@datalabrotterdam/nova-ai-cli 1.2.0-alpha.2 → 1.2.0-alpha.3

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+# [@datalabrotterdam/nova-ai-cli-v1.2.0-alpha.3](https://github.com/Datalab-Rotterdam/nova-ai-cli/compare/@datalabrotterdam/nova-ai-cli@1.2.0-alpha.2...@datalabrotterdam/nova-ai-cli@1.2.0-alpha.3) (2026-10-04)
+
+
+### Bug Fixes
+
+* **agent:** never overwrite an unreadable settings file when switching a skill ([ca989ef](https://github.com/Datalab-Rotterdam/nova-ai-cli/commit/ca989ef1810fc903cea069cdadf3041fe164e364))
+* **cli:** install the command as nova-ai only ([eda8064](https://github.com/Datalab-Rotterdam/nova-ai-cli/commit/eda806411af1738ff6f6b1404d23d4e84a74ced8))
+
+
+### Features
+
+* **agent,cli:** Nova skill folders, switching skills off, a budgeted skill list ([0891c79](https://github.com/Datalab-Rotterdam/nova-ai-cli/commit/0891c79248d3a645d638f12f46928a54652b0941))
+* **cli:** update notice from npm for every channel, cached daily ([c3a0014](https://github.com/Datalab-Rotterdam/nova-ai-cli/commit/c3a001473336aac14d216cdeec0bedde4df34427))
+
 # [@datalabrotterdam/nova-ai-cli-v1.2.0-alpha.2](https://github.com/Datalab-Rotterdam/nova-ai-cli/compare/@datalabrotterdam/nova-ai-cli@1.2.0-alpha.1...@datalabrotterdam/nova-ai-cli@1.2.0-alpha.2) (2026-10-03)
 
 

package/README.md

@@ -44,6 +44,11 @@ nova-ai                # start the terminal UI in your project
 Or without installing: `npx @datalabrotterdam/nova-ai-cli login`, then
 `npx @datalabrotterdam/nova-ai-cli`.
 
+When a newer version is on npm, the terminal UI says so, and so do `-p` and
+`--version` (on stderr, only in a terminal). npm is asked at most once a day;
+an alpha install also follows the `alpha` channel. `NOVA_NO_UPDATE_CHECK=1`
+turns it off (it is off in CI).
+
 ```
 nova-ai [options]                 Interactive terminal UI
 nova-ai -p [options] [prompt]     Run one request headless (see nova-ai -p --help)
@@ -131,7 +136,7 @@ always options, client file system and terminals, form questions, plans, usage
 and title updates, MCP servers (stdio, HTTP, SSE), image prompts, and three
 login methods (browser, `NOVA_API_KEY`, or `nova-ai login` in a terminal).
 Nova-specific features (prompt queue, rewind, compaction, context usage,
-background jobs) are `_nova/…` extension methods. The agent is also published
+per-session settings, background jobs) are `_nova/…` extension methods. The agent is also published
 on its own as
 [`@datalabrotterdam/nova-ai-agent`](https://www.npmjs.com/package/@datalabrotterdam/nova-ai-agent)
 (command `nova-ai-agent`), without the terminal UI, for integrations that only
@@ -153,6 +158,9 @@ need ACP. Everything is documented in
   private `~/.nova-ai/projects/<key>/settings.json`, outside the repository.
   Compound commands (`a && b`, pipes) are checked part by part; substitutions
   and nested shells need an exact rule.
+- **Web pages are fetched only with approval.** `fetch_url` asks every time
+  unless a rule allows that URL (a URL can carry data out), and a redirect to
+  another site needs its own approval.
 - **File access stays in the workspace** (symlinks resolved); commands run in
   their own process group with a timeout, and the whole tree is stopped on
   cancel.
@@ -172,8 +180,11 @@ VS Code extension: settings, per-project trust, sessions and memory.
 - **Instructions**: `NOVA.md` and `AGENTS.md` in the workspace.
 - **Memory**: a `MEMORY.md` index plus notes, globally and per project,
   through the `memory_read` and `memory_write` tools (writes need approval).
-- **Skills**: `SKILL.md` files under `.agents/skills`, `.claude/skills` or
-  `.codex/skills`, in the workspace or your home folder.
+- **Skills**: `SKILL.md` files under `.nova-ai/skills` in the workspace or
+  `~/.nova-ai/skills` for every project (`.agents`, `.claude` and `.codex`
+  skills folders are read too). `/skills` lists them; `/skills off <name>`
+  switches one off in this project (`--global`: everywhere). Only names and
+  short descriptions go into the prompt; Nova loads a skill when it fits.
 - **MCP servers**: `.mcp.json` or `mcpServers` in `.nova-ai/settings.json`.
 
 The complete layout and rule syntax: [docs/NOVA_HOME.md](https://github.com/Datalab-Rotterdam/nova-ai-cli/blob/main/docs/NOVA_HOME.md).
@@ -195,6 +206,7 @@ hand).
 | `NOVA_TOOL_PROTOCOL` | Force `native` or `text` tool calling |
 | `NOVA_NES_MODEL` | Separate model for next-edit suggestions (ACP) |
 | `NOVA_KITTY_KEYBOARD` | `1`/`0`: force the kitty keyboard protocol on or off |
+| `NOVA_NO_UPDATE_CHECK` | Don't ask npm for a newer version (also `NO_UPDATE_NOTIFIER`, or `CI`) |
 
 ## Development
 

package/dist/chunk-37PMUZ34.js

@@ -0,0 +1,147 @@
+import {
+  CLI_PACKAGE_NAME,
+  cliVersion
+} from "./chunk-FMHWW3E6.js";
+
+// src/update-check.ts
+import { mkdirSync, readFileSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+import { novaHomeRoot } from "@datalabrotterdam/nova-ai-agent/core/nova-home.js";
+var DIST_TAGS_URL = `https://registry.npmjs.org/-/package/${CLI_PACKAGE_NAME.replace("/", "%2F")}/dist-tags`;
+var DEFAULT_TIMEOUT_MS = 3e3;
+var CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+function updateCachePath() {
+  return join(novaHomeRoot(), "update-check.json");
+}
+function updateChecksDisabled(env = process.env) {
+  return Boolean(env.NOVA_NO_UPDATE_CHECK || env.NO_UPDATE_NOTIFIER || env.CI);
+}
+async function checkForUpdate(options = {}) {
+  try {
+    if (updateChecksDisabled(options.env)) return null;
+    const currentVersion = options.currentVersion ?? cliVersion();
+    if (!currentVersion) return null;
+    const distTags = await readDistTags(options);
+    if (!distTags) return null;
+    return chooseUpdate(currentVersion, distTags);
+  } catch {
+    return null;
+  }
+}
+function chooseUpdate(currentVersion, distTags) {
+  const channel = prereleaseChannel(currentVersion);
+  const tags = channel && distTags[channel] ? [channel, "latest"] : ["latest"];
+  let best = null;
+  for (const tag of tags) {
+    const version = distTags[tag];
+    if (!version || !isNewerVersion(version, currentVersion)) continue;
+    if (!best || isNewerVersion(version, best.version)) best = { tag, version };
+  }
+  if (!best) return null;
+  return {
+    currentVersion,
+    latestVersion: best.version,
+    command: `npm install -g ${CLI_PACKAGE_NAME}@${best.tag}`
+  };
+}
+async function readDistTags(options) {
+  const now = (options.now ?? Date.now)();
+  const cachePath = options.cachePath === void 0 ? updateCachePath() : options.cachePath;
+  const cached = cachePath ? readCache(cachePath) : null;
+  if (cached && now - cached.checkedAt >= 0 && now - cached.checkedAt < CACHE_MAX_AGE_MS) {
+    return cached.distTags;
+  }
+  const response = await (options.fetchImpl ?? fetch)(DIST_TAGS_URL, {
+    headers: { accept: "application/json" },
+    signal: AbortSignal.any([
+      AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+      ...options.signal ? [options.signal] : []
+    ])
+  });
+  if (!response.ok) return null;
+  const payload = await response.json();
+  if (!isDistTags(payload)) return null;
+  if (cachePath) writeCache(cachePath, { checkedAt: now, distTags: payload });
+  return payload;
+}
+function readCache(path) {
+  try {
+    const value = JSON.parse(readFileSync(path, "utf8"));
+    if (value && typeof value === "object" && typeof value.checkedAt === "number" && isDistTags(value.distTags)) {
+      return value;
+    }
+  } catch {
+  }
+  return null;
+}
+function writeCache(path, value) {
+  try {
+    mkdirSync(dirname(path), { recursive: true, mode: 448 });
+    writeFileSync(path, `${JSON.stringify(value)}
+`, { mode: 384 });
+  } catch {
+  }
+}
+function isDistTags(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && Object.values(value).every((version) => typeof version === "string");
+}
+function prereleaseChannel(version) {
+  const parsed = parseVersion(version);
+  const first = parsed?.prerelease[0];
+  return first && !/^\d+$/.test(first) ? first : null;
+}
+function readInstalledVersion() {
+  return cliVersion();
+}
+function isNewerVersion(candidate, current) {
+  const next = parseVersion(candidate);
+  const installed = parseVersion(current);
+  if (!next || !installed) return false;
+  for (let index = 0; index < 3; index++) {
+    const difference = next.core[index] - installed.core[index];
+    if (difference !== 0) return difference > 0;
+  }
+  return comparePrerelease(next.prerelease, installed.prerelease) > 0;
+}
+function parseVersion(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
+  if (!match) return null;
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    prerelease: match[4]?.split(".") ?? []
+  };
+}
+function comparePrerelease(left, right) {
+  if (left.length === 0 || right.length === 0) {
+    if (left.length === right.length) return 0;
+    return left.length === 0 ? 1 : -1;
+  }
+  const length = Math.max(left.length, right.length);
+  for (let index = 0; index < length; index++) {
+    const leftPart = left[index];
+    const rightPart = right[index];
+    if (leftPart === void 0 || rightPart === void 0) {
+      return leftPart === rightPart ? 0 : leftPart === void 0 ? -1 : 1;
+    }
+    if (leftPart === rightPart) continue;
+    const leftNumber = /^\d+$/.test(leftPart) ? Number(leftPart) : null;
+    const rightNumber = /^\d+$/.test(rightPart) ? Number(rightPart) : null;
+    if (leftNumber !== null && rightNumber !== null) return leftNumber - rightNumber;
+    if (leftNumber !== null || rightNumber !== null) return leftNumber !== null ? -1 : 1;
+    return leftPart < rightPart ? -1 : 1;
+  }
+  return 0;
+}
+function formatUpdateNotice(update) {
+  return `Update available: nova-ai ${update.currentVersion} \u2192 ${update.latestVersion}. Run: ${update.command}`;
+}
+
+export {
+  updateCachePath,
+  updateChecksDisabled,
+  checkForUpdate,
+  chooseUpdate,
+  readInstalledVersion,
+  isNewerVersion,
+  formatUpdateNotice
+};

package/dist/{chunk-SKAW2KXC.js → chunk-FMHWW3E6.js}

@@ -6,5 +6,6 @@ function cliVersion() {
 }
 
 export {
+  CLI_PACKAGE_NAME,
   cliVersion
 };

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   cliVersion
-} from "./chunk-SKAW2KXC.js";
+} from "./chunk-FMHWW3E6.js";
 
 // src/cli.ts
 var SUBCOMMANDS = {
@@ -86,6 +86,28 @@ function parseTuiArgs(args) {
 }
 
 // src/index.ts
+function startUpdateCheck() {
+  if (!process.stderr.isTTY) return null;
+  const abort = new AbortController();
+  const result = import("./update-check-OX6WAPNN.js").then(({ checkForUpdate }) => checkForUpdate({ signal: abort.signal })).catch(() => null);
+  return { result, cancel: () => abort.abort() };
+}
+async function noticeUpdate(check, waitMs) {
+  let timer;
+  const update = await Promise.race([
+    check.result,
+    new Promise((resolve) => {
+      timer = setTimeout(() => resolve(null), waitMs);
+    })
+  ]);
+  clearTimeout(timer);
+  check.cancel();
+  if (!update) return;
+  const { formatUpdateNotice } = await import("./update-check-OX6WAPNN.js");
+  process.stderr.write(`
+${formatUpdateNotice(update)}
+`);
+}
 async function main() {
   const command = parseCli(process.argv.slice(2));
   switch (command.mode) {
@@ -99,10 +121,13 @@ ${MAIN_HELP}
       process.stdout.write(`${MAIN_HELP}
 `);
       return 0;
-    case "version":
+    case "version": {
+      const update = startUpdateCheck();
       process.stdout.write(`${versionText()}
 `);
+      if (update) await noticeUpdate(update, 800);
       return 0;
+    }
     case "acp": {
       if (command.args.length) {
         process.stderr.write(`--acp takes no other arguments (got ${command.args.join(" ")}).
@@ -114,8 +139,11 @@ ${MAIN_HELP}
       return 0;
     }
     case "print": {
+      const update = startUpdateCheck();
       const { default: runHeadless } = await import("./headless-OFJFVJ3O.js");
-      return runHeadless(command.args);
+      const code = await runHeadless(command.args);
+      if (update) await noticeUpdate(update, 500);
+      return code;
     }
     case "login": {
       const { runLogin } = await import("@datalabrotterdam/nova-ai-agent/commands/login.js");
@@ -147,7 +175,7 @@ ${MAIN_HELP}
         );
         return 2;
       }
-      const { default: runChat } = await import("./tui-NJWDD5X7.js");
+      const { default: runChat } = await import("./tui-LNFSHL4Y.js");
       return runChat(options);
     }
   }

package/dist/{tui-NJWDD5X7.js → tui-LNFSHL4Y.js}

@@ -1,6 +1,7 @@
 import {
-  cliVersion
-} from "./chunk-SKAW2KXC.js";
+  checkForUpdate
+} from "./chunk-37PMUZ34.js";
+import "./chunk-FMHWW3E6.js";
 import {
   TuiAcpClient,
   createStore,
@@ -1012,82 +1013,6 @@ function fromAgentPermissionMode(mode) {
   return mode === "bypassPermissions" ? "bypassAll" : mode === "acceptEdits" ? "acceptEdits" : "ask";
 }
 
-// src/tui/update-check.ts
-var PACKAGE_NAME = "@datalabrotterdam/nova-ai-cli";
-var REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME.replace("/", "%2F")}/latest`;
-var DEFAULT_TIMEOUT_MS = 3e3;
-var UPDATE_COMMAND = "npm install -g @datalabrotterdam/nova-ai-cli@latest";
-async function checkForUpdate(options = {}) {
-  try {
-    const currentVersion = options.currentVersion ?? readInstalledVersion();
-    if (!currentVersion) return null;
-    const response = await (options.fetchImpl ?? fetch)(REGISTRY_URL, {
-      headers: { accept: "application/json" },
-      signal: AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS)
-    });
-    if (!response.ok) return null;
-    const payload = await response.json();
-    if (!isVersionPayload(payload)) return null;
-    if (!isNewerVersion(payload.version, currentVersion)) return null;
-    return {
-      currentVersion,
-      latestVersion: payload.version,
-      command: UPDATE_COMMAND
-    };
-  } catch {
-    return null;
-  }
-}
-function readInstalledVersion() {
-  return cliVersion();
-}
-function isNewerVersion(candidate, current) {
-  const next = parseVersion(candidate);
-  const installed = parseVersion(current);
-  if (!next || !installed) return false;
-  for (let index = 0; index < 3; index++) {
-    const difference = next.core[index] - installed.core[index];
-    if (difference !== 0) return difference > 0;
-  }
-  return comparePrerelease(next.prerelease, installed.prerelease) > 0;
-}
-function isVersionPayload(value) {
-  return typeof value === "object" && value !== null && "version" in value && typeof value.version === "string";
-}
-function parseVersion(value) {
-  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(
-    value
-  );
-  if (!match) return null;
-  return {
-    core: [Number(match[1]), Number(match[2]), Number(match[3])],
-    prerelease: match[4]?.split(".") ?? []
-  };
-}
-function comparePrerelease(left, right) {
-  if (left.length === 0 || right.length === 0) {
-    if (left.length === right.length) return 0;
-    return left.length === 0 ? 1 : -1;
-  }
-  const length = Math.max(left.length, right.length);
-  for (let index = 0; index < length; index++) {
-    const leftPart = left[index];
-    const rightPart = right[index];
-    if (leftPart === void 0 || rightPart === void 0) {
-      return leftPart === rightPart ? 0 : leftPart === void 0 ? -1 : 1;
-    }
-    if (leftPart === rightPart) continue;
-    const leftNumber = /^\d+$/.test(leftPart) ? Number(leftPart) : null;
-    const rightNumber = /^\d+$/.test(rightPart) ? Number(rightPart) : null;
-    if (leftNumber !== null && rightNumber !== null)
-      return leftNumber - rightNumber;
-    if (leftNumber !== null || rightNumber !== null)
-      return leftNumber !== null ? -1 : 1;
-    return leftPart < rightPart ? -1 : 1;
-  }
-  return 0;
-}
-
 // src/tui/ink/terminal-keyboard.ts
 var KITTY_QUERY = "\x1B[?u";
 var DEVICE_ATTRIBUTES_QUERY = "\x1B[c";
@@ -1808,6 +1733,11 @@ function PlanView({
 
 // src/tui/ink/controller.ts
 import { setWorkspaceTrusted } from "@datalabrotterdam/nova-ai-agent/core/nova-home.js";
+import {
+  disabledSkillNames,
+  discoverSkills as discoverSkills2,
+  setSkillEnabled
+} from "@datalabrotterdam/nova-ai-agent/core/skills.js";
 import { INTERACTION_MODES } from "@datalabrotterdam/nova-ai-agent/core/interaction-modes.js";
 
 // src/tui/commands/builtins.ts
@@ -1884,7 +1814,7 @@ var builtinCommands = [
   },
   {
     name: "exit",
-    description: "Exit nova-ai-cli",
+    description: "Exit nova-ai",
     run(ctx) {
       ctx.exit();
     }
@@ -1957,9 +1887,20 @@ var builtinCommands = [
   },
   {
     name: "skills",
-    description: "Inspect discovered user and workspace skills",
-    run(ctx) {
-      ctx.openSkillInspector();
+    description: "List skills, or switch one: /skills on|off <name> [--global]",
+    run(ctx, args) {
+      const words = args.trim().split(/\s+/).filter(Boolean);
+      if (!words.length) {
+        ctx.openSkillInspector();
+        return;
+      }
+      const global = words.includes("--global");
+      const [action, name] = words.filter((word) => word !== "--global");
+      if (action !== "on" && action !== "off" || !name) {
+        ctx.print("Usage: /skills, or /skills on|off <name> [--global]");
+        return;
+      }
+      ctx.print(ctx.switchSkill(name, action === "on", global));
     }
   },
   {
@@ -4024,15 +3965,38 @@ status: failed - ${failure.message}`);
       rows.length ? rows.join("\n\n") : "No MCP servers configured for this workspace.\n\nAdd a project .mcp.json or mcpServers to .nova-ai/settings.json; ACP connects them when the session starts."
     );
   };
+  /** Every discovered skill with its state; switched-off skills stay listed. */
   openSkillInspector = () => {
-    const skills = this.runner.skillSessionStatus();
+    const cwd = this.runner.cwd;
+    const skills = discoverSkills2(cwd);
+    const disabled = disabledSkillNames(cwd);
+    const on = skills.filter((skill) => !disabled.has(skill.name)).length;
     this.showText(
-      `Skills (${skills.length})`,
-      skills.length ? skills.map((skill) => `${skill.name} [${skill.source}]
+      `Skills (${on} on, ${skills.length - on} off)`,
+      skills.length ? [
+        ...skills.map(
+          (skill) => `${skill.name} [${skill.source}]${disabled.has(skill.name) ? " (off)" : ""}
 ${skill.description}
-${skill.path}`).join("\n\n") : "No skills discovered. Add SKILL.md under .agents/skills, .claude/skills, or .codex/skills in the workspace or user profile."
+${skill.path}`
+        ),
+        "/skills off <name> switches one off in this project (--global: everywhere); /skills on <name> switches it back on."
+      ].join("\n\n") : "No skills discovered. Add SKILL.md under .nova-ai/skills (or .agents, .claude, .codex skills) in the workspace, or ~/.nova-ai/skills for all projects."
     );
   };
+  /** /skills on|off <name> [--global]: applies from the next message. */
+  switchSkill = (name, enabled, global) => {
+    const cwd = this.runner.cwd;
+    if (!discoverSkills2(cwd).some((skill) => skill.name === name)) {
+      return `No skill named "${name}". /skills lists them.`;
+    }
+    try {
+      setSkillEnabled(cwd, global ? "global" : "project", name, enabled);
+    } catch (error) {
+      return errorMessage(error, "Could not change the skill.");
+    }
+    const stillOff = enabled && disabledSkillNames(cwd).has(name);
+    return stillOff ? `Switched "${name}" on ${global ? "globally" : "in this project"}, but it is still off ${global ? "in this project" : "globally"} (use ${global ? "/skills on " + name : "/skills on " + name + " --global"}).` : `Skill "${name}" is ${enabled ? "on" : "off"} ${global ? "everywhere" : "in this project"} from the next message.`;
+  };
   openUsageInspector = async () => {
     this.showText("Context usage", "Calculating context usage...");
     try {
@@ -4119,6 +4083,7 @@ ${skill.path}`).join("\n\n") : "No skills discovered. Add SKILL.md under .agents
     openToolInspector: this.openToolInspector,
     openMcpInspector: this.openMcpInspector,
     openSkillInspector: this.openSkillInspector,
+    switchSkill: this.switchSkill,
     openUsageInspector: this.openUsageInspector,
     steerMessage: (message) => this.runner.steer(message),
     queuedMessages: () => this.runner.queuedMessages(),

package/dist/update-check-OX6WAPNN.js

@@ -0,0 +1,19 @@
+import {
+  checkForUpdate,
+  chooseUpdate,
+  formatUpdateNotice,
+  isNewerVersion,
+  readInstalledVersion,
+  updateCachePath,
+  updateChecksDisabled
+} from "./chunk-37PMUZ34.js";
+import "./chunk-FMHWW3E6.js";
+export {
+  checkForUpdate,
+  chooseUpdate,
+  formatUpdateNotice,
+  isNewerVersion,
+  readInstalledVersion,
+  updateCachePath,
+  updateChecksDisabled
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datalabrotterdam/nova-ai-cli",
-  "version": "1.2.0-alpha.2",
+  "version": "1.2.0-alpha.3",
   "description": "Agentic coding with DataLab Rotterdam's Nova AI in your terminal: interactive TUI, headless mode, and an ACP agent for editors",
   "license": "Apache-2.0",
   "author": "DataLab Rotterdam",
@@ -21,7 +21,6 @@
   },
   "homepage": "https://github.com/Datalab-Rotterdam/nova-ai-cli#readme",
   "bin": {
-    "nova-ai-cli": "dist/index.js",
     "nova-ai": "dist/index.js"
   },
   "files": [