@get-dx/cli 0.8.0 → 0.10.0

package/dist/doctor/network.js

@@ -0,0 +1,224 @@
+import { describeError, errorCode, timed } from "./format.js";
+import { CHECK_TIMEOUT_MS, DOCTOR_HEADER, } from "./probes.js";
+import { check } from "./types.js";
+const TLS_VERIFY_HINT = "Your network may be intercepting HTTPS traffic with its own certificate.\nSet NODE_EXTRA_CA_CERTS to your corporate CA bundle (PEM), or ask your network team to allow {host}.";
+const CONNECTION_RESET_HINT = "A firewall or proxy on your network is likely interrupting HTTPS traffic to {host}.\nAsk your network team to allow {host}, or set NODE_EXTRA_CA_CERTS to your corporate CA bundle.";
+export async function checkNetwork(options) {
+    const { apiBaseUrl, webBaseUrl, version, probes } = options;
+    const checks = [];
+    let url;
+    try {
+        url = new URL(apiBaseUrl);
+    }
+    catch {
+        checks.push(check("dns", "DNS", "fail", `invalid API base URL "${apiBaseUrl}"`, {
+            hint: "Check DX_API_BASE_URL or the apiBaseUrl in your config file.",
+        }), await webAppCheck(webBaseUrl, version, probes));
+        return {
+            section: { id: "network", title: "Network", checks },
+            facts: { apiReachable: false },
+        };
+    }
+    const host = url.hostname;
+    const isHttps = url.protocol === "https:";
+    const port = url.port ? Number(url.port) : isHttps ? 443 : 80;
+    const fill = (text) => text.replaceAll("{host}", host);
+    let skipReason = null;
+    const skip = (id, label) => check(id, label, "skip", `skipped because ${skipReason}`);
+    // 1. DNS
+    try {
+        const { value: addresses, ms } = await timed(() => probes.lookup(host));
+        checks.push(check("dns", "DNS", "ok", `resolved to ${addresses.join(", ")} (${ms}ms)`, { data: { addresses, ms } }));
+    }
+    catch (error) {
+        const code = errorCode(error);
+        checks.push(check("dns", "DNS", "fail", describeError(error, "DNS lookup"), {
+            hint: code === "ENOTFOUND"
+                ? fill("{host} could not be resolved. Check the API base URL, your VPN, and your DNS settings.")
+                : "Check your network connection, VPN, and DNS settings.",
+            data: { code },
+        }));
+        skipReason = "DNS lookup failed";
+    }
+    // 2. TCP
+    if (skipReason) {
+        checks.push(skip("tcp", "TCP connect"));
+    }
+    else {
+        try {
+            const { ms } = await timed(() => probes.tcpConnect(host, port));
+            checks.push(check("tcp", "TCP connect", "ok", `port ${port} open (${ms}ms)`, {
+                data: { port, ms },
+            }));
+        }
+        catch (error) {
+            checks.push(check("tcp", "TCP connect", "fail", describeError(error, `connecting to port ${port}`), {
+                hint: fill(`A firewall may be blocking outbound connections to {host} on port ${port}.`),
+                data: { port, code: errorCode(error) },
+            }));
+            skipReason = "the TCP connection failed";
+        }
+    }
+    // 3. TLS
+    if (!isHttps) {
+        checks.push(check("tls", "TLS handshake", "skip", "skipped because the API base URL does not use HTTPS"));
+    }
+    else if (skipReason) {
+        checks.push(skip("tls", "TLS handshake"));
+    }
+    else {
+        const tlsCheck = await tlsHandshakeCheck(host, port, probes, fill);
+        checks.push(tlsCheck);
+        if (tlsCheck.status === "fail") {
+            skipReason = "the TLS handshake failed";
+        }
+    }
+    // 4. HTTPS request to the API
+    let apiReachable = false;
+    if (skipReason) {
+        checks.push(skip("https", "HTTPS"));
+    }
+    else {
+        const httpsCheck = await apiRequestCheck(apiBaseUrl, version, probes, fill);
+        checks.push(httpsCheck);
+        apiReachable = httpsCheck.status === "ok";
+    }
+    // 5. Web app, independent of the API checks
+    checks.push(await webAppCheck(webBaseUrl, version, probes));
+    return {
+        section: { id: "network", title: `Network (${host})`, checks },
+        facts: { apiReachable },
+    };
+}
+async function tlsHandshakeCheck(host, port, probes, fill) {
+    try {
+        const { value: result, ms } = await timed(() => probes.tlsHandshake(host, port));
+        const { certificate } = result;
+        const parts = [
+            result.protocol,
+            certificate.issuer ? `issuer "${certificate.issuer}"` : null,
+            certificate.validTo
+                ? `valid until ${certificate.validTo.slice(0, 10)}`
+                : null,
+        ].filter(Boolean);
+        const summary = `${parts.join("; ")} (${ms}ms)`;
+        const data = {
+            protocol: result.protocol,
+            subject: certificate.subject,
+            issuer: certificate.issuer,
+            valid_to: certificate.validTo,
+            authorized: result.authorized,
+            authorization_error: result.authorizationError,
+            root: result.rootIssuer,
+            root_is_bundled: result.rootIsBundled,
+            ms,
+        };
+        if (!result.authorized) {
+            return check("tls", "TLS handshake", "fail", `certificate not trusted (${result.authorizationError ?? "unknown error"}); ${summary}`, { hint: fill(TLS_VERIFY_HINT), data });
+        }
+        if (result.rootIsBundled === false) {
+            return check("tls", "TLS handshake", "warn", `trusted via a non-public CA "${result.rootIssuer}"; ${summary}`, {
+                hint: `Traffic appears to be intercepted by "${result.rootIssuer}". This works because that CA is trusted locally, but requests are being inspected by your network.`,
+                data,
+            });
+        }
+        return check("tls", "TLS handshake", "ok", summary, { data });
+    }
+    catch (error) {
+        const code = errorCode(error);
+        const reset = code === "ECONNRESET" || code === "EPIPE";
+        return check("tls", "TLS handshake", "fail", reset
+            ? `connection reset by peer during handshake (${code})`
+            : describeError(error, "TLS handshake"), {
+            hint: fill(reset ? CONNECTION_RESET_HINT : TLS_VERIFY_HINT),
+            data: { code },
+        });
+    }
+}
+async function apiRequestCheck(apiBaseUrl, version, probes, fill) {
+    const url = `${apiBaseUrl}/auth.info`;
+    try {
+        const { value: response, ms } = await timed(async () => {
+            const response = await probes.fetch(url, {
+                headers: {
+                    ...clientHeaders(version),
+                    ...DOCTOR_HEADER,
+                    Accept: "application/json",
+                },
+                signal: AbortSignal.timeout(CHECK_TIMEOUT_MS),
+            });
+            return { status: response.status, text: await response.text() };
+        });
+        const data = { url, status: response.status, ms };
+        if (!isJson(response.text)) {
+            return check("https", "HTTPS", "fail", `unexpected non-JSON response (HTTP ${response.status}) (${ms}ms)`, {
+                hint: fill("Something other than the DX API answered. A proxy, firewall, or captive portal may be intercepting requests to {host}."),
+                data,
+            });
+        }
+        if (response.status >= 500) {
+            return check("https", "HTTPS", "fail", `DX API returned HTTP ${response.status} (${ms}ms)`, {
+                hint: "The DX API is having problems. Try again in a few minutes.",
+                data,
+            });
+        }
+        const message = response.status === 401
+            ? `DX API responded (401 without token, as expected) (${ms}ms)`
+            : `DX API responded (HTTP ${response.status}) (${ms}ms)`;
+        return check("https", "HTTPS", "ok", message, { data });
+    }
+    catch (error) {
+        return check("https", "HTTPS", "fail", describeError(error, "request"), {
+            hint: fill("Requests to {host} are failing even though the connection succeeded. A proxy or firewall may be interfering."),
+            data: { url, code: errorCode(error) },
+        });
+    }
+}
+async function webAppCheck(webBaseUrl, version, probes) {
+    try {
+        const { value: status, ms } = await timed(async () => {
+            const response = await probes.fetch(webBaseUrl, {
+                headers: { ...clientHeaders(version), ...DOCTOR_HEADER },
+                signal: AbortSignal.timeout(CHECK_TIMEOUT_MS),
+            });
+            await response.body?.cancel();
+            return response.status;
+        });
+        const data = { url: webBaseUrl, status, ms };
+        if (status >= 500) {
+            return check("web_app", "Web app reachable", "fail", `${webBaseUrl} returned HTTP ${status} (${ms}ms)`, {
+                hint: "The DX web app is having problems. Browser login may not work.",
+                data,
+            });
+        }
+        if (status >= 400) {
+            return check("web_app", "Web app reachable", "warn", `${webBaseUrl} returned HTTP ${status} (${ms}ms)`, {
+                hint: "The web app answered with an error. A proxy or firewall may be blocking it, and browser login may not work.",
+                data,
+            });
+        }
+        return check("web_app", "Web app reachable", "ok", `${webBaseUrl} responded ${status} (${ms}ms)`, { data });
+    }
+    catch (error) {
+        return check("web_app", "Web app reachable", "fail", `${webBaseUrl}: ${describeError(error, "request")}`, {
+            hint: "Browser login (`dx auth login` without --token) needs the web app. Check your network, or log in with --token instead.",
+            data: { url: webBaseUrl, code: errorCode(error) },
+        });
+    }
+}
+function clientHeaders(version) {
+    return {
+        "X-Client-Type": "dx-cli",
+        "X-Client-Version": version,
+        "User-Agent": `dx-cli/${version}`,
+    };
+}
+function isJson(text) {
+    try {
+        JSON.parse(text);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/doctor/probes.js

@@ -0,0 +1,130 @@
+import { X509Certificate } from "node:crypto";
+import dns from "node:dns";
+import net from "node:net";
+import tls from "node:tls";
+export const CHECK_TIMEOUT_MS = 10_000;
+/** Headers sent on doctor's requests, so they can be told apart in logs. */
+export const DOCTOR_HEADER = { "X-DX-Doctor": "1" };
+export class ProbeTimeoutError extends Error {
+    timeoutMs;
+    constructor(timeoutMs) {
+        super(`timed out after ${timeoutMs / 1000}s`);
+        this.name = "ProbeTimeoutError";
+        this.timeoutMs = timeoutMs;
+    }
+}
+export const defaultProbes = {
+    lookup: (hostname) => withTimeout(dns.promises
+        .lookup(hostname, { all: true })
+        .then((results) => results.map((result) => result.address))),
+    tcpConnect,
+    tlsHandshake,
+    fetch: (input, init) => globalThis.fetch(input, init),
+};
+function withTimeout(promise) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new ProbeTimeoutError(CHECK_TIMEOUT_MS)), CHECK_TIMEOUT_MS);
+        timer.unref?.();
+        promise.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+    });
+}
+function tcpConnect(hostname, port) {
+    return new Promise((resolve, reject) => {
+        const socket = net.connect({ host: hostname, port });
+        socket.setTimeout(CHECK_TIMEOUT_MS, () => {
+            socket.destroy();
+            reject(new ProbeTimeoutError(CHECK_TIMEOUT_MS));
+        });
+        socket.once("connect", () => {
+            socket.destroy();
+            resolve();
+        });
+        socket.once("error", (error) => {
+            socket.destroy();
+            reject(error);
+        });
+    });
+}
+function tlsHandshake(hostname, port) {
+    return new Promise((resolve, reject) => {
+        // Verify manually after the handshake so a bad chain is reported with its
+        // details instead of only as an error.
+        const socket = tls.connect({
+            host: hostname,
+            port,
+            servername: net.isIP(hostname) ? undefined : hostname,
+            rejectUnauthorized: false,
+        });
+        socket.setTimeout(CHECK_TIMEOUT_MS, () => {
+            socket.destroy();
+            reject(new ProbeTimeoutError(CHECK_TIMEOUT_MS));
+        });
+        socket.once("secureConnect", () => {
+            const peer = socket.getPeerCertificate(true);
+            const root = findChainRoot(peer);
+            const authorizationError = socket.authorizationError;
+            resolve({
+                protocol: socket.getProtocol() ?? null,
+                authorized: socket.authorized,
+                authorizationError: authorizationError
+                    ? String(authorizationError.code ??
+                        authorizationError)
+                    : null,
+                certificate: {
+                    subject: certificateName(peer.subject),
+                    issuer: certificateName(peer.issuer),
+                    validTo: peer.valid_to ? new Date(peer.valid_to).toISOString() : null,
+                },
+                rootIsBundled: root
+                    ? bundledRootFingerprints().has(root.fingerprint256)
+                    : null,
+                rootIssuer: root ? certificateName(root.subject) : null,
+            });
+            socket.destroy();
+        });
+        socket.once("error", (error) => {
+            socket.destroy();
+            reject(error);
+        });
+    });
+}
+/** The self-signed root at the top of a peer chain, if Node resolved one. */
+function findChainRoot(certificate) {
+    let current = certificate;
+    const seen = new Set();
+    while (current?.fingerprint256 && !seen.has(current.fingerprint256)) {
+        seen.add(current.fingerprint256);
+        const issuer = current.issuerCertificate;
+        if (!issuer || issuer.fingerprint256 === current.fingerprint256) {
+            return issuer ? current : null;
+        }
+        current = issuer;
+    }
+    return null;
+}
+let bundledFingerprints;
+function bundledRootFingerprints() {
+    bundledFingerprints ??= new Set(tls.rootCertificates.map((pem) => new X509Certificate(pem).fingerprint256));
+    return bundledFingerprints;
+}
+function certificateName(name) {
+    if (!name) {
+        return null;
+    }
+    const value = (key) => {
+        const field = name[key];
+        return Array.isArray(field) ? field[0] : field;
+    };
+    const commonName = value("CN");
+    const organization = value("O");
+    if (commonName && organization && commonName !== organization) {
+        return `${commonName} (${organization})`;
+    }
+    return commonName ?? organization ?? null;
+}

package/dist/doctor/skill.js

@@ -0,0 +1,16 @@
+import os from "node:os";
+import path from "node:path";
+import { isSkillInstalled } from "../skill.js";
+import { tildify } from "./format.js";
+import { check } from "./types.js";
+export async function checkSkill() {
+    const installed = await isSkillInstalled();
+    const skillPath = tildify(path.join(os.homedir(), ".agents", "skills", "dx-cli"));
+    return {
+        id: "skill",
+        title: "Agent skill",
+        checks: [
+            check("skill", "dx-cli skill", "ok", installed ? `installed (${skillPath})` : "not installed", { data: { installed, path: installed ? skillPath : null } }),
+        ],
+    };
+}

package/dist/doctor/types.js

@@ -0,0 +1,11 @@
+export function check(id, label, status, message, options = {}) {
+    return {
+        id,
+        label,
+        status,
+        message,
+        hint: status === "warn" || status === "fail" ? (options.hint ?? null) : null,
+        source: options.source ?? null,
+        data: options.data ?? null,
+    };
+}

package/dist/http.js

@@ -2,6 +2,7 @@ import { CliError, HttpError } from "./errors.js";
 export async function request(runtime, route, options = {}) {
     const method = options.method || "GET";
     const headers = new Headers({
+        ...options.headers,
         Accept: "application/json",
         "X-Client-Type": "dx-cli",
         "X-Client-Version": runtime.version,
@@ -40,6 +41,7 @@ export async function request(runtime, route, options = {}) {
             method,
             headers,
             body: requestBody,
+            signal: options.signal,
         });
     }
     catch (error) {

package/dist/secrets.js

@@ -8,6 +8,35 @@ export async function getToken(baseUrl) {
     }
     return await getSecretStore().get(baseUrl);
 }
+/**
+ * Like `getToken`, but reports where the token came from, and surfaces errors
+ * reading the OS secret store instead of treating them as a missing token.
+ */
+export async function getTokenWithSource(baseUrl) {
+    if (process.env.DX_API_TOKEN) {
+        return { source: "env", token: process.env.DX_API_TOKEN };
+    }
+    let store;
+    try {
+        store = getSecretStore();
+    }
+    catch (error) {
+        return {
+            source: "error",
+            storeName: null,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+    const result = await store.probe(baseUrl);
+    switch (result.status) {
+        case "found":
+            return { source: "keychain", token: result.token, storeName: store.name };
+        case "missing":
+            return { source: "none", storeName: store.name };
+        case "error":
+            return { source: "error", storeName: store.name, error: result.error };
+    }
+}
 export async function setToken(baseUrl, token) {
     await getSecretStore().set(baseUrl, token);
 }
@@ -26,9 +55,16 @@ function getSecretStore(platform = process.platform) {
     }
     throw new CliError(`Unsupported platform for secure token storage: ${platform}`);
 }
+// `security` exits with this code when no matching keychain item exists.
+const MACOS_ITEM_NOT_FOUND_EXIT_CODE = 44;
 function macosSecretStore() {
     return {
+        name: "macOS Keychain",
         async get(baseUrl) {
+            const result = await this.probe(baseUrl);
+            return result.status === "found" ? result.token : null;
+        },
+        async probe(baseUrl) {
             try {
                 const result = await execa("security", [
                     "find-generic-password",
@@ -38,10 +74,15 @@ function macosSecretStore() {
                     baseUrl,
                     "-w",
                 ]);
-                return result.stdout?.trim() ?? null;
+                const token = result.stdout?.trim();
+                return token ? { status: "found", token } : { status: "missing" };
             }
-            catch {
-                return null;
+            catch (error) {
+                if (isRecord(error) &&
+                    error.exitCode === MACOS_ITEM_NOT_FOUND_EXIT_CODE) {
+                    return { status: "missing" };
+                }
+                return { status: "error", error: describeStoreError(error) };
             }
         },
         async set(baseUrl, token) {
@@ -86,7 +127,12 @@ function macosSecretStore() {
 }
 function linuxSecretStore() {
     return {
+        name: "Linux Secret Service (secret-tool)",
         async get(baseUrl) {
+            const result = await this.probe(baseUrl);
+            return result.status === "found" ? result.token : null;
+        },
+        async probe(baseUrl) {
             try {
                 const result = await execa("secret-tool", [
                     "lookup",
@@ -95,10 +141,21 @@ function linuxSecretStore() {
                     "account",
                     baseUrl,
                 ]);
-                return result.stdout?.trim() ?? null;
+                const token = result.stdout?.trim();
+                return token ? { status: "found", token } : { status: "missing" };
             }
-            catch {
-                return null;
+            catch (error) {
+                if (hasErrorCode(error, "ENOENT")) {
+                    return { status: "error", error: "`secret-tool` is not installed" };
+                }
+                // `secret-tool lookup` exits 1 without output when nothing matches.
+                if (isRecord(error) &&
+                    error.exitCode === 1 &&
+                    !errorStderr(error) &&
+                    !isLinuxSecretServiceUnavailable(error)) {
+                    return { status: "missing" };
+                }
+                return { status: "error", error: describeStoreError(error) };
             }
         },
         async set(baseUrl, token) {
@@ -116,12 +173,18 @@ function linuxSecretStore() {
 }
 function windowsSecretStore() {
     return {
+        name: "Windows Credential Manager",
         async get(baseUrl) {
+            const result = await this.probe(baseUrl);
+            return result.status === "found" ? result.token : null;
+        },
+        async probe(baseUrl) {
             try {
-                return await crossKeychain.getPassword(SERVICE, encodeAccountName(baseUrl));
+                const token = await crossKeychain.getPassword(SERVICE, encodeAccountName(baseUrl));
+                return token ? { status: "found", token } : { status: "missing" };
             }
-            catch {
-                return null;
+            catch (error) {
+                return { status: "error", error: describeStoreError(error) };
             }
         },
         async set(baseUrl, token) {
@@ -191,6 +254,21 @@ function isLinuxSecretServiceUnavailable(error) {
         "No such secret service",
     ].some((message) => text.includes(message));
 }
+function errorStderr(error) {
+    return typeof error.stderr === "string" ? error.stderr.trim() : "";
+}
+function describeStoreError(error) {
+    if (isRecord(error)) {
+        const stderr = errorStderr(error);
+        if (stderr) {
+            return stderr;
+        }
+        if (typeof error.shortMessage === "string") {
+            return error.shortMessage;
+        }
+    }
+    return error instanceof Error ? error.message : String(error);
+}
 function formatErrorDetails(error) {
     if (!isRecord(error) || typeof error.stderr !== "string") {
         return null;

package/dist/ui/blocks.js

@@ -104,3 +104,49 @@ export class JsonBlock extends AbstractBlock {
         return pc.cyan(JSON.stringify(this.value, null, 2)) + "\n";
     }
 }
+function statusMarker(status) {
+    switch (status) {
+        case "ok":
+            return pc.green("[ OK ]");
+        case "warn":
+            return pc.yellow("[WARN]");
+        case "fail":
+            return pc.red("[FAIL]");
+        case "skip":
+            return pc.dim("[SKIP]");
+    }
+}
+/**
+ * A titled list of `[ OK ]` / `[WARN]` / `[FAIL]` / `[SKIP]` rows, e.g.:
+ *
+ * ```
+ * Network
+ *   [ OK ] DNS              resolved to 104.18.20.33
+ *   [FAIL] TLS handshake    connection reset by peer
+ *          → A firewall or proxy is likely interrupting HTTPS traffic.
+ * ```
+ */
+export class StatusListBlock extends AbstractBlock {
+    title;
+    rows;
+    options;
+    constructor(title, rows, options) {
+        super();
+        this.title = title;
+        this.rows = rows;
+        this.options = options;
+    }
+    render() {
+        const lines = [pc.bold(this.title)];
+        for (const row of this.rows) {
+            const label = padEnd(row.label, this.options.labelWidth);
+            lines.push(`  ${statusMarker(row.status)} ${label}${row.detail}`);
+            if (row.hint) {
+                const [first, ...rest] = row.hint.split("\n");
+                lines.push(`         → ${first}`);
+                lines.push(...rest.map((line) => `           ${line}`));
+            }
+        }
+        return lines.join("\n") + "\n";
+    }
+}

package/dist/ui.js

@@ -2,7 +2,7 @@ import dayjs from "dayjs";
 import relativeTimePlugin from "dayjs/plugin/relativeTime.js";
 import pc from "picocolors";
 export { GLYPHS } from "./ui/glyphs.js";
-import { DescriptionListBlock, DescriptionListItemContainer, HeadingBlock, JsonBlock, ListItemContainer, ParagraphBlock, UnorderedListBlock, CodeBlock, } from "./ui/blocks.js";
+import { DescriptionListBlock, DescriptionListItemContainer, HeadingBlock, JsonBlock, ListItemContainer, ParagraphBlock, UnorderedListBlock, CodeBlock, StatusListBlock, } from "./ui/blocks.js";
 dayjs.extend(relativeTimePlugin);
 // Block-level elements
 export function h1(text) {
@@ -49,6 +49,13 @@ export function dli(term, detailItems) {
         return new DescriptionListItemContainer(term, detailItems);
     }
 }
+/**
+ * Create a titled list of `[ OK ]` / `[WARN]` / `[FAIL]` / `[SKIP]` rows, as
+ * used by `dx doctor`.
+ */
+export function statusList(title, rows, options) {
+    return new StatusListBlock(title, rows, options);
+}
 export function codeBlock(text) {
     return new CodeBlock(text);
 }

package/dist/versionCheck.js

@@ -10,7 +10,7 @@ import * as ui from "./ui.js";
 import cliPackage from "../package.json" with { type: "json" };
 const VERSION_CHECK_INTERVAL_HOURS = 24;
 const SNOOZE_DAYS = 7;
-const SKIP_COMMANDS = new Set(["auth", "init"]);
+const SKIP_COMMANDS = new Set(["auth", "doctor", "init"]);
 const SKIP_OPTIONS = new Set(["-h", "--help", "-v", "--version"]);
 /**
  * Compares two semver strings (e.g. "1.2.3").
@@ -52,10 +52,32 @@ export function shouldShowVersionPrompt(latestVersion, versionPromptSelection) {
     }
     return true;
 }
-async function fetchLatestVersion(runtime) {
-    const response = await request(runtime, "/cli.currentVersion", { method: "GET" });
+export async function fetchLatestVersion(runtime, options) {
+    const response = await request(runtime, "/cli.currentVersion", { ...options, method: "GET" });
     return response.body.versions.cli;
 }
+const NPM_LATEST_URL = `https://registry.npmjs.org/${cliPackage.name}/latest`;
+/**
+ * Fetch the latest published version from the npm registry. Unlike
+ * `fetchLatestVersion`, this does not need a DX API token.
+ */
+export async function fetchLatestVersionFromNpm(options) {
+    const response = await fetch(NPM_LATEST_URL, {
+        headers: {
+            Accept: "application/json",
+            "User-Agent": `dx-cli/${cliPackage.version}`,
+        },
+        signal: options?.signal,
+    });
+    if (!response.ok) {
+        throw new Error(`npm registry returned HTTP ${response.status}`);
+    }
+    const body = (await response.json());
+    if (typeof body.version !== "string") {
+        throw new Error("npm registry response did not include a version");
+    }
+    return body.version;
+}
 /**
  * Checks whether a newer CLI version is available.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@get-dx/cli",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "DX CLI",
   "author": "DX <developers@getdx.com>",
   "bugs": {