@glasshome/widget-cli 0.4.13 → 0.4.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glasshome/widget-cli",
-  "version": "0.4.13",
+  "version": "0.4.14",
   "description": "CLI for creating and managing GlassHome widgets",
   "type": "module",
   "bin": {

package/src/commands/create.ts

@@ -10,6 +10,7 @@ import {
 } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { cancel, confirm, isCancel, log, spinner, text } from "@clack/prompts";
+import { getCliVersion } from "../utils/version";
 import { promptWidgetDetails, scaffoldWidget } from "./add";
 
 const templateDir = resolve(import.meta.dir, "../../template");
@@ -114,11 +115,15 @@ export async function runCreate() {
     const projectDesc =
       (projectDescription as string) || `A GlassHome widget project: ${projectName}`;
 
-    // Replace project-level placeholders in package.json
+    // Replace project-level placeholders in package.json. Pin the CLI to the
+    // version that scaffolded the project (caret) so `bun widget` resolves the
+    // project-local binary and `bun update` keeps it current, instead of a
+    // stale global/bunx copy.
     const pkgPath = join(targetDir, "package.json");
     let pkgContent = readFileSync(pkgPath, "utf-8");
     pkgContent = pkgContent.replace(/PROJECT_NAME/g, projectName as string);
     pkgContent = pkgContent.replace(/PROJECT_DESCRIPTION/g, projectDesc);
+    pkgContent = pkgContent.replace(/CLI_VERSION/g, `^${getCliVersion()}`);
     writeFileSync(pkgPath, pkgContent);
 
     // Replace project-level placeholders in README.md

package/src/commands/login.ts

@@ -3,6 +3,7 @@ import { createServer, type IncomingMessage, type ServerResponse } from "node:ht
 import { log, spinner } from "@clack/prompts";
 import open from "open";
 import { getHubUrl, storeToken } from "../utils/auth";
+import { enforceCliVersion, notifyCliUpdate } from "../utils/version";
 
 // Public client: PKCE authenticates it, no client secret. The redirect is an
 // IP-loopback URI (RFC 8252) registered on the hub.
@@ -19,6 +20,11 @@ function base64url(buf: Buffer): string {
 export async function runLogin(hubUrl?: string): Promise<void> {
   const hub = hubUrl ?? getHubUrl();
 
+  // Refuse to start the OAuth dance if the hub no longer supports this CLI;
+  // otherwise a stale client fails mid-flow with an opaque redirect error.
+  await enforceCliVersion(hub);
+  await notifyCliUpdate();
+
   // Generate PKCE parameters
   const codeVerifier = base64url(randomBytes(32));
   const codeChallenge = base64url(createHash("sha256").update(codeVerifier).digest());

package/src/commands/publish.ts

@@ -12,6 +12,7 @@ import {
   readManifest,
   writeManifest,
 } from "../utils/manifest";
+import { enforceCliVersion } from "../utils/version";
 import { runLogin } from "./login";
 
 interface PublishOptions {
@@ -38,6 +39,10 @@ export async function runPublish(
   // Step 2: Authenticate
   const hubUrl = hubUrlOverride ?? getHubUrl();
   if (hubUrlOverride) log.info(`Hub: ${hubUrl}`);
+
+  // Stop an unsupported CLI before it uploads against a protocol it predates.
+  await enforceCliVersion(hubUrl);
+
   let token = await getToken(hubUrl);
 
   if (!token) {

package/src/utils/version.ts

@@ -0,0 +1,66 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { log } from "@clack/prompts";
+import semver from "semver";
+
+/** This CLI's own version, read from the package.json it ships with. */
+export function getCliVersion(): string {
+  try {
+    const pkgPath = resolve(import.meta.dir, "../../package.json");
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf-8")) as { version?: string };
+    return pkg.version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+
+/**
+ * Ask the hub for the minimum CLI version its protocol still accepts and stop
+ * with an actionable message when this CLI is below it. Older hub-facing breaks
+ * (e.g. the 0.4.11 OAuth redirect change) surfaced as opaque errors; this turns
+ * them into "update your CLI". Network/parse failures are non-fatal: the check
+ * never blocks publishing when the hub can't be reached.
+ */
+export async function enforceCliVersion(hubUrl: string): Promise<void> {
+  const current = getCliVersion();
+
+  let minSupported: string | undefined;
+  try {
+    const res = await fetch(`${hubUrl}/api/widgets/cli-version`);
+    if (res.ok) {
+      const data = (await res.json()) as { minSupported?: string };
+      minSupported = data.minSupported;
+    }
+  } catch {
+    return;
+  }
+
+  if (minSupported && semver.valid(minSupported) && semver.lt(current, minSupported)) {
+    throw new Error(
+      `This widget CLI (${current}) is no longer supported by ${hubUrl} (minimum ${minSupported}).\n` +
+        "Update it:  bun add -g @glasshome/widget-cli@latest\n" +
+        "Or run once without installing:  bunx @glasshome/widget-cli@latest <command>",
+    );
+  }
+}
+
+/**
+ * Best-effort nudge: warn when a newer CLI is published on npm. Never blocks;
+ * any failure (offline, registry hiccup) is swallowed.
+ */
+export async function notifyCliUpdate(): Promise<void> {
+  const current = getCliVersion();
+  try {
+    const res = await fetch("https://registry.npmjs.org/@glasshome/widget-cli/latest");
+    if (!res.ok) return;
+    const data = (await res.json()) as { version?: string };
+    const latest = data.version;
+    if (latest && semver.valid(latest) && semver.gt(latest, current)) {
+      log.warn(
+        `A newer widget CLI is available (${current} → ${latest}). Update:  bun add -g @glasshome/widget-cli@latest`,
+      );
+    }
+  } catch {
+    // ignore
+  }
+}

package/template/package.json.template

@@ -16,6 +16,7 @@
     "@glasshome/widget-sdk": "^0.2.0"
   },
   "devDependencies": {
+    "@glasshome/widget-cli": "CLI_VERSION",
     "@types/bun": "latest",
     "typescript": "^5.0.0",
     "vite": "^7.3.1",