@ctxo/cli 0.8.2 → 0.9.0

package/dist/{cli-router-3UHVNKWD.js → cli-router-L34BRMXQ.js}

@@ -31,8 +31,8 @@ import {
 } from "./chunk-PSKDDLSF.js";
 
 // src/cli/cli-router.ts
-import { readFileSync as readFileSync14, existsSync as existsSync22 } from "fs";
-import { dirname as dirname8, join as join24 } from "path";
+import { readFileSync as readFileSync15, existsSync as existsSync23 } from "fs";
+import { dirname as dirname8, join as join25 } from "path";
 
 // src/cli/index-command.ts
 import { execFileSync as execFileSync2 } from "child_process";
@@ -264,7 +264,6 @@ async function loadPlugins(projectRoot, options = {}) {
 
 // src/cli/install-command.ts
 import { existsSync as existsSync5 } from "fs";
-import { spawn } from "child_process";
 import { createRequire as createRequire2 } from "module";
 import { join as join4 } from "path";
 
@@ -523,6 +522,16 @@ function buildInstallCommand(manager, packages, options = {}) {
   }
 }
 
+// src/core/install/run-package-manager.ts
+import { spawn } from "child_process";
+function runPackageManager(command, args, cwd) {
+  return new Promise((resolve4, reject) => {
+    const child = spawn(command, [...args], { cwd, stdio: "inherit", shell: process.platform === "win32" });
+    child.on("exit", (code) => resolve4(code ?? 0));
+    child.on("error", (err) => reject(err));
+  });
+}
+
 // src/cli/install-command.ts
 var InstallCommand = class {
   constructor(projectRoot) {
@@ -579,7 +588,7 @@ var InstallCommand = class {
       console.error("[ctxo] --dry-run set; not executing.");
       return;
     }
-    const code = await spawnInstall(plan.command, plan.args, this.projectRoot);
+    const code = await runPackageManager(plan.command, plan.args, this.projectRoot);
     if (code !== 0) {
       console.error(`[ctxo] ${plan.command} exited with code ${code}`);
       process.exitCode = code;
@@ -648,13 +657,6 @@ function isLockedCI(env) {
   if (env["CI"] !== "true" && env["CI"] !== "1") return false;
   return true;
 }
-function spawnInstall(command, args, cwd) {
-  return new Promise((resolve4, reject) => {
-    const child = spawn(command, [...args], { cwd, stdio: "inherit", shell: process.platform === "win32" });
-    child.on("exit", (code) => resolve4(code ?? 0));
-    child.on("error", (err) => reject(err));
-  });
-}
 
 // src/adapters/storage/json-index-writer.ts
 import { mkdirSync, unlinkSync, existsSync as existsSync6 } from "fs";
@@ -3606,7 +3608,7 @@ var DoctorCommand = class {
     this.ctxoRoot = join22(projectRoot, ".ctxo");
   }
   async run(options = {}) {
-    const { getVersion: getVersion2 } = await import("./cli-router-3UHVNKWD.js");
+    const { getVersion: getVersion2 } = await import("./cli-router-L34BRMXQ.js");
     console.error(`ctxo v${getVersion2()} \u2014 health check
 `);
     const checks = [
@@ -3867,20 +3869,363 @@ var VisualizeCommand = class {
   }
 };
 
+// src/cli/update-command.ts
+import { existsSync as existsSync22, readFileSync as readFileSync14 } from "fs";
+import { join as join24 } from "path";
+
+// src/core/update/registry-client.ts
+import { request } from "https";
+var log5 = createLogger("ctxo:update:registry");
+var DEFAULT_TIMEOUT_MS = 5e3;
+async function fetchDistTags(packageName, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const fetcher = options.fetcher ?? defaultHttpsFetcher;
+  const url = `https://registry.npmjs.org/${encodeURIComponent(packageName)}`;
+  let response;
+  try {
+    response = await fetcher(url, timeoutMs);
+  } catch (err) {
+    return classifyFetchError(packageName, err);
+  }
+  if (response.status === 404) {
+    return { name: packageName, reason: "registry-404", status: 404 };
+  }
+  if (response.status < 200 || response.status >= 300) {
+    return { name: packageName, reason: "registry-error", status: response.status };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(response.body);
+  } catch {
+    return { name: packageName, reason: "registry-error", status: response.status, message: "invalid JSON" };
+  }
+  const distTags = parsed["dist-tags"];
+  if (!distTags || typeof distTags !== "object") {
+    return { name: packageName, reason: "registry-error", status: response.status, message: "missing dist-tags" };
+  }
+  return { name: packageName, distTags };
+}
+async function fetchDistTagsBatch(packageNames, options = {}) {
+  return Promise.all(packageNames.map((name) => fetchDistTags(name, options)));
+}
+function classifyFetchError(name, err) {
+  const code = err?.code;
+  const message = err?.message ?? String(err);
+  if (code === "ETIMEDOUT" || /timeout/i.test(message)) {
+    return { name, reason: "timeout", message };
+  }
+  if (code === "ECONNREFUSED" || code === "ECONNRESET" || code === "ENOTFOUND" || code === "EAI_AGAIN") {
+    return { name, reason: "network", message };
+  }
+  log5.error(`unexpected fetch error for ${name}: ${message}`);
+  return { name, reason: "network", message };
+}
+var defaultHttpsFetcher = (url, timeoutMs) => new Promise((resolve4, reject) => {
+  const req = request(url, { method: "GET", headers: { "user-agent": "ctxo-update", accept: "application/json" } }, (res) => {
+    const chunks = [];
+    res.on("data", (chunk) => chunks.push(chunk));
+    res.on("end", () => resolve4({ status: res.statusCode ?? 0, body: Buffer.concat(chunks).toString("utf-8") }));
+    res.on("error", reject);
+  });
+  req.setTimeout(timeoutMs, () => {
+    req.destroy(Object.assign(new Error(`timeout after ${timeoutMs}ms`), { code: "ETIMEDOUT" }));
+  });
+  req.on("error", reject);
+  req.end();
+});
+
+// src/core/update/update-plan.ts
+var SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
+function parseSemver(version) {
+  const match = SEMVER_RE.exec(version.trim());
+  if (!match) return null;
+  const prereleaseRaw = match[4] ?? "";
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    prerelease: prereleaseRaw ? prereleaseRaw.split(".") : []
+  };
+}
+function detectChannel(version) {
+  const parsed = parseSemver(version);
+  if (!parsed || parsed.prerelease.length === 0) return "latest";
+  const first = parsed.prerelease[0];
+  if (/^\d+$/.test(first)) return "latest";
+  return first;
+}
+function compareSemver(a, b) {
+  const pa = parseSemver(a);
+  const pb = parseSemver(b);
+  if (!pa && !pb) return 0;
+  if (!pa) return -1;
+  if (!pb) return 1;
+  if (pa.major !== pb.major) return pa.major < pb.major ? -1 : 1;
+  if (pa.minor !== pb.minor) return pa.minor < pb.minor ? -1 : 1;
+  if (pa.patch !== pb.patch) return pa.patch < pb.patch ? -1 : 1;
+  if (pa.prerelease.length === 0 && pb.prerelease.length === 0) return 0;
+  if (pa.prerelease.length === 0) return 1;
+  if (pb.prerelease.length === 0) return -1;
+  const len = Math.max(pa.prerelease.length, pb.prerelease.length);
+  for (let i = 0; i < len; i++) {
+    const ai = pa.prerelease[i];
+    const bi = pb.prerelease[i];
+    if (ai === void 0) return -1;
+    if (bi === void 0) return 1;
+    const aNum = /^\d+$/.test(ai);
+    const bNum = /^\d+$/.test(bi);
+    if (aNum && bNum) {
+      const an = Number(ai);
+      const bn = Number(bi);
+      if (an !== bn) return an < bn ? -1 : 1;
+    } else if (aNum && !bNum) {
+      return -1;
+    } else if (!aNum && bNum) {
+      return 1;
+    } else if (ai !== bi) {
+      return ai < bi ? -1 : 1;
+    }
+  }
+  return 0;
+}
+function computePackageStates(installed, results) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const r of results) byName.set(r.name, r);
+  return installed.map((pkg) => {
+    const installedChannel = detectChannel(pkg.version);
+    const result = byName.get(pkg.name);
+    if (!result) {
+      return { name: pkg.name, current: pkg.version, latest: null, channel: installedChannel, status: "unknown" };
+    }
+    if (!("distTags" in result)) {
+      return { name: pkg.name, current: pkg.version, latest: null, channel: installedChannel, status: "unknown", reason: result.reason };
+    }
+    const hasInstalledChannel = typeof result.distTags[installedChannel] === "string";
+    const targetChannel = hasInstalledChannel ? installedChannel : "latest";
+    const target = result.distTags[targetChannel] ?? null;
+    if (!target) {
+      return { name: pkg.name, current: pkg.version, latest: null, channel: installedChannel, status: "unknown" };
+    }
+    const cmp = compareSemver(pkg.version, target);
+    const status = cmp === 0 ? "current" : cmp < 0 ? "update" : "ahead";
+    return { name: pkg.name, current: pkg.version, latest: target, channel: targetChannel, status };
+  });
+}
+function selectInstallTargets(states) {
+  return states.filter((s) => s.status === "update" && typeof s.latest === "string").filter((s) => isSafeVersionSpecifier(s.latest)).map((s) => ({ name: s.name, version: s.latest }));
+}
+var SAFE_SPECIFIER_RE = /^[0-9A-Za-z.+-]+$/;
+function isSafeVersionSpecifier(version) {
+  return SAFE_SPECIFIER_RE.test(version);
+}
+
+// src/cli/update-command.ts
+var log6 = createLogger("ctxo:update");
+var CTXO_CLI_PACKAGE = "@ctxo/cli";
+function formatText(report) {
+  const lines = [];
+  lines.push("ctxo update \u2014 checking registry for updates...");
+  lines.push("");
+  const updatesExist = report.packages.some((p) => p.status === "update");
+  if (!updatesExist && report.strategy !== "print") {
+    const total = report.packages.length;
+    lines.push(`All ${total} package${total === 1 ? "" : "s"} are up to date.`);
+    return lines.join("\n");
+  }
+  const nameCol = Math.max(7, ...report.packages.map((p) => p.name.length));
+  const curCol = Math.max(7, ...report.packages.map((p) => p.current.length));
+  const latestCol = Math.max(15, ...report.packages.map((p) => (p.latest ?? "(not found)").length));
+  lines.push(
+    `${"PACKAGE".padEnd(nameCol)}  ${"CURRENT".padEnd(curCol)}  ${`LATEST (${report.channel})`.padEnd(latestCol)}  STATUS`
+  );
+  for (const pkg of report.packages) {
+    const latestText = pkg.latest ?? "(not found)";
+    const statusText = renderStatus(pkg, report.channel);
+    lines.push(
+      `${pkg.name.padEnd(nameCol)}  ${pkg.current.padEnd(curCol)}  ${latestText.padEnd(latestCol)}  ${statusText}`
+    );
+  }
+  if (report.plan && report.strategy === "execute") {
+    lines.push("");
+    lines.push(`Plan: ${report.plan.command} ${report.plan.args.join(" ")}`);
+    lines.push(`Using ${report.plan.manager} (${formatManagerSource(report.plan)})`);
+    lines.push("");
+    lines.push("Running...");
+  } else if (report.plan && report.strategy === "print") {
+    lines.push("");
+    lines.push("To update, run:");
+    lines.push(`  ${report.plan.command} ${report.plan.args.join(" ")}`);
+  }
+  return lines.join("\n");
+}
+function renderStatus(pkg, reportChannel) {
+  switch (pkg.status) {
+    case "current":
+      return "up to date";
+    case "ahead":
+      return "ahead of registry";
+    case "unknown":
+      return pkg.reason === "registry-404" ? "skipped" : `error${pkg.reason ? ` (${pkg.reason})` : ""}`;
+    case "update":
+      return pkg.channel === reportChannel ? "update" : `update (${pkg.channel})`;
+  }
+}
+function formatManagerSource(plan) {
+  return plan.managerDetail ? `${plan.managerSource}: ${plan.managerDetail}` : plan.managerSource;
+}
+function formatJson2(report) {
+  return JSON.stringify(
+    {
+      ctxo: report.ctxo,
+      channel: report.channel,
+      packages: report.packages,
+      plan: report.plan,
+      executed: report.executed,
+      ...report.exitCode !== void 0 ? { exitCode: report.exitCode } : {}
+    },
+    null,
+    2
+  );
+}
+var UpdateCommand = class {
+  constructor(projectRoot, deps = {}) {
+    this.projectRoot = projectRoot;
+    this.deps = deps;
+  }
+  projectRoot;
+  deps;
+  async run(options = {}) {
+    if (options.pm && !isPackageManager(options.pm)) {
+      this.emitError(`Unknown --pm value "${options.pm}".`);
+      this.deps.setExitCode?.(1);
+      return;
+    }
+    const discover = this.deps.discoverInstalled ?? defaultDiscoverInstalled;
+    const installed = await discover(this.projectRoot);
+    if (installed.length === 0) {
+      this.emit(options.json ? "{}\n" : "ctxo update \u2014 no @ctxo/* packages discovered.\n");
+      return;
+    }
+    const names = installed.map((p) => p.name);
+    const results = await fetchDistTagsBatch(names, { fetcher: this.deps.fetcher });
+    const allMissed = results.every((r) => !("distTags" in r));
+    if (allMissed) {
+      this.emitError("registry unreachable for every package; aborting.");
+      this.deps.setExitCode?.(1);
+      return;
+    }
+    const states = computePackageStates(installed, results);
+    const targets = selectInstallTargets(states);
+    const cliVersion = getVersion();
+    const channel = detectChannel(cliVersion);
+    const plan = targets.length === 0 ? null : this.buildPlan(targets, options);
+    const strategy = this.pickStrategy(targets, options);
+    const baseReport = {
+      ctxo: cliVersion,
+      channel,
+      packages: states,
+      plan,
+      strategy,
+      executed: false
+    };
+    if (options.check) {
+      const checkStrategy = plan ? "print" : strategy;
+      this.emitReport({ ...baseReport, strategy: checkStrategy }, options.json ?? false);
+      return;
+    }
+    if (strategy === "none" || strategy === "print" || !plan) {
+      this.emitReport(baseReport, options.json ?? false);
+      return;
+    }
+    if (!options.force && !options.global && isLockedCI2(this.deps.env ?? process.env)) {
+      this.emitReport({ ...baseReport, strategy: "print" }, options.json ?? false);
+      this.emitError("CI environment with frozen lockfile detected. Refusing to mutate. Use --force or --global.");
+      this.deps.setExitCode?.(1);
+      return;
+    }
+    if (!options.json) this.emitReport(baseReport, false);
+    const run2 = this.deps.runner ?? runPackageManager;
+    const code = await run2(plan.command, plan.args, this.projectRoot);
+    const finalReport = { ...baseReport, executed: true, exitCode: code };
+    if (options.json) this.emit(formatJson2(finalReport) + "\n");
+    if (code !== 0) this.deps.setExitCode?.(code);
+  }
+  buildPlan(targets, options) {
+    const resolution = resolvePackageManager({
+      flag: options.pm,
+      projectRoot: this.projectRoot,
+      env: this.deps.env
+    });
+    const specifiers = targets.map((t) => `${t.name}@${t.version}`);
+    const useGlobal = options.global || !this.projectHasCtxoDep();
+    const invocation = buildInstallCommand(resolution.manager, specifiers, { global: useGlobal });
+    return {
+      manager: resolution.manager,
+      managerSource: resolution.source,
+      managerDetail: resolution.detail,
+      global: useGlobal,
+      command: invocation.command,
+      args: invocation.args
+    };
+  }
+  pickStrategy(targets, options) {
+    if (targets.length === 0) return "none";
+    if (options.print) return "print";
+    if (options.global) return "execute";
+    return this.projectHasCtxoDep() ? "execute" : "print";
+  }
+  projectHasCtxoDep() {
+    const pkg = join24(this.projectRoot, "package.json");
+    if (!existsSync22(pkg)) return false;
+    try {
+      const json = JSON.parse(readFileSync14(pkg, "utf-8"));
+      const merged = { ...json.dependencies ?? {}, ...json.devDependencies ?? {} };
+      return Object.keys(merged).some(
+        (name) => name === CTXO_CLI_PACKAGE || name.startsWith("@ctxo/lang-") || name.startsWith("ctxo-lang-")
+      );
+    } catch (err) {
+      log6.error(`failed to read project package.json: ${err.message}`);
+      return false;
+    }
+  }
+  emit(text) {
+    process.stdout.write(text);
+  }
+  emitError(text) {
+    process.stderr.write(`[ctxo] ${text}
+`);
+  }
+  emitReport(report, json) {
+    if (json) this.emit(formatJson2(report) + "\n");
+    else this.emit(formatText(report) + "\n");
+  }
+};
+async function defaultDiscoverInstalled(projectRoot) {
+  const out = [{ name: CTXO_CLI_PACKAGE, version: getVersion() }];
+  const manifestPath = loadManifestPath(projectRoot);
+  if (!manifestPath) return out;
+  const { plugins } = await discoverPlugins({ manifestPath });
+  for (const p of plugins) out.push({ name: p.specifier, version: p.plugin.version });
+  return out;
+}
+function isLockedCI2(env) {
+  return env["CI"] === "true" || env["CI"] === "1";
+}
+
 // src/cli/cli-router.ts
 function getVersion() {
   let dir = import.meta.dirname;
   for (let i = 0; i < 10; i++) {
-    const pkg = join24(dir, "package.json");
-    if (existsSync22(pkg)) {
+    const pkg = join25(dir, "package.json");
+    if (existsSync23(pkg)) {
       try {
-        const json = JSON.parse(readFileSync14(pkg, "utf-8"));
+        const json = JSON.parse(readFileSync15(pkg, "utf-8"));
         return json.version ?? "unknown";
       } catch {
         break;
       }
     }
-    const parent = join24(dir, "..");
+    const parent = join25(dir, "..");
     if (parent === dir) break;
     dir = parent;
   }
@@ -3889,7 +4234,7 @@ function getVersion() {
 function locateGitRoot(startDir) {
   let dir = startDir;
   for (let i = 0; i < 12; i++) {
-    if (existsSync22(join24(dir, ".git"))) return dir;
+    if (existsSync23(join25(dir, ".git"))) return dir;
     const parent = dirname8(dir);
     if (parent === dir) break;
     dir = parent;
@@ -4042,6 +4387,43 @@ var CliRouter = class {
         });
         break;
       }
+      case "update": {
+        const flagValues = {};
+        for (let i = 1; i < args.length; i++) {
+          const a = args[i];
+          if (a === "--check") flagValues["check"] = true;
+          else if (a === "--print") flagValues["print"] = true;
+          else if (a === "--global" || a === "-g") flagValues["global"] = true;
+          else if (a === "--json") flagValues["json"] = true;
+          else if (a === "--force") flagValues["force"] = true;
+          else if (a === "--pm") {
+            const next = args[++i];
+            if (!next) {
+              console.error("[ctxo] --pm requires a value");
+              process.exit(1);
+              return;
+            }
+            flagValues["pm"] = next;
+          } else {
+            console.error(`[ctxo] Unknown update flag: ${a}`);
+            process.exit(1);
+            return;
+          }
+        }
+        await new UpdateCommand(this.projectRoot, {
+          setExitCode: (code) => {
+            process.exitCode = code;
+          }
+        }).run({
+          check: flagValues["check"] === true,
+          print: flagValues["print"] === true,
+          global: flagValues["global"] === true,
+          json: flagValues["json"] === true,
+          force: flagValues["force"] === true,
+          pm: typeof flagValues["pm"] === "string" ? flagValues["pm"] : void 0
+        });
+        break;
+      }
       case "visualize": {
         const outputIdx = args.indexOf("--output");
         const outputArg = outputIdx !== -1 ? args[outputIdx + 1] : void 0;
@@ -4089,6 +4471,13 @@ Usage:
   ctxo install python -y    Batch install, no prompt
   ctxo install ts --global  Install globally
   ctxo install py --dry-run Show command without running
+  ctxo update              Check + apply updates for ctxo + plugins
+  ctxo update --check      Check only, no install
+  ctxo update --print      Print install command, never execute
+  ctxo update --global     Force a global install
+  ctxo update --json       Machine-readable output
+  ctxo update --pm <pm>    Override package manager (npm|pnpm|yarn|bun)
+  ctxo update --force      Bypass CI lockfile guard
   ctxo --version                 Print core version
   ctxo --version --verbose       Print core + plugins + runtime
   ctxo --version --json          Machine-readable version payload
@@ -4102,4 +4491,4 @@ export {
   getVersion,
   locateGitRoot
 };
-//# sourceMappingURL=cli-router-3UHVNKWD.js.map
+//# sourceMappingURL=cli-router-L34BRMXQ.js.map