@punks/cli 1.0.3 → 1.0.5

package/README.md

@@ -67,7 +67,7 @@ Current scaffold-managed global tools:
 - `portless`
 - `skills`
 
-On startup, `punks` checks npm for a newer CLI version. When it can infer whether the installed binary came from Bun, pnpm, or npm, it updates itself with the same global package manager; otherwise it prints a manual update hint. If the `dp-cli` operator skill is installed in the current project or globally, startup also asks the `skills` CLI to update that skill. Set `DP_NO_UPDATE_CHECK=1` or `DP_NO_SKILL_UPDATE_CHECK=1` to skip those checks.
+On startup, `punks` starts best-effort checks for a newer CLI version and the `dp-cli` operator skill. CLI package updates prompt before running the inferred package-manager command. The `dp-cli` skill is auto-installed when missing and auto-updated when present through targeted `skills add ... --skill dp-cli` / `skills update dp-cli ...` commands only; startup never runs or suggests plain root `skills update`. Set `DP_NO_UPDATE_CHECK=1` or `DP_NO_SKILL_UPDATE_CHECK=1` to skip those checks.
 
 ## Publishing
 

package/dist/index.js

@@ -10883,6 +10883,10 @@ var require_public_api = __commonJS((exports) => {
   exports.stringify = stringify;
 });
 
+// src/index.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { createInterface as createInterface3 } from "readline/promises";
+
 // node_modules/.pnpm/effect@3.19.19/node_modules/effect/dist/esm/Array.js
 var exports_Array = {};
 __export(exports_Array, {
@@ -42283,16 +42287,15 @@ var toolCatalog = [
   }
 ];
 
-// src/version.ts
-var cliPackageName = "@punks/cli";
-var cliVersion = "1.0.2";
-
+// package.json
+var name = "@punks/cli";
+var version = "1.0.5";
 // src/baseline/bundled.ts
 var bundledBaseline = {
   summary: {
     source: "bundled",
     channel: "bundled",
-    version: cliVersion,
+    version,
     tag: null,
     commit: null,
     sha256: null
@@ -42778,8 +42781,8 @@ var collectPackageNames = (pkg) => {
     if (!record2) {
       return;
     }
-    for (const name of Object.keys(record2)) {
-      names.add(name);
+    for (const name2 of Object.keys(record2)) {
+      names.add(name2);
     }
   };
   addEntries(pkg.dependencies);
@@ -43570,12 +43573,13 @@ var renderHint = (value5) => paint(brandPalette.muted, value5);
 var renderSelfUpdateNotice = ({
   currentVersion,
   latestVersion,
-  packageName
+  packageName,
+  command
 }) => renderPanel("CLI update available", [
   `${packageName} ${currentVersion} is behind ${latestVersion}.`,
   "",
   "usage:",
-  `  \u2022 run \`npm install -g ${packageName}@latest\` to update this CLI`
+  `  \u2022 run \`${command?.join(" ") ?? `npm install -g ${packageName}@latest`}\` to update this CLI`
 ].join(`
 `));
 var renderQuestion = (value5) => [
@@ -44075,8 +44079,8 @@ var packsForWorkspace = ({
   const dependencyNames = manifest?.dependencies ?? [];
   const dependencies = new Set(dependencyNames);
   const selectedPacks = new Set(finalPacks);
-  const hasDependency = (name) => dependencies.has(name);
-  const hasDependencyPrefix = (prefix) => dependencyNames.some((name) => name.startsWith(prefix));
+  const hasDependency = (name2) => dependencies.has(name2);
+  const hasDependencyPrefix = (prefix) => dependencyNames.some((name2) => name2.startsWith(prefix));
   const hasBackendDependency = () => hasDependency("better-auth") || hasDependency("drizzle-orm") || hasDependency("drizzle-kit") || hasDependency("elysia") || hasDependencyPrefix("@trpc/");
   const hasFrontendDependency = () => hasDependency("next") || hasDependency("react") || hasDependency("react-dom") || hasDependency("@tanstack/react-query");
   const hasFrontendWorkspaceName = () => relativeWorkspacePath.split(path8.sep).some((segment) => segment === "frontend" || segment === "ui" || segment === "web") || (manifest?.packageName?.replace(/^@[^/]+\//u, "").split(/[^a-zA-Z0-9]+/u).filter((segment) => segment.length > 0).map((segment) => segment.toLowerCase()).some((segment) => segment === "frontend" || segment === "ui" || segment === "web") ?? false);
@@ -44682,7 +44686,7 @@ var writeScaffoldOutput = ({
       lintAssets,
       subagentManifestSpec,
       baseline: baseline.summary,
-      cliVersion,
+      version,
       managedFiles,
       generatedFiles: manifestGeneratedFiles
     })
@@ -46418,7 +46422,7 @@ var managedFileSchema = Struct({
 });
 var scaffoldManifestSchema = parseJson(Struct({
   repoShapeMode: optional(String$),
-  cliVersion: optional(String$),
+  version: optional(String$),
   finalPacks: Array$(String$),
   baseline: optional(Unknown),
   generatedFiles: optional(Array$(String$)),
@@ -46802,7 +46806,7 @@ var readTaggedVersion = async ({
   try {
     const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}/${encodeURIComponent(tag4)}`, {
       headers: {
-        accept: "application/vnd.npm.install-v1+json"
+        accept: "application/json"
       },
       signal: controller.signal
     });
@@ -46835,7 +46839,7 @@ var checkSelfUpdate = async ({
     updateAvailable: isNewerVersion(latestVersion, currentVersion)
   };
 };
-var commandExists2 = (command) => spawnSync("which", [command], { stdio: "ignore" }).status === 0;
+var commandExists2 = (command) => spawnSync("which", [command], { stdio: "ignore", timeout: 750 }).status === 0;
 var detectCliInstallPackageManager = ({
   entrypoint = process.argv[1] ?? "",
   userAgent = process.env.npm_config_user_agent
@@ -46907,39 +46911,47 @@ var autoUpdateCliIfStale = async ({
     packageName,
     tag: tag4
   });
-  const result = spawnSync(command[0], command.slice(1), {
-    stdio: "inherit",
-    shell: false
-  });
-  if (result.status !== 0) {
-    return {
-      status: "failed",
-      check: check2,
-      packageManager,
-      command
-    };
-  }
   return {
-    status: "updated",
+    status: "available",
     check: check2,
     packageManager,
     command
   };
 };
 var parseSkillList = (value5) => {
-  const parsed = JSON.parse(value5);
-  if (!Array.isArray(parsed)) {
-    return [];
+  try {
+    const parsed = JSON.parse(value5);
+    if (!Array.isArray(parsed)) {
+      return [];
+    }
+    return parsed.flatMap((entry) => {
+      if (typeof entry === "object" && entry !== null && "name" in entry && "path" in entry && "scope" in entry && typeof entry.name === "string" && typeof entry.path === "string" && typeof entry.scope === "string") {
+        return [{
+          name: entry.name,
+          path: entry.path,
+          scope: entry.scope
+        }];
+      }
+      return [];
+    });
+  } catch {
+    return parseTextSkillList(value5);
   }
-  return parsed.flatMap((entry) => {
-    if (typeof entry === "object" && entry !== null && "name" in entry && "path" in entry && "scope" in entry && typeof entry.name === "string" && typeof entry.path === "string" && typeof entry.scope === "string") {
-      return [{
-        name: entry.name,
-        path: entry.path,
-        scope: entry.scope
-      }];
+};
+var stripAnsi = (value5) => value5.replace(/\x1B\[[0-?]*[ -/]*[@-~]/gu, "");
+var parseTextSkillList = (value5) => {
+  const scope5 = value5.includes("Global Skills") ? "global" : "project";
+  return stripAnsi(value5).split(`
+`).flatMap((line4) => {
+    const match18 = line4.match(/^([^\s]+)\s+(.+)$/u);
+    if (match18 === null || match18[1] === "Project" || match18[1] === "Global") {
+      return [];
     }
-    return [];
+    return [{
+      name: match18[1],
+      path: match18[2].trim(),
+      scope: scope5
+    }];
   });
 };
 var listSkills = (scope5) => {
@@ -46948,66 +46960,82 @@ var listSkills = (scope5) => {
     encoding: "utf8",
     shell: false,
     stdio: ["ignore", "pipe", "ignore"],
-    timeout: 5000
+    timeout: 1500
   });
   if (result.status !== 0) {
     return [];
   }
-  try {
-    return parseSkillList(result.stdout);
-  } catch {
-    return [];
-  }
-};
-var updateDpCliSkill = (scope5) => {
-  const args2 = scope5 === "global" ? ["update", "dp-cli", "--global", "--yes"] : ["update", "dp-cli", "--project", "--yes"];
-  const result = spawnSync("skills", args2, {
+  return parseSkillList(result.stdout);
+};
+var skillUpdateCommand = (scope5) => scope5 === "global" ? ["skills", "update", "dp-cli", "--global", "--yes"] : ["skills", "update", "dp-cli", "--project", "--yes"];
+var skillInstallCommand = () => [
+  "skills",
+  "add",
+  "wearedevpunks/skills",
+  "--global",
+  "--skill",
+  "dp-cli",
+  "--yes"
+];
+var runSkillsCommand = (command) => {
+  const result = spawnSync(command[0], command.slice(1), {
     stdio: "ignore",
     shell: false,
     timeout: 30000
   });
   return result.status === 0;
 };
+var updateDpCliSkill = (scope5) => runSkillsCommand(skillUpdateCommand(scope5));
 var installDpCliSkillGlobal = () => {
-  const result = spawnSync("skills", [
-    "add",
-    "wearedevpunks/skills",
-    "--global",
-    "--skill",
-    "dp-cli",
-    "--yes"
-  ], {
-    stdio: "ignore",
-    shell: false,
-    timeout: 30000
-  });
-  return result.status === 0;
+  return runSkillsCommand(skillInstallCommand());
 };
-var ensureDpCliSkillPresent = () => {
+var checkDpCliSkillPresence = () => {
   if (!commandExists2("skills")) {
     return {
       skillsCliAvailable: false,
       detected: false,
       project: false,
-      global: false,
-      installedGlobal: false,
-      updatedProject: false,
-      updatedGlobal: false
+      global: false
     };
   }
   const projectBeforeInstall = listSkills("project").some((skill) => skill.name === "dp-cli");
   const globalBeforeInstall = listSkills("global").some((skill) => skill.name === "dp-cli");
-  const installedGlobal = projectBeforeInstall || globalBeforeInstall ? false : installDpCliSkillGlobal();
   const project3 = projectBeforeInstall;
-  const global = globalBeforeInstall || installedGlobal || listSkills("global").some((skill) => skill.name === "dp-cli");
+  const global = globalBeforeInstall;
   return {
     skillsCliAvailable: true,
     detected: project3 || global,
     project: project3,
-    global,
-    installedGlobal,
-    updatedProject: project3 ? updateDpCliSkill("project") : false,
-    updatedGlobal: global ? updateDpCliSkill("global") : false
+    global
+  };
+};
+var maintainDpCliSkill = () => {
+  const presence = checkDpCliSkillPresence();
+  if (!presence.skillsCliAvailable) {
+    return {
+      ...presence,
+      installedGlobal: false,
+      updatedProject: false,
+      updatedGlobal: false
+    };
+  }
+  if (!presence.detected) {
+    const installedGlobal = installDpCliSkillGlobal();
+    return {
+      skillsCliAvailable: true,
+      detected: installedGlobal,
+      project: false,
+      global: installedGlobal,
+      installedGlobal,
+      updatedProject: false,
+      updatedGlobal: installedGlobal ? updateDpCliSkill("global") : false
+    };
+  }
+  return {
+    ...presence,
+    installedGlobal: false,
+    updatedProject: presence.project ? updateDpCliSkill("project") : false,
+    updatedGlobal: presence.global ? updateDpCliSkill("global") : false
   };
 };
 
@@ -47015,31 +47043,72 @@ var ensureDpCliSkillPresent = () => {
 var app = exports_Command.make("punks", {}, () => exports_Effect.sync(() => console.log(renderCommandGuide()))).pipe(exports_Command.withDescription("Devpunks AI scaffolding CLI."), exports_Command.withSubcommands([scaffoldCommand, updateCommand]));
 var cli = exports_Command.run(app, {
   name: "punks",
-  version: cliVersion
+  version
 });
 var shouldCheckSelfUpdate = () => process.env.DP_NO_UPDATE_CHECK !== "1" && process.env.CI === undefined && process.argv.includes("--help") === false && process.argv.includes("-h") === false && process.argv.includes("--version") === false && process.argv.includes("-v") === false;
-var selfUpdateNotice = exports_Effect.promise(async () => {
-  if (!shouldCheckSelfUpdate()) {
-    return;
-  }
+var shouldCheckDpCliSkillUpdate = () => process.env.DP_NO_SKILL_UPDATE_CHECK !== "1" && process.env.CI === undefined && process.argv.includes("--help") === false && process.argv.includes("-h") === false && process.argv.includes("--version") === false && process.argv.includes("-v") === false;
+var runCliUpdateCheck = async () => {
   const result = await autoUpdateCliIfStale({
-    currentVersion: cliVersion,
-    packageName: cliPackageName,
+    currentVersion: version,
+    packageName: name,
     tag: process.env.DP_UPDATE_TAG ?? "latest"
   });
-  if (result.status === "manager-not-detected" || result.status === "failed") {
+  if (result.status === "available" || result.status === "manager-not-detected" || result.status === "failed") {
     console.error(renderSelfUpdateNotice({
       currentVersion: result.check.currentVersion,
       latestVersion: result.check.latestVersion,
-      packageName: result.check.packageName
+      packageName: result.check.packageName,
+      command: result.command
     }));
   }
-});
-var shouldCheckDpCliSkillUpdate = () => process.env.DP_NO_SKILL_UPDATE_CHECK !== "1" && process.env.CI === undefined && process.argv.includes("--help") === false && process.argv.includes("-h") === false && process.argv.includes("--version") === false && process.argv.includes("-v") === false;
-var dpCliSkillUpdate = exports_Effect.sync(() => {
-  if (!shouldCheckDpCliSkillUpdate()) {
+  if (result.status !== "available" || process.stdin.isTTY !== true) {
     return;
   }
-  ensureDpCliSkillPresent();
-});
-exports_Effect.zipRight(exports_Effect.zipRight(selfUpdateNotice, dpCliSkillUpdate), cli(process.argv)).pipe(exports_Effect.provide(exports_Layer.mergeAll(exports_BunContext.layer)), exports_BunRuntime.runMain);
+  const prompt4 = createInterface3({
+    input: process.stdin,
+    output: process.stderr
+  });
+  try {
+    const answer = await prompt4.question("Update punks CLI now? [y/N]: ");
+    if (!["y", "yes"].includes(answer.trim().toLowerCase())) {
+      return;
+    }
+    console.error(`punks startup checks: running \`${result.command.join(" ")}\``);
+    const update5 = spawnSync2(result.command[0], result.command.slice(1), {
+      stdio: "inherit",
+      shell: false
+    });
+    if (update5.status !== 0) {
+      console.error("punks startup checks: CLI update failed.");
+    }
+  } finally {
+    prompt4.close();
+  }
+};
+var runDpCliSkillCheck = () => {
+  const skillResult = maintainDpCliSkill();
+  if (!skillResult.skillsCliAvailable) {
+    return;
+  }
+  if (skillResult.installedGlobal) {
+    console.error("punks startup checks: installed `dp-cli` skill globally.");
+  }
+  if (skillResult.updatedProject || skillResult.updatedGlobal) {
+    console.error("punks startup checks: updated `dp-cli` skill.");
+  }
+};
+var runStartupChecks = async () => {
+  const checkCli = shouldCheckSelfUpdate();
+  const checkSkill = shouldCheckDpCliSkillUpdate();
+  if (!checkCli && !checkSkill) {
+    return;
+  }
+  if (checkSkill) {
+    setTimeout(runDpCliSkillCheck, 0);
+  }
+  if (checkCli) {
+    await runCliUpdateCheck();
+  }
+};
+runStartupChecks().catch(() => {});
+cli(process.argv).pipe(exports_Effect.provide(exports_Layer.mergeAll(exports_BunContext.layer)), exports_BunRuntime.runMain);

package/docs/README.md

@@ -11,8 +11,7 @@ Implementation notes:
 - distributed skill assets live in `skills/`
 - runtime projection/writing logic lives in `src/scaffold/`
 - `punks update` refreshes scaffold-managed assets from `.devpunks/scaffold-manifest.json`
-- CLI startup checks npm's `latest` dist-tag for `@punks/cli` and prints a self-update notice when the installed CLI is behind. Set `DP_NO_UPDATE_CHECK=1` to skip the check or `DP_UPDATE_TAG=next` to compare against another dist-tag.
-- CLI startup also checks for the `dp-cli` skill through the `skills` CLI, installing it globally when absent and updating it when present. Set `DP_NO_SKILL_UPDATE_CHECK=1` to skip this best-effort pass.
+- CLI startup checks npm's `latest` dist-tag and prompts before CLI package updates; it auto-installs/updates only the named `dp-cli` skill through targeted `skills add ... --skill dp-cli` / `skills update dp-cli ...` commands. Set `DP_NO_UPDATE_CHECK=1` or `DP_NO_SKILL_UPDATE_CHECK=1` to skip those checks, and `DP_UPDATE_TAG=next` to compare against another dist-tag.
 - baseline releases use `baseline/stable/*` GitHub release tags, separate from npm executable tags such as `v1.0.1`
 - shared neutral hook and sync assets live in `src/data/hooks/` and `src/data/scripts/`
 - scaffolded required tools always include `portless` and `skills` so generated guidance can standardize local dev origins and keep skill entrypoints up to date

package/docs/runbooks/dp-cli-scaffolding.md

@@ -217,11 +217,11 @@ The npm account must have publish access to `@punks/cli`; otherwise npm may repo
 
 ## CLI Self-Update Detection
 
-The CLI also performs best-effort startup checks on normal command startup. It checks the npm package version for `@punks/cli`, and it checks for the `dp-cli` skill through the global `skills` CLI, installing it when absent and updating it when present. These are separate from `punks update`, which updates scaffold-managed repo assets.
+The CLI also starts best-effort startup checks on normal command startup. It checks the npm package version for `@punks/cli`, and it checks the `dp-cli` skill through the `skills` CLI. CLI package updates require an interactive `y/N` confirmation before running the inferred package-manager command. The `dp-cli` skill is auto-installed when missing and auto-updated when present, but only through targeted `skills add ... --skill dp-cli` / `skills update dp-cli ...` commands. Startup must never run or suggest plain root `skills update`. These checks are separate from `punks update`, which updates scaffold-managed repo assets.
 
 - checks `https://registry.npmjs.org/%40punks%2Fcli/latest`
 - compares that dist-tag version with the bundled CLI version
-- prints `npm install -g @punks/cli@latest` only when the registry version is newer
+- prompts to run the inferred package-manager command only when the registry version is newer
 - silently skips the notice when npm is unreachable, the registry response is invalid, or the command is `--help` / `--version`
 - skips in CI and when `DP_NO_UPDATE_CHECK=1`
 - supports `DP_UPDATE_TAG=next` for canary/operator testing against another dist-tag

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@punks/cli",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Devpunks AI scaffolding CLI",
   "type": "module",
   "bin": {