@datalabrotterdam/nova-ai-cli 1.2.0-alpha.2 → 1.2.0-alpha.4

package/CHANGELOG.md

@@ -1,3 +1,29 @@
+# [@datalabrotterdam/nova-ai-cli-v1.2.0-alpha.4](https://github.com/Datalab-Rotterdam/nova-ai-cli/compare/@datalabrotterdam/nova-ai-cli@1.2.0-alpha.3...@datalabrotterdam/nova-ai-cli@1.2.0-alpha.4) (2026-10-05)
+
+
+### Bug Fixes
+
+* **cli:** depend on the agent version the CLI was released with ([4931439](https://github.com/Datalab-Rotterdam/nova-ai-cli/commit/4931439d106063b81e24367d6aa9c3f285f4ad15))
+
+
+### Features
+
+* **cli:** offer npm updates at start-up, remind until installed, /update ([18defca](https://github.com/Datalab-Rotterdam/nova-ai-cli/commit/18defcaea988698f9d0909419bb2aa1fdedfa5a9))
+
+# [@datalabrotterdam/nova-ai-cli-v1.2.0-alpha.3](https://github.com/Datalab-Rotterdam/nova-ai-cli/compare/@datalabrotterdam/nova-ai-cli@1.2.0-alpha.2...@datalabrotterdam/nova-ai-cli@1.2.0-alpha.3) (2026-10-04)
+
+
+### Bug Fixes
+
+* **agent:** never overwrite an unreadable settings file when switching a skill ([ca989ef](https://github.com/Datalab-Rotterdam/nova-ai-cli/commit/ca989ef1810fc903cea069cdadf3041fe164e364))
+* **cli:** install the command as nova-ai only ([eda8064](https://github.com/Datalab-Rotterdam/nova-ai-cli/commit/eda806411af1738ff6f6b1404d23d4e84a74ced8))
+
+
+### Features
+
+* **agent,cli:** Nova skill folders, switching skills off, a budgeted skill list ([0891c79](https://github.com/Datalab-Rotterdam/nova-ai-cli/commit/0891c79248d3a645d638f12f46928a54652b0941))
+* **cli:** update notice from npm for every channel, cached daily ([c3a0014](https://github.com/Datalab-Rotterdam/nova-ai-cli/commit/c3a001473336aac14d216cdeec0bedde4df34427))
+
 # [@datalabrotterdam/nova-ai-cli-v1.2.0-alpha.2](https://github.com/Datalab-Rotterdam/nova-ai-cli/compare/@datalabrotterdam/nova-ai-cli@1.2.0-alpha.1...@datalabrotterdam/nova-ai-cli@1.2.0-alpha.2) (2026-10-03)
 
 

package/README.md

@@ -44,6 +44,18 @@ nova-ai                # start the terminal UI in your project
 Or without installing: `npx @datalabrotterdam/nova-ai-cli login`, then
 `npx @datalabrotterdam/nova-ai-cli`.
 
+When a newer version is on npm, `nova-ai` asks before the terminal UI opens:
+Enter installs it (`npm install -g`) and restarts, `n` asks again tomorrow, `s`
+skips that version. Until it is installed, the status line keeps reminding you,
+and `/update` installs it and restarts in the same session. `-p` and
+`--version` print a notice (on stderr, only in a terminal). npm is asked at
+most once a day; an alpha install also follows the `alpha` channel.
+`NOVA_NO_UPDATE_CHECK=1` turns it off (it is off in CI).
+
+nova-ai installs updates itself only when it was installed with
+`npm install -g`; with npx, another package manager or a project dependency it
+shows the command to run instead.
+
 ```
 nova-ai [options]                 Interactive terminal UI
 nova-ai -p [options] [prompt]     Run one request headless (see nova-ai -p --help)
@@ -131,7 +143,7 @@ always options, client file system and terminals, form questions, plans, usage
 and title updates, MCP servers (stdio, HTTP, SSE), image prompts, and three
 login methods (browser, `NOVA_API_KEY`, or `nova-ai login` in a terminal).
 Nova-specific features (prompt queue, rewind, compaction, context usage,
-background jobs) are `_nova/…` extension methods. The agent is also published
+per-session settings, background jobs) are `_nova/…` extension methods. The agent is also published
 on its own as
 [`@datalabrotterdam/nova-ai-agent`](https://www.npmjs.com/package/@datalabrotterdam/nova-ai-agent)
 (command `nova-ai-agent`), without the terminal UI, for integrations that only
@@ -153,6 +165,9 @@ need ACP. Everything is documented in
   private `~/.nova-ai/projects/<key>/settings.json`, outside the repository.
   Compound commands (`a && b`, pipes) are checked part by part; substitutions
   and nested shells need an exact rule.
+- **Web pages are fetched only with approval.** `fetch_url` asks every time
+  unless a rule allows that URL (a URL can carry data out), and a redirect to
+  another site needs its own approval.
 - **File access stays in the workspace** (symlinks resolved); commands run in
   their own process group with a timeout, and the whole tree is stopped on
   cancel.
@@ -172,8 +187,11 @@ VS Code extension: settings, per-project trust, sessions and memory.
 - **Instructions**: `NOVA.md` and `AGENTS.md` in the workspace.
 - **Memory**: a `MEMORY.md` index plus notes, globally and per project,
   through the `memory_read` and `memory_write` tools (writes need approval).
-- **Skills**: `SKILL.md` files under `.agents/skills`, `.claude/skills` or
-  `.codex/skills`, in the workspace or your home folder.
+- **Skills**: `SKILL.md` files under `.nova-ai/skills` in the workspace or
+  `~/.nova-ai/skills` for every project (`.agents`, `.claude` and `.codex`
+  skills folders are read too). `/skills` lists them; `/skills off <name>`
+  switches one off in this project (`--global`: everywhere). Only names and
+  short descriptions go into the prompt; Nova loads a skill when it fits.
 - **MCP servers**: `.mcp.json` or `mcpServers` in `.nova-ai/settings.json`.
 
 The complete layout and rule syntax: [docs/NOVA_HOME.md](https://github.com/Datalab-Rotterdam/nova-ai-cli/blob/main/docs/NOVA_HOME.md).
@@ -195,6 +213,7 @@ hand).
 | `NOVA_TOOL_PROTOCOL` | Force `native` or `text` tool calling |
 | `NOVA_NES_MODEL` | Separate model for next-edit suggestions (ACP) |
 | `NOVA_KITTY_KEYBOARD` | `1`/`0`: force the kitty keyboard protocol on or off |
+| `NOVA_NO_UPDATE_CHECK` | Don't ask npm for a newer version (also `NO_UPDATE_NOTIFIER`, or `CI`) |
 
 ## Development
 

package/dist/{chunk-SKAW2KXC.js → chunk-FMHWW3E6.js}

@@ -6,5 +6,6 @@ function cliVersion() {
 }
 
 export {
+  CLI_PACKAGE_NAME,
   cliVersion
 };

package/dist/chunk-L77KQRGZ.js

@@ -0,0 +1,170 @@
+import {
+  CLI_PACKAGE_NAME,
+  cliVersion
+} from "./chunk-FMHWW3E6.js";
+
+// src/update-check.ts
+import { mkdirSync, readFileSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+import { novaHomeRoot } from "@datalabrotterdam/nova-ai-agent/core/nova-home.js";
+var DIST_TAGS_URL = `https://registry.npmjs.org/-/package/${CLI_PACKAGE_NAME.replace("/", "%2F")}/dist-tags`;
+var DEFAULT_TIMEOUT_MS = 3e3;
+var CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+function updateCachePath() {
+  return join(novaHomeRoot(), "update-check.json");
+}
+function updateChecksDisabled(env = process.env) {
+  return Boolean(env.NOVA_NO_UPDATE_CHECK || env.NO_UPDATE_NOTIFIER || env.CI);
+}
+async function checkForUpdate(options = {}) {
+  try {
+    if (updateChecksDisabled(options.env)) return null;
+    const currentVersion = options.currentVersion ?? cliVersion();
+    if (!currentVersion) return null;
+    const distTags = await readDistTags(options);
+    if (!distTags) return null;
+    return chooseUpdate(currentVersion, distTags);
+  } catch {
+    return null;
+  }
+}
+function chooseUpdate(currentVersion, distTags) {
+  const channel = prereleaseChannel(currentVersion);
+  const tags = channel && distTags[channel] ? [channel, "latest"] : ["latest"];
+  let best = null;
+  for (const tag of tags) {
+    const version = distTags[tag];
+    if (!version || !isNewerVersion(version, currentVersion)) continue;
+    if (!best || isNewerVersion(version, best.version)) best = { tag, version };
+  }
+  if (!best) return null;
+  return {
+    currentVersion,
+    latestVersion: best.version,
+    tag: best.tag,
+    command: `npm install -g ${CLI_PACKAGE_NAME}@${best.tag}`
+  };
+}
+async function readDistTags(options) {
+  const now = (options.now ?? Date.now)();
+  const cachePath = options.cachePath === void 0 ? updateCachePath() : options.cachePath;
+  const cached = cachePath ? readCache(cachePath) : null;
+  if (cached && now - cached.checkedAt >= 0 && now - cached.checkedAt < CACHE_MAX_AGE_MS) {
+    return cached.distTags;
+  }
+  const response = await (options.fetchImpl ?? fetch)(DIST_TAGS_URL, {
+    headers: { accept: "application/json" },
+    signal: AbortSignal.any([
+      AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+      ...options.signal ? [options.signal] : []
+    ])
+  });
+  if (!response.ok) return null;
+  const payload = await response.json();
+  if (!isDistTags(payload)) return null;
+  if (cachePath) writeCache(cachePath, { ...cached, checkedAt: now, distTags: payload });
+  return payload;
+}
+function readCache(path) {
+  try {
+    const value = JSON.parse(readFileSync(path, "utf8"));
+    if (value && typeof value === "object" && typeof value.checkedAt === "number" && isDistTags(value.distTags)) {
+      return value;
+    }
+  } catch {
+  }
+  return null;
+}
+var SNOOZE_MS = 24 * 60 * 60 * 1e3;
+function shouldAskAboutUpdate(update, options = {}) {
+  const cachePath = options.cachePath === void 0 ? updateCachePath() : options.cachePath;
+  const cached = cachePath ? readCache(cachePath) : null;
+  if (!cached) return true;
+  if (cached.skippedVersion === update.latestVersion) return false;
+  const now = (options.now ?? Date.now)();
+  return !(typeof cached.snoozedUntil === "number" && now < cached.snoozedUntil);
+}
+function rememberUpdateAnswer(answer, update, options = {}) {
+  const cachePath = options.cachePath === void 0 ? updateCachePath() : options.cachePath;
+  if (!cachePath) return;
+  const cached = readCache(cachePath);
+  const base = cached ?? { checkedAt: 0, distTags: {} };
+  const now = (options.now ?? Date.now)();
+  writeCache(
+    cachePath,
+    answer === "skip" ? { ...base, skippedVersion: update.latestVersion, snoozedUntil: void 0 } : { ...base, snoozedUntil: now + SNOOZE_MS }
+  );
+}
+function writeCache(path, value) {
+  try {
+    mkdirSync(dirname(path), { recursive: true, mode: 448 });
+    writeFileSync(path, `${JSON.stringify(value)}
+`, { mode: 384 });
+  } catch {
+  }
+}
+function isDistTags(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && Object.values(value).every((version) => typeof version === "string");
+}
+function prereleaseChannel(version) {
+  const parsed = parseVersion(version);
+  const first = parsed?.prerelease[0];
+  return first && !/^\d+$/.test(first) ? first : null;
+}
+function readInstalledVersion() {
+  return cliVersion();
+}
+function isNewerVersion(candidate, current) {
+  const next = parseVersion(candidate);
+  const installed = parseVersion(current);
+  if (!next || !installed) return false;
+  for (let index = 0; index < 3; index++) {
+    const difference = next.core[index] - installed.core[index];
+    if (difference !== 0) return difference > 0;
+  }
+  return comparePrerelease(next.prerelease, installed.prerelease) > 0;
+}
+function parseVersion(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
+  if (!match) return null;
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    prerelease: match[4]?.split(".") ?? []
+  };
+}
+function comparePrerelease(left, right) {
+  if (left.length === 0 || right.length === 0) {
+    if (left.length === right.length) return 0;
+    return left.length === 0 ? 1 : -1;
+  }
+  const length = Math.max(left.length, right.length);
+  for (let index = 0; index < length; index++) {
+    const leftPart = left[index];
+    const rightPart = right[index];
+    if (leftPart === void 0 || rightPart === void 0) {
+      return leftPart === rightPart ? 0 : leftPart === void 0 ? -1 : 1;
+    }
+    if (leftPart === rightPart) continue;
+    const leftNumber = /^\d+$/.test(leftPart) ? Number(leftPart) : null;
+    const rightNumber = /^\d+$/.test(rightPart) ? Number(rightPart) : null;
+    if (leftNumber !== null && rightNumber !== null) return leftNumber - rightNumber;
+    if (leftNumber !== null || rightNumber !== null) return leftNumber !== null ? -1 : 1;
+    return leftPart < rightPart ? -1 : 1;
+  }
+  return 0;
+}
+function formatUpdateNotice(update) {
+  return `Update available: nova-ai ${update.currentVersion} \u2192 ${update.latestVersion}. Run: ${update.command}`;
+}
+
+export {
+  updateCachePath,
+  updateChecksDisabled,
+  checkForUpdate,
+  chooseUpdate,
+  shouldAskAboutUpdate,
+  rememberUpdateAnswer,
+  readInstalledVersion,
+  isNewerVersion,
+  formatUpdateNotice
+};

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   cliVersion
-} from "./chunk-SKAW2KXC.js";
+} from "./chunk-FMHWW3E6.js";
 
 // src/cli.ts
 var SUBCOMMANDS = {
@@ -86,6 +86,28 @@ function parseTuiArgs(args) {
 }
 
 // src/index.ts
+function startUpdateCheck() {
+  if (!process.stderr.isTTY) return null;
+  const abort = new AbortController();
+  const result = import("./update-check-G3PYCRWM.js").then(({ checkForUpdate }) => checkForUpdate({ signal: abort.signal })).catch(() => null);
+  return { result, cancel: () => abort.abort() };
+}
+async function noticeUpdate(check, waitMs) {
+  let timer;
+  const update = await Promise.race([
+    check.result,
+    new Promise((resolve) => {
+      timer = setTimeout(() => resolve(null), waitMs);
+    })
+  ]);
+  clearTimeout(timer);
+  check.cancel();
+  if (!update) return;
+  const { formatUpdateNotice } = await import("./update-check-G3PYCRWM.js");
+  process.stderr.write(`
+${formatUpdateNotice(update)}
+`);
+}
 async function main() {
   const command = parseCli(process.argv.slice(2));
   switch (command.mode) {
@@ -99,10 +121,13 @@ ${MAIN_HELP}
       process.stdout.write(`${MAIN_HELP}
 `);
       return 0;
-    case "version":
+    case "version": {
+      const update = startUpdateCheck();
       process.stdout.write(`${versionText()}
 `);
+      if (update) await noticeUpdate(update, 800);
       return 0;
+    }
     case "acp": {
       if (command.args.length) {
         process.stderr.write(`--acp takes no other arguments (got ${command.args.join(" ")}).
@@ -114,8 +139,11 @@ ${MAIN_HELP}
       return 0;
     }
     case "print": {
+      const update = startUpdateCheck();
       const { default: runHeadless } = await import("./headless-OFJFVJ3O.js");
-      return runHeadless(command.args);
+      const code = await runHeadless(command.args);
+      if (update) await noticeUpdate(update, 500);
+      return code;
     }
     case "login": {
       const { runLogin } = await import("@datalabrotterdam/nova-ai-agent/commands/login.js");
@@ -147,7 +175,7 @@ ${MAIN_HELP}
         );
         return 2;
       }
-      const { default: runChat } = await import("./tui-NJWDD5X7.js");
+      const { default: runChat } = await import("./tui-OWU4YGTT.js");
       return runChat(options);
     }
   }

package/dist/{tui-NJWDD5X7.js → tui-OWU4YGTT.js}

@@ -1,6 +1,12 @@
 import {
+  checkForUpdate,
+  rememberUpdateAnswer,
+  shouldAskAboutUpdate
+} from "./chunk-L77KQRGZ.js";
+import {
+  CLI_PACKAGE_NAME,
   cliVersion
-} from "./chunk-SKAW2KXC.js";
+} from "./chunk-FMHWW3E6.js";
 import {
   TuiAcpClient,
   createStore,
@@ -9,11 +15,105 @@ import {
 } from "./chunk-NHGIUEIR.js";
 
 // src/tui/index.ts
-import { createInterface } from "readline/promises";
+import { createInterface as createInterface2 } from "readline/promises";
 import { readCredentials } from "@datalabrotterdam/nova-ai-agent/core/credentials.js";
-import { listStoredSessions as listStoredSessions2 } from "@datalabrotterdam/nova-ai-agent/core/sessions.js";
+import { listStoredSessions as listStoredSessions2, loadStoredSession as loadStoredSession2 } from "@datalabrotterdam/nova-ai-agent/core/sessions.js";
 import { setWorkspaceTrusted as setWorkspaceTrusted2 } from "@datalabrotterdam/nova-ai-agent/core/nova-home.js";
 
+// src/update-install.ts
+import { spawnSync } from "child_process";
+import { existsSync, realpathSync } from "fs";
+import { dirname, join, sep } from "path";
+import { createInterface } from "readline/promises";
+var START_WAIT_MS = 1500;
+var UPDATED_FROM_ENV = "NOVA_UPDATED_FROM";
+function globalNpmPrefix(options = {}) {
+  const script = options.scriptPath ?? process.argv[1];
+  if (!script) return null;
+  const windows = (options.platform ?? process.platform) === "win32";
+  const marker = `${sep}node_modules${sep}${CLI_PACKAGE_NAME.split("/").join(sep)}${sep}`;
+  const resolved = realPath(script);
+  const at = resolved.lastIndexOf(marker);
+  if (at < 0) return null;
+  const nodeModulesParent = resolved.slice(0, at);
+  const prefix = windows ? nodeModulesParent : dirname(nodeModulesParent);
+  if (!windows && nodeModulesParent !== join(prefix, "lib")) return null;
+  return existsSync(join(prefix, windows ? "nova-ai.cmd" : join("bin", "nova-ai"))) ? prefix : null;
+}
+async function withInstallability(update, options = {}) {
+  if (!update) return null;
+  return { ...update, installable: globalNpmPrefix(options) !== null };
+}
+function npmInvocation(args) {
+  return process.platform === "win32" ? [`npm ${args.map((arg) => /\s/.test(arg) ? `"${arg}"` : arg).join(" ")}`, [], true] : ["npm", args, false];
+}
+function realPath(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    return path;
+  }
+}
+function parseUpdateAnswer(answer) {
+  const value = answer.trim().toLowerCase();
+  if (value === "" || value === "y" || value === "yes") return "update";
+  if (value === "s" || value === "skip") return "skip";
+  return "later";
+}
+async function askToUpdate(update) {
+  const prompt = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    console.log(`
+Update available: nova-ai ${update.currentVersion} \u2192 ${update.latestVersion}`);
+    return parseUpdateAnswer(
+      await prompt.question("Update now? [Y/n/s] (n: not today, s: skip this version) ")
+    );
+  } finally {
+    prompt.close();
+  }
+}
+async function offerUpdateAtStart(check, restartArgs) {
+  let timer;
+  const update = await Promise.race([
+    check,
+    new Promise((resolve2) => {
+      timer = setTimeout(() => resolve2(null), START_WAIT_MS);
+    })
+  ]);
+  clearTimeout(timer);
+  if (!update?.installable || !shouldAskAboutUpdate(update)) return null;
+  const answer = await askToUpdate(update);
+  if (answer !== "update") {
+    rememberUpdateAnswer(answer, update);
+    console.log(
+      answer === "skip" ? `Skipping ${update.latestVersion}; you'll be asked again for a newer version.` : "Not now. /update installs it any time."
+    );
+    return null;
+  }
+  return installAndRestart(update, restartArgs);
+}
+function installAndRestart(update, restartArgs) {
+  const prefix = globalNpmPrefix();
+  if (!prefix) return null;
+  console.log(`
+Installing nova-ai ${update.latestVersion}\u2026`);
+  const [file, args, shell] = npmInvocation(["install", "-g", "--prefix", prefix, `${CLI_PACKAGE_NAME}@${update.tag}`]);
+  const install = spawnSync(file, args, { stdio: "inherit", shell });
+  if (install.status !== 0) {
+    console.error(`
+The update did not install. Run it yourself: ${update.command}
+`);
+    return null;
+  }
+  const script = process.argv[1];
+  if (!script) return null;
+  const restarted = spawnSync(process.execPath, [...process.execArgv, script, ...restartArgs], {
+    stdio: "inherit",
+    env: { ...process.env, [UPDATED_FROM_ENV]: update.currentVersion }
+  });
+  return restarted.status ?? 1;
+}
+
 // src/tui/ink/app.tsx
 import { Box as Box6, render, Static, Text as Text6, useBoxMetrics, useWindowSize } from "ink";
 import { useEffect, useRef, useState as useState2, useSyncExternalStore as useSyncExternalStore2 } from "react";
@@ -45,7 +145,7 @@ import {
 
 // src/tui/files/file-mentions.ts
 import { statSync } from "fs";
-import { isAbsolute, relative, resolve, sep } from "path";
+import { isAbsolute, relative, resolve, sep as sep2 } from "path";
 var MENTION_RE = /@(?:"([^"]+)"|'([^']+)'|([^\s]+))/g;
 var TRAILING_PUNCTUATION = /[.,;:!?\)\]\}]+$/;
 function findWorkspaceFileMentions(text, cwd) {
@@ -55,10 +155,10 @@ function findWorkspaceFileMentions(text, cwd) {
     const raw = match[1] ?? match[2] ?? match[3] ?? "";
     const candidates = [raw, raw.replace(TRAILING_PUNCTUATION, "")].filter((value, index, all) => value && all.indexOf(value) === index);
     for (const candidate of candidates) {
-      const normalized = candidate.replace(/[\\/]/g, sep);
+      const normalized = candidate.replace(/[\\/]/g, sep2);
       const absolutePath = resolve(workspaceRoot, normalized);
       const relativePath = relative(workspaceRoot, absolutePath);
-      if (relativePath.startsWith(`..${sep}`) || relativePath === ".." || isAbsolute(relativePath)) continue;
+      if (relativePath.startsWith(`..${sep2}`) || relativePath === ".." || isAbsolute(relativePath)) continue;
       try {
         if (!statSync(absolutePath).isFile()) continue;
       } catch {
@@ -66,7 +166,7 @@ function findWorkspaceFileMentions(text, cwd) {
       }
       mentions.set(absolutePath.toLowerCase(), {
         absolutePath,
-        relativePath: relativePath.split(sep).join("/")
+        relativePath: relativePath.split(sep2).join("/")
       });
       break;
     }
@@ -1012,82 +1112,6 @@ function fromAgentPermissionMode(mode) {
   return mode === "bypassPermissions" ? "bypassAll" : mode === "acceptEdits" ? "acceptEdits" : "ask";
 }
 
-// src/tui/update-check.ts
-var PACKAGE_NAME = "@datalabrotterdam/nova-ai-cli";
-var REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME.replace("/", "%2F")}/latest`;
-var DEFAULT_TIMEOUT_MS = 3e3;
-var UPDATE_COMMAND = "npm install -g @datalabrotterdam/nova-ai-cli@latest";
-async function checkForUpdate(options = {}) {
-  try {
-    const currentVersion = options.currentVersion ?? readInstalledVersion();
-    if (!currentVersion) return null;
-    const response = await (options.fetchImpl ?? fetch)(REGISTRY_URL, {
-      headers: { accept: "application/json" },
-      signal: AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS)
-    });
-    if (!response.ok) return null;
-    const payload = await response.json();
-    if (!isVersionPayload(payload)) return null;
-    if (!isNewerVersion(payload.version, currentVersion)) return null;
-    return {
-      currentVersion,
-      latestVersion: payload.version,
-      command: UPDATE_COMMAND
-    };
-  } catch {
-    return null;
-  }
-}
-function readInstalledVersion() {
-  return cliVersion();
-}
-function isNewerVersion(candidate, current) {
-  const next = parseVersion(candidate);
-  const installed = parseVersion(current);
-  if (!next || !installed) return false;
-  for (let index = 0; index < 3; index++) {
-    const difference = next.core[index] - installed.core[index];
-    if (difference !== 0) return difference > 0;
-  }
-  return comparePrerelease(next.prerelease, installed.prerelease) > 0;
-}
-function isVersionPayload(value) {
-  return typeof value === "object" && value !== null && "version" in value && typeof value.version === "string";
-}
-function parseVersion(value) {
-  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(
-    value
-  );
-  if (!match) return null;
-  return {
-    core: [Number(match[1]), Number(match[2]), Number(match[3])],
-    prerelease: match[4]?.split(".") ?? []
-  };
-}
-function comparePrerelease(left, right) {
-  if (left.length === 0 || right.length === 0) {
-    if (left.length === right.length) return 0;
-    return left.length === 0 ? 1 : -1;
-  }
-  const length = Math.max(left.length, right.length);
-  for (let index = 0; index < length; index++) {
-    const leftPart = left[index];
-    const rightPart = right[index];
-    if (leftPart === void 0 || rightPart === void 0) {
-      return leftPart === rightPart ? 0 : leftPart === void 0 ? -1 : 1;
-    }
-    if (leftPart === rightPart) continue;
-    const leftNumber = /^\d+$/.test(leftPart) ? Number(leftPart) : null;
-    const rightNumber = /^\d+$/.test(rightPart) ? Number(rightPart) : null;
-    if (leftNumber !== null && rightNumber !== null)
-      return leftNumber - rightNumber;
-    if (leftNumber !== null || rightNumber !== null)
-      return leftNumber !== null ? -1 : 1;
-    return leftPart < rightPart ? -1 : 1;
-  }
-  return 0;
-}
-
 // src/tui/ink/terminal-keyboard.ts
 var KITTY_QUERY = "\x1B[?u";
 var DEVICE_ATTRIBUTES_QUERY = "\x1B[c";
@@ -1464,7 +1488,7 @@ function StatusLine({
   const separator = /* @__PURE__ */ jsx2(Text2, { color: palette.faint, children: " | " });
   const usage = ui.contextUsage ? `ctx:${formatTokenCount(ui.contextUsage.totalTokens)}${ui.contextUsage.contextWindow ? `/${formatTokenCount(ui.contextUsage.contextWindow)}` : ""}` : null;
   return /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", children: [
-    ui.updateAvailable ? /* @__PURE__ */ jsx2(Text2, { color: palette.warning, children: `Update ${ui.updateAvailable.latestVersion} available (current ${ui.updateAvailable.currentVersion}). Run: ${ui.updateAvailable.command}` }) : null,
+    ui.updateAvailable ? /* @__PURE__ */ jsx2(Text2, { color: palette.warning, children: `Update ${ui.updateAvailable.latestVersion} available (current ${ui.updateAvailable.currentVersion}). ${ui.updateAvailable.installable ? "Type /update to install it." : `Run: ${ui.updateAvailable.command}`}` }) : null,
     ui.statusLine ? /* @__PURE__ */ jsx2(Text2, { color: palette.muted, children: ui.statusLine }) : null,
     /* @__PURE__ */ jsxs2(Text2, { wrap: "truncate-end", children: [
       /* @__PURE__ */ jsx2(Text2, { color: palette.muted, children: model }),
@@ -1808,6 +1832,11 @@ function PlanView({
 
 // src/tui/ink/controller.ts
 import { setWorkspaceTrusted } from "@datalabrotterdam/nova-ai-agent/core/nova-home.js";
+import {
+  disabledSkillNames,
+  discoverSkills as discoverSkills2,
+  setSkillEnabled
+} from "@datalabrotterdam/nova-ai-agent/core/skills.js";
 import { INTERACTION_MODES } from "@datalabrotterdam/nova-ai-agent/core/interaction-modes.js";
 
 // src/tui/commands/builtins.ts
@@ -1884,11 +1913,19 @@ var builtinCommands = [
   },
   {
     name: "exit",
-    description: "Exit nova-ai-cli",
+    description: "Exit nova-ai",
     run(ctx) {
       ctx.exit();
     }
   },
+  {
+    name: "update",
+    description: "Install the newer nova-ai from npm and restart in this session",
+    run(ctx) {
+      const message = ctx.requestUpdate();
+      if (message) ctx.print(message);
+    }
+  },
   {
     name: "mode",
     description: "Switch interaction mode (/mode agent|ask|plan)",
@@ -1957,9 +1994,20 @@ var builtinCommands = [
   },
   {
     name: "skills",
-    description: "Inspect discovered user and workspace skills",
-    run(ctx) {
-      ctx.openSkillInspector();
+    description: "List skills, or switch one: /skills on|off <name> [--global]",
+    run(ctx, args) {
+      const words = args.trim().split(/\s+/).filter(Boolean);
+      if (!words.length) {
+        ctx.openSkillInspector();
+        return;
+      }
+      const global = words.includes("--global");
+      const [action, name] = words.filter((word) => word !== "--global");
+      if (action !== "on" && action !== "off" || !name) {
+        ctx.print("Usage: /skills, or /skills on|off <name> [--global]");
+        return;
+      }
+      ctx.print(ctx.switchSkill(name, action === "on", global));
     }
   },
   {
@@ -2257,10 +2305,10 @@ console.log(ObjC.unwrap(png.base64EncodedStringWithOptions(0)));
 `;
 
 // src/tui/files/find-fd.ts
-import { spawnSync } from "child_process";
+import { spawnSync as spawnSync2 } from "child_process";
 var FD_CANDIDATES = ["fd", "fdfind"];
 var cachedPath;
-function resolveFdPath(run = (command, args) => spawnSync(command, args, { stdio: "ignore" })) {
+function resolveFdPath(run = (command, args) => spawnSync2(command, args, { stdio: "ignore" })) {
   if (cachedPath !== void 0) return cachedPath;
   for (const candidate of FD_CANDIDATES) {
     const result = run(candidate, ["--version"]);
@@ -2275,7 +2323,7 @@ function resolveFdPath(run = (command, args) => spawnSync(command, args, { stdio
 
 // src/tui/files/list-workspace-files.ts
 import { readdirSync } from "fs";
-import { join, relative as relative2, sep as sep2 } from "path";
+import { join as join2, relative as relative2, sep as sep3 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".nova-ai", "out", "coverage", ".next", ".turbo"]);
 function listWorkspaceFiles(cwd, max = 2e3) {
   const results = [];
@@ -2291,12 +2339,12 @@ function listWorkspaceFiles(cwd, max = 2e3) {
     for (const entry of entries) {
       if (results.length >= max) break;
       if (entry.isSymbolicLink()) continue;
-      const full = join(dir, entry.name);
+      const full = join2(dir, entry.name);
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
         stack.push(full);
       } else if (entry.isFile()) {
-        results.push(relative2(cwd, full).split(sep2).join("/"));
+        results.push(relative2(cwd, full).split(sep3).join("/"));
       }
     }
   }
@@ -2327,7 +2375,7 @@ var DraftImageAttachments = class {
 import { spawn } from "child_process";
 import { readdirSync as readdirSync2, statSync as statSync2 } from "fs";
 import { homedir } from "os";
-import { basename, dirname, join as join2 } from "path";
+import { basename, dirname as dirname2, join as join3 } from "path";
 var PATH_DELIMITERS = /* @__PURE__ */ new Set([" ", "	", '"', "'", "="]);
 var MAX_SUGGESTIONS2 = 20;
 var WorkspaceAutocompleteProvider = class {
@@ -2408,14 +2456,14 @@ var WorkspaceAutocompleteProvider = class {
   pathSuggestions(prefix) {
     const quoted = prefix.startsWith('"');
     const raw = quoted ? prefix.slice(1) : prefix;
-    const expanded = raw === "~" || raw.startsWith("~/") ? join2(homedir(), raw.slice(1)) : raw;
+    const expanded = raw === "~" || raw.startsWith("~/") ? join3(homedir(), raw.slice(1)) : raw;
     const absolute = expanded.startsWith("/") || /^[A-Za-z]:[\\/]/.test(expanded);
     const separator = Math.max(raw.lastIndexOf("/"), raw.lastIndexOf("\\"));
     const listsDirectory = raw === "" || raw === "~" || separator === raw.length - 1;
-    const directoryPart = listsDirectory ? expanded : dirname(expanded);
+    const directoryPart = listsDirectory ? expanded : dirname2(expanded);
     const namePrefix = listsDirectory ? "" : basename(expanded);
     const displayDirectory = raw === "~" ? "~/" : separator >= 0 ? raw.slice(0, separator + 1) : "";
-    const searchDirectory = absolute ? directoryPart : join2(this.cwd, directoryPart);
+    const searchDirectory = absolute ? directoryPart : join3(this.cwd, directoryPart);
     let entries;
     try {
       entries = readdirSync2(searchDirectory, { withFileTypes: true });
@@ -2429,7 +2477,7 @@ var WorkspaceAutocompleteProvider = class {
       if (!isDirectory && entry.isSymbolicLink()) {
         try {
           isDirectory = statSync2(
-            join2(searchDirectory, entry.name)
+            join3(searchDirectory, entry.name)
           ).isDirectory();
         } catch {
         }
@@ -3798,6 +3846,8 @@ var TuiController = class {
   unsubscribeStore;
   resolveExit = () => {
   };
+  /** Set by /update: the caller installs and restarts after the TUI exits. */
+  updateRequested = false;
   /** Settles once the user asked to quit; `run` then tears the view down. */
   exitRequested = new Promise((resolve2) => {
     this.resolveExit = resolve2;
@@ -4024,15 +4074,38 @@ status: failed - ${failure.message}`);
       rows.length ? rows.join("\n\n") : "No MCP servers configured for this workspace.\n\nAdd a project .mcp.json or mcpServers to .nova-ai/settings.json; ACP connects them when the session starts."
     );
   };
+  /** Every discovered skill with its state; switched-off skills stay listed. */
   openSkillInspector = () => {
-    const skills = this.runner.skillSessionStatus();
+    const cwd = this.runner.cwd;
+    const skills = discoverSkills2(cwd);
+    const disabled = disabledSkillNames(cwd);
+    const on = skills.filter((skill) => !disabled.has(skill.name)).length;
     this.showText(
-      `Skills (${skills.length})`,
-      skills.length ? skills.map((skill) => `${skill.name} [${skill.source}]
+      `Skills (${on} on, ${skills.length - on} off)`,
+      skills.length ? [
+        ...skills.map(
+          (skill) => `${skill.name} [${skill.source}]${disabled.has(skill.name) ? " (off)" : ""}
 ${skill.description}
-${skill.path}`).join("\n\n") : "No skills discovered. Add SKILL.md under .agents/skills, .claude/skills, or .codex/skills in the workspace or user profile."
+${skill.path}`
+        ),
+        "/skills off <name> switches one off in this project (--global: everywhere); /skills on <name> switches it back on."
+      ].join("\n\n") : "No skills discovered. Add SKILL.md under .nova-ai/skills (or .agents, .claude, .codex skills) in the workspace, or ~/.nova-ai/skills for all projects."
     );
   };
+  /** /skills on|off <name> [--global]: applies from the next message. */
+  switchSkill = (name, enabled, global) => {
+    const cwd = this.runner.cwd;
+    if (!discoverSkills2(cwd).some((skill) => skill.name === name)) {
+      return `No skill named "${name}". /skills lists them.`;
+    }
+    try {
+      setSkillEnabled(cwd, global ? "global" : "project", name, enabled);
+    } catch (error) {
+      return errorMessage(error, "Could not change the skill.");
+    }
+    const stillOff = enabled && disabledSkillNames(cwd).has(name);
+    return stillOff ? `Switched "${name}" on ${global ? "globally" : "in this project"}, but it is still off ${global ? "in this project" : "globally"} (use ${global ? "/skills on " + name : "/skills on " + name + " --global"}).` : `Skill "${name}" is ${enabled ? "on" : "off"} ${global ? "everywhere" : "in this project"} from the next message.`;
+  };
   openUsageInspector = async () => {
     this.showText("Context usage", "Calculating context usage...");
     try {
@@ -4099,6 +4172,19 @@ ${skill.path}`).join("\n\n") : "No skills discovered. Add SKILL.md under .agents
     clear: () => void this.runner.startNewSession(),
     newSession: () => this.runner.startNewSession(),
     exit: () => this.requestExit(),
+    requestUpdate: () => {
+      const update = this.store.getState().updateAvailable;
+      if (!update) return "No newer nova-ai found on npm.";
+      if (!update.installable) {
+        return `nova-ai ${update.latestVersion} is available, but this copy wasn't installed with npm -g, so it can't update itself. Run: ${update.command}`;
+      }
+      if (this.store.getState().busy) {
+        return "Wait for the current request to finish (or press Esc), then run /update again.";
+      }
+      this.updateRequested = true;
+      this.requestExit();
+      return null;
+    },
     resumeSession: (sessionId) => {
       const id = sessionId ?? listSessionsForCwd(this.runner.cwd)[0]?.sessionId;
       return id ? this.runner.resumeFrom(id) : false;
@@ -4119,6 +4205,7 @@ ${skill.path}`).join("\n\n") : "No skills discovered. Add SKILL.md under .agents
     openToolInspector: this.openToolInspector,
     openMcpInspector: this.openMcpInspector,
     openSkillInspector: this.openSkillInspector,
+    switchSkill: this.switchSkill,
     openUsageInspector: this.openUsageInspector,
     steerMessage: (message) => this.runner.steer(message),
     queuedMessages: () => this.runner.queuedMessages(),
@@ -4674,6 +4761,7 @@ async function runInkTui(credentials, cwd, args, options = {}) {
   }
   stdout.write(`Resume this session with: nova-ai --resume ${runner.sessionId}
 `);
+  return { sessionId: runner.sessionId, updateRequested: controller.updateRequested };
 }
 function App({ controller }) {
   const view = useSyncExternalStore2(controller.subscribe, controller.getView);
@@ -4772,6 +4860,15 @@ async function runChat(options) {
     return 1;
   }
   const credentials = options.model ? { ...stored, defaultModel: options.model } : stored;
+  const updateCheck = checkForUpdate().then((update) => withInstallability(update));
+  const updatedFrom = process.env[UPDATED_FROM_ENV];
+  if (updatedFrom) {
+    delete process.env[UPDATED_FROM_ENV];
+    console.log(`Updated nova-ai ${updatedFrom} \u2192 ${cliVersion() ?? "?"}.`);
+  } else {
+    const restartedCode = await offerUpdateAtStart(updateCheck, process.argv.slice(2));
+    if (restartedCode !== null) return restartedCode;
+  }
   const cwd = process.cwd();
   let resume = options.resume;
   if (options.continueLast) {
@@ -4783,11 +4880,22 @@ async function runChat(options) {
   }
   if (workspaceNeedsTrust(cwd)) await askToTrust(cwd);
   const args = resume ? ["--resume", resume] : [];
-  await runInkTui(credentials, cwd, args);
+  const result = await runInkTui(credentials, cwd, args, { checkForUpdate: () => updateCheck });
+  if (result.updateRequested) {
+    const update = await updateCheck;
+    if (update) {
+      const restartArgs = [
+        ...loadStoredSession2(result.sessionId) ? ["--resume", result.sessionId] : [],
+        ...options.model ? ["--model", options.model] : []
+      ];
+      const restartedCode = installAndRestart(update, restartArgs);
+      if (restartedCode !== null) return restartedCode;
+    }
+  }
   return 0;
 }
 async function askToTrust(cwd) {
-  const prompt = createInterface({ input: process.stdin, output: process.stdout });
+  const prompt = createInterface2({ input: process.stdin, output: process.stdout });
   try {
     console.log(`
 ${cwd}`);

package/dist/update-check-G3PYCRWM.js

@@ -0,0 +1,23 @@
+import {
+  checkForUpdate,
+  chooseUpdate,
+  formatUpdateNotice,
+  isNewerVersion,
+  readInstalledVersion,
+  rememberUpdateAnswer,
+  shouldAskAboutUpdate,
+  updateCachePath,
+  updateChecksDisabled
+} from "./chunk-L77KQRGZ.js";
+import "./chunk-FMHWW3E6.js";
+export {
+  checkForUpdate,
+  chooseUpdate,
+  formatUpdateNotice,
+  isNewerVersion,
+  readInstalledVersion,
+  rememberUpdateAnswer,
+  shouldAskAboutUpdate,
+  updateCachePath,
+  updateChecksDisabled
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datalabrotterdam/nova-ai-cli",
-  "version": "1.2.0-alpha.2",
+  "version": "1.2.0-alpha.4",
   "description": "Agentic coding with DataLab Rotterdam's Nova AI in your terminal: interactive TUI, headless mode, and an ACP agent for editors",
   "license": "Apache-2.0",
   "author": "DataLab Rotterdam",
@@ -21,7 +21,6 @@
   },
   "homepage": "https://github.com/Datalab-Rotterdam/nova-ai-cli#readme",
   "bin": {
-    "nova-ai-cli": "dist/index.js",
     "nova-ai": "dist/index.js"
   },
   "files": [
@@ -40,7 +39,7 @@
   },
   "dependencies": {
     "@agentclientprotocol/sdk": "^0.29.0",
-    "@datalabrotterdam/nova-ai-agent": "^1.0.0-alpha.1",
+    "@datalabrotterdam/nova-ai-agent": "^1.0.0-alpha.2",
     "@datalabrotterdam/nova-sdk": "^1.3.2",
     "chalk": "^5.3.0",
     "cli-highlight": "^2.1.11",