@glasshome/widget-cli 0.7.0 → 0.8.0

package/bin/cli.ts

@@ -2,6 +2,7 @@
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { intro, log, outro } from "@clack/prompts";
+import { notifyCliUpdate, notifySdkUpdate } from "../src/utils/version";
 
 function resolveWidgetDir(): string {
   if (explicitDir) {
@@ -94,6 +95,9 @@ if (effectiveCommand === "help") {
 
 intro(`glasshome-widget ${effectiveCommand}`);
 
+// Best-effort, throttled nudge when a newer CLI is on npm. Never blocks.
+await notifyCliUpdate();
+
 switch (effectiveCommand) {
   case "create": {
     const { runCreate } = await import("../src/commands/create");
@@ -110,8 +114,10 @@ switch (effectiveCommand) {
   }
 
   case "build": {
+    const widgetDir = resolveWidgetDir();
+    await notifySdkUpdate(widgetDir);
     const { runBuild } = await import("../src/commands/build");
-    await runBuild(resolveWidgetDir());
+    await runBuild(widgetDir);
     outro("Done");
     break;
   }
@@ -130,8 +136,10 @@ switch (effectiveCommand) {
 
   case "validate": {
     const widgetName = args[0];
+    const widgetDir = resolveWidgetDir();
+    await notifySdkUpdate(widgetDir);
     const { runValidate } = await import("../src/commands/validate");
-    const passed = await runValidate(resolveWidgetDir(), widgetName);
+    const passed = await runValidate(widgetDir, widgetName);
     outro(passed ? "All checks passed" : "Validation failed");
     process.exit(passed ? 0 : 1);
     break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glasshome/widget-cli",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "CLI for creating and managing GlassHome widgets",
   "type": "module",
   "bin": {
@@ -22,7 +22,7 @@
   "dependencies": {
     "@clack/prompts": "^1.6.0",
     "@glasshome/widget-contract": "0.1.1",
-    "@glasshome/widget-sdk": "1.4.0",
+    "@glasshome/widget-sdk": "1.4.1",
     "open": "^11.0.0",
     "picocolors": "^1.1.1",
     "semver": "^7.6.0",

package/src/commands/login.ts

@@ -3,7 +3,7 @@ import { createServer, type IncomingMessage, type ServerResponse } from "node:ht
 import { log, spinner } from "@clack/prompts";
 import open from "open";
 import { getHubUrl, storeToken } from "../utils/auth";
-import { enforceCliVersion, notifyCliUpdate } from "../utils/version";
+import { enforceCliVersion } from "../utils/version";
 
 // Public client: PKCE authenticates it, no client secret. The redirect is an
 // IP-loopback URI (RFC 8252) registered on the hub.
@@ -23,7 +23,6 @@ export async function runLogin(hubUrl?: string): Promise<void> {
   // Refuse to start the OAuth dance if the hub no longer supports this CLI;
   // otherwise a stale client fails mid-flow with an opaque redirect error.
   await enforceCliVersion(hub);
-  await notifyCliUpdate();
 
   // Generate PKCE parameters
   const codeVerifier = base64url(randomBytes(32));
@@ -149,10 +148,19 @@ export async function runLogin(hubUrl?: string): Promise<void> {
     name?: string;
     email?: string;
     sub?: string;
+    username?: string;
   };
   const displayName = userInfo.name || userInfo.email || userInfo.sub || "unknown";
-  const scopeBase = userInfo.name || userInfo.email?.split("@")[0] || userInfo.sub || "unknown";
-  const scope = scopeBase.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+  // The hub assigns each account a stable, unique personal scope (its username)
+  // and is the source of truth; publish always re-fetches the live scope list
+  // from /api/widgets/scopes. Prefer that username here so the stored value and
+  // the login message match what the user actually publishes under. Fall back to
+  // local derivation only for older hubs that don't return a username yet.
+  const scope =
+    userInfo.username ||
+    (userInfo.name || userInfo.email?.split("@")[0] || userInfo.sub || "unknown")
+      .toLowerCase()
+      .replace(/[^a-z0-9-]/g, "-");
 
   // Store tokens
   storeToken({

package/src/commands/upgrade.ts

@@ -122,8 +122,7 @@ export async function runUpgrade(cwd: string): Promise<void> {
       log.warn(`Synced to ${sdkVersion} but validation has warnings/errors. Check above.`);
     }
   } else {
-    // Standalone mode: can't fetch from npm (private package), guide user
-    log.info("@glasshome/widget-sdk is a workspace package and is not published to npm.");
+    log.info("Not inside the widget workspace. Upgrade @glasshome/widget-sdk manually:");
     note(
       [
         "1. Bump @glasshome/widget-sdk in package.json peerDependencies",

package/src/commands/validate.ts

@@ -6,6 +6,7 @@ import {
   publishManifestSchema,
   requiresCapabilities,
 } from "@glasshome/widget-contract";
+import semver from "semver";
 import {
   discoverWidgets,
   formatBytes,
@@ -14,6 +15,7 @@ import {
   readRegistry,
   type WidgetManifest,
 } from "../utils/manifest";
+import { getProjectSdkVersion } from "../utils/version";
 
 interface ValidationResult {
   passed: boolean;
@@ -155,6 +157,9 @@ export async function runValidate(
 
   const failed: string[] = [];
 
+  // Manifest sdkVersion range must admit the pinned SDK, else it lies about compatibility.
+  const projectSdk = getProjectSdkVersion(cwd);
+
   for (const name of toValidate) {
     if (!quiet) log.step(name);
 
@@ -184,6 +189,19 @@ export async function runValidate(
       }
     }
 
+    if (
+      !quiet &&
+      projectSdk &&
+      manifest.sdkVersion &&
+      manifest.sdkVersion !== "*" &&
+      semver.validRange(manifest.sdkVersion) &&
+      !semver.satisfies(projectSdk, manifest.sdkVersion)
+    ) {
+      log.warn(
+        `  - manifest sdkVersion "${manifest.sdkVersion}" excludes the installed SDK ${projectSdk}; run \`bun widget upgrade\``,
+      );
+    }
+
     // Check bundle exists
     const bundlePath = resolve(cwd, "dist", `${name}.js`);
     if (!existsSync(bundlePath)) {

package/src/utils/version.ts

@@ -1,5 +1,6 @@
-import { readFileSync } from "node:fs";
-import { resolve } from "node:path";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
 import { log } from "@clack/prompts";
 import semver from "semver";
 
@@ -44,23 +45,131 @@ export async function enforceCliVersion(hubUrl: string): Promise<void> {
   }
 }
 
+const UPDATE_CACHE_FILE = join(homedir(), ".glasshome", "update-check.json");
+// Hit npm at most once per day; every other run reads the cached result.
+const UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+// Cap the daily refresh so a slow registry never stalls a command.
+const UPDATE_FETCH_TIMEOUT_MS = 2000;
+const CLI_PKG = "@glasshome/widget-cli";
+const SDK_PKG = "@glasshome/widget-sdk";
+
+interface UpdateCache {
+  lastCheck: number;
+  cli: string | null;
+  sdk: string | null;
+}
+
+function notifierDisabled(): boolean {
+  return Boolean(process.env.GLASSHOME_NO_UPDATE_NOTIFIER || process.env.CI);
+}
+
+function readUpdateCache(): UpdateCache | null {
+  try {
+    const raw = JSON.parse(readFileSync(UPDATE_CACHE_FILE, "utf-8")) as Partial<UpdateCache>;
+    if (typeof raw.lastCheck === "number") {
+      return {
+        lastCheck: raw.lastCheck,
+        cli: typeof raw.cli === "string" ? raw.cli : null,
+        sdk: typeof raw.sdk === "string" ? raw.sdk : null,
+      };
+    }
+  } catch {}
+  return null;
+}
+
+function writeUpdateCache(cache: UpdateCache): void {
+  try {
+    mkdirSync(join(homedir(), ".glasshome"), { recursive: true });
+    writeFileSync(UPDATE_CACHE_FILE, JSON.stringify(cache), { mode: 0o600 });
+  } catch {}
+}
+
+async function fetchLatestVersion(pkg: string): Promise<string | null> {
+  try {
+    const res = await fetch(`https://registry.npmjs.org/${pkg}/latest`, {
+      signal: AbortSignal.timeout(UPDATE_FETCH_TIMEOUT_MS),
+    });
+    if (!res.ok) return null;
+    const data = (await res.json()) as { version?: string };
+    return data.version ?? null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Latest published cli + sdk versions, refreshing the shared daily cache when
+ * stale. Warm runs stay offline; a failed refresh keeps the last known value.
+ */
+async function getLatestVersions(): Promise<{ cli: string | null; sdk: string | null }> {
+  const cache = readUpdateCache();
+  const now = Date.now();
+  if (cache && now - cache.lastCheck < UPDATE_CHECK_INTERVAL_MS) {
+    return { cli: cache.cli, sdk: cache.sdk };
+  }
+  const [cli, sdk] = await Promise.all([
+    fetchLatestVersion(CLI_PKG),
+    fetchLatestVersion(SDK_PKG),
+  ]);
+  const merged = { cli: cli ?? cache?.cli ?? null, sdk: sdk ?? cache?.sdk ?? null };
+  writeUpdateCache({ lastCheck: now, ...merged });
+  return merged;
+}
+
 /**
- * Best-effort nudge: warn when a newer CLI is published on npm. Never blocks;
- * any failure (offline, registry hiccup) is swallowed.
+ * Best-effort nudge: warn when a newer CLI is published on npm. Runs on every
+ * command but only queries the registry once per day (shared cache in
+ * ~/.glasshome/update-check.json) so warm runs stay offline and instant. Never
+ * blocks; any failure (offline, registry hiccup) is swallowed. Opt out with
+ * GLASSHOME_NO_UPDATE_NOTIFIER or CI.
  */
 export async function notifyCliUpdate(): Promise<void> {
+  if (notifierDisabled()) return;
+
   const current = getCliVersion();
+  const { cli: latest } = await getLatestVersions();
+  if (latest && semver.valid(latest) && semver.gt(latest, current)) {
+    log.warn(
+      `A newer widget CLI is available (${current} → ${latest}). Update:  bun add -g ${CLI_PKG}@latest`,
+    );
+  }
+}
+
+/** The @glasshome/widget-sdk version this project declares in its package.json. */
+export function getProjectSdkVersion(cwd: string): string | null {
   try {
-    const res = await fetch("https://registry.npmjs.org/@glasshome/widget-cli/latest");
-    if (!res.ok) return;
-    const data = (await res.json()) as { version?: string };
-    const latest = data.version;
-    if (latest && semver.valid(latest) && semver.gt(latest, current)) {
-      log.warn(
-        `A newer widget CLI is available (${current} → ${latest}). Update:  bun add -g @glasshome/widget-cli@latest`,
-      );
-    }
+    const pkg = JSON.parse(readFileSync(join(cwd, "package.json"), "utf-8")) as {
+      dependencies?: Record<string, string>;
+      devDependencies?: Record<string, string>;
+      peerDependencies?: Record<string, string>;
+    };
+    const range =
+      pkg.peerDependencies?.[SDK_PKG] ??
+      pkg.devDependencies?.[SDK_PKG] ??
+      pkg.dependencies?.[SDK_PKG];
+    if (!range) return null;
+    const clean = range.replace(/^[\^~]/, "");
+    return semver.valid(clean) ? clean : null;
   } catch {
-    // ignore
+    return null;
+  }
+}
+
+/**
+ * Best-effort nudge: warn when the project's @glasshome/widget-sdk is behind the
+ * latest published SDK. Same throttled cache as the CLI check; opt out the same
+ * way. No-ops outside a widget project or when the pin isn't a plain version.
+ */
+export async function notifySdkUpdate(cwd: string): Promise<void> {
+  if (notifierDisabled()) return;
+
+  const declared = getProjectSdkVersion(cwd);
+  if (!declared) return;
+
+  const { sdk: latest } = await getLatestVersions();
+  if (latest && semver.valid(latest) && semver.gt(latest, declared)) {
+    log.warn(
+      `A newer widget SDK is available (${declared} → ${latest}). Update:  bun widget upgrade`,
+    );
   }
 }