@freecodecamp/universe-cli 0.7.0 → 0.7.2

package/README.md

@@ -88,8 +88,8 @@ All commands support `--json` for CI integration.
 The CLI resolves a GitHub identity in this order — first match wins:
 
 1. `$GITHUB_TOKEN` / `$GH_TOKEN` env (CI explicit)
-1. `gh auth token` shell-out (laptop with `gh` installed)
-1. Device-flow stored token at `~/.config/universe-cli/token`
+1. Device-flow stored token at `~/.config/universe-cli/token` (`universe login`)
+1. `gh auth token` shell-out (laptop fallback when no `universe login` token)
 
 CI runners must export `$GITHUB_TOKEN` explicitly. artemis validates the bearer via GitHub `GET /user`, then authorizes server-side against the Valkey-backed registry. Run `universe whoami` to see which slot resolved; inspect the sites you can deploy to with `universe sites ls --mine`.
 
@@ -111,10 +111,10 @@ Full operator walkthrough (login → deploy → promote → rollback, CI shape,
 
 ## Environment overrides
 
-| Env                         | Default                          | Purpose                                                   |
-| --------------------------- | -------------------------------- | --------------------------------------------------------- |
-| `UNIVERSE_PROXY_URL`        | `https://uploads.freecode.camp`  | Override proxy host (staging etc.)                        |
-| `UNIVERSE_GH_CLIENT_ID`     | _baked-in freeCodeCamp OAuth id_ | Override GitHub OAuth App id (fork tenants, `login` only) |
-| `GITHUB_TOKEN` / `GH_TOKEN` | —                                | Slot 1 of identity chain                                  |
+| Env                         | Default                                        | Purpose                                                    |
+| --------------------------- | ---------------------------------------------- | ---------------------------------------------------------- |
+| `UNIVERSE_PROXY_URL`        | `https://uploads.freecode.camp`                | Override proxy host (staging etc.)                         |
+| `UNIVERSE_GH_CLIENT_ID`     | _baked-in freeCodeCamp-Universe GitHub App id_ | Override GitHub App client id (fork tenants, `login` only) |
+| `GITHUB_TOKEN` / `GH_TOKEN` | —                                              | Slot 1 of identity chain                                   |
 
-The shipped binary embeds the `freeCodeCamp` GitHub OAuth App client id (public; device flow uses no `client_secret`), so `universe login` works out of the box for staff. Fork operators and self-hosted mirror tenants set `UNIVERSE_GH_CLIENT_ID` to their own OAuth App's id — env value wins when set.
+The shipped binary embeds the `freeCodeCamp-Universe` GitHub App client id (public; device flow uses no `client_secret`), so `universe login` works out of the box for staff once the App is installed on their org. Fork operators and self-hosted mirror tenants set `UNIVERSE_GH_CLIENT_ID` to their own GitHub App's id — env value wins when set.

package/dist/index.cjs

@@ -8962,14 +8962,14 @@ async function resolveIdentity(opts = {}) {
   if (isNonEmpty(ghTokenEnv)) {
     return { token: ghTokenEnv.trim(), source: "env_GH_TOKEN" };
   }
-  const ghCli = await execGh();
-  if (isNonEmpty(ghCli)) {
-    return { token: ghCli.trim(), source: "gh_cli" };
-  }
   const stored = await loadStored();
   if (isNonEmpty(stored)) {
     return { token: stored.trim(), source: "device_flow" };
   }
+  const ghCli = await execGh();
+  if (isNonEmpty(ghCli)) {
+    return { token: ghCli.trim(), source: "gh_cli" };
+  }
   return null;
 }
 
@@ -23810,6 +23810,19 @@ async function runDeviceFlow(opts) {
 
 // src/commands/login.ts
 var DEFAULT_SCOPE = "read:org user:email";
+var DEFAULT_PROXY_URL2 = "https://uploads.freecode.camp";
+var NO_SITES_WARNING = [
+  "Logged in, but the proxy reports 0 authorized sites for your account.",
+  "This usually means the Universe CLI GitHub App is not installed on the org",
+  "that owns the registry-authz team (production: `freeCodeCamp-Universe`), or",
+  "your account is not on a team granted access to any site.",
+  "",
+  "Next steps:",
+  "  1. Run `universe whoami` to confirm the identity that resolved.",
+  "  2. Ask an org owner to install the Universe CLI GitHub App on the org.",
+  "  3. Confirm your team membership at",
+  "     https://github.com/orgs/freeCodeCamp-Universe/teams."
+].join("\n");
 function emitJson2(envelope) {
   process.stdout.write(JSON.stringify(envelope) + "\n");
 }
@@ -23881,10 +23894,46 @@ async function login(options, deps = {}) {
     return;
   }
   await save(token);
+  const selfCheck = await postLoginSelfCheck(token, env, deps);
   if (options.json) {
-    emitJson2(buildEnvelope("login", true, { stored: true }));
+    emitJson2(
+      buildEnvelope("login", true, {
+        stored: true,
+        ...selfCheck.checked ? {
+          authorizedSitesCount: selfCheck.authorizedSitesCount,
+          ...selfCheck.warning ? { warning: selfCheck.warning } : {}
+        } : {}
+      })
+    );
   } else {
     success2("Logged in. Token stored at ~/.config/universe-cli/token.");
+    if (selfCheck.checked && selfCheck.warning) {
+      const warn = deps.logWarn ?? ((s) => O2.warn(s));
+      warn(selfCheck.warning);
+    }
+  }
+}
+async function postLoginSelfCheck(token, env, deps) {
+  const mkClient = deps.createProxyClient ?? createProxyClient;
+  try {
+    const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL2;
+    const client = mkClient({
+      baseUrl,
+      getAuthToken: () => token,
+      timeoutMs: parseFetchTimeoutMs(env)
+    });
+    const result = await client.whoami();
+    const count = result.authorizedSites.length;
+    if (count === 0) {
+      return {
+        checked: true,
+        authorizedSitesCount: 0,
+        warning: NO_SITES_WARNING
+      };
+    }
+    return { checked: true, authorizedSitesCount: count };
+  } catch {
+    return { checked: false, authorizedSitesCount: 0 };
   }
 }
 
@@ -24296,7 +24345,7 @@ async function rollback(options, deps = {}) {
 }
 
 // src/commands/whoami.ts
-var DEFAULT_PROXY_URL2 = "https://uploads.freecode.camp";
+var DEFAULT_PROXY_URL3 = "https://uploads.freecode.camp";
 function emitJson7(envelope) {
   process.stdout.write(JSON.stringify(envelope) + "\n");
 }
@@ -24319,7 +24368,7 @@ async function whoami(options, deps = {}) {
     exit(EXIT_CREDENTIALS);
     return;
   }
-  const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL2;
+  const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL3;
   const client = mkClient({
     baseUrl,
     getAuthToken: () => identity.token,
@@ -24572,8 +24621,162 @@ async function update(options, deps = {}) {
   }
 }
 
+// src/lib/update-notifier.ts
+var import_node_fs3 = require("fs");
+var import_promises8 = require("fs/promises");
+var import_node_os2 = require("os");
+var import_node_path9 = require("path");
+var APP_DIR2 = "universe-cli";
+var CACHE_FILE = "update-check.json";
+var PKG_NAME = "@freecodecamp/universe-cli";
+var NPM_LATEST_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`;
+var TTL_MS = 24 * 60 * 60 * 1e3;
+var FETCH_TIMEOUT_MS = 3e3;
+function configBase2() {
+  const xdg = process.env["XDG_CONFIG_HOME"];
+  if (xdg && xdg.length > 0) return xdg;
+  return (0, import_node_path9.join)((0, import_node_os2.homedir)(), ".config");
+}
+function cachePath() {
+  return (0, import_node_path9.join)(configBase2(), APP_DIR2, CACHE_FILE);
+}
+function isDisabled() {
+  const v = process.env["UNIVERSE_NO_UPDATE_CHECK"];
+  return v === "1" || v === "true";
+}
+function parseCache(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null || !("latest" in parsed) || !("lastCheck" in parsed)) {
+    return null;
+  }
+  const { latest, lastCheck } = parsed;
+  if (typeof latest !== "string" || typeof lastCheck !== "number") {
+    return null;
+  }
+  return { latest, lastCheck };
+}
+async function readCache() {
+  try {
+    const raw = await (0, import_promises8.readFile)(cachePath(), "utf-8");
+    return parseCache(raw);
+  } catch {
+    return null;
+  }
+}
+function readCacheSync() {
+  try {
+    const raw = (0, import_node_fs3.readFileSync)(cachePath(), "utf-8");
+    return parseCache(raw);
+  } catch {
+    return null;
+  }
+}
+async function writeCache(c2) {
+  const path = cachePath();
+  await (0, import_promises8.mkdir)((0, import_node_path9.dirname)(path), { recursive: true, mode: 448 });
+  await (0, import_promises8.writeFile)(path, JSON.stringify(c2), { mode: 420 });
+}
+async function fetchLatest() {
+  const ctl = new AbortController();
+  const timer = setTimeout(() => ctl.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const res = await fetch(NPM_LATEST_URL, {
+      signal: ctl.signal,
+      headers: { accept: "application/json" }
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    return typeof body.version === "string" ? body.version : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function compareVersions(a, b) {
+  const pa = parseVersion(a);
+  const pb = parseVersion(b);
+  if (pa === null || pb === null) return 0;
+  for (let i = 0; i < 3; i += 1) {
+    const ai = pa[i] ?? 0;
+    const bi = pb[i] ?? 0;
+    if (ai < bi) return -1;
+    if (ai > bi) return 1;
+  }
+  return 0;
+}
+function parseVersion(s) {
+  const core = s.split("-")[0] ?? "";
+  const parts = core.split(".");
+  if (parts.length !== 3) return null;
+  const nums = parts.map((p2) => Number.parseInt(p2, 10));
+  if (nums.some((n) => Number.isNaN(n))) return null;
+  return [nums[0], nums[1], nums[2]];
+}
+async function refreshIfStale(now = Date.now()) {
+  if (isDisabled()) return;
+  const cache = await readCache();
+  if (cache !== null && now - cache.lastCheck < TTL_MS) return;
+  const latest = await fetchLatest();
+  if (latest === null) return;
+  try {
+    await writeCache({ latest, lastCheck: now });
+  } catch {
+  }
+}
+function getNoticeSync(current) {
+  if (isDisabled()) return null;
+  const cache = readCacheSync();
+  if (cache === null) return null;
+  if (compareVersions(current, cache.latest) >= 0) return null;
+  return { current, latest: cache.latest };
+}
+function useColor() {
+  if (process.env["NO_COLOR"] && process.env["NO_COLOR"].length > 0) {
+    return false;
+  }
+  return process.stderr.isTTY === true;
+}
+function paint(s, code, color) {
+  if (!color) return s;
+  return `\x1B[${code}m${s}\x1B[0m`;
+}
+function formatNotice(n, color = useColor()) {
+  const dim = (s) => paint(s, "2", color);
+  const yellow = (s) => paint(s, "33", color);
+  const cyan = (s) => paint(s, "36", color);
+  const bar = dim("\u2502");
+  const lines = [
+    "",
+    bar,
+    `${yellow("\u25B2")}  Update available: ${dim(n.current)} \u2192 ${cyan(n.latest)}`,
+    `${bar}  Run ${cyan(`npm i -g ${PKG_NAME}`)} to upgrade`,
+    dim("\u2514"),
+    ""
+  ];
+  return lines.join("\n");
+}
+function installExitNotice(current) {
+  if (isDisabled()) return;
+  let printed = false;
+  const emit = () => {
+    if (printed) return;
+    printed = true;
+    const n = getNoticeSync(current);
+    if (n === null) return;
+    process.stderr.write(formatNotice(n));
+  };
+  process.on("beforeExit", emit);
+  process.on("exit", emit);
+}
+
 // src/cli.ts
-var version2 = true ? "0.7.0" : "0.0.0";
+var version2 = true ? "0.7.2" : "0.0.0";
 function handleActionError(command, json2, err) {
   const ctx = { json: json2, command };
   const message = err instanceof Error ? err.message : "unknown error";
@@ -24589,6 +24792,8 @@ function findFirstPositional(args) {
   return -1;
 }
 function run(argv = process.argv) {
+  installExitNotice(version2);
+  void refreshIfStale();
   const args = argv.slice(2);
   const firstPosIdx = findFirstPositional(args);
   const namespace = firstPosIdx >= 0 ? args[firstPosIdx] : void 0;

package/dist/index.js

@@ -221,14 +221,14 @@ async function resolveIdentity(opts = {}) {
   if (isNonEmpty(ghTokenEnv)) {
     return { token: ghTokenEnv.trim(), source: "env_GH_TOKEN" };
   }
-  const ghCli = await execGh();
-  if (isNonEmpty(ghCli)) {
-    return { token: ghCli.trim(), source: "gh_cli" };
-  }
   const stored = await loadStored();
   if (isNonEmpty(stored)) {
     return { token: stored.trim(), source: "device_flow" };
   }
+  const ghCli = await execGh();
+  if (isNonEmpty(ghCli)) {
+    return { token: ghCli.trim(), source: "gh_cli" };
+  }
   return null;
 }
 
@@ -1308,6 +1308,19 @@ async function runDeviceFlow(opts) {
 
 // src/commands/login.ts
 var DEFAULT_SCOPE = "read:org user:email";
+var DEFAULT_PROXY_URL2 = "https://uploads.freecode.camp";
+var NO_SITES_WARNING = [
+  "Logged in, but the proxy reports 0 authorized sites for your account.",
+  "This usually means the Universe CLI GitHub App is not installed on the org",
+  "that owns the registry-authz team (production: `freeCodeCamp-Universe`), or",
+  "your account is not on a team granted access to any site.",
+  "",
+  "Next steps:",
+  "  1. Run `universe whoami` to confirm the identity that resolved.",
+  "  2. Ask an org owner to install the Universe CLI GitHub App on the org.",
+  "  3. Confirm your team membership at",
+  "     https://github.com/orgs/freeCodeCamp-Universe/teams."
+].join("\n");
 function emitJson2(envelope) {
   process.stdout.write(JSON.stringify(envelope) + "\n");
 }
@@ -1379,10 +1392,46 @@ async function login(options, deps = {}) {
     return;
   }
   await save(token);
+  const selfCheck = await postLoginSelfCheck(token, env, deps);
   if (options.json) {
-    emitJson2(buildEnvelope("login", true, { stored: true }));
+    emitJson2(
+      buildEnvelope("login", true, {
+        stored: true,
+        ...selfCheck.checked ? {
+          authorizedSitesCount: selfCheck.authorizedSitesCount,
+          ...selfCheck.warning ? { warning: selfCheck.warning } : {}
+        } : {}
+      })
+    );
   } else {
     success("Logged in. Token stored at ~/.config/universe-cli/token.");
+    if (selfCheck.checked && selfCheck.warning) {
+      const warn = deps.logWarn ?? ((s) => log3.warn(s));
+      warn(selfCheck.warning);
+    }
+  }
+}
+async function postLoginSelfCheck(token, env, deps) {
+  const mkClient = deps.createProxyClient ?? createProxyClient;
+  try {
+    const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL2;
+    const client = mkClient({
+      baseUrl,
+      getAuthToken: () => token,
+      timeoutMs: parseFetchTimeoutMs(env)
+    });
+    const result = await client.whoami();
+    const count = result.authorizedSites.length;
+    if (count === 0) {
+      return {
+        checked: true,
+        authorizedSitesCount: 0,
+        warning: NO_SITES_WARNING
+      };
+    }
+    return { checked: true, authorizedSitesCount: count };
+  } catch {
+    return { checked: false, authorizedSitesCount: 0 };
   }
 }
 
@@ -1799,7 +1848,7 @@ async function rollback(options, deps = {}) {
 
 // src/commands/whoami.ts
 import { log as log8 } from "@clack/prompts";
-var DEFAULT_PROXY_URL2 = "https://uploads.freecode.camp";
+var DEFAULT_PROXY_URL3 = "https://uploads.freecode.camp";
 function emitJson7(envelope) {
   process.stdout.write(JSON.stringify(envelope) + "\n");
 }
@@ -1822,7 +1871,7 @@ async function whoami(options, deps = {}) {
     exit(EXIT_CREDENTIALS);
     return;
   }
-  const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL2;
+  const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL3;
   const client = mkClient({
     baseUrl,
     getAuthToken: () => identity.token,
@@ -2081,8 +2130,162 @@ async function update(options, deps = {}) {
   }
 }
 
+// src/lib/update-notifier.ts
+import { readFileSync } from "fs";
+import { mkdir as mkdir2, readFile as readFile6, writeFile as writeFile2 } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join3 } from "path";
+var APP_DIR2 = "universe-cli";
+var CACHE_FILE = "update-check.json";
+var PKG_NAME = "@freecodecamp/universe-cli";
+var NPM_LATEST_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`;
+var TTL_MS = 24 * 60 * 60 * 1e3;
+var FETCH_TIMEOUT_MS = 3e3;
+function configBase2() {
+  const xdg = process.env["XDG_CONFIG_HOME"];
+  if (xdg && xdg.length > 0) return xdg;
+  return join3(homedir2(), ".config");
+}
+function cachePath() {
+  return join3(configBase2(), APP_DIR2, CACHE_FILE);
+}
+function isDisabled() {
+  const v = process.env["UNIVERSE_NO_UPDATE_CHECK"];
+  return v === "1" || v === "true";
+}
+function parseCache(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null || !("latest" in parsed) || !("lastCheck" in parsed)) {
+    return null;
+  }
+  const { latest, lastCheck } = parsed;
+  if (typeof latest !== "string" || typeof lastCheck !== "number") {
+    return null;
+  }
+  return { latest, lastCheck };
+}
+async function readCache() {
+  try {
+    const raw = await readFile6(cachePath(), "utf-8");
+    return parseCache(raw);
+  } catch {
+    return null;
+  }
+}
+function readCacheSync() {
+  try {
+    const raw = readFileSync(cachePath(), "utf-8");
+    return parseCache(raw);
+  } catch {
+    return null;
+  }
+}
+async function writeCache(c) {
+  const path = cachePath();
+  await mkdir2(dirname2(path), { recursive: true, mode: 448 });
+  await writeFile2(path, JSON.stringify(c), { mode: 420 });
+}
+async function fetchLatest() {
+  const ctl = new AbortController();
+  const timer = setTimeout(() => ctl.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const res = await fetch(NPM_LATEST_URL, {
+      signal: ctl.signal,
+      headers: { accept: "application/json" }
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    return typeof body.version === "string" ? body.version : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function compareVersions(a, b) {
+  const pa = parseVersion(a);
+  const pb = parseVersion(b);
+  if (pa === null || pb === null) return 0;
+  for (let i = 0; i < 3; i += 1) {
+    const ai = pa[i] ?? 0;
+    const bi = pb[i] ?? 0;
+    if (ai < bi) return -1;
+    if (ai > bi) return 1;
+  }
+  return 0;
+}
+function parseVersion(s) {
+  const core = s.split("-")[0] ?? "";
+  const parts = core.split(".");
+  if (parts.length !== 3) return null;
+  const nums = parts.map((p) => Number.parseInt(p, 10));
+  if (nums.some((n) => Number.isNaN(n))) return null;
+  return [nums[0], nums[1], nums[2]];
+}
+async function refreshIfStale(now = Date.now()) {
+  if (isDisabled()) return;
+  const cache = await readCache();
+  if (cache !== null && now - cache.lastCheck < TTL_MS) return;
+  const latest = await fetchLatest();
+  if (latest === null) return;
+  try {
+    await writeCache({ latest, lastCheck: now });
+  } catch {
+  }
+}
+function getNoticeSync(current) {
+  if (isDisabled()) return null;
+  const cache = readCacheSync();
+  if (cache === null) return null;
+  if (compareVersions(current, cache.latest) >= 0) return null;
+  return { current, latest: cache.latest };
+}
+function useColor() {
+  if (process.env["NO_COLOR"] && process.env["NO_COLOR"].length > 0) {
+    return false;
+  }
+  return process.stderr.isTTY === true;
+}
+function paint(s, code, color) {
+  if (!color) return s;
+  return `\x1B[${code}m${s}\x1B[0m`;
+}
+function formatNotice(n, color = useColor()) {
+  const dim = (s) => paint(s, "2", color);
+  const yellow = (s) => paint(s, "33", color);
+  const cyan = (s) => paint(s, "36", color);
+  const bar = dim("\u2502");
+  const lines = [
+    "",
+    bar,
+    `${yellow("\u25B2")}  Update available: ${dim(n.current)} \u2192 ${cyan(n.latest)}`,
+    `${bar}  Run ${cyan(`npm i -g ${PKG_NAME}`)} to upgrade`,
+    dim("\u2514"),
+    ""
+  ];
+  return lines.join("\n");
+}
+function installExitNotice(current) {
+  if (isDisabled()) return;
+  let printed = false;
+  const emit = () => {
+    if (printed) return;
+    printed = true;
+    const n = getNoticeSync(current);
+    if (n === null) return;
+    process.stderr.write(formatNotice(n));
+  };
+  process.on("beforeExit", emit);
+  process.on("exit", emit);
+}
+
 // src/cli.ts
-var version = true ? "0.7.0" : "0.0.0";
+var version = true ? "0.7.2" : "0.0.0";
 function handleActionError(command, json, err) {
   const ctx = { json, command };
   const message = err instanceof Error ? err.message : "unknown error";
@@ -2098,6 +2301,8 @@ function findFirstPositional(args) {
   return -1;
 }
 function run(argv = process.argv) {
+  installExitNotice(version);
+  void refreshIfStale();
   const args = argv.slice(2);
   const firstPosIdx = findFirstPositional(args);
   const namespace = firstPosIdx >= 0 ? args[firstPosIdx] : void 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@freecodecamp/universe-cli",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "main": "dist/index.js",
   "scripts": {
     "test": "vitest run",