@psnext/slingcli 3.3.20260911-1 → 3.3.20260915-1

package/README.md

@@ -100,11 +100,28 @@ sling
 | `SLINGSHOT_WORKSPACE_ID`  | Workspace ID for analytics                      |
 | `SLINGSHOT_DEBUG`         | Enable Slingshot debug logging (`true`/`false`) |
 | `SKIP_SLING_AUTO_INSTALL` | Skip first-run auto-install of default packages |
+| `SKIP_SLING_AUTO_UPDATE_CHECK` | Skip the startup check for a new Sling release |
 
 Slingshot debug logs are written to `~/.sling/logs/analytics/<timestamp>.log`.
 
 ## Updating
 
+Sling checks for a new release at startup. Nothing is ever installed without your
+say-so, and what it offers depends on the release type:
+
+- **Patch** (a new build within the same `major.minor` line): Sling shows the new
+  version and asks before installing, then restarts. Answer `n` to stay put, or pass
+  `-y` / `--yes` to accept without being asked. Outside an interactive terminal Sling
+  shows the manual command instead of prompting.
+- **Minor** (a new `major.minor` line) and **major**: never installed by Sling. It
+  shows a notice with the new version and the command to run yourself.
+
+The one exception is a mandatory minimum version published by the Sling team: below
+that floor Sling updates without prompting.
+
+Set `SKIP_SLING_AUTO_UPDATE_CHECK=1`, pass `--offline`, or set `PI_OFFLINE=1` to skip the
+check entirely. To update manually at any time:
+
 ```bash
 npm install -g @psnext/slingcli@latest
 ```

package/bin/sling.js

@@ -50,6 +50,9 @@ function findSlingPkg() {
 }
 const { slingVersion: SLING_VERSION } = findSlingPkg();
 process.env.SLING_VERSION = SLING_VERSION;
+// Sling owns its version checks. Disable the bundled pi startup notice so
+// users only see Sling's update policy and instructions below.
+process.env.PI_SKIP_VERSION_CHECK ||= "1";
 process.env.PI_SUBAGENT_PI_BINARY_ENV = "sling";
 // if (IS_DEV) process.env.PI_SUBAGENT_PI_BINARY_ENV = "node " + process.argv[1];
 const { main } = IS_DEV
@@ -84,9 +87,9 @@ function applyNoEnv(args) {
   return filtered;
 }
 
-async function runCommand(command, args) {
+async function runCommand(command, args, options = {}) {
   return new Promise((resolve, reject) => {
-    const proc = spawn(command, args, { stdio: "inherit", shell: false });
+    const proc = spawn(command, args, { stdio: "inherit", shell: false, ...options });
     proc.on("close", (code) => {
       if (code !== 0) reject(new Error(`Command failed with code ${code}`));
       else resolve();
@@ -275,67 +278,138 @@ export async function checkAndInstallPackages(argv = process.argv.slice(2)) {
   }
 }
 
-async function checkForUpdate(args) {
-  if (process.env.SKIP_SLING_AUTO_UPDATE_CHECK) return;
-  if (args.includes("--version") || args.includes("-v")) return;
-  if (args.includes("install")) return;
-
-  const autoYes = hasUpdateRequest(args);
-
-  const [latestVersion, remoteConfig] = await Promise.all([
-    fetchLatestNpmVersion(),
-    fetchRemoteAppConfig(),
-  ]);
+export function getSlingUpdateKind(currentVersion, latestVersion) {
+  const current = semver.parse(currentVersion);
+  const latest = semver.parse(latestVersion);
+  if (!current || !latest || !semver.gt(latest, current)) return undefined;
+
+  if (latest.major !== current.major) return "major";
+  if (latest.minor !== current.minor) return "minor";
+  // Sling releases carry the build date in the patch position and the build
+  // number as a prerelease tag (3.3.20260914-1). Both move within the same
+  // major.minor line, so both count as a patch release for update purposes.
+  return "patch";
+}
 
-  if (!latestVersion || !semver.gt(latestVersion, SLING_VERSION)) return;
+const MANUAL_UPDATE_COMMAND = "npm install -g @psnext/slingcli@latest";
 
-  // Gate 2: force if current < minVersion (user is below the minimum required)
-  const shouldForceUpdate = remoteConfig && semver.lt(SLING_VERSION, remoteConfig.minVersion);
+function showManualUpdateNotice(currentVersion, latestVersion, updateKind) {
+  const summary =
+    `Sling ${updateKind} update available: ${latestVersion} (current ${currentVersion}). ` +
+    `This version is not installed automatically. Run: ${MANUAL_UPDATE_COMMAND}`;
 
-  if (!shouldForceUpdate && !autoYes && (!process.stdin.isTTY || !process.stdout.isTTY)) return;
+  // Printed here it lands on the normal screen buffer, which the TUI hides the
+  // moment it switches to the alternate buffer. Hand it to the slingshot
+  // extension too, which re-shows it inside the session where it can be read.
+  process.env.SLING_UPDATE_NOTICE = summary;
 
-  if (shouldForceUpdate) {
-    if (remoteConfig?.updateMessage) console.log(remoteConfig.updateMessage);
-    console.log(`Required version ${latestVersion} detected. Updating now...`);
-  } else {
-    console.log(`A new version ${latestVersion} is available (current ${SLING_VERSION}).`);
-  }
+  console.log("\nSling update available");
+  console.log(
+    `A new ${updateKind} version ${latestVersion} is available (current ${currentVersion}).`,
+  );
+  console.log("This version is not installed automatically.");
+  console.log(`Run: ${MANUAL_UPDATE_COMMAND}\n`);
+}
 
-  let shouldUpdate = autoYes || shouldForceUpdate;
-  if (!shouldUpdate) {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    let answer;
-    try {
-      answer = (await rl.question("Update now? [Y/n] ")).trim().toLowerCase();
-    } finally {
-      rl.close();
-    }
-    shouldUpdate = !answer.startsWith("n");
+async function confirmUpdate(latestVersion) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = (await rl.question(`Update to ${latestVersion} now? [Y/n] `)).trim().toLowerCase();
+    return !answer.startsWith("n");
+  } finally {
+    rl.close();
   }
+}
 
-  if (!shouldUpdate) return;
-
-  console.log("Installing @psnext/slingcli@" + latestVersion + "...");
+// Shared tail of every path that actually updates. `required` marks the
+// remote-kill-switch path, where failing to update is fatal.
+async function installAndRestart(versionSpec, args, { required }) {
+  console.log(`Installing @psnext/slingcli@${versionSpec}...`);
   try {
-    await runCommand("npm", ["install", "-g", "@psnext/slingcli@latest"]);
+    await runCommand("npm", ["install", "-g", `@psnext/slingcli@${versionSpec}`]);
   } catch {
     console.error("✗ Auto-update failed. Run manually:");
-    console.error("  npm install -g @psnext/slingcli@latest");
+    console.error(`  ${MANUAL_UPDATE_COMMAND}`);
     console.error("  (you may need sudo)");
-    if (shouldForceUpdate) process.exit(1);
+    if (required) process.exit(1);
     return;
   }
 
-  console.log("✓ Updated to " + latestVersion + ". Restarting sling...");
+  console.log(`✓ Updated to ${versionSpec}. Restarting sling...`);
   const restartArgs = stripUpdateRequestFlags(args);
   try {
-    await runCommand(process.execPath, [__filename, ...restartArgs]);
-    process.exit(0);
+    // The restarted process must not run the update check again. If the global
+    // install landed on a different npm prefix than the binary running now, it
+    // would rediscover the same update and reinstall in a loop.
+    await runCommand(process.execPath, [__filename, ...restartArgs], {
+      env: { ...process.env, SKIP_SLING_AUTO_UPDATE_CHECK: "1" },
+    });
   } catch {
     console.error("✓ Updated, but failed to restart automatically.");
     console.error("  Please run: sling " + restartArgs.join(" "));
-    process.exit(0);
   }
+  process.exit(0);
+}
+
+async function checkForUpdate(args) {
+  if (isTruthyFlag(process.env.SKIP_SLING_AUTO_UPDATE_CHECK)) return;
+  if (isTruthyFlag(process.env.PI_OFFLINE)) return;
+  if (args.includes("--version") || args.includes("-v")) return;
+  if (args.includes("--offline")) return;
+  if (args.includes("install")) return;
+
+  const [latestVersion, remoteConfig] = await Promise.all([
+    fetchLatestNpmVersion(),
+    fetchRemoteAppConfig(),
+  ]);
+
+  // The remote kill switch outranks the semver policy: anyone below minVersion
+  // is updated without a prompt, whatever the release type. It runs before the
+  // semver gate on purpose — behind it, an unreachable registry would leave a
+  // user who is below the floor sitting on their old build.
+  if (remoteConfig && semver.lt(SLING_VERSION, remoteConfig.minVersion)) {
+    if (remoteConfig.updateMessage) console.log(remoteConfig.updateMessage);
+    if (latestVersion) {
+      console.log(`Required version ${latestVersion} detected. Updating now...`);
+    } else {
+      console.log(
+        `Sling ${SLING_VERSION} is below the required minimum ${remoteConfig.minVersion}. Updating now...`,
+      );
+    }
+    // No published version in hand means the registry lookup failed; let npm
+    // resolve the dist-tag rather than skipping a mandatory update.
+    await installAndRestart(latestVersion ?? "latest", args, { required: true });
+    return;
+  }
+
+  const updateKind = latestVersion && getSlingUpdateKind(SLING_VERSION, latestVersion);
+  if (!updateKind) return;
+
+  // Sling only ever installs a patch itself. Minor and major are announced and
+  // left to the user to run manually.
+  if (updateKind !== "patch") {
+    showManualUpdateNotice(SLING_VERSION, latestVersion, updateKind);
+    return;
+  }
+
+  // Even a patch needs the user to say yes. `-y`/`--yes` is that yes.
+  if (!hasUpdateRequest(args)) {
+    // No way to ask in a pipe or CI run, so fall back to the manual notice.
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+      showManualUpdateNotice(SLING_VERSION, latestVersion, updateKind);
+      return;
+    }
+    console.log("\nSling update available");
+    console.log(
+      `A new patch version ${latestVersion} is available (current ${SLING_VERSION}).`,
+    );
+    if (!(await confirmUpdate(latestVersion))) {
+      console.log(`Staying on ${SLING_VERSION}. Update later with: ${MANUAL_UPDATE_COMMAND}\n`);
+      return;
+    }
+  }
+
+  await installAndRestart(latestVersion, args, { required: false });
 }
 
 // `sling install <pkg>` defaults to global (~/.sling/agent). When run from a