@pleri/olam-cli 0.1.85 → 0.1.87

package/dist/image-digests.json

@@ -1,9 +1,9 @@
 {
-  "auth": "sha256:ee6b1d1046933c76acc8d28cd83ac3871bc69057d2401014252872dc5ec42db7",
-  "devbox": "sha256:0b7a8ed93e55bec3cd12351689a6213daa87a9fc7531b9dfcfb0513ba62add61",
-  "host-cp": "sha256:c83cf8649893661b42266bc5bba9110e2067395c27dd02713179a3717a389cf3",
+  "auth": "sha256:acd77f9b4b2764841207e6e749e0bd5044843458f789eb5548cb4363d02fb985",
+  "devbox": "sha256:edda28d8b75bd1d6aaa599100b97d83260bae05b3e81949c95b2f9192b1cfa04",
+  "host-cp": "sha256:6bd8927957fb2ee1aeaf372738814953e49c247c38663ea372c570e2c0795c58",
   "mcp-auth": "sha256:e47169ad3fbc9cab216248fecbc56874343a5daab84b1f18d67529b7d415cf95",
   "$schema_version": 1,
-  "$published_version": "0.1.85",
+  "$published_version": "0.1.87",
   "$registry": "ghcr.io/pleri"
 }

package/host-cp/src/version-status.mjs

@@ -120,6 +120,45 @@ export async function fetchAuthServiceSha(authServiceUrl) {
   }
 }
 
+/**
+ * Inspect a locally-tagged docker image (by reference such as
+ * `ghcr.io/pleri/olam-host-cp:latest`) and extract its baked
+ * OLAM_BUILD_SHA env. Returns 'unknown' if the image isn't pulled,
+ * the docker socket is unreachable, or the env is missing.
+ *
+ * Used as the "what's the latest published image we'd swap to?"
+ * signal for the upgrade comparator — replaces the prior
+ * `operatorHead` (operator's local git HEAD) which over-reports
+ * upgradeAvailable whenever an SPA-only PR merges between releases.
+ *
+ * @param {string} dockerApiBase
+ * @param {string} imageRef  e.g. "ghcr.io/pleri/olam-host-cp:latest"
+ * @returns {Promise<string>}
+ */
+export async function fetchLatestImageSha(dockerApiBase, imageRef) {
+  try {
+    const res = await fetch(
+      `${dockerApiBase}/images/${encodeURIComponent(imageRef)}/json`,
+      { signal: AbortSignal.timeout(5000) },
+    );
+    if (!res.ok) return 'unknown';
+    const image = /** @type {unknown} */ (await res.json());
+    if (!image || typeof image !== 'object') return 'unknown';
+    const config = /** @type {Record<string, unknown>} */ (image)['Config'];
+    if (!config || typeof config !== 'object') return 'unknown';
+    const env = /** @type {Record<string, unknown>} */ (config)['Env'];
+    if (!Array.isArray(env)) return 'unknown';
+    for (const e of env) {
+      if (typeof e === 'string' && e.startsWith('OLAM_BUILD_SHA=')) {
+        return e.slice('OLAM_BUILD_SHA='.length);
+      }
+    }
+    return 'unknown';
+  } catch {
+    return 'unknown';
+  }
+}
+
 /**
  * Fetch the devbox image SHA. We check the running devbox container's
  * OLAM_BUILD_SHA env var via the docker socket proxy (inspect endpoint).
@@ -181,13 +220,30 @@ export async function fetchDevboxImageSha(dockerApiBase) {
 export async function buildVersionSnapshot({ authServiceUrl, dockerApiBase }) {
   const operatorHead = readOperatorHead();
 
-  const [authSha, devboxSha] = await Promise.all([
-    fetchAuthServiceSha(authServiceUrl),
-    fetchDevboxImageSha(dockerApiBase),
-  ]);
+  // Inspect locally-pulled `:latest` image tags to get the actual
+  // published baked SHA — what `olam upgrade` would swap us to next.
+  // Fall back to operatorHead when the image isn't pulled (first-run
+  // or stack never upgraded) so the banner still surfaces SOMETHING.
+  const [authSha, devboxSha, hostCpLatestPublished, authLatestPublished, devboxLatestPublished] =
+    await Promise.all([
+      fetchAuthServiceSha(authServiceUrl),
+      fetchDevboxImageSha(dockerApiBase),
+      fetchLatestImageSha(dockerApiBase, 'ghcr.io/pleri/olam-host-cp:latest'),
+      fetchLatestImageSha(dockerApiBase, 'ghcr.io/pleri/olam-auth-service:latest'),
+      fetchLatestImageSha(dockerApiBase, 'ghcr.io/pleri/olam-devbox:latest'),
+    ]);
 
   const hostCpRunning = process.env.OLAM_BUILD_SHA ?? 'unknown';
 
+  // Pick "latest" per component: use the published image SHA when we
+  // can read it (truthful — that's what would swap in), else fall back
+  // to operatorHead (legacy behaviour, may over-report between SPA-only
+  // PR merges and the next image rebuild — but still informative when
+  // the operator hasn't yet pulled `:latest`).
+  const hostCpLatest = pickLatest(hostCpLatestPublished, operatorHead);
+  const authLatest = pickLatest(authLatestPublished, operatorHead);
+  const devboxLatest = pickLatest(devboxLatestPublished, operatorHead);
+
   // CLI version is propagated by `olam host-cp start` via the
   // OLAM_CLI_VERSION env (see packages/cli/src/commands/host-cp.ts
   // buildComposeEnv). Falls back to host-cp's own package.json when
@@ -199,18 +255,18 @@ export async function buildVersionSnapshot({ authServiceUrl, dockerApiBase }) {
   return {
     hostCp: {
       running: hostCpRunning,
-      latest: operatorHead,
-      upgradeAvailable: isUpgradeAvailable(hostCpRunning, operatorHead),
+      latest: hostCpLatest,
+      upgradeAvailable: isUpgradeAvailable(hostCpRunning, hostCpLatest),
     },
     authService: {
       running: authSha,
-      latest: operatorHead,
-      upgradeAvailable: isUpgradeAvailable(authSha, operatorHead),
+      latest: authLatest,
+      upgradeAvailable: isUpgradeAvailable(authSha, authLatest),
     },
     devbox: {
       running: devboxSha,
-      latest: operatorHead,
-      upgradeAvailable: isUpgradeAvailable(devboxSha, operatorHead),
+      latest: devboxLatest,
+      upgradeAvailable: isUpgradeAvailable(devboxSha, devboxLatest),
     },
     operatorHead,
     checkedAt: new Date().toISOString(),
@@ -218,6 +274,21 @@ export async function buildVersionSnapshot({ authServiceUrl, dockerApiBase }) {
   };
 }
 
+/**
+ * Prefer the published-image SHA (truthful "would swap to") over the
+ * operator's local git HEAD (over-reports when SPA-only PRs land
+ * between image rebuilds). Falls back to operatorHead when the image
+ * isn't pulled (e.g. cold-start before first `olam upgrade`).
+ *
+ * @param {string} publishedImageSha
+ * @param {string} operatorHead
+ * @returns {string}
+ */
+export function pickLatest(publishedImageSha, operatorHead) {
+  if (publishedImageSha && publishedImageSha !== 'unknown') return publishedImageSha;
+  return operatorHead;
+}
+
 /**
  * Read host-cp's bundled package.json version as the CLI-version
  * fallback when OLAM_CLI_VERSION isn't propagated. The container

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pleri/olam-cli",
-  "version": "0.1.85",
+  "version": "0.1.87",
   "type": "module",
   "bin": {
     "olam": "./bin/olam.cjs"