@everme/cli 0.25.0 → 0.26.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everme/cli",
-  "version": "0.25.0",
+  "version": "0.26.1",
   "description": "EverMe CLI — npm wrapper that downloads and runs the platform-native evercli binary on first use.",
   "license": "Apache-2.0",
   "bin": {
@@ -8,7 +8,7 @@
   },
   "scripts": {
     "postinstall": "node scripts/install.js",
-    "test": "node --test tests/install.test.js"
+    "test": "node --test tests/install.test.js tests/upgrade-plugins.test.js"
   },
   "os": [
     "darwin",
@@ -26,6 +26,7 @@
     "scripts/install.js",
     "scripts/install-wizard.js",
     "scripts/run.js",
+    "scripts/upgrade-plugins.js",
     "sha256sums.txt",
     "LICENSE",
     "README.md"

package/scripts/install.js

@@ -24,6 +24,7 @@ const path = require("path");
 const os = require("os");
 const crypto = require("crypto");
 const { execFileSync } = require("child_process");
+const { refreshPlugins } = require("./upgrade-plugins.js");
 
 const VERSION = require("../package.json").version;
 const REPO = "EverMind-AI/EverMe";
@@ -359,6 +360,14 @@ if (require.main === module) {
 
   try {
     install();
+    // One-shot plugin refresh: bring already-installed hosts to the latest
+    // plugin line. Never fatal — guards + per-host try/catch live in the
+    // module; we belt-and-suspenders wrap here so nothing fails `npm i -g`.
+    try {
+      refreshPlugins({ binPath: dest, env: process.env });
+    } catch (e) {
+      console.error(`[@everme/cli] plugin refresh skipped: ${e.message}`);
+    }
   } catch (err) {
     console.error(`Failed to install ${NAME}:`, err.message);
     console.error(

package/scripts/upgrade-plugins.js

@@ -0,0 +1,201 @@
+// Copyright 2026 Evermind AI
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * Plugin refresh invoked from @everme/cli postinstall. After the new binary
+ * is on disk, bring already-installed plugin hosts up to the latest plugin
+ * line — without any new evercli subcommand. Discovery reuses the read-only
+ * `plugin list`; refresh is per host class (see spec
+ * .work_context/specs/2026-06-23-cli-postinstall-one-shot-upgrade-design.md).
+ */
+
+"use strict";
+
+const fs = require("fs");
+const { execFileSync } = require("child_process");
+
+// Quote-delimited bare/latest spec pairs. JSON host configs (cursor, gemini,
+// claude-desktop, opencode) use double quotes; codex's config.toml uses single
+// quotes. Each pair is inherently idempotent — once `@latest` is present the
+// bare quoted token no longer exists (the closing quote sits after `@latest`).
+const MCP_SPEC_PAIRS = [
+  ['"@everme/memory-mcp"', '"@everme/memory-mcp@latest"'],
+  ["'@everme/memory-mcp'", "'@everme/memory-mcp@latest'"],
+];
+
+const NPX_PLATFORMS = new Set(["cursor", "claude-desktop", "codex", "gemini", "opencode"]);
+
+const LIST_TIMEOUT_MS = 15000;
+const REFRESH_TIMEOUT_MS = 60000;
+
+function npmCommand() {
+  return process.platform === "win32" ? "npm.cmd" : "npm";
+}
+
+function defaultRunner(file, args, opts) {
+  return execFileSync(file, args, opts);
+}
+
+// discoverHosts runs the read-only `plugin list --format json` against the
+// freshly-downloaded binary and returns the platforms array. Throws if the
+// envelope is missing or not ok so the caller treats discovery as failed.
+function discoverHosts(binPath, runner) {
+  const run = runner || defaultRunner;
+  const out = run(binPath, ["plugin", "list", "--format", "json"], {
+    encoding: "utf8",
+    timeout: LIST_TIMEOUT_MS,
+    stdio: ["ignore", "pipe", "ignore"],
+  });
+  const env = JSON.parse(out);
+  if (!env || env.ok !== true || !env.data || !Array.isArray(env.data.platforms)) {
+    throw new Error("unexpected `plugin list` envelope shape");
+  }
+  return env.data.platforms;
+}
+
+// patchNpxSpec adds @latest to the memory-mcp spec in a host config file by a
+// literal, format-agnostic replace of the quoted bare token. Idempotent: the
+// quoted bare token no longer exists once @latest is present. Touches only the
+// package spec — never credential fields.
+//
+// The replace is atomic: write a sibling temp file, fsync, then rename over the
+// original. These configs carry credentials, so an interrupted in-place
+// truncate/write (crash, disk full) must never leave a corrupted file. The
+// original mode is preserved (host configs are 0600).
+function patchNpxSpec(configPath) {
+  const before = fs.readFileSync(configPath, "utf8");
+  let after = before;
+  for (const [bare, latest] of MCP_SPEC_PAIRS) {
+    if (after.includes(bare)) after = after.split(bare).join(latest);
+  }
+  if (after === before) return false;
+  const mode = fs.statSync(configPath).mode & 0o777;
+  const tmp = `${configPath}.everme-tmp-${process.pid}`;
+  try {
+    const fd = fs.openSync(tmp, "w", mode);
+    try {
+      fs.writeFileSync(fd, after);
+      fs.fsyncSync(fd);
+    } finally {
+      fs.closeSync(fd);
+    }
+    fs.chmodSync(tmp, mode);
+    fs.renameSync(tmp, configPath);
+  } catch (e) {
+    try {
+      fs.unlinkSync(tmp);
+    } catch (_) {
+      // temp file may not exist if openSync failed — ignore.
+    }
+    throw e;
+  }
+  return true;
+}
+
+// refreshClaudeCode brings Claude Code to the latest plugin payload. Two steps
+// are required: `evercli plugin install claude-code` reuses an already-present
+// global npm package without upgrading it (pluginSourceSpec short-circuits on
+// the existing `npm root -g` path), so the @latest bump must happen first; the
+// re-install then runs `claude plugin marketplace add` + `claude plugin install`
+// so Claude Code actually loads the fresh hooks/commands/MCP. Step 2 rotates the
+// local agent token (per-(platform, fingerprint) — other devices unaffected).
+function refreshClaudeCode(binPath, runner) {
+  const run = runner || defaultRunner;
+  run(npmCommand(), ["install", "-g", "@everme/claude-code@latest"], {
+    encoding: "utf8",
+    timeout: REFRESH_TIMEOUT_MS,
+    stdio: ["ignore", "ignore", "inherit"],
+  });
+  run(binPath, ["plugin", "install", "claude-code"], {
+    encoding: "utf8",
+    timeout: REFRESH_TIMEOUT_MS,
+    stdio: ["ignore", "ignore", "inherit"],
+  });
+}
+
+// `plugins update <id>` is the refresh verb: it bumps an already-tracked plugin
+// to latest by id (not an npm spec) and leaves openclaw.json alone, unlike
+// `install --force`, which reruns the full install-time config scaffolding and
+// rewrites the credential-bearing config. The host is already installed in the
+// refresh context; if it somehow isn't tracked, update errors and the caller
+// degrades it to a warning.
+function refreshOpenClaw(runner) {
+  const run = runner || defaultRunner;
+  run("openclaw", ["plugins", "update", "@everme/openclaw"], {
+    encoding: "utf8",
+    timeout: REFRESH_TIMEOUT_MS,
+    stdio: ["ignore", "ignore", "inherit"],
+  });
+}
+
+function refreshHermes(binPath, runner) {
+  const run = runner || defaultRunner;
+  run(binPath, ["plugin", "install", "hermes"], {
+    encoding: "utf8",
+    timeout: REFRESH_TIMEOUT_MS,
+    stdio: ["ignore", "ignore", "inherit"],
+  });
+}
+
+function skipReason(env) {
+  if (env.EVERME_SKIP_PLUGIN_UPGRADE) return "EVERME_SKIP_PLUGIN_UPGRADE is set";
+  if (env.CI) return "CI environment";
+  if (typeof process.getuid === "function" && process.getuid() === 0) return "running as root";
+  if (env.SUDO_USER) return "running under sudo";
+  return null;
+}
+
+// refreshPlugins is the postinstall entrypoint. It NEVER throws: every failure
+// degrades to a stderr warning so `npm i -g` always succeeds.
+function refreshPlugins(opts) {
+  const { binPath, env, runner } = opts;
+  const log = opts.logger || ((m) => console.error(m));
+
+  const skip = skipReason(env);
+  if (skip) {
+    log(`[@everme/cli] Skipping plugin refresh (${skip}). ` +
+      `Re-run \`npm i -g @everme/cli@latest\` as your normal user to refresh plugins.`);
+    return;
+  }
+
+  let hosts;
+  try {
+    hosts = discoverHosts(binPath, runner);
+  } catch (e) {
+    log(`[@everme/cli] Could not enumerate plugin hosts; skipping plugin refresh: ${e.message}`);
+    return;
+  }
+
+  for (const h of hosts) {
+    if (!h || h.hasEverMeEntry !== true) continue;
+    try {
+      if (NPX_PLATFORMS.has(h.platform)) {
+        if (h.configPath && patchNpxSpec(h.configPath)) {
+          log(`[@everme/cli] ${h.platform}: pinned memory-mcp to @latest`);
+        }
+      } else if (h.platform === "claude-code") {
+        refreshClaudeCode(binPath, runner);
+      } else if (h.platform === "openclaw") {
+        refreshOpenClaw(runner);
+      } else if (h.platform === "hermes") {
+        refreshHermes(binPath, runner);
+      }
+    } catch (e) {
+      log(`[@everme/cli] ${h.platform}: refresh failed (continuing): ${e.message}`);
+    }
+  }
+}
+
+module.exports = {
+  NPX_PLATFORMS,
+  LIST_TIMEOUT_MS,
+  REFRESH_TIMEOUT_MS,
+  npmCommand,
+  discoverHosts,
+  patchNpxSpec,
+  refreshClaudeCode,
+  refreshOpenClaw,
+  refreshHermes,
+  skipReason,
+  refreshPlugins,
+};

package/sha256sums.txt

@@ -1,6 +1,6 @@
-768f6897ab2dc8ea7436505c32d122c3eaa555b2ce20647422d835f69bffefed  evercli_darwin_amd64.tar.gz
-b9e5daddac0b9e746891304bfbde3fea1ea392d5aeb45b2d7700a32be58f0291  evercli_darwin_arm64.tar.gz
-1d8f16039f036ae1bc71ccfd28159f42ccd744a42f73e2f240650e5331bde242  evercli_linux_amd64.tar.gz
-c8128ea80bfd5d4d20e140d5435dc9750689a3e5510130cb168f76d3a5f33d15  evercli_linux_arm64.tar.gz
-768b6f32e3a1a62a2d9f41cc85a7f58b3e94ae760fe96a621bd23c0367fea302  evercli_windows_amd64.zip
-871bf7299398e11d56d45f24a38ebdaa973d2a3d010fce05dbe1ec36e9299e09  evercli_windows_arm64.zip
+8553ccaa870d067424c56df3c82a4ce91189b6f98d509455714f90a9f7bda4b9  evercli_darwin_amd64.tar.gz
+2a31902a5cfeeb553588f6eb4f81be9b65cd87d3934ac8466933a8f4afae7110  evercli_darwin_arm64.tar.gz
+4a0e7879a423733a7b1eaa59b908e3235bb04aeb2ef0c8b4433c16a3e6176c0f  evercli_linux_amd64.tar.gz
+916a0a0cf4018e77989e331fa4245d5bbf344020079ae1821944d748739f56f5  evercli_linux_arm64.tar.gz
+154eb3cdfc568d39a5e2fdceef5cdef6ad24fa5a2e3d1292c6b8f9ff16b123e5  evercli_windows_amd64.zip
+5dec906014eceba9fbccef052181e813ce06cef046729005581942a83af38867  evercli_windows_arm64.zip