is behind ${status.latest}, but the upgrade is skipped — ` +
+            `${SKIP_REASON[source.kind] ?? "the install source is not a global install"}.\n` +
+            `Upgrade by hand with: ${source.upgradeCommand.join(" ")}\n`);
+    }
+    else {
+        process.stdout.write(`CLI already at ${status.current}\n`);
+    }
+    if (dryRun) {
+        if (willUpgrade) {
+            process.stdout.write(`upgrade: would run — ${source.upgradeCommand.join(" ")}\n`);
+        }
+        if (!skipInstall) {
+            process.stdout.write(`refresh: would run — ${refreshCommand.join(" ")}\n`);
+        }
+        return 0;
+    }
+    // --- upgrade ---
+    if (willUpgrade) {
+        process.stdout.write("Upgrading the CLI…\n");
+        const result = runStep(run, source.upgradeCommand);
+        if (!result.ok) {
+            const message = result.error ?? "";
+            process.stderr.write(`upgrade: failed — ${message}\n`);
+            if (isPermissionError(message)) {
+                process.stderr.write("The global install directory is not writable by your user. Fix the ownership " +
+                    `of your npm prefix so global installs work without sudo, then re-run \`uploads update\`.\n`);
+            }
+            process.stderr.write(`Run it by hand: ${source.upgradeCommand.join(" ")}\n`);
+            return 1;
+        }
+        process.stdout.write("upgrade: ok\n");
+        if (verbose && result.output)
+            process.stdout.write(`  ${result.output}\n`);
+    }
+    if (skipInstall)
+        return 0;
+    // --- refresh ---
+    // After an upgrade the in-process code is the OLD version, so spawn the newly
+    // installed binary. Its skill list is the one that should be installed.
+    if (willUpgrade) {
+        process.stdout.write("Refreshing skills and MCP…\n");
+        const result = runStep(run, refreshCommand);
+        if (!result.ok) {
+            process.stderr.write(`refresh: failed — ${result.error ?? ""}\n`);
+            process.stderr.write("Run it by hand: uploads install\n");
+            return 1;
+        }
+        process.stdout.write(result.output ? `${result.output}\n` : "refresh: ok\n");
+        return 0;
+    }
+    // Nothing changed, so the in-process install code is already current.
+    return runInstall(verbose ? ["--verbose"] : [], { globals: opts.globals, runner: run });
+}

package/dist/commands.d.ts

@@ -166,7 +166,16 @@ export declare function commentViaSuffix(via: AttachmentsCommentResult["via"]):
  */
 export declare class GithubCommentAuthorizationError extends Error {
 }
-export declare function syncAttachmentsComment(client: UploadsClient, target: GhTarget, run: CommandRunner, workspace?: string): Promise<AttachmentsCommentResult>;
+/**
+ * `opts.resync` marks an explicit `uploads comment` invocation rather than a
+ * background sync (attach, screenshot, put --comment). It costs the server one
+ * extra comment listing and in exchange collapses any duplicate managed
+ * comment (issue #480) — worth it on the rare, explicitly-asked-for resync,
+ * not on every attach.
+ */
+export declare function syncAttachmentsComment(client: UploadsClient, target: GhTarget, run: CommandRunner, workspace?: string, opts?: {
+    resync?: boolean;
+}): Promise<AttachmentsCommentResult>;
 /**
  * Lever 3 (issue #469): a nudge for when an image lands on a PR/issue with
  * no `path` metadata — `path` is one of the highest-value queryable tags

package/dist/commands.js

@@ -450,13 +450,21 @@ export function commentViaSuffix(via) {
  */
 export class GithubCommentAuthorizationError extends Error {
 }
-export async function syncAttachmentsComment(client, target, run, workspace) {
+/**
+ * `opts.resync` marks an explicit `uploads comment` invocation rather than a
+ * background sync (attach, screenshot, put --comment). It costs the server one
+ * extra comment listing and in exchange collapses any duplicate managed
+ * comment (issue #480) — worth it on the rare, explicitly-asked-for resync,
+ * not on every attach.
+ */
+export async function syncAttachmentsComment(client, target, run, workspace, opts = {}) {
     let bot;
     try {
         bot = await client.upsertGithubComment({
             repo: target.repo,
             num: target.num,
             kind: target.kind,
+            ...(opts.resync ? { resync: true } : {}),
         });
     }
     catch {
@@ -2258,6 +2266,7 @@ async function resyncCommentAfterMetaSet(ctx, key, touchedKeys) {
             repo: target.repo,
             num: target.num,
             kind: target.kind,
+            resync: true,
         });
         if (bot.posted) {
             if (!ctx.quiet && !ctx.json) {
@@ -2336,7 +2345,9 @@ export async function runComment(ctx, args, help = false, run = execRunner) {
     const target = ghTargetFromFlags(parsed.flags, run);
     if (!target)
         throw new UsageError("comment requires --pr or --issue");
-    const result = await syncAttachmentsComment(ctx.client, target, run, ctx.config.workspace);
+    const result = await syncAttachmentsComment(ctx.client, target, run, ctx.config.workspace, {
+        resync: true,
+    });
     if (ctx.json) {
         await writeJson({ ...target, ...result });
     }

package/dist/github-gh.d.ts

@@ -55,7 +55,8 @@ export declare function resolveGhTitle(target: GhTarget, run?: CommandRunner): s
 export declare function ghMetadataFromTargetWithTitle(target: GhTarget, run?: CommandRunner): Record<string, string>;
 /**
  * Create the managed attachments comment, or edit it in place if it already
- * exists. Never touches any other comment. Body is passed via stdin
+ * exists. Never touches any other comment except best-effort deletes of
+ * duplicate marker comments (see below). Body is passed via stdin
  * (`-F body=@-`) so it is never shell-interpolated.
  *
  * `marker` identifies which comment to hunt for (see `findManagedComment`);
@@ -63,6 +64,27 @@ export declare function ghMetadataFromTargetWithTitle(target: GhTarget, run?: Co
  * (built via `attachmentsCommentBody(items, galleries, marker)`), so patching
  * an adopted legacy comment migrates it to the namespaced marker in place.
  * Defaults to the shared legacy marker for backward compatibility.
+ *
+ * Self-healing dedupe (issue #486, mirroring the bot path's #470/#484 fix):
+ * a create race (two concurrent `uploads attach` runs, neither finding an
+ * existing comment) can leave more than one marker comment on the thread.
+ * This path has no id cache, so unlike the bot path a duplicate here never
+ * heals on its own — every sync just patches the oldest and leaves the rest
+ * stale. After patching (or creating), any extra exact-`marker` hits are
+ * deleted best-effort via `gh api -X DELETE`; a failed delete is swallowed
+ * and never fails the caller's command, and the next sync retries anyway.
+ *
+ * On why this duplicates the bot path rather than deferring to it: the gh
+ * fallback is a supported path, not a stopgap, so it is held at behavioral
+ * parity deliberately. This file already reimplements the hunt, the legacy
+ * adoption and the create-vs-patch gate against a different transport (the
+ * `gh` subprocess, not the App's token), and #486 existed precisely because
+ * the two drifted. Treat any behavior change to `upsertBotComment`
+ * (apps/api/src/github-comment.ts) as owing a matching change here. Note
+ * this is the one place the CLI deletes a GitHub resource under the
+ * invoking human's own credentials — bounded to comments carrying this
+ * workspace's exact namespaced marker, whose content is always
+ * regenerable.
  */
 export declare function upsertAttachmentsComment(target: GhTarget, body: string, run?: CommandRunner, marker?: string, opts?: {
     createIfMissing?: boolean;

package/dist/github-gh.js

@@ -187,7 +187,9 @@ export function ghMetadataFromTargetWithTitle(target, run = execRunner) {
 /**
  * PR comments live on the issues endpoint, so one path covers PRs and issues.
  * `--paginate` follows Link headers and merges every page into one array, so the
- * marker comment is found even on threads past 100 comments.
+ * marker comment is found even on threads past 100 comments. GitHub returns
+ * comments oldest-first, so `hits[0]` (after merging paginated pages, which
+ * preserve that order) is the oldest exact-`marker` hit.
  *
  * Hunts for `marker` (the namespaced, per-workspace marker) first; when none
  * is found, falls back to a comment carrying the shared legacy
@@ -195,6 +197,12 @@ export function ghMetadataFromTargetWithTitle(target, run = execRunner) {
  * migrated in place. When `marker` IS the legacy marker (no workspace to
  * namespace with) this collapses to a single hunt, unchanged from pre-4b
  * behavior.
+ *
+ * Collects EVERY comment carrying `marker` (a create race can leave more
+ * than one — issue #486, mirroring the bot path's #470 fix): the oldest is
+ * `comment`, the rest come back as `extras` for the caller to delete. Only
+ * exact-`marker` hits are ever extras — a legacy (unnamespaced) comment may
+ * belong to a different workspace, so it is adopted at most, never deleted.
  */
 function findManagedComment(target, run, marker) {
     const raw = run("gh", [
@@ -203,16 +211,25 @@ function findManagedComment(target, run, marker) {
         "--paginate",
     ]);
     const comments = JSON.parse(raw);
-    const namespacedHit = comments.find((c) => typeof c.body === "string" && c.body.includes(marker));
-    if (namespacedHit)
-        return namespacedHit;
+    const hits = comments.filter((c) => typeof c.body === "string" && c.body.includes(marker));
+    if (hits.length > 0) {
+        // In legacy mode (no workspace to namespace with) our "exact" marker IS
+        // the shared one, so a second hit is not our own duplicate — it may be
+        // another workspace's comment. Adopt the oldest and never delete: the
+        // adopt-only contract is about the marker being ambiguous, which is just
+        // as true when it is the marker we are hunting on.
+        const extras = marker === ATTACHMENTS_MARKER ? undefined : hits.slice(1);
+        return { comment: hits[0], extras };
+    }
     if (marker === ATTACHMENTS_MARKER)
-        return undefined;
-    return comments.find((c) => typeof c.body === "string" && c.body.includes(ATTACHMENTS_MARKER));
+        return {};
+    const legacyHit = comments.find((c) => typeof c.body === "string" && c.body.includes(ATTACHMENTS_MARKER));
+    return { comment: legacyHit };
 }
 /**
  * Create the managed attachments comment, or edit it in place if it already
- * exists. Never touches any other comment. Body is passed via stdin
+ * exists. Never touches any other comment except best-effort deletes of
+ * duplicate marker comments (see below). Body is passed via stdin
  * (`-F body=@-`) so it is never shell-interpolated.
  *
  * `marker` identifies which comment to hunt for (see `findManagedComment`);
@@ -220,10 +237,41 @@ function findManagedComment(target, run, marker) {
  * (built via `attachmentsCommentBody(items, galleries, marker)`), so patching
  * an adopted legacy comment migrates it to the namespaced marker in place.
  * Defaults to the shared legacy marker for backward compatibility.
+ *
+ * Self-healing dedupe (issue #486, mirroring the bot path's #470/#484 fix):
+ * a create race (two concurrent `uploads attach` runs, neither finding an
+ * existing comment) can leave more than one marker comment on the thread.
+ * This path has no id cache, so unlike the bot path a duplicate here never
+ * heals on its own — every sync just patches the oldest and leaves the rest
+ * stale. After patching (or creating), any extra exact-`marker` hits are
+ * deleted best-effort via `gh api -X DELETE`; a failed delete is swallowed
+ * and never fails the caller's command, and the next sync retries anyway.
+ *
+ * On why this duplicates the bot path rather than deferring to it: the gh
+ * fallback is a supported path, not a stopgap, so it is held at behavioral
+ * parity deliberately. This file already reimplements the hunt, the legacy
+ * adoption and the create-vs-patch gate against a different transport (the
+ * `gh` subprocess, not the App's token), and #486 existed precisely because
+ * the two drifted. Treat any behavior change to `upsertBotComment`
+ * (apps/api/src/github-comment.ts) as owing a matching change here. Note
+ * this is the one place the CLI deletes a GitHub resource under the
+ * invoking human's own credentials — bounded to comments carrying this
+ * workspace's exact namespaced marker, whose content is always
+ * regenerable.
  */
 export function upsertAttachmentsComment(target, body, run = execRunner, marker = ATTACHMENTS_MARKER, opts = {}) {
     const createIfMissing = opts.createIfMissing ?? true;
-    const existing = findManagedComment(target, run, marker);
+    const { comment: existing, extras } = findManagedComment(target, run, marker);
+    const deleteExtras = () => {
+        for (const extra of extras ?? []) {
+            try {
+                run("gh", ["api", `repos/${target.repo}/issues/comments/${extra.id}`, "-X", "DELETE"]);
+            }
+            catch {
+                // Best effort only — a failed delete must never fail the caller's command.
+            }
+        }
+    };
     if (existing) {
         run("gh", [
             "api",
@@ -233,12 +281,15 @@ export function upsertAttachmentsComment(target, body, run = execRunner, marker
             "-F",
             "body=@-",
         ], body);
+        deleteExtras();
         return { action: "updated" };
     }
     // Patch-only (createIfMissing false, i.e. an empty body) with no existing
     // comment: nothing to do — never create one just to say it's empty.
     if (!createIfMissing)
         return { action: "skipped" };
+    // No existing marker hit means `extras` is necessarily empty here (see
+    // `findManagedComment`) — nothing to delete after a create.
     run("gh", ["api", `repos/${target.repo}/issues/${target.num}/comments`, "-F", "body=@-"], body);
     return { action: "created" };
 }

package/dist/install-source.d.ts

@@ -0,0 +1,14 @@
+export type InstallKind = "global" | "workspace" | "npx" | "unknown";
+export type PackageManager = "npm" | "pnpm" | "bun";
+export interface InstallSource {
+    kind: InstallKind;
+    /** Falls back to npm for every non-global kind. */
+    manager: PackageManager;
+    /** Upgrades the global install. Only meaningful when kind is "global". */
+    upgradeCommand: string[];
+}
+/**
+ * @param modulePath Absolute path of a file inside the installed package,
+ *   normally `realpathSync(fileURLToPath(import.meta.url))`.
+ */
+export declare function detectInstallSource(modulePath: string): InstallSource;

package/dist/install-source.js

@@ -0,0 +1,42 @@
+/**
+ * Classify where the running CLI was installed from.
+ *
+ * `uploads update` upgrades the global npm package. That is only safe when the
+ * CLI actually came from a global install — upgrading a workspace checkout
+ * would overwrite a developer's build with the published version.
+ *
+ * Pure and path-only: no filesystem or process access, so it is fully testable.
+ */
+import { PACKAGE_NAME } from "./update-check.js";
+const UPGRADE_COMMANDS = {
+    npm: ["npm", "install", "-g", `${PACKAGE_NAME}@latest`],
+    pnpm: ["pnpm", "add", "-g", `${PACKAGE_NAME}@latest`],
+    bun: ["bun", "add", "-g", `${PACKAGE_NAME}@latest`],
+};
+function classify(path) {
+    // npx is checked first: a cache entry can also contain a global-looking marker.
+    if (path.includes("/_npx/"))
+        return { kind: "npx", manager: "npm" };
+    if (path.includes("/.bun/install/global/"))
+        return { kind: "global", manager: "bun" };
+    if (path.includes("/pnpm/global/"))
+        return { kind: "global", manager: "pnpm" };
+    if (path.includes("/lib/node_modules/"))
+        return { kind: "global", manager: "npm" };
+    // Windows npm globals have no `lib` segment: `<prefix>\npm\node_modules\<pkg>`.
+    if (path.includes("/npm/node_modules/"))
+        return { kind: "global", manager: "npm" };
+    // No node_modules segment at all means we are running out of a source checkout.
+    if (!path.includes("/node_modules/"))
+        return { kind: "workspace", manager: "npm" };
+    return { kind: "unknown", manager: "npm" };
+}
+/**
+ * @param modulePath Absolute path of a file inside the installed package,
+ *   normally `realpathSync(fileURLToPath(import.meta.url))`.
+ */
+export function detectInstallSource(modulePath) {
+    const normalized = modulePath.split("\\").join("/");
+    const { kind, manager } = classify(normalized);
+    return { kind, manager, upgradeCommand: UPGRADE_COMMANDS[manager] };
+}

package/dist/mcp/tools.js

@@ -1158,7 +1158,10 @@ export function createUploadsMcpTools(opts) {
                 if (!target)
                     usage("comment requires pr or issue");
                 const { config, client } = clientFor(args);
-                const result = await syncAttachmentsComment(client, target, run, config.workspace);
+                // Explicit resync, same as `uploads comment` (issue #480).
+                const result = await syncAttachmentsComment(client, target, run, config.workspace, {
+                    resync: true,
+                });
                 return { ...target, ...result };
             },
         },

package/dist/update-check.js

@@ -116,7 +116,7 @@ export async function maybeHintUpdate(opts = {}) {
         if (!status.updateAvailable || !status.latest)
             return;
         const write = opts.write ?? ((text) => process.stderr.write(text));
-        write(`hint: ${PACKAGE_NAME}@${status.latest} is available (you have ${status.current}). Update: npm i -g ${PACKAGE_NAME}\n`);
+        write(`hint: ${PACKAGE_NAME}@${status.latest} is available (you have ${status.current}). Update: uploads update\n`);
     }
     catch {
         // Never surface update-check failures.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@buildinternet/uploads",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "CLI and client for uploads.sh — workspace-scoped image hosting for GitHub embeds",
   "type": "module",
   "sideEffects": false,