@house365/comate 0.9.20 → 0.9.23

package/bin/cli.mjs

@@ -8,10 +8,13 @@ import { dirname } from 'node:path';
 import { readFileSync } from 'node:fs';
 import { get } from 'node:https';
 
-import { run, skillsInvocation, SKILLS_TIMEOUT_MS } from './init.mjs';
+import { run, skillsInvocation, SKILLS_TIMEOUT_MS, atLeast } from './init.mjs';
 
 // Check npm registry for the latest version and notify if an update is available.
 async function checkForUpdates(currentVersion) {
+  // Escape hatch: skip the network round-trip entirely. Keeps `--version`
+  // deterministic and offline-safe in tests and CI.
+  if (process.env.COMATE_NO_UPDATE_CHECK) return;
   return new Promise((resolve) => {
     const req = get('https://registry.npmjs.org/@house365/comate/latest', { timeout: 3000 }, (res) => {
       if (res.statusCode !== 200) {
@@ -24,7 +27,11 @@ async function checkForUpdates(currentVersion) {
         try {
           const pkg = JSON.parse(data);
           const latestVersion = pkg.version;
-          if (latestVersion && latestVersion !== currentVersion) {
+          // Notify only when the registry is strictly newer. A plain `!==` also
+          // fired when local was ahead of the registry (e.g. mid-release, before
+          // publish lands), printing a bogus "update available" for an older
+          // version and polluting `--version` stdout.
+          if (latestVersion && atLeast(latestVersion, currentVersion) && latestVersion !== currentVersion) {
             console.log('');
             console.log(`\x1b[33m🔔 有新版本可用：${latestVersion} (当前版本：${currentVersion})\x1b[0m`);
             console.log(`\x1b[36m更新命令：npm install -g @house365/comate@latest\x1b[0m`);
@@ -61,6 +68,23 @@ const SKILLS_PASSTHROUGH = new Set([
   'experimental_sync',
 ]);
 
+// Flags accepted on a bare `comate [flags]` invocation — these forward to the
+// implicit `skills add`. Anything else starting with `-` is a typo (e.g.
+// `--vasdasd`) and must hit help instead of silently installing everything.
+// --version/-v and --help/-h are intercepted earlier, so they need not be here.
+const ADD_FLAGS = new Set([
+  '-g', '--global',
+  '-a', '--agent',
+  '-s', '--skill',
+  '-l', '--list',
+  '-y', '--yes',
+  '--copy',
+  '--metadata',
+  '--subagent',
+  '--all',
+  '--full-depth',
+]);
+
 const HELP_TEXT = `comate — SDD (规约驱动开发) 的 AI 开发编排器
 
 用法:
@@ -90,8 +114,11 @@ const packageVersion = JSON.parse(readFileSync(`${pkgRoot}/package.json`, 'utf8'
 
 if (args[0] === '--version' || args[0] === '-v') {
   console.log(packageVersion);
-  // Check for updates in the background, non-blocking
-  checkForUpdates(packageVersion).catch(() => {
+  // Await the check: without it, process.exit(0) fires synchronously and the
+  // process dies before the registry request resolves, so the update notice
+  // never prints. The check has its own 3s timeout, so a dead network stalls
+  // this by at most 3s.
+  await checkForUpdates(packageVersion).catch(() => {
     // Silently ignore network errors
   });
   process.exit(0);
@@ -132,6 +159,17 @@ if (args.length && !args[0].startsWith('-')) {
     printHelp(console.error);
     process.exit(1);
   }
+} else if (args[0]?.startsWith('-')) {
+  // Bare-flags mode: every arg is forwarded to the implicit `skills add`. Any
+  // dash-prefixed arg that isn't a known install flag is a typo (e.g.
+  // --vasdasd). Without this it fell through and silently installed everything.
+  // Flag values (e.g. `-a claude-code`) don't start with `-`, so they're safe.
+  const bad = args.find((a) => a.startsWith('-') && !ADD_FLAGS.has(a));
+  if (bad) {
+    console.error(`comate: 未知选项 '${bad}'\n`);
+    printHelp(console.error);
+    process.exit(1);
+  }
 }
 
 // No args, or only flags (-g, --list, …) = install every comate skill from this

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@house365/comate",
-  "version": "0.9.20",
+  "version": "0.9.23",
   "description": "comate —— SDD (规约驱动开发) 的 AI 开发编排器（Agent Skills）",
   "type": "module",
   "license": "MIT",