@iamdevlinph/codex-kit 1.1.7 → 1.1.8

package/README.md

@@ -60,6 +60,12 @@ existing active guidance. During reconciliation, Codex merges only applicable
 rules into the project's `AGENTS.md` and preserves its local organization and
 adaptations.
 
+Both `project init` and `project sync` contact the public npm registry before
+writing project files. If the installed CLI is stale, or npm is unreachable or
+returns invalid metadata, the command fails without changing the project. Rerun
+with `pnpm dlx @iamdevlinph/codex-kit@latest` after the registry is available;
+stale builds print the exact command.
+
 ## Commands
 
 | Action | Command |
@@ -179,7 +185,10 @@ codex-kit project sync --cwd /path/to/project
 - Codex with custom subagent and lifecycle-hook support
 
 The published package contains no credentials or runtime dependencies. Version
-checks contact the public npm registry only when `codex-kit version check` runs.
+checks and project initialization/synchronization contact the public npm
+registry; project operations fail closed before writing when that check cannot
+verify the latest release. The CLI never auto-installs or executes downloaded
+code.
 
 ## Security and license
 

package/bin/codex-kit.js

@@ -575,6 +575,87 @@ function uninstallGlobal(options) {
 // src/project/commands.ts
 import { existsSync as existsSync6, statSync as statSync2 } from "node:fs";
 import { join as join6 } from "node:path";
+
+// src/version.ts
+function parseVersion(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(value);
+  if (!match) throw new Error(`Invalid package version: ${value}`);
+  return {
+    numbers: [Number(match[1]), Number(match[2]), Number(match[3])],
+    prerelease: match[4] ?? null
+  };
+}
+function compareVersions(left, right) {
+  const a = parseVersion(left);
+  const b = parseVersion(right);
+  for (const [leftNumber, rightNumber] of [
+    [a.numbers[0], b.numbers[0]],
+    [a.numbers[1], b.numbers[1]],
+    [a.numbers[2], b.numbers[2]]
+  ])
+    if (leftNumber !== rightNumber) return Math.sign(leftNumber - rightNumber);
+  if (a.prerelease === b.prerelease) return 0;
+  if (!a.prerelease) return 1;
+  if (!b.prerelease) return -1;
+  return Math.sign(
+    a.prerelease.localeCompare(b.prerelease, "en", { numeric: true })
+  );
+}
+async function fetchLatestVersion() {
+  const url = `${REGISTRY}/${encodeURIComponent(PACKAGE.name)}/latest`;
+  let response;
+  try {
+    response = await fetch(url, { signal: AbortSignal.timeout(15e3) });
+  } catch (error) {
+    throw new Error(
+      `Unable to check ${REGISTRY}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (!response.ok)
+    throw new Error(
+      `Unable to check ${REGISTRY}: ${response.status} ${response.statusText}`
+    );
+  let value;
+  try {
+    value = await response.json();
+  } catch {
+    throw new Error("Registry returned no package version.");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value) || typeof value.version !== "string")
+    throw new Error("Registry returned no package version.");
+  const latest = value.version;
+  parseVersion(latest);
+  return latest;
+}
+async function getLatestVersion() {
+  const override = process.env.CODEX_KIT_LATEST_VERSION;
+  if (override) {
+    parseVersion(override);
+    return override;
+  }
+  return fetchLatestVersion();
+}
+async function checkVersion() {
+  const latest = await getLatestVersion();
+  console.log(`Installed: ${PACKAGE.version}`);
+  console.log(`Latest:    ${latest}`);
+  const comparison = compareVersions(PACKAGE.version, latest);
+  if (comparison === 0) {
+    console.log("codex-kit is up to date.");
+    return;
+  }
+  if (comparison > 0) {
+    console.log("This local build is newer than the published package.");
+    return;
+  }
+  console.log(
+    `Update available. Run:
+  pnpm add --global ${PACKAGE.name}@latest
+  codex-kit global install`
+  );
+}
+
+// src/project/commands.ts
 var STATE_FILE2 = ".codex-kit-state.json";
 var PROJECT_BEGIN = "<!-- BEGIN codex-kit:shared-template -->";
 var PROJECT_END = "<!-- END codex-kit:shared-template -->";
@@ -644,9 +725,17 @@ and validation succeed, confirm codex-kit project status is up to date, then
 report any template-worthy generalized promotion.
 ===== END CODEX RECONCILIATION PROMPT =====`;
 }
-function syncProject(options) {
+async function syncProject(options, action = "sync") {
   const { cwd } = options;
   requireDirectory(cwd);
+  const latest = await getLatestVersion();
+  if (compareVersions(PACKAGE.version, latest) < 0)
+    throw new Error(
+      `Installed: ${PACKAGE.version}
+Latest:    ${latest}
+Published guidelines are newer than this local build. Rerun with:
+  pnpm dlx ${PACKAGE.name}@latest project ${action} --cwd '${cwd.replaceAll("'", "'\\''")}'`
+    );
   const agentsFile = join6(cwd, "AGENTS.md");
   const stagedTemplate = join6(cwd, "TEMPLATE_AGENTS.md");
   const desired = Buffer.from(readText(TEMPLATE_FILE));
@@ -744,79 +833,6 @@ function markApplied(options) {
   console.log(`recorded template reconciliation: ${stagedTemplate}`);
 }
 
-// src/version.ts
-function parseVersion(value) {
-  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(value);
-  if (!match) throw new Error(`Invalid package version: ${value}`);
-  return {
-    numbers: [Number(match[1]), Number(match[2]), Number(match[3])],
-    prerelease: match[4] ?? null
-  };
-}
-function compareVersions(left, right) {
-  const a = parseVersion(left);
-  const b = parseVersion(right);
-  for (const [leftNumber, rightNumber] of [
-    [a.numbers[0], b.numbers[0]],
-    [a.numbers[1], b.numbers[1]],
-    [a.numbers[2], b.numbers[2]]
-  ])
-    if (leftNumber !== rightNumber) return Math.sign(leftNumber - rightNumber);
-  if (a.prerelease === b.prerelease) return 0;
-  if (!a.prerelease) return 1;
-  if (!b.prerelease) return -1;
-  return Math.sign(
-    a.prerelease.localeCompare(b.prerelease, "en", { numeric: true })
-  );
-}
-async function fetchLatestVersion() {
-  const url = `${REGISTRY}/${encodeURIComponent(PACKAGE.name)}/latest`;
-  let response;
-  try {
-    response = await fetch(url, { signal: AbortSignal.timeout(15e3) });
-  } catch (error) {
-    throw new Error(
-      `Unable to check ${REGISTRY}: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-  if (!response.ok)
-    throw new Error(
-      `Unable to check ${REGISTRY}: ${response.status} ${response.statusText}`
-    );
-  let value;
-  try {
-    value = await response.json();
-  } catch {
-    throw new Error("Registry returned no package version.");
-  }
-  if (!value || typeof value !== "object" || Array.isArray(value) || typeof value.version !== "string")
-    throw new Error("Registry returned no package version.");
-  const latest = value.version;
-  parseVersion(latest);
-  return latest;
-}
-async function checkVersion() {
-  let latest = process.env.CODEX_KIT_LATEST_VERSION;
-  if (!latest) latest = await fetchLatestVersion();
-  if (!latest) throw new Error("Registry returned no package version.");
-  console.log(`Installed: ${PACKAGE.version}`);
-  console.log(`Latest:    ${latest}`);
-  const comparison = compareVersions(PACKAGE.version, latest);
-  if (comparison === 0) {
-    console.log("codex-kit is up to date.");
-    return;
-  }
-  if (comparison > 0) {
-    console.log("This local build is newer than the published package.");
-    return;
-  }
-  console.log(
-    `Update available. Run:
-  pnpm add --global ${PACKAGE.name}@latest
-  codex-kit global install`
-  );
-}
-
 // src/cli/options.ts
 import { homedir } from "node:os";
 import { join as join7, resolve as resolve2 } from "node:path";
@@ -865,8 +881,8 @@ Commands:
   global configure     Set the orchestrator and normal/Plan reasoning defaults.
   global list          Show model settings, routing status, and custom agents.
   global uninstall     Restore managed config values and remove package-owned files.
-  project init         Initialize AGENTS.md, TEMPLATE_AGENTS.md, and project state.
-  project sync         Refresh TEMPLATE_AGENTS.md without editing AGENTS.md.
+  project init         Initialize project files after checking the latest npm release.
+  project sync         Refresh the template after checking the latest npm release.
   project status       Show whether template changes still need reconciliation.
   project mark-applied Record the current template as reconciled with AGENTS.md.
   version check        Compare the installed version with the latest npm release.
@@ -891,6 +907,7 @@ Options by command:
 
   project init, project sync
     --cwd PATH  Use a project directory other than the current directory.
+                npm access is required; stale or unverifiable builds fail before writes.
 
   project status, project mark-applied
     --cwd PATH  Use a project directory other than the current directory.
@@ -919,7 +936,7 @@ async function main(argv = process.argv.slice(2)) {
   else if (scope === "global" && action === "uninstall")
     uninstallGlobal(options);
   else if (scope === "project" && (action === "init" || action === "sync"))
-    syncProject(options);
+    await syncProject(options, action);
   else if (scope === "project" && action === "status") projectStatus(options);
   else if (scope === "project" && action === "mark-applied")
     markApplied(options);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@iamdevlinph/codex-kit",
-	"version": "1.1.7",
+	"version": "1.1.8",
 	"description": "Portable Codex subagents and project AGENTS.md defaults.",
 	"type": "module",
 	"bin": {