@nordbyte/nordrelay 0.5.0 → 0.5.2

package/dist/channel-actions.js

@@ -52,13 +52,13 @@ export function renderAgentUpdatePickerAction(descriptors) {
             "Agent updates:",
             ...available.map((descriptor) => `${descriptor.label}: /update ${descriptor.id}`),
             "",
-            "Use /update jobs to list running and recent agent updates.",
+            "Use /update install <agent> for missing CLIs and /update jobs to list running and recent agent updates.",
         ].join("\n"),
         html: [
             "<b>Agent updates:</b>",
             ...available.map((descriptor) => `<b>${escapeHTML(descriptor.label)}:</b> <code>/update ${escapeHTML(descriptor.id)}</code>`),
             "",
-            "Use <code>/update jobs</code> to list running and recent agent updates.",
+            "Use <code>/update install &lt;agent&gt;</code> for missing CLIs and <code>/update jobs</code> to list running and recent agent updates.",
         ].join("\n"),
         buttons,
     };
@@ -86,13 +86,13 @@ export function renderAgentUpdateJobsAction(jobs) {
     return {
         plain: [
             "Agent update jobs:",
-            ...limited.map((job) => `${job.id}: ${job.agentLabel} · ${job.status} · ${formatLocalDateTime(new Date(job.updatedAt))}`),
+            ...limited.map((job) => `${job.id}: ${job.agentLabel} ${job.operation ?? "update"} · ${job.status} · ${formatLocalDateTime(new Date(job.updatedAt))}`),
             "",
             "Use /update log <id>, /update cancel <id>, or /update input <id> <text>.",
         ].join("\n"),
         html: [
             "<b>Agent update jobs:</b>",
-            ...limited.map((job) => `<code>${escapeHTML(job.id)}</code> ${escapeHTML(job.agentLabel)} · <b>${escapeHTML(job.status)}</b> · <code>${escapeHTML(formatLocalDateTime(new Date(job.updatedAt)))}</code>`),
+            ...limited.map((job) => `<code>${escapeHTML(job.id)}</code> ${escapeHTML(job.agentLabel)} ${escapeHTML(job.operation ?? "update")} · <b>${escapeHTML(job.status)}</b> · <code>${escapeHTML(formatLocalDateTime(new Date(job.updatedAt)))}</code>`),
             "",
             "Use <code>/update log &lt;id&gt;</code>, <code>/update cancel &lt;id&gt;</code>, or <code>/update input &lt;id&gt; &lt;text&gt;</code>.",
         ].join("\n"),
@@ -106,7 +106,7 @@ export function renderAgentUpdateJobAction(job) {
     const tail = trimLine(job.outputTail || "(waiting for output)", 1200);
     return {
         plain: [
-            `${job.agentLabel} update ${job.status}.`,
+            `${job.agentLabel} ${job.operation ?? "update"} ${job.status}.`,
             `ID: ${job.id}`,
             `Method: ${job.method}`,
             `Command: ${command}`,
@@ -120,7 +120,7 @@ export function renderAgentUpdateJobAction(job) {
             tail,
         ].filter(Boolean).join("\n"),
         html: [
-            `<b>${escapeHTML(job.agentLabel)} update ${escapeHTML(job.status)}.</b>`,
+            `<b>${escapeHTML(job.agentLabel)} ${escapeHTML(job.operation ?? "update")} ${escapeHTML(job.status)}.</b>`,
             `<b>ID:</b> <code>${escapeHTML(job.id)}</code>`,
             `<b>Method:</b> <code>${escapeHTML(job.method)}</code>`,
             `<b>Command:</b> <code>${escapeHTML(command)}</code>`,
@@ -145,7 +145,7 @@ export function renderAgentUpdateLogAction(result) {
     const tail = trimLine(result.plain || "(empty)", 3000);
     return {
         plain: [
-            `${result.job.agentLabel} update log`,
+            `${result.job.agentLabel} ${result.job.operation ?? "update"} log`,
             `ID: ${result.job.id}`,
             `Status: ${result.job.status}`,
             `File: ${result.job.logPath}`,
@@ -153,7 +153,7 @@ export function renderAgentUpdateLogAction(result) {
             tail,
         ].join("\n"),
         html: [
-            `<b>${escapeHTML(result.job.agentLabel)} update log</b>`,
+            `<b>${escapeHTML(result.job.agentLabel)} ${escapeHTML(result.job.operation ?? "update")} log</b>`,
             `<b>ID:</b> <code>${escapeHTML(result.job.id)}</code>`,
             `<b>Status:</b> <code>${escapeHTML(result.job.status)}</code>`,
             `<b>File:</b> <code>${escapeHTML(result.job.logPath)}</code>`,

package/dist/codex-cli.js

@@ -26,7 +26,7 @@ export function findExecutableOnPath(command, pathValue) {
         return undefined;
     }
     const extensions = process.platform === "win32"
-        ? (process.env.PATHEXT || ".EXE;.CMD;.BAT;.COM").split(";")
+        ? ["", ...(process.env.PATHEXT || ".EXE;.CMD;.BAT;.COM").split(";")]
         : [""];
     for (const rawDirectory of pathValue.split(path.delimiter)) {
         const directory = rawDirectory.trim();

package/dist/config-metadata.js

@@ -88,6 +88,7 @@ export const SETTING_DEFINITIONS = [
     setting("NORDRELAY_AUDIT_MAX_EVENTS", "Audit max events", "Workspace", "number", "Retained audit events.", true),
     setting("NORDRELAY_SESSION_LOCK_TTL_MS", "Session lock TTL", "Workspace", "number", "Write-lock TTL.", true),
     setting("NORDRELAY_VERSION_CACHE_TTL_MS", "Version cache TTL", "Workspace", "number", "NPM version cache TTL.", true),
+    setting("NORDRELAY_CLI_VERSION_CACHE_TTL_MS", "CLI version cache TTL", "Workspace", "number", "Installed agent CLI version cache TTL.", true),
     setting("OPENAI_API_KEY", "OpenAI API key", "Voice", "secret", "Whisper fallback API key.", true),
     setting("VOICE_PREFERRED_BACKEND", "Voice backend", "Voice", "string", "auto, parakeet, faster-whisper, or openai.", false, ["auto", "parakeet", "faster-whisper", "openai"]),
     setting("VOICE_DEFAULT_LANGUAGE", "Voice language", "Voice", "string", "Default transcription language.", false),
@@ -180,6 +181,7 @@ const EXAMPLE_VALUES = {
     "NORDRELAY_AUDIT_MAX_EVENTS": "1000",
     "NORDRELAY_SESSION_LOCK_TTL_MS": "1800000",
     "NORDRELAY_VERSION_CACHE_TTL_MS": "3600000",
+    "NORDRELAY_CLI_VERSION_CACHE_TTL_MS": "60000",
     "NORDRELAY_DASHBOARD_HOST": "127.0.0.1",
     "NORDRELAY_DASHBOARD_PORT": "31878",
     "NORDRELAY_ENV_FILE": "",

package/dist/operations.js

@@ -1,9 +1,9 @@
-import { spawn, spawnSync } from "node:child_process";
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, writeFileSync } from "node:fs";
+import { execFile, spawn } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { readFile, stat } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { describeCodexCli, resolveCodexCli } from "./codex-cli.js";
+import { describeCodexCli, findExecutableOnPath, resolveCodexCli } from "./codex-cli.js";
 import { findLatestDatabase } from "./codex-state.js";
 import { describeClaudeCodeCli, resolveClaudeCodeCli } from "./claude-code-cli.js";
 import { describeHermesCli, resolveHermesCli } from "./hermes-cli.js";
@@ -21,6 +21,8 @@ const CLAUDE_CODE_SDK_PACKAGE_NAME = "@anthropic-ai/claude-agent-sdk";
 const DEFAULT_HOME = path.join(os.homedir(), ".nordrelay");
 const SECRET_RE = /(bot|token|api[_-]?key|authorization|bearer|password|secret)(["'=: ]+)([^\s"',]+)/gi;
 const DEFAULT_VERSION_CACHE_TTL_MS = 60 * 60 * 1000;
+const DEFAULT_CLI_VERSION_CACHE_TTL_MS = 60 * 1000;
+const cliVersionCache = new Map();
 export function getConnectorHome() {
     return process.env.NORDRELAY_HOME || DEFAULT_HOME;
 }
@@ -96,97 +98,86 @@ export async function getPackageVersion() {
     }
 }
 export async function getVersionChecks(options = {}) {
-    const nordrelayVersion = await getPackageVersion();
-    const codexCli = resolveCodexCli();
-    const piCli = resolvePiCli(process.env, options.piCliPath);
-    const hermesCli = resolveHermesCli(process.env, options.hermesCliPath);
-    const openClawCli = resolveOpenClawCli(process.env, options.openClawCliPath);
-    const claudeCodeCli = resolveClaudeCodeCli(process.env, options.claudeCodeCliPath);
-    const codexVersionLabel = codexCli.path
-        ? detectCliVersion(codexCli.path)
-        : readInstalledPackageVersion(CODEX_PACKAGE_NAME) ?? "not installed";
-    const piVersionLabel = piCli.path
-        ? detectCliVersion(piCli.path)
-        : readInstalledPackageVersion(PI_PACKAGE_NAME) ?? readInstalledPackageVersion(LEGACY_PI_PACKAGE_NAME) ?? "not installed";
-    const legacyPiPackageVersion = readInstalledPackageVersion(LEGACY_PI_PACKAGE_NAME);
-    const hermesVersionLabel = hermesCli.path ? detectCliVersion(hermesCli.path) : "not installed";
-    const openClawVersionLabel = openClawCli.path ? detectCliVersion(openClawCli.path) : "not installed";
-    const claudeCodeVersionLabel = claudeCodeCli.path
-        ? detectCliVersion(claudeCodeCli.path)
-        : readInstalledPackageVersion(CLAUDE_CODE_SDK_PACKAGE_NAME) ?? "bundled";
-    const claudeCodePackageName = claudeCodeCli.path ? CLAUDE_CODE_PACKAGE_NAME : CLAUDE_CODE_SDK_PACKAGE_NAME;
-    return {
-        nordrelay: buildVersionCheck({
+    const [nordrelayVersion, cliVersions] = await Promise.all([
+        getPackageVersion(),
+        resolveAgentCliVersions(options),
+    ]);
+    const [nordrelay, codex, pi, hermes, openclaw, claudeCode,] = await Promise.all([
+        buildVersionCheck({
             label: "NordRelay",
             packageName: PACKAGE_NAME,
             installedLabel: nordrelayVersion,
             installedVersion: extractVersion(nordrelayVersion),
         }),
-        codex: buildVersionCheck({
+        buildVersionCheck({
             label: "Codex",
             packageName: CODEX_PACKAGE_NAME,
-            installedLabel: codexVersionLabel,
-            installedVersion: extractVersion(codexVersionLabel),
-            notInstalled: codexVersionLabel === "not installed",
+            installedLabel: cliVersions.codexVersionLabel,
+            installedVersion: extractVersion(cliVersions.codexVersionLabel),
+            notInstalled: cliVersions.codexVersionLabel === "not installed",
         }),
-        pi: buildVersionCheck({
+        buildVersionCheck({
             label: "Pi",
             packageName: PI_PACKAGE_NAME,
-            installedLabel: piVersionLabel,
-            installedVersion: extractVersion(piVersionLabel),
-            notInstalled: piVersionLabel === "not installed",
-            detail: legacyPiPackageVersion ? `Legacy package ${LEGACY_PI_PACKAGE_NAME} is present; current package is ${PI_PACKAGE_NAME}.` : undefined,
+            installedLabel: cliVersions.piVersionLabel,
+            installedVersion: extractVersion(cliVersions.piVersionLabel),
+            notInstalled: cliVersions.piVersionLabel === "not installed",
+            detail: cliVersions.legacyPiPackageVersion ? `Legacy package ${LEGACY_PI_PACKAGE_NAME} is present; current package is ${PI_PACKAGE_NAME}.` : undefined,
         }),
-        hermes: buildHermesVersionCheck(hermesVersionLabel),
-        openclaw: buildVersionCheck({
+        buildHermesVersionCheck(cliVersions.hermesVersionLabel),
+        buildVersionCheck({
             label: "OpenClaw",
             packageName: OPENCLAW_PACKAGE_NAME,
-            installedLabel: openClawVersionLabel,
-            installedVersion: extractVersion(openClawVersionLabel),
-            notInstalled: openClawVersionLabel === "not installed",
+            installedLabel: cliVersions.openClawVersionLabel,
+            installedVersion: extractVersion(cliVersions.openClawVersionLabel),
+            notInstalled: cliVersions.openClawVersionLabel === "not installed",
         }),
-        claudeCode: buildVersionCheck({
+        buildVersionCheck({
             label: "Claude Code",
-            packageName: claudeCodePackageName,
-            installedLabel: claudeCodeVersionLabel,
-            installedVersion: extractVersion(claudeCodeVersionLabel),
-            notInstalled: claudeCodeVersionLabel === "not installed",
+            packageName: cliVersions.claudeCodePackageName,
+            installedLabel: cliVersions.claudeCodeVersionLabel,
+            installedVersion: extractVersion(cliVersions.claudeCodeVersionLabel),
+            notInstalled: cliVersions.claudeCodeVersionLabel === "not installed",
         }),
+    ]);
+    return {
+        nordrelay,
+        codex,
+        pi,
+        hermes,
+        openclaw,
+        claudeCode,
     };
 }
 export async function getConnectorHealth(options = {}) {
-    const rawState = await readConnectorState();
-    const version = await getPackageVersion();
+    const [rawState, version, cliVersions] = await Promise.all([
+        readConnectorState(),
+        getPackageVersion(),
+        resolveAgentCliVersions(options),
+    ]);
     const pidRunning = isProcessRunning(rawState.pid);
     const appPidRunning = isProcessRunning(rawState.appPid);
     const state = normalizeConnectorState(rawState, pidRunning, appPidRunning);
-    const codexCli = resolveCodexCli();
-    const piCli = resolvePiCli(process.env, options.piCliPath);
-    const hermesCli = resolveHermesCli(process.env, options.hermesCliPath);
-    const openClawCli = resolveOpenClawCli(process.env, options.openClawCliPath);
-    const claudeCodeCli = resolveClaudeCodeCli(process.env, options.claudeCodeCliPath);
     return {
         version,
         state,
         pidRunning,
         appPidRunning,
-        codexCli: describeCodexCli(codexCli),
-        codexCliPath: codexCli.path ?? null,
-        codexCliVersion: detectCliVersion(codexCli.path),
-        piCli: describePiCli(piCli),
-        piCliPath: piCli.path ?? null,
-        piCliVersion: detectCliVersion(piCli.path),
-        hermesCli: describeHermesCli(hermesCli),
-        hermesCliPath: hermesCli.path ?? null,
-        hermesCliVersion: detectCliVersion(hermesCli.path),
-        openClawCli: describeOpenClawCli(openClawCli),
-        openClawCliPath: openClawCli.path ?? null,
-        openClawCliVersion: detectCliVersion(openClawCli.path),
-        claudeCodeCli: describeClaudeCodeCli(claudeCodeCli),
-        claudeCodeCliPath: claudeCodeCli.path ?? null,
-        claudeCodeCliVersion: claudeCodeCli.path
-            ? detectCliVersion(claudeCodeCli.path)
-            : readInstalledPackageVersion(CLAUDE_CODE_SDK_PACKAGE_NAME) ?? "bundled",
+        codexCli: describeCodexCli(cliVersions.codexCli),
+        codexCliPath: cliVersions.codexCli.path ?? null,
+        codexCliVersion: cliVersions.codexVersionLabel,
+        piCli: describePiCli(cliVersions.piCli),
+        piCliPath: cliVersions.piCli.path ?? null,
+        piCliVersion: cliVersions.piVersionLabel,
+        hermesCli: describeHermesCli(cliVersions.hermesCli),
+        hermesCliPath: cliVersions.hermesCli.path ?? null,
+        hermesCliVersion: cliVersions.hermesVersionLabel,
+        openClawCli: describeOpenClawCli(cliVersions.openClawCli),
+        openClawCliPath: cliVersions.openClawCli.path ?? null,
+        openClawCliVersion: cliVersions.openClawVersionLabel,
+        claudeCodeCli: describeClaudeCodeCli(cliVersions.claudeCodeCli),
+        claudeCodeCliPath: cliVersions.claudeCodeCli.path ?? null,
+        claudeCodeCliVersion: cliVersions.claudeCodeVersionLabel,
         stateFile: getConnectorStatePath(),
         logFile: getConnectorLogPath(),
         databasePath: findLatestDatabase(),
@@ -208,23 +199,22 @@ export function spawnSelfUpdate() {
     const script = getWrapperScriptPath();
     const updateLog = getUpdateLogPath();
     const method = detectSelfUpdateMethod(sourceRoot);
-    const commands = method === "npm"
-        ? buildNpmSelfUpdateCommands()
-        : buildGitSelfUpdateCommands(script);
-    const logFd = openSync(updateLog, "a");
-    const command = [
-        "set -e",
-        `printf '\\n[%s] Starting ${method} connector self-update\\n' "$(date -Is)"`,
-        ...commands,
-    ].join(" && ");
-    const child = spawn("sh", ["-lc", command], {
+    mkdirSync(path.dirname(updateLog), { recursive: true });
+    const child = spawn(process.execPath, [
+        script,
+        "update",
+        "--method",
+        method,
+        "--home",
+        getConnectorHome(),
+        "--keep-pending-updates",
+    ], {
         cwd: sourceRoot,
         detached: true,
         env: process.env,
-        stdio: ["ignore", logFd, logFd],
+        stdio: "ignore",
     });
     child.unref();
-    closeSync(logFd);
     return {
         logPath: updateLog,
         method,
@@ -274,40 +264,62 @@ function normalizeConnectorState(state, pidRunning, appPidRunning) {
 function redactSecrets(text) {
     return text.replace(SECRET_RE, "$1$2[redacted]");
 }
-function buildGitSelfUpdateCommands(script) {
-    return [
-        "git pull --ff-only origin main",
-        "npm install",
-        "npm run check",
-        "npm test",
-        "npm run build",
-        `printf '[%s] Checks passed; restarting connector\\n' "$(date -Is)"`,
-        `${shellQuote(process.execPath)} ${shellQuote(script)} restart --keep-pending-updates`,
-    ];
-}
-function buildNpmSelfUpdateCommands() {
-    return [
-        `${resolveNpmCommand()} install -g ${PACKAGE_NAME}@latest`,
-        "nordrelay version",
-        `printf '[%s] npm update finished; restarting connector\\n' "$(date -Is)"`,
-        "nordrelay restart --keep-pending-updates",
-    ];
-}
-function resolveNpmCommand() {
-    const npmExecPath = process.env.npm_execpath;
-    if (npmExecPath && existsSync(npmExecPath)) {
-        return `${shellQuote(process.execPath)} ${shellQuote(npmExecPath)}`;
-    }
-    return "npm";
+async function resolveAgentCliVersions(options = {}) {
+    const codexCli = resolveCodexCli();
+    const piCli = resolvePiCli(process.env, options.piCliPath);
+    const hermesCli = resolveHermesCli(process.env, options.hermesCliPath);
+    const openClawCli = resolveOpenClawCli(process.env, options.openClawCliPath);
+    const claudeCodeCli = resolveClaudeCodeCli(process.env, options.claudeCodeCliPath);
+    const legacyPiPackageVersion = readInstalledPackageVersion(LEGACY_PI_PACKAGE_NAME);
+    const [codexVersionLabel, piVersionLabel, hermesVersionLabel, openClawVersionLabel, claudeCodeVersionLabel,] = await Promise.all([
+        codexCli.path ? detectCliVersion(codexCli.path) : Promise.resolve(readInstalledPackageVersion(CODEX_PACKAGE_NAME) ?? "not installed"),
+        piCli.path ? detectCliVersion(piCli.path) : Promise.resolve(readInstalledPackageVersion(PI_PACKAGE_NAME) ?? legacyPiPackageVersion ?? "not installed"),
+        hermesCli.path ? detectCliVersion(hermesCli.path) : Promise.resolve("not installed"),
+        openClawCli.path ? detectCliVersion(openClawCli.path) : Promise.resolve("not installed"),
+        claudeCodeCli.path ? detectCliVersion(claudeCodeCli.path) : Promise.resolve(readInstalledPackageVersion(CLAUDE_CODE_SDK_PACKAGE_NAME) ?? "bundled"),
+    ]);
+    return {
+        codexCli,
+        piCli,
+        hermesCli,
+        openClawCli,
+        claudeCodeCli,
+        codexVersionLabel,
+        piVersionLabel,
+        hermesVersionLabel,
+        openClawVersionLabel,
+        claudeCodeVersionLabel,
+        claudeCodePackageName: claudeCodeCli.path ? CLAUDE_CODE_PACKAGE_NAME : CLAUDE_CODE_SDK_PACKAGE_NAME,
+        legacyPiPackageVersion,
+    };
 }
-function detectCliVersion(commandPath) {
+async function detectCliVersion(commandPath) {
     if (!commandPath) {
         return "not installed";
     }
-    const result = spawnSync(commandPath, ["--version"], {
-        encoding: "utf8",
+    const ttlMs = parseCliVersionCacheTtlMs();
+    if (ttlMs > 0) {
+        const cached = cliVersionCache.get(commandPath);
+        if (cached && Date.now() < cached.expiresAt) {
+            if (cached.value !== undefined) {
+                return cached.value;
+            }
+            if (cached.promise) {
+                return cached.promise;
+            }
+        }
+        const promise = detectCliVersionUncached(commandPath);
+        cliVersionCache.set(commandPath, { promise, expiresAt: Date.now() + ttlMs });
+        const value = await promise;
+        cliVersionCache.set(commandPath, { value, expiresAt: Date.now() + ttlMs });
+        return value;
+    }
+    return detectCliVersionUncached(commandPath);
+}
+async function detectCliVersionUncached(commandPath) {
+    const result = await runCommand(commandPath, ["--version"], {
+        shell: isWindowsShellScript(commandPath),
         timeout: 3000,
-        windowsHide: true,
     });
     const output = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     if (result.error) {
@@ -318,15 +330,17 @@ function detectCliVersion(commandPath) {
     }
     return output || "unknown";
 }
-function buildHermesVersionCheck(installedLabel) {
+async function buildHermesVersionCheck(installedLabel) {
     if (installedLabel === "not installed") {
+        const latest = await detectLatestNpmVersion(HERMES_PACKAGE_NAME);
         return {
             label: "Hermes",
             packageName: HERMES_PACKAGE_NAME,
             installedLabel: "not installed",
             installedVersion: null,
-            latestVersion: null,
+            latestVersion: latest.version,
             status: "not-installed",
+            detail: latest.error,
         };
     }
     const lines = installedLabel.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
@@ -343,16 +357,17 @@ function buildHermesVersionCheck(installedLabel) {
         detail: updateLine ?? (installedVersion ? undefined : "Could not parse Hermes version or update status"),
     };
 }
-function buildVersionCheck(options) {
+async function buildVersionCheck(options) {
     if (options.notInstalled) {
+        const latest = options.skipLatest ? { version: null, error: undefined } : await detectLatestNpmVersion(options.packageName);
         return {
             label: options.label,
             packageName: options.packageName,
             installedLabel: "not installed",
             installedVersion: null,
-            latestVersion: null,
+            latestVersion: latest.version,
             status: "not-installed",
-            detail: options.detail,
+            detail: [options.detail, latest.error].filter(Boolean).join(" ") || undefined,
         };
     }
     if (options.skipLatest) {
@@ -366,7 +381,7 @@ function buildVersionCheck(options) {
             detail: options.detail ?? "Latest-version lookup is not available for this package source",
         };
     }
-    const latest = detectLatestNpmVersion(options.packageName);
+    const latest = await detectLatestNpmVersion(options.packageName);
     if (!options.installedVersion || !latest.version) {
         return {
             label: options.label,
@@ -388,19 +403,22 @@ function buildVersionCheck(options) {
         detail: [options.detail, latest.error].filter(Boolean).join(" ") || undefined,
     };
 }
-function detectLatestNpmVersion(packageName) {
+async function detectLatestNpmVersion(packageName) {
     const cached = readVersionCache(packageName);
     if (cached) {
         return cached;
     }
-    const result = spawnSync("npm", ["view", packageName, "version", "--registry=https://registry.npmjs.org"], {
-        encoding: "utf8",
+    const npm = resolveNpmSpawnCommand();
+    if (!npm) {
+        return { version: null, error: "npm was not found on PATH; latest-version lookup is unavailable" };
+    }
+    const result = await runCommand(npm.command, [...npm.argsPrefix, "view", packageName, "version", "--registry=https://registry.npmjs.org"], {
+        shell: npm.shell,
         timeout: 5000,
-        windowsHide: true,
     });
     const output = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     if (result.error) {
-        return { version: null, error: result.error.message };
+        return { version: null, error: `${npm.display}: ${result.error.message}` };
     }
     if (result.status !== 0) {
         return { version: null, error: output || `npm exited ${result.status ?? "unknown"}` };
@@ -409,6 +427,94 @@ function detectLatestNpmVersion(packageName) {
     writeVersionCache(packageName, resolved.version);
     return resolved;
 }
+function runCommand(command, args, options) {
+    return new Promise((resolve) => {
+        const useShell = Boolean(options.shell);
+        execFile(useShell ? formatShellCommand(command, args) : command, useShell ? [] : args, {
+            encoding: "utf8",
+            shell: useShell,
+            timeout: options.timeout,
+            windowsHide: true,
+            env: process.env,
+            maxBuffer: 1024 * 1024,
+        }, (error, stdout, stderr) => {
+            const enriched = error;
+            resolve({
+                stdout: typeof stdout === "string" ? stdout : "",
+                stderr: typeof stderr === "string" ? stderr : "",
+                status: typeof enriched?.code === "number" ? enriched.code : error ? 1 : 0,
+                signal: enriched?.signal,
+                error: enriched ?? undefined,
+            });
+        });
+    });
+}
+function formatShellCommand(command, args) {
+    return [command, ...args].map(quoteShellArg).join(" ");
+}
+function quoteShellArg(value) {
+    if (process.platform === "win32") {
+        return quoteWindowsCmdArg(value);
+    }
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function quoteWindowsCmdArg(value) {
+    if (value.length === 0) {
+        return "\"\"";
+    }
+    if (!/[\s"&|<>()^%]/.test(value)) {
+        return value;
+    }
+    return `"${value
+        .replace(/%/g, "%%")
+        .replace(/(\\*)"/g, '$1$1\\"')
+        .replace(/(\\+)$/g, "$1$1")}"`;
+}
+export function resolveNpmSpawnCommand(env = process.env) {
+    const npmExecPath = env.npm_execpath?.trim();
+    if (npmExecPath && existsSync(npmExecPath)) {
+        return {
+            command: process.execPath,
+            argsPrefix: [npmExecPath],
+            display: `${process.execPath} ${npmExecPath}`,
+            shell: false,
+        };
+    }
+    const pathMatch = findExecutableOnPath("npm", env.PATH);
+    if (pathMatch) {
+        return {
+            command: pathMatch,
+            argsPrefix: [],
+            display: pathMatch,
+            shell: isWindowsShellScript(pathMatch),
+        };
+    }
+    for (const candidate of commonNpmCandidates(env)) {
+        if (!existsSync(candidate)) {
+            continue;
+        }
+        return {
+            command: candidate,
+            argsPrefix: [],
+            display: candidate,
+            shell: isWindowsShellScript(candidate),
+        };
+    }
+    return null;
+}
+function commonNpmCandidates(env) {
+    const names = process.platform === "win32" ? ["npm.cmd", "npm.bat", "npm"] : ["npm"];
+    const directories = [
+        path.dirname(process.execPath),
+        env.APPDATA ? path.join(env.APPDATA, "npm") : undefined,
+        env.ProgramFiles ? path.join(env.ProgramFiles, "nodejs") : undefined,
+        env["ProgramFiles(x86)"] ? path.join(env["ProgramFiles(x86)"], "nodejs") : undefined,
+    ].filter((value) => Boolean(value));
+    return directories.flatMap((directory) => names.map((name) => path.join(directory, name)));
+}
+function isWindowsShellScript(filePath) {
+    return process.platform === "win32" && /\.(?:cmd|bat)$/i.test(filePath);
+}
 function readVersionCache(packageName) {
     const ttlMs = parseVersionCacheTtlMs();
     if (ttlMs <= 0) {
@@ -458,6 +564,14 @@ function parseVersionCacheTtlMs() {
     const parsed = Number(raw);
     return Number.isFinite(parsed) ? Math.max(0, Math.floor(parsed)) : DEFAULT_VERSION_CACHE_TTL_MS;
 }
+function parseCliVersionCacheTtlMs() {
+    const raw = process.env.NORDRELAY_CLI_VERSION_CACHE_TTL_MS;
+    if (!raw) {
+        return DEFAULT_CLI_VERSION_CACHE_TTL_MS;
+    }
+    const parsed = Number(raw);
+    return Number.isFinite(parsed) ? Math.max(0, Math.floor(parsed)) : DEFAULT_CLI_VERSION_CACHE_TTL_MS;
+}
 function readInstalledPackageVersion(packageName) {
     try {
         const packagePath = path.join(getSourceRoot(), "node_modules", ...packageName.split("/"), "package.json");
@@ -489,9 +603,6 @@ function compareVersions(left, right) {
 function parseVersionParts(value) {
     return value.split(/[.-]/).slice(0, 3).map((part) => Number.parseInt(part, 10) || 0);
 }
-function shellQuote(value) {
-    return `'${value.replace(/'/g, `'\\''`)}'`;
-}
 function formatLogLine(line) {
     const trimmed = line.trim();
     if (!trimmed) {