@jelou/cli 1.36.0 → 1.37.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jelou/cli",
-  "version": "1.36.0",
+  "version": "1.37.1",
   "description": "Build AI agents on the Jelou platform — from your terminal or your AI editor.",
   "author": "Jelou Inc. (https://jelou.ai)",
   "license": "SEE LICENSE IN LICENSE",
@@ -23,11 +23,11 @@
     "THIRD_PARTY_NOTICES.md"
   ],
   "optionalDependencies": {
-    "@jelou/cli-darwin-arm64": "1.36.0",
-    "@jelou/cli-darwin-x64": "1.36.0",
-    "@jelou/cli-linux-x64": "1.36.0",
-    "@jelou/cli-linux-arm64": "1.36.0",
-    "@jelou/cli-win32-x64": "1.36.0"
+    "@jelou/cli-darwin-arm64": "1.37.1",
+    "@jelou/cli-darwin-x64": "1.37.1",
+    "@jelou/cli-linux-x64": "1.37.1",
+    "@jelou/cli-linux-arm64": "1.37.1",
+    "@jelou/cli-win32-x64": "1.37.1"
   },
   "keywords": [
     "jelou",
@@ -56,35 +56,43 @@
     "access": "public"
   },
   "jelou": {
-    "minVersion": "1.36.0",
+    "minVersion": "1.37.1",
     "release_notes": {
-      "version": "1.36.0",
-      "date": "2026-05-26",
-      "headline": "`jelou login` is friction-free on first run, and update notices now reach every CLI instance.",
+      "version": "1.37.1",
+      "date": "2026-05-27",
+      "headline": "Fixed `meta.update_available.below_floor` dropping on error exits and env-var bypasses.",
       "highlights": [
         {
-          "type": "improved",
-          "text": "First-time `jelou login` no longer asks for a \"Profile name\" — it saves silently as your company slug and the outro tells you how to add more accounts later. Power users can still pass `--profile <name>` explicitly."
+          "type": "fixed",
+          "text": "`meta.update_available.below_floor: true` is now stamped on every agent envelope when the CLI is below the floor — including error responses (auth, input, validation). Previously ~187 `output.failWith` callsites silently terminated before the envelope meta was attached."
         },
         {
-          "type": "improved",
-          "text": "Re-logging into an existing profile (token rotation, fresh laptop) now silently refreshes the token instead of prompting to overwrite. Different accounts that slug to the same name auto-suffix (e.g. `acme-corp-2`)."
+          "type": "fixed",
+          "text": "`JELOU_NO_UPDATE_CHECK=1` and `JELOU_ALLOW_OUTDATED=1` no longer silence the floor signal. Both env vars remain valid for skipping network probes / suppressing stderr noise; the agent-visible flag is unconditional now."
+        },
+        {
+          "type": "fixed",
+          "text": "Hostile or middleman'd npm registry payloads with an unterminated OSC hyperlink (e.g. `\\x1b]8;;<URL>` with no `\\x07` terminator) can no longer inject visible attacker URLs into the update prompt's release-notes display."
+        },
+        {
+          "type": "new",
+          "text": "`meta.update_available.min_version` field on the agent envelope when below floor — distinguishes the published `minVersion` floor from `latest` (registry's most-recent build). Agents can now render \"upgrade to at least X\" accurately."
         },
         {
           "type": "improved",
-          "text": "The \"Update available\" notice now fires on every CLI invocation — previously it was silenced when stdout wasn't a TTY, so piped commands never saw it."
+          "text": "Stderr footer now reads `Update required: X → Y (below minimum version Z)` when the CLI is below floor (previously used identical wording to a routine soft update)."
         },
         {
           "type": "improved",
-          "text": "Skill preambles now surface optional CLI upgrades via a new `CLI_UPDATE_AVAILABLE` marker. Agents can offer the upgrade before the hard floor kicks in, instead of waiting for things to break."
+          "text": "Audit log line under `~/.jelou/hard-stops.log` restored to `blocked outdated currentVersion=...` prefix for back-compat with anchored `^blocked` ops dashboards."
         },
         {
-          "type": "new",
-          "text": "`jelou skills ack-update --version <X>` — dismiss the optional-upgrade prompt for one version. New releases re-prompt automatically; no time-based snooze surprises."
+          "type": "heads_up",
+          "text": "`minVersion` floor moves from `1.37.0` to `1.37.1`. Every CLI below `1.37.1` will see the soft \"Update available\" prompt on next invocation (within ~5 min cache TTL); `--json`/`--agent` envelopes also stamp `below_floor: true`. The CLI still runs either way — nothing is blocked."
         },
         {
           "type": "heads_up",
-          "text": "The `jelou.minVersion` floor moves from `1.35.0` to `1.36.0`. Older CLIs hard-stop on the next non-allow-listed invocation until the user runs `npm install -g @jelou/cli@latest`. Emergency bypass: `JELOU_ALLOW_OUTDATED=1`."
+          "text": "`JELOU_ALLOW_OUTDATED=1` is now a no-op (emits a once-per-machine deprecation note on first use). Safe to remove from `.zshrc` / CI configs."
         }
       ]
     }