@odla-ai/cli 0.27.13 → 0.27.14

package/dist/bin.cjs

@@ -8663,6 +8663,9 @@ Safety:
   grant, run it once with --request-grant. That flag ignores ODLA_DEV_TOKEN and
   the local cache, prints and opens a fresh exact-project owner-review URL, then
   continues provisioning with the approved replacement credential.
+  Before a non-dry-run provision, the executable checks npm's current CLI
+  release. A confirmed stale client stops with a safe npx rerun command; a
+  workspace-linked client also identifies the worktree that must be updated.
   Run Code from a GitHub checkout already connected to an app in Studio; an
   odla.config.mjs may select the app explicitly but is not required. Code host
   approval and credential hashes live in odla-ai/db. The host
@@ -12798,8 +12801,80 @@ async function calendarCommand(parsed, dependencies) {
   else await calendarDisconnect(options);
 }
 
+// src/cli-update.ts
+var import_node_fs20 = require("fs");
+var DEFAULT_REGISTRY_URL = "https://registry.npmjs.org/@odla-ai%2fcli/latest";
+var VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+async function requireCurrentCliForProvision(argv, options = {}) {
+  if (argv[0] !== "provision" || argv.includes("--dry-run")) return;
+  const current = options.currentVersion ?? cliVersion();
+  if (!VERSION.test(current)) return;
+  const latest = await fetchLatestCliVersion(options);
+  if (!latest || compareVersions(current, latest) >= 0) return;
+  const entryPath = resolvedEntryPath(options.entryPath ?? process.argv[1]);
+  const workspace = isWorkspaceCli(entryPath);
+  const rerun = renderReleasedProvisionCommand(latest, argv);
+  const source = workspace ? ` This executable resolves to the workspace build at ${entryPath}; update/rebase that worktree and rebuild it before using the linked CLI again.` : " Update the installed dependency before using its CLI again.";
+  throw new Error(
+    `provision blocked: @odla-ai/cli ${current} is older than the released ${latest}. Provisioning grant requests are security-sensitive, and a stale client can omit required authority.${source}
+Run the current release now:
+  ${rerun}`
+  );
+}
+async function fetchLatestCliVersion(options) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 2500);
+  timeout.unref?.();
+  try {
+    const response2 = await (options.fetch ?? fetch)(
+      options.registryUrl ?? process.env.ODLA_CLI_REGISTRY_URL ?? DEFAULT_REGISTRY_URL,
+      {
+        headers: {
+          accept: "application/json",
+          "user-agent": `odla-ai-cli/${options.currentVersion ?? cliVersion()}`
+        },
+        signal: controller.signal
+      }
+    );
+    if (!response2.ok) return null;
+    const body = await response2.json();
+    return typeof body.version === "string" && VERSION.test(body.version) ? body.version : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function resolvedEntryPath(entryPath) {
+  if (!entryPath) return "unknown executable";
+  try {
+    return (0, import_node_fs20.realpathSync)(entryPath);
+  } catch {
+    return entryPath;
+  }
+}
+function isWorkspaceCli(entryPath) {
+  const normalized = entryPath.replaceAll("\\", "/");
+  return normalized.includes("/packages/cli/dist/bin.") && !normalized.includes("/node_modules/");
+}
+function renderReleasedProvisionCommand(latest, argv) {
+  const safeArgs = [];
+  for (let index = 0; index < argv.length; index++) {
+    const value2 = argv[index];
+    safeArgs.push(value2);
+    if (value2 === "--token" && index + 1 < argv.length) {
+      safeArgs.push("<redacted-token>");
+      index++;
+    }
+  }
+  return ["npx", "--yes", `@odla-ai/cli@${latest}`, ...safeArgs].map(shellQuote).join(" ");
+}
+function shellQuote(value2) {
+  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value2) ? value2 : `'${value2.replaceAll("'", `'"'"'`)}'`;
+}
+
 // src/bin.ts
-runCli().catch((err) => {
+requireCurrentCliForProvision(process.argv.slice(2)).then(() => runCli()).catch((err) => {
   console.error(redactSecrets(`odla-ai: ${err instanceof Error ? err.message : String(err)}`));
   process.exitCode = exitCodeFor(err);
 });