@moda-ai/cli 1.3.0 → 1.4.0

package/dist/cli.js

@@ -14,6 +14,7 @@ import { runSyncCommand } from './sync.js';
 import { runDoctorCommand, runStatusCommand } from './doctor.js';
 import { CliInputError } from './errors.js';
 import { isTelemetryDisabled, sendCliUsageTelemetry, stripTelemetryFlag, } from './telemetry.js';
+import { isUpdateCheckDisabled, printUpdateNotice, startUpdateCheck, stripUpdateCheckFlag, } from './update-check.js';
 import { createCommandContext } from './command-context.js';
 import { createCommandRegistry } from './command-registry.js';
 import { createAgentErrorEnvelope, errorToAgentError, outputModeFromFlags, } from './output.js';
@@ -178,6 +179,7 @@ Common flags:
   --yes                            Accept explicit automation defaults
   --tui                            Force the human analyst dashboard when supported
   --no-tui                         Show raw analyst stream instead of dashboard
+  --no-update-check                Skip the daily new-version check (or MODA_CLI_UPDATE_CHECK=0)
 
 Runs flags:
   --outcome=OUTCOME                Filter by outcome (running|succeeded|partial|failed|loop|abandoned|unknown)
@@ -961,8 +963,9 @@ function printAgentCliError(command, error) {
 }
 export async function dispatchParsedCommand(parsed, startedAt = Date.now()) {
     const { command, flags } = parsed;
-    const commandFlags = stripTelemetryFlag(flags);
+    const commandFlags = stripUpdateCheckFlag(stripTelemetryFlag(flags));
     const telemetryDisabled = isTelemetryDisabled(flags);
+    const updateCheckDisabled = isUpdateCheckDisabled(flags);
     if (command === '--version' || command === '-V' || flags.version === 'true') {
         console.log(`moda-cli ${VERSION}`);
         return 0;
@@ -989,6 +992,11 @@ export async function dispatchParsedCommand(parsed, startedAt = Date.now()) {
     if (definition.name === 'agent' && commandFlags.json !== 'true') {
         commandFlags.agent = 'true';
     }
+    // Kick off the registry check before the handler so the (at most daily)
+    // request overlaps with command work instead of delaying exit.
+    if (!updateCheckDisabled) {
+        void startUpdateCheck();
+    }
     if (definition.validateConfigBeforeRun) {
         validateConfig();
     }
@@ -1014,6 +1022,9 @@ export async function dispatchParsedCommand(parsed, startedAt = Date.now()) {
                 apiRequestCount: getApiRequestCount(),
             });
         }
+        if (!updateCheckDisabled) {
+            printUpdateNotice();
+        }
         return result.exitCode;
     }
     catch (error) {
@@ -1035,6 +1046,9 @@ export async function dispatchParsedCommand(parsed, startedAt = Date.now()) {
         else {
             printCliError(error);
         }
+        if (!updateCheckDisabled) {
+            printUpdateNotice();
+        }
         return 1;
     }
 }

package/dist/update-check.d.ts

@@ -0,0 +1,31 @@
+import { type ProfileIOOptions } from './profiles.js';
+export declare function stripUpdateCheckFlag(flags: Record<string, string>): Record<string, string>;
+export declare function isUpdateCheckDisabled(flags: Record<string, string>, env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Numeric semver comparison ignoring prerelease/build suffixes; npm's
+ * `latest` dist-tag only carries stable releases, so this is sufficient
+ * without pulling in a semver dependency.
+ */
+export declare function isNewerVersion(candidate: string, current: string): boolean;
+/**
+ * Refresh the cached latest version from the npm registry at most once per
+ * 24 hours. Fire-and-forget from the CLI dispatcher. The abort timer is
+ * unref'd so it can't keep the process alive after the socket closes (it does
+ * not unref the in-flight fetch itself — a fast command may still wait up to
+ * REGISTRY_TIMEOUT_MS for the request to resolve, matching the telemetry
+ * module's trade-off). Every failure path is swallowed — an update check must
+ * never break a command.
+ */
+export declare function startUpdateCheck(options?: ProfileIOOptions, now?: number): Promise<void>;
+/**
+ * Returns the upgrade notice when the cached registry version is newer than
+ * the running build, or undefined. Reads only the local cache — never the
+ * network — so it is safe to call synchronously at the end of every command.
+ */
+export declare function getUpdateNotice(options?: ProfileIOOptions): string | undefined;
+/**
+ * Print the upgrade notice to stderr in interactive terminals only: stdout
+ * stays machine-readable, and piped/CI invocations stay noise-free.
+ */
+export declare function printUpdateNotice(options?: ProfileIOOptions): void;
+//# sourceMappingURL=update-check.d.ts.map

package/dist/update-check.js

@@ -0,0 +1,141 @@
+// src/update-check.ts — Daily npm-registry version check with an upgrade
+// notice. Mirrors the telemetry contract: fire-and-forget, short abort
+// timeout, never throws, and never touches stdout (notice goes to stderr so
+// JSON/agent output stays machine-readable).
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { VERSION } from './config.js';
+import { getModaDir } from './profiles.js';
+const UPDATE_CHECK_FLAG = 'no-update-check';
+const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+const REGISTRY_TIMEOUT_MS = 1_500;
+const REGISTRY_LATEST_URL = 'https://registry.npmjs.org/@moda-ai/cli/latest';
+// npm's `latest` dist-tag is always a stable semver. Anchored, no control
+// chars: a registry response intercepted by a proxy can't smuggle ANSI escape
+// sequences into the cache (and thus the terminal notice) this way.
+const SEMVER_RE = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
+export function stripUpdateCheckFlag(flags) {
+    const { [UPDATE_CHECK_FLAG]: _drop, ...rest } = flags;
+    return rest;
+}
+export function isUpdateCheckDisabled(flags, env = process.env) {
+    return (flags[UPDATE_CHECK_FLAG] === 'true' ||
+        env.MODA_CLI_UPDATE_CHECK === '0' ||
+        env.DO_NOT_TRACK === '1' ||
+        // Treat CI as set only when it carries a real truthy value: `CI=false`
+        // and `CI=0` are common ways to simulate a non-CI shell locally.
+        (env.CI !== undefined &&
+            env.CI !== '' &&
+            env.CI !== 'false' &&
+            env.CI !== '0'));
+}
+function cachePath(options = {}) {
+    return join(getModaDir(options), 'update-check.json');
+}
+function readCache(options = {}) {
+    try {
+        const parsed = JSON.parse(readFileSync(cachePath(options), 'utf8'));
+        if (parsed &&
+            typeof parsed === 'object' &&
+            typeof parsed.checked_at === 'number' &&
+            typeof parsed.latest === 'string') {
+            return parsed;
+        }
+    }
+    catch {
+        // Missing or corrupt cache means "never checked".
+    }
+    return undefined;
+}
+function writeCache(cache, options = {}) {
+    try {
+        mkdirSync(getModaDir(options), { recursive: true });
+        writeFileSync(cachePath(options), `${JSON.stringify(cache, null, 2)}\n`, 'utf8');
+    }
+    catch {
+        // Best-effort: an unwritable cache only means we re-check next run.
+    }
+}
+/**
+ * Numeric semver comparison ignoring prerelease/build suffixes; npm's
+ * `latest` dist-tag only carries stable releases, so this is sufficient
+ * without pulling in a semver dependency.
+ */
+export function isNewerVersion(candidate, current) {
+    const parse = (v) => v.split(/[-+]/)[0].split('.').map((part) => Number.parseInt(part, 10) || 0);
+    const a = parse(candidate);
+    const b = parse(current);
+    for (let i = 0; i < 3; i++) {
+        if ((a[i] ?? 0) > (b[i] ?? 0))
+            return true;
+        if ((a[i] ?? 0) < (b[i] ?? 0))
+            return false;
+    }
+    return false;
+}
+/**
+ * Refresh the cached latest version from the npm registry at most once per
+ * 24 hours. Fire-and-forget from the CLI dispatcher. The abort timer is
+ * unref'd so it can't keep the process alive after the socket closes (it does
+ * not unref the in-flight fetch itself — a fast command may still wait up to
+ * REGISTRY_TIMEOUT_MS for the request to resolve, matching the telemetry
+ * module's trade-off). Every failure path is swallowed — an update check must
+ * never break a command.
+ */
+export async function startUpdateCheck(options = {}, now = Date.now()) {
+    const cache = readCache(options);
+    if (cache && now - cache.checked_at < CHECK_INTERVAL_MS) {
+        return;
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), REGISTRY_TIMEOUT_MS);
+    if (typeof timeout.unref === 'function') {
+        timeout.unref();
+    }
+    try {
+        const res = await fetch(REGISTRY_LATEST_URL, {
+            headers: { Accept: 'application/json' },
+            signal: controller.signal,
+        });
+        if (!res.ok)
+            return;
+        const body = (await res.json());
+        if (typeof body.version !== 'string' || !SEMVER_RE.test(body.version))
+            return;
+        writeCache({ checked_at: now, latest: body.version }, options);
+    }
+    catch {
+        // Network/timeout errors are expected offline; try again next run.
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+/**
+ * Returns the upgrade notice when the cached registry version is newer than
+ * the running build, or undefined. Reads only the local cache — never the
+ * network — so it is safe to call synchronously at the end of every command.
+ */
+export function getUpdateNotice(options = {}) {
+    const cache = readCache(options);
+    if (!cache || !isNewerVersion(cache.latest, VERSION)) {
+        return undefined;
+    }
+    return [
+        '',
+        `Update available: moda-cli ${VERSION} → ${cache.latest}`,
+        'Run `npm install -g @moda-ai/cli@latest` to update.',
+    ].join('\n');
+}
+/**
+ * Print the upgrade notice to stderr in interactive terminals only: stdout
+ * stays machine-readable, and piped/CI invocations stay noise-free.
+ */
+export function printUpdateNotice(options = {}) {
+    if (!process.stderr.isTTY)
+        return;
+    const notice = getUpdateNotice(options);
+    if (notice)
+        console.error(notice);
+}
+//# sourceMappingURL=update-check.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moda-ai/cli",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "CLI for Moda - AI agent analytics and observability",
   "type": "module",
   "bin": {