@odla-ai/cli 0.27.13 → 0.27.14

package/dist/bin.js

@@ -1,12 +1,86 @@
 #!/usr/bin/env node
 import {
+  cliVersion,
+  compareVersions,
   exitCodeFor,
   redactSecrets,
   runCli
-} from "./chunk-3YSCRXPF.js";
+} from "./chunk-3SQ2XUBB.js";
+
+// src/cli-update.ts
+import { realpathSync } from "fs";
+var DEFAULT_REGISTRY_URL = "https://registry.npmjs.org/@odla-ai%2fcli/latest";
+var VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+async function requireCurrentCliForProvision(argv, options = {}) {
+  if (argv[0] !== "provision" || argv.includes("--dry-run")) return;
+  const current = options.currentVersion ?? cliVersion();
+  if (!VERSION.test(current)) return;
+  const latest = await fetchLatestCliVersion(options);
+  if (!latest || compareVersions(current, latest) >= 0) return;
+  const entryPath = resolvedEntryPath(options.entryPath ?? process.argv[1]);
+  const workspace = isWorkspaceCli(entryPath);
+  const rerun = renderReleasedProvisionCommand(latest, argv);
+  const source = workspace ? ` This executable resolves to the workspace build at ${entryPath}; update/rebase that worktree and rebuild it before using the linked CLI again.` : " Update the installed dependency before using its CLI again.";
+  throw new Error(
+    `provision blocked: @odla-ai/cli ${current} is older than the released ${latest}. Provisioning grant requests are security-sensitive, and a stale client can omit required authority.${source}
+Run the current release now:
+  ${rerun}`
+  );
+}
+async function fetchLatestCliVersion(options) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 2500);
+  timeout.unref?.();
+  try {
+    const response = await (options.fetch ?? fetch)(
+      options.registryUrl ?? process.env.ODLA_CLI_REGISTRY_URL ?? DEFAULT_REGISTRY_URL,
+      {
+        headers: {
+          accept: "application/json",
+          "user-agent": `odla-ai-cli/${options.currentVersion ?? cliVersion()}`
+        },
+        signal: controller.signal
+      }
+    );
+    if (!response.ok) return null;
+    const body = await response.json();
+    return typeof body.version === "string" && VERSION.test(body.version) ? body.version : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function resolvedEntryPath(entryPath) {
+  if (!entryPath) return "unknown executable";
+  try {
+    return realpathSync(entryPath);
+  } catch {
+    return entryPath;
+  }
+}
+function isWorkspaceCli(entryPath) {
+  const normalized = entryPath.replaceAll("\\", "/");
+  return normalized.includes("/packages/cli/dist/bin.") && !normalized.includes("/node_modules/");
+}
+function renderReleasedProvisionCommand(latest, argv) {
+  const safeArgs = [];
+  for (let index = 0; index < argv.length; index++) {
+    const value = argv[index];
+    safeArgs.push(value);
+    if (value === "--token" && index + 1 < argv.length) {
+      safeArgs.push("<redacted-token>");
+      index++;
+    }
+  }
+  return ["npx", "--yes", `@odla-ai/cli@${latest}`, ...safeArgs].map(shellQuote).join(" ");
+}
+function shellQuote(value) {
+  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", `'"'"'`)}'`;
+}
 
 // src/bin.ts
-runCli().catch((err) => {
+requireCurrentCliForProvision(process.argv.slice(2)).then(() => runCli()).catch((err) => {
   console.error(redactSecrets(`odla-ai: ${err instanceof Error ? err.message : String(err)}`));
   process.exitCode = exitCodeFor(err);
 });

package/dist/bin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/bin.ts"],"sourcesContent":["import { exitCodeFor, runCli } from \"./cli\";\nimport { redactSecrets } from \"./redact\";\n\nrunCli().catch((err) => {\n  console.error(redactSecrets(`odla-ai: ${err instanceof Error ? err.message : String(err)}`));\n  process.exitCode = exitCodeFor(err);\n});\n"],"mappings":";;;;;;;;AAGA,OAAO,EAAE,MAAM,CAAC,QAAQ;AACtB,UAAQ,MAAM,cAAc,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE,CAAC;AAC3F,UAAQ,WAAW,YAAY,GAAG;AACpC,CAAC;","names":[]}
+{"version":3,"sources":["../src/cli-update.ts","../src/bin.ts"],"sourcesContent":["import { realpathSync } from \"node:fs\";\nimport { compareVersions } from \"./runbook-requires\";\nimport { cliVersion } from \"./version\";\n\nconst DEFAULT_REGISTRY_URL = \"https://registry.npmjs.org/@odla-ai%2fcli/latest\";\nconst VERSION = /^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/;\n\nexport interface CliUpdateCheckOptions {\n  currentVersion?: string;\n  entryPath?: string;\n  fetch?: typeof fetch;\n  registryUrl?: string;\n  timeoutMs?: number;\n}\n\n/**\n * Provisioning handshakes are security-sensitive protocol requests. Before a\n * real provision run, stop a CLI which is confirmed older than npm's current\n * release so an agent cannot unknowingly submit an obsolete grant shape.\n * Registry unavailability remains fail-open: npm must not become a production\n * availability dependency for an otherwise current CLI.\n */\nexport async function requireCurrentCliForProvision(\n  argv: readonly string[],\n  options: CliUpdateCheckOptions = {},\n): Promise<void> {\n  if (argv[0] !== \"provision\" || argv.includes(\"--dry-run\")) return;\n\n  const current = options.currentVersion ?? cliVersion();\n  if (!VERSION.test(current)) return;\n  const latest = await fetchLatestCliVersion(options);\n  if (!latest || compareVersions(current, latest) >= 0) return;\n\n  const entryPath = resolvedEntryPath(options.entryPath ?? process.argv[1]);\n  const workspace = isWorkspaceCli(entryPath);\n  const rerun = renderReleasedProvisionCommand(latest, argv);\n  const source = workspace\n    ? ` This executable resolves to the workspace build at ${entryPath}; update/rebase that worktree and rebuild it before using the linked CLI again.`\n    : \" Update the installed dependency before using its CLI again.\";\n  throw new Error(\n    `provision blocked: @odla-ai/cli ${current} is older than the released ${latest}. ` +\n    `Provisioning grant requests are security-sensitive, and a stale client can omit required authority.${source}\\n` +\n    `Run the current release now:\\n  ${rerun}`,\n  );\n}\n\nasync function fetchLatestCliVersion(\n  options: CliUpdateCheckOptions,\n): Promise<string | null> {\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 2_500);\n  timeout.unref?.();\n  try {\n    const response = await (options.fetch ?? fetch)(\n      options.registryUrl ?? process.env.ODLA_CLI_REGISTRY_URL ?? DEFAULT_REGISTRY_URL,\n      {\n        headers: {\n          accept: \"application/json\",\n          \"user-agent\": `odla-ai-cli/${options.currentVersion ?? cliVersion()}`,\n        },\n        signal: controller.signal,\n      },\n    );\n    if (!response.ok) return null;\n    const body = await response.json() as { version?: unknown };\n    return typeof body.version === \"string\" && VERSION.test(body.version)\n      ? body.version\n      : null;\n  } catch {\n    return null;\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\nfunction resolvedEntryPath(entryPath: string | undefined): string {\n  if (!entryPath) return \"unknown executable\";\n  try {\n    return realpathSync(entryPath);\n  } catch {\n    return entryPath;\n  }\n}\n\nfunction isWorkspaceCli(entryPath: string): boolean {\n  const normalized = entryPath.replaceAll(\"\\\\\", \"/\");\n  return normalized.includes(\"/packages/cli/dist/bin.\") &&\n    !normalized.includes(\"/node_modules/\");\n}\n\nfunction renderReleasedProvisionCommand(\n  latest: string,\n  argv: readonly string[],\n): string {\n  const safeArgs: string[] = [];\n  for (let index = 0; index < argv.length; index++) {\n    const value = argv[index]!;\n    safeArgs.push(value);\n    if (value === \"--token\" && index + 1 < argv.length) {\n      safeArgs.push(\"<redacted-token>\");\n      index++;\n    }\n  }\n  return [\"npx\", \"--yes\", `@odla-ai/cli@${latest}`, ...safeArgs]\n    .map(shellQuote)\n    .join(\" \");\n}\n\nfunction shellQuote(value: string): string {\n  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value)\n    ? value\n    : `'${value.replaceAll(\"'\", `'\"'\"'`)}'`;\n}\n","import { exitCodeFor, runCli } from \"./cli\";\nimport { requireCurrentCliForProvision } from \"./cli-update\";\nimport { redactSecrets } from \"./redact\";\n\nrequireCurrentCliForProvision(process.argv.slice(2))\n  .then(() => runCli())\n  .catch((err) => {\n    console.error(redactSecrets(`odla-ai: ${err instanceof Error ? err.message : String(err)}`));\n    process.exitCode = exitCodeFor(err);\n  });\n"],"mappings":";;;;;;;;;;AAAA,SAAS,oBAAoB;AAI7B,IAAM,uBAAuB;AAC7B,IAAM,UAAU;AAiBhB,eAAsB,8BACpB,MACA,UAAiC,CAAC,GACnB;AACf,MAAI,KAAK,CAAC,MAAM,eAAe,KAAK,SAAS,WAAW,EAAG;AAE3D,QAAM,UAAU,QAAQ,kBAAkB,WAAW;AACrD,MAAI,CAAC,QAAQ,KAAK,OAAO,EAAG;AAC5B,QAAM,SAAS,MAAM,sBAAsB,OAAO;AAClD,MAAI,CAAC,UAAU,gBAAgB,SAAS,MAAM,KAAK,EAAG;AAEtD,QAAM,YAAY,kBAAkB,QAAQ,aAAa,QAAQ,KAAK,CAAC,CAAC;AACxE,QAAM,YAAY,eAAe,SAAS;AAC1C,QAAM,QAAQ,+BAA+B,QAAQ,IAAI;AACzD,QAAM,SAAS,YACX,uDAAuD,SAAS,oFAChE;AACJ,QAAM,IAAI;AAAA,IACR,mCAAmC,OAAO,+BAA+B,MAAM,wGACuB,MAAM;AAAA;AAAA,IACzE,KAAK;AAAA,EAC1C;AACF;AAEA,eAAe,sBACb,SACwB;AACxB,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,QAAQ,aAAa,IAAK;AAC/E,UAAQ,QAAQ;AAChB,MAAI;AACF,UAAM,WAAW,OAAO,QAAQ,SAAS;AAAA,MACvC,QAAQ,eAAe,QAAQ,IAAI,yBAAyB;AAAA,MAC5D;AAAA,QACE,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,cAAc,eAAe,QAAQ,kBAAkB,WAAW,CAAC;AAAA,QACrE;AAAA,QACA,QAAQ,WAAW;AAAA,MACrB;AAAA,IACF;AACA,QAAI,CAAC,SAAS,GAAI,QAAO;AACzB,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,WAAO,OAAO,KAAK,YAAY,YAAY,QAAQ,KAAK,KAAK,OAAO,IAChE,KAAK,UACL;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT,UAAE;AACA,iBAAa,OAAO;AAAA,EACtB;AACF;AAEA,SAAS,kBAAkB,WAAuC;AAChE,MAAI,CAAC,UAAW,QAAO;AACvB,MAAI;AACF,WAAO,aAAa,SAAS;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eAAe,WAA4B;AAClD,QAAM,aAAa,UAAU,WAAW,MAAM,GAAG;AACjD,SAAO,WAAW,SAAS,yBAAyB,KAClD,CAAC,WAAW,SAAS,gBAAgB;AACzC;AAEA,SAAS,+BACP,QACA,MACQ;AACR,QAAM,WAAqB,CAAC;AAC5B,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;AAChD,UAAM,QAAQ,KAAK,KAAK;AACxB,aAAS,KAAK,KAAK;AACnB,QAAI,UAAU,aAAa,QAAQ,IAAI,KAAK,QAAQ;AAClD,eAAS,KAAK,kBAAkB;AAChC;AAAA,IACF;AAAA,EACF;AACA,SAAO,CAAC,OAAO,SAAS,gBAAgB,MAAM,IAAI,GAAG,QAAQ,EAC1D,IAAI,UAAU,EACd,KAAK,GAAG;AACb;AAEA,SAAS,WAAW,OAAuB;AACzC,SAAO,2BAA2B,KAAK,KAAK,IACxC,QACA,IAAI,MAAM,WAAW,KAAK,OAAO,CAAC;AACxC;;;AC5GA,8BAA8B,QAAQ,KAAK,MAAM,CAAC,CAAC,EAChD,KAAK,MAAM,OAAO,CAAC,EACnB,MAAM,CAAC,QAAQ;AACd,UAAQ,MAAM,cAAc,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE,CAAC;AAC3F,UAAQ,WAAW,YAAY,GAAG;AACpC,CAAC;","names":[]}

package/dist/{chunk-3YSCRXPF.js → chunk-3SQ2XUBB.js}

@@ -9517,6 +9517,9 @@ Safety:
   grant, run it once with --request-grant. That flag ignores ODLA_DEV_TOKEN and
   the local cache, prints and opens a fresh exact-project owner-review URL, then
   continues provisioning with the approved replacement credential.
+  Before a non-dry-run provision, the executable checks npm's current CLI
+  release. A confirmed stale client stops with a safe npx rerun command; a
+  workspace-linked client also identifies the worktree that must be updated.
   Run Code from a GitHub checkout already connected to an app in Studio; an
   odla.config.mjs may select the app explicitly but is not required. Code host
   approval and credential hashes live in odla-ai/db. The host
@@ -12885,6 +12888,7 @@ export {
   calendarDisconnect,
   CAPABILITIES,
   printCapabilities,
+  cliVersion,
   ConfigOperationCommandError,
   desiredRegistryState,
   configApply,
@@ -12918,6 +12922,7 @@ export {
   describeProblem,
   invocationPath,
   surfacePaths,
+  compareVersions,
   runHostedSecurity,
   getHostedSecurityIntent,
   getHostedSecurityPlan,
@@ -12930,4 +12935,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=chunk-3YSCRXPF.js.map
+//# sourceMappingURL=chunk-3SQ2XUBB.js.map