@ggalmazor/decoy 1.1.0 → 1.3.0

package/README.md

@@ -40,10 +40,11 @@ decoy find invoice.pdf -m 'ES\d{2}( ?\d{4}){5}'  # only the matches
 decoy redact invoice.pdf -m 'ES\d{2}( ?\d{4}){5}' -m '[\w.+-]+@[\w-]+\.[\w.]+' --mood corporate
 decoy redact screenshot.png -b 120,340,260,32   # images have no text layer: boxes are x,y,w,h[@page]
 decoy verify invoice-decoyed.pdf -m 'ES\d{2}( ?\d{4}){5}' --original invoice.pdf
-decoy mcp                                       # find_text, redact, and verify as MCP tools over stdio
+decoy update                                    # is there a newer version? The only network call decoy makes
+decoy mcp                                       # find_text, redact, verify, and check_update as MCP tools over stdio
 ```
 
-`redact` covers every match of every `-m` pattern (a JavaScript regular expression, matched per line so a number split at spaces still matches) and every `-b` box with a decoy, then writes `<name>-decoyed.pdf` or `.png` next to the input. `--mood`, `--clean`, `--cell`, `--seed`, `--text`, and `--watermark` are the panel's controls; `--json` on any command returns machine-readable output. `verify` proves what an agent can prove about a file it did not watch being made: a PDF has no text layer and no metadata, no pattern is still readable, and, given `--original`, only the matched boxes changed.
+`redact` covers every match of every `-m` pattern (a JavaScript regular expression, matched per line so a number split at spaces still matches) and every `-b` box with a decoy, then writes `<name>-decoyed.pdf` or `.png` next to the input. `--mood`, `--clean`, `--cell`, `--seed`, `--text`, and `--watermark` are the panel's controls; `--json` on any command returns machine-readable output. `verify` proves what an agent can prove about a file it did not watch being made: a PDF has no text layer and no metadata, no pattern is still readable, and, given `--original`, only the matched boxes changed. `update` is the one command that touches the network: a single request to the npm registry for the latest version, made only when you (or an agent, through the `check_update` tool) ask for it.
 
 For agents, `skills/decoy-redact/SKILL.md` is a ready-made skill (copy it into `.claude/skills/` or `~/.claude/skills/`), and the MCP server plugs into any client:
 

package/dist-cli/decoy.mjs

@@ -1460,6 +1460,72 @@ function round(rect) {
 	};
 }
 //#endregion
+//#region src/cli/update.ts
+var PACKAGE_NAME = "@ggalmazor/decoy";
+var REGISTRY = "https://registry.npmjs.org";
+function parts(version) {
+	const [core, prerelease = null] = version.replace(/^v/, "").split("-", 2);
+	return {
+		numbers: core.split(".").map((n) => Number(n) || 0),
+		prerelease
+	};
+}
+function compareVersions(a, b) {
+	const pa = parts(a);
+	const pb = parts(b);
+	for (let i = 0; i < 3; i++) {
+		const d = (pa.numbers[i] ?? 0) - (pb.numbers[i] ?? 0);
+		if (d !== 0) return Math.sign(d);
+	}
+	if (pa.prerelease && !pb.prerelease) return -1;
+	if (!pa.prerelease && pb.prerelease) return 1;
+	return 0;
+}
+async function checkForUpdate(installed, fetchImpl = fetch, timeoutMs = 8e3) {
+	const base = {
+		package: PACKAGE_NAME,
+		installed,
+		command: `npm install -g ${PACKAGE_NAME}@latest`,
+		registry: REGISTRY
+	};
+	try {
+		const res = await fetchImpl(`${REGISTRY}/${encodeURIComponent(PACKAGE_NAME)}/latest`, {
+			headers: { accept: "application/json" },
+			signal: AbortSignal.timeout(timeoutMs)
+		});
+		if (!res.ok) return {
+			...base,
+			latest: null,
+			updateAvailable: false,
+			error: `registry answered ${res.status}`
+		};
+		const body = await res.json();
+		if (typeof body.version !== "string") return {
+			...base,
+			latest: null,
+			updateAvailable: false,
+			error: "registry answer had no version"
+		};
+		return {
+			...base,
+			latest: body.version,
+			updateAvailable: compareVersions(body.version, installed) > 0
+		};
+	} catch (error) {
+		return {
+			...base,
+			latest: null,
+			updateAvailable: false,
+			error: error.message
+		};
+	}
+}
+function describeUpdate(report) {
+	if (report.error) return `${report.package} ${report.installed} installed; could not reach ${report.registry}: ${report.error}`;
+	if (report.updateAvailable) return `${report.package} ${report.installed} installed, ${report.latest} available. Update with: ${report.command}`;
+	return `${report.package} ${report.installed} is the latest version.`;
+}
+//#endregion
 //#region src/cli/verify.ts
 function inside(rects, x, y) {
 	return rects.some((r) => x >= r.x && x < r.x + r.w && y >= r.y && y < r.y + r.h);
@@ -1692,11 +1758,22 @@ async function serveMcp(version) {
 			return failure(error);
 		}
 	});
+	server.registerTool("check_update", {
+		title: "Check for a newer decoy",
+		description: "Asks registry.npmjs.org for the latest published version of @ggalmazor/decoy and compares it with the running one. This is the only network request decoy ever makes, and it happens only when this tool is called; nothing about the user or their files is sent. Returns installed, latest, updateAvailable, and the install command.",
+		inputSchema: {}
+	}, async () => {
+		try {
+			return json(await checkForUpdate(version));
+		} catch (error) {
+			return failure(error);
+		}
+	});
 	await server.connect(new StdioServerTransport());
 }
 //#endregion
 //#region src/cli/main.ts
-var VERSION = "1.1.0";
+var VERSION = "1.3.0";
 function collect(value, previous) {
 	return [...previous, value];
 }
@@ -1778,6 +1855,12 @@ program.command("verify").description("check a redacted file: no text layer, no
 		fail(error);
 	}
 });
+program.command("update").description("ask the npm registry whether a newer version exists (the only network request decoy ever makes)").action(async () => {
+	const report = await checkForUpdate(VERSION);
+	if (program.opts().json) console.log(JSON.stringify(report, null, 2));
+	else console.log(describeUpdate(report));
+	process.exit(report.error ? 1 : 0);
+});
 program.command("mcp").description("serve find_text, redact, and verify as MCP tools over stdio").action(async () => {
 	try {
 		await serveMcp(VERSION);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggalmazor/decoy",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "Redaction that paints a pixelated decoy phrase over the secret instead of pixelating the secret. Web app, CLI, and MCP server; everything runs on your machine.",
   "keywords": [
     "redaction",