@petercjl/topazlabscli 0.2.2 → 0.2.3

package/README.md

@@ -15,7 +15,7 @@ npm install --global @petercjl/topazlabscli
 topazlabscli skill install --agent all
 ```
 
-The CLI checks npm for a newer stable release before operational commands, at most once every six hours. It first uses the registry already configured for npm and automatically tries `https://registry.npmmirror.com/` if that registry is unavailable. The successful registry is also used for installation, without changing the user's `.npmrc`. When an update is available the CLI upgrades itself, refreshes installed Agent Skills, and then resumes the original command. It discovers npm through the running Node installation, preserves SealSeek's managed global prefix/cache, and discovers Windows OpenSSH through the standard system location, so it also works in Agent runtimes with a restricted `PATH`. A temporary registry outage does not block video processing. `topazlabscli update` forces an immediate manual update.
+The CLI checks npm for a newer stable release before operational commands, at most once every six hours. It first uses the registry already configured for npm and automatically tries `https://registry.npmmirror.com/` if that registry is unavailable. The successful registry is used to download the complete update tarball before the installed version is touched, without changing the user's `.npmrc`. When an update is available the CLI upgrades itself from that local tarball, refreshes installed Agent Skills, and then resumes the original command. It discovers npm through the running Node installation, preserves SealSeek's managed global prefix/cache, and discovers Windows OpenSSH through the standard system location, so it also works in Agent runtimes with a restricted `PATH`. A temporary registry outage does not block video processing. `topazlabscli update` forces an immediate manual update.
 
 On Windows, SealSeek Skills are installed into `%USERPROFILE%\.sealseek\workspace\skills` when that workspace is present. The CLI automatically uses a managed copy because SealSeek rejects junctions that resolve outside the workspace Skill root; subsequent CLI updates refresh the copy from the npm package. The copy includes a local runtime manifest so the Agent can invoke the canonical package even when its PATH is restricted. `SEALSEEK_SKILLS_HOME` remains available as an explicit override.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@petercjl/topazlabscli",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Cross-Agent CLI and portable Skill for queued remote Topaz Video AI processing",
   "type": "module",
   "bin": {

package/skill/topazlabscli/SKILL.md

@@ -39,7 +39,7 @@ Use the CLI as the single execution surface. Do not reproduce SSH, SFTP, queue,
 
 Configuration, hostnames, addresses, usernames, SSH identities, VPN details, media, Topaz binaries, models, and credentials are external to this Skill and npm package. Installation does not grant access to a workstation. Treat the configured server and Topaz license as user-managed resources.
 
-Before operational commands, the CLI performs a cached npm update check. It tries the user's current npm registry and then its built-in reachable-registry fallback without changing the user's global npm configuration. A newer stable package is installed from the same registry that answered the version check, installed Agent Skills are refreshed, and the original command resumes under the new version. The CLI resolves npm through the running Agent's Node installation when PATH is restricted. Registry, npm, and Skill-refresh failures produce a warning and continue with the installed version. Treat `doctor`'s `updates.registry` check as advisory; a failed update source does not make video processing unavailable.
+Before operational commands, the CLI performs a cached npm update check. It tries the user's current npm registry and then its built-in reachable-registry fallback without changing the user's global npm configuration. A newer stable package is fully downloaded from the registry that answered the version check before the installed version is touched, then installed Agent Skills are refreshed and the original command resumes under the new version. The CLI resolves npm through the running Agent's Node installation when PATH is restricted. Registry, npm, and Skill-refresh failures produce a warning and continue with the installed version. Treat `doctor`'s `updates.registry` check as advisory; a failed update source does not make video processing unavailable.
 
 Do not overwrite a local output unless the user has authorized that exact existing target. The remote worker retains job inputs, outputs, status, and logs for operator review; cleanup is an administrative action outside version 0.2.
 

package/src/update.mjs

@@ -1,4 +1,5 @@
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { loadConfig } from "./config.mjs";
 import { binScript, updateStatePath } from "./paths.mjs";
@@ -118,10 +119,26 @@ function registryFailureMessage(attempts) {
 export async function installLatestPackage(pkg, registry, dependencies = {}) {
   const env = dependencies.env || process.env;
   const execute = dependencies.run || run;
-  return execute("npm", ["install", "--global", `${pkg.name}@latest`, "--registry", registry], {
-    env,
-    timeoutMs: dependencies.installTimeoutMs
-  });
+  const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "topazlabscli-update-"));
+  try {
+    const packed = await execute("npm", ["pack", `${pkg.name}@latest`, "--json", "--pack-destination", temporary, "--registry", registry], {
+      env,
+      timeoutMs: dependencies.timeoutMs || UPDATE_TIMEOUT_MS
+    });
+    if (packed.code !== 0) return packed;
+    let filename;
+    try { filename = JSON.parse(packed.stdout.trim())[0]?.filename; }
+    catch {}
+    if (!filename) {
+      return { ...packed, code: 1, stderr: packed.stderr || "npm pack did not return a package filename." };
+    }
+    return await execute("npm", ["install", "--global", path.join(temporary, filename)], {
+      env,
+      timeoutMs: dependencies.installTimeoutMs
+    });
+  } finally {
+    fs.rmSync(temporary, { recursive: true, force: true });
+  }
 }
 
 export async function maybeAutoUpdate(rawArgs, pkg, dependencies = {}) {
@@ -136,7 +153,7 @@ export async function maybeAutoUpdate(rawArgs, pkg, dependencies = {}) {
   const intervalHours = Number(config.settings?.update_check_hours ?? DEFAULT_INTERVAL_HOURS);
   const intervalMs = Math.max(0, intervalHours) * 60 * 60 * 1000;
   const state = readState(stateFile);
-  if (intervalMs > 0 && Number.isFinite(state.last_checked_at) && now - state.last_checked_at < intervalMs) {
+  if (intervalMs > 0 && state.registry && Number.isFinite(state.last_checked_at) && now - state.last_checked_at < intervalMs) {
     return { checked: false, reason: "fresh", latest: state.latest || null, registry: state.registry || null };
   }