@roamcode.ai/server 1.0.0 → 1.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@roamcode.ai/server",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Host-native server for RoamCode",
   "homepage": "https://roamcode.ai",
   "bugs": "https://github.com/burakgon/roamcode/issues",
@@ -35,12 +35,12 @@
     "@fastify/static": "^9.3.0",
     "@fastify/websocket": "^11.3.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "better-sqlite3": "^12.11.1",
+    "better-sqlite3": "12.11.1",
     "fastify": "^5.10.0",
     "node-pty": "1.1.0",
     "web-push": "^3.6.7",
     "zod": "^4.4.3",
-    "@roamcode.ai/web": "1.0.0"
+    "@roamcode.ai/web": "1.0.2"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",

package/dist/auth.d.ts

@@ -1,63 +0,0 @@
-export declare function extractBearerToken(authorizationHeader: string | undefined): string | undefined;
-export interface AuthGateOptions {
-    token?: string;
-    /** Consecutive failures from one client before it is locked out. Default 10. */
-    maxFailures?: number;
-    /** Lockout duration in ms. Default 60000. */
-    lockoutMs?: number;
-    /**
-     * Grace window (ms) after {@link AuthGate.rotateToken} during which the PREVIOUS token is still
-     * accepted, so a callback already in flight with the old token (e.g. a running mcp-send subprocess that
-     * captured RC_TOKEN at spawn) survives the rotation instead of 401-ing mid-conversation. Default 60000.
-     */
-    graceMs?: number;
-    /** Injectable clock for tests. Default Date.now. */
-    now?: () => number;
-}
-export type AuthCheckResult = {
-    ok: true;
-} | {
-    ok: false;
-    reason: "locked" | "invalid" | "missing-token-config";
-};
-/**
- * Verifies a bearer access token in constant time and applies a per-client
- * lockout after repeated failures. Pure / I/O-free so it is unit-testable;
- * Task 8 wires it as a single global Fastify `preHandler` that also gates the
- * WebSocket upgrade.
- *
- * Proxy lockout caveat: the lockout is keyed by `clientKey` (`request.ip`).
- * Behind a reverse proxy (Caddy / Cloudflare) `request.ip` is the proxy's IP
- * for EVERY client, collapsing the per-client lockout to one shared key. To
- * stop that from self-DoS-ing the sole legitimate user, {@link check} validates
- * the token FIRST: a CORRECT token is ALWAYS accepted, even while its key is
- * locked out — the lockout only ever throttles WRONG guesses. Supplying a real
- * per-client key (Fastify `trustProxy` scoped to the proxy) still makes the
- * throttle per-client, but is no longer required to keep the user from being
- * locked out by someone else's bad traffic.
- */
-export declare class AuthGate {
-    private token?;
-    private previousToken?;
-    private previousValidUntil;
-    private readonly maxFailures;
-    private readonly lockoutMs;
-    private readonly graceMs;
-    private readonly now;
-    private readonly clients;
-    constructor(opts: AuthGateOptions);
-    check(presentedToken: string | undefined, clientKey: string): AuthCheckResult;
-    /**
-     * Atomically swap in a fresh access token (POST /token/rotate). Every subsequent {@link check} compares
-     * against the new token; the OLD token is accepted only for a brief grace window (graceMs) so in-flight
-     * callbacks holding it (a running mcp-send subprocess) survive the rotation instead of 401-ing mid-turn.
-     * A 2nd rotation within the window REPLACES previousToken with the most-recent old token (no list grows).
-     * Also clears all per-client lockout state — rotation is an explicit administrative reset, so a fresh
-     * slate is correct (and avoids leaving a client locked out against a token that no longer exists).
-     */
-    rotateToken(newToken: string): void;
-    /** Drop entries whose lockout has expired and whose failure count is 0 — keeps the map bounded. */
-    private sweepExpired;
-    /** TEST ONLY: number of tracked clients currently locked (lockedUntil in the future). */
-    lockedClientCount(): number;
-}

package/dist/auth.js

@@ -1,133 +0,0 @@
-import { timingSafeEqual } from "node:crypto";
-export function extractBearerToken(authorizationHeader) {
-    if (!authorizationHeader)
-        return undefined;
-    const match = /^Bearer\s+(.+)$/i.exec(authorizationHeader.trim());
-    return match ? match[1] : undefined;
-}
-/** Constant-time string compare that does not leak length via early return. */
-function constantTimeEqual(a, b) {
-    const bufA = Buffer.from(a, "utf8");
-    const bufB = Buffer.from(b, "utf8");
-    // timingSafeEqual requires equal lengths; compare against a fixed-length digest-free padding.
-    if (bufA.length !== bufB.length) {
-        // Still do a compare to keep timing uniform, then return false.
-        timingSafeEqual(bufA, bufA);
-        return false;
-    }
-    return timingSafeEqual(bufA, bufB);
-}
-/**
- * Verifies a bearer access token in constant time and applies a per-client
- * lockout after repeated failures. Pure / I/O-free so it is unit-testable;
- * Task 8 wires it as a single global Fastify `preHandler` that also gates the
- * WebSocket upgrade.
- *
- * Proxy lockout caveat: the lockout is keyed by `clientKey` (`request.ip`).
- * Behind a reverse proxy (Caddy / Cloudflare) `request.ip` is the proxy's IP
- * for EVERY client, collapsing the per-client lockout to one shared key. To
- * stop that from self-DoS-ing the sole legitimate user, {@link check} validates
- * the token FIRST: a CORRECT token is ALWAYS accepted, even while its key is
- * locked out — the lockout only ever throttles WRONG guesses. Supplying a real
- * per-client key (Fastify `trustProxy` scoped to the proxy) still makes the
- * throttle per-client, but is no longer required to keep the user from being
- * locked out by someone else's bad traffic.
- */
-export class AuthGate {
-    // NOT readonly: rotateToken() atomically swaps in a fresh secret (POST /token/rotate). Every subsequent
-    // check() compares against the new token, so the OLD token is invalid the instant rotation completes —
-    // except within the brief grace window below, where the PREVIOUS token is still accepted.
-    token;
-    // DUAL-TOKEN GRACE: the token rotation REPLACED, plus the wall time it stays acceptable until. Lets a
-    // callback already in flight with the old token (a running mcp-send subprocess captured RC_TOKEN at
-    // spawn; rewriting its 0600 config can't update the live process env) finish instead of 401-ing
-    // mid-conversation. Only ONE previous token is ever retained — a 2nd rotation within the window
-    // supersedes it with the most-recent old token (never a growing list).
-    previousToken;
-    previousValidUntil = 0;
-    maxFailures;
-    lockoutMs;
-    graceMs;
-    now;
-    clients = new Map();
-    constructor(opts) {
-        this.token = opts.token;
-        this.maxFailures = opts.maxFailures ?? 10;
-        this.lockoutMs = opts.lockoutMs ?? 60000;
-        this.graceMs = opts.graceMs ?? 60000;
-        this.now = opts.now ?? Date.now;
-    }
-    check(presentedToken, clientKey) {
-        if (!this.token)
-            return { ok: false, reason: "missing-token-config" };
-        this.sweepExpired();
-        const state = this.clients.get(clientKey) ?? { failures: 0, lockedUntil: 0 };
-        const t = this.now();
-        // Validate the token FIRST — BEFORE consulting the lockout. Accept the CURRENT token, OR — within the
-        // post-rotation grace window — the PREVIOUS one. Both go through the same length-mismatch-safe
-        // constant-time compare (no early return leaks length). A correct token is accepted even while this key
-        // is locked out, so bad guesses (from an attacker, or from ANY client when they all share the proxy's IP
-        // as clientKey) can never lock out the real user. SECURITY: the grace is a marginal exposure — the old
-        // token was already valid up to the instant of rotation; 60s more only lets in-flight MCP callbacks
-        // (send_image/send_file) complete, the deliberate tradeoff vs breaking attachments mid-turn.
-        const matchesCurrent = presentedToken !== undefined && constantTimeEqual(presentedToken, this.token);
-        const matchesPrevious = presentedToken !== undefined &&
-            this.previousToken !== undefined &&
-            t <= this.previousValidUntil &&
-            constantTimeEqual(presentedToken, this.previousToken);
-        if (matchesCurrent || matchesPrevious) {
-            this.clients.delete(clientKey); // reset on success
-            return { ok: true };
-        }
-        // Wrong token. Only now does the lockout apply — a locked key keeps rejecting WRONG guesses without
-        // counting further (the lock governs); the correct token above is unaffected.
-        if (state.lockedUntil > t)
-            return { ok: false, reason: "locked" };
-        state.failures += 1;
-        if (state.failures >= this.maxFailures) {
-            state.lockedUntil = t + this.lockoutMs;
-            state.failures = 0; // reset the counter; the lock now governs
-        }
-        this.clients.set(clientKey, state);
-        return { ok: false, reason: "invalid" };
-    }
-    /**
-     * Atomically swap in a fresh access token (POST /token/rotate). Every subsequent {@link check} compares
-     * against the new token; the OLD token is accepted only for a brief grace window (graceMs) so in-flight
-     * callbacks holding it (a running mcp-send subprocess) survive the rotation instead of 401-ing mid-turn.
-     * A 2nd rotation within the window REPLACES previousToken with the most-recent old token (no list grows).
-     * Also clears all per-client lockout state — rotation is an explicit administrative reset, so a fresh
-     * slate is correct (and avoids leaving a client locked out against a token that no longer exists).
-     */
-    rotateToken(newToken) {
-        // Retain the just-replaced token for the grace window — but ONLY when graceMs > 0, so graceMs:0 means
-        // an UNAMBIGUOUS instant cutover (no previous token retained, no same-millisecond boundary acceptance).
-        if (this.token !== undefined && this.graceMs > 0) {
-            this.previousToken = this.token;
-            this.previousValidUntil = this.now() + this.graceMs;
-        }
-        else {
-            this.previousToken = undefined;
-            this.previousValidUntil = 0;
-        }
-        this.token = newToken;
-        this.clients.clear();
-    }
-    /** Drop entries whose lockout has expired and whose failure count is 0 — keeps the map bounded. */
-    sweepExpired() {
-        const t = this.now();
-        for (const [key, state] of this.clients) {
-            if (state.lockedUntil <= t && state.failures === 0)
-                this.clients.delete(key);
-        }
-    }
-    /** TEST ONLY: number of tracked clients currently locked (lockedUntil in the future). */
-    lockedClientCount() {
-        const t = this.now();
-        let n = 0;
-        for (const state of this.clients.values())
-            if (state.lockedUntil > t)
-                n += 1;
-        return n;
-    }
-}

package/dist/claude-auth-service.d.ts

@@ -1,76 +0,0 @@
-import { type ChildProcess } from "node:child_process";
-/**
- * In-app re-authentication of the `claude` CLI's Claude subscription, so a user whose server-side login
- * expired (Anthropic returns 401 "Invalid authentication credentials" → every turn fails) can sign in
- * again FROM THE APP instead of SSHing to the server to run `claude auth login`.
- *
- * It wraps `claude`'s OWN manual OAuth flow (no reverse-engineering of Anthropic's OAuth):
- *   1. `claude auth login --claudeai` prints an authorize URL whose redirect is a HOSTED page
- *      (platform.claude.com/oauth/code/callback — not localhost), then waits on stdin for a pasted code.
- *   2. We spawn it, capture that URL, and hand it to the UI; the user opens it in ANY browser (their
- *      phone), authorizes, and copies the code the callback page shows.
- *   3. The UI posts the code back; we write it to the subprocess stdin; `claude` exchanges it and saves
- *      FRESH credentials where every future claude spawn reads them — auth is restored, no restart needed.
- *
- * Single in-flight login at a time (a new start supersedes a stale one); a started login self-expires so
- * an abandoned flow can't hold a subprocess forever. Spawn deps are injectable for unit tests.
- */
-export interface ClaudeAuthStatus {
-    /** Whether `claude` has stored credentials. NOTE: this reflects the LOCAL creds existing, not that they
-     *  still work — expired creds report loggedIn:true yet 401 on use, so re-auth is offered regardless. */
-    loggedIn: boolean;
-    email?: string;
-    /** "max" | "pro" | … (the Claude subscription tier), when reported. */
-    subscriptionType?: string;
-    authMethod?: string;
-    orgName?: string;
-}
-/** Parse `claude auth status` JSON output into a status. Returns {loggedIn:false} on any unparhseable/empty. */
-export declare function parseAuthStatus(stdout: string): ClaudeAuthStatus;
-/** Pull the authorize URL out of `claude auth login` output ("…visit: https://…/oauth/authorize?…"). */
-export declare function extractLoginUrl(output: string): string | undefined;
-export interface ClaudeAuthDeps {
-    /** Spawn a claude subcommand: `claude <args>` with the server env (login-session creds resolve). */
-    spawn: (args: string[]) => ChildProcess;
-    now: () => number;
-    /** How long a started login waits for the URL before giving up (default 20s). */
-    urlTimeoutMs?: number;
-    /** How long a started login may sit awaiting its code before self-expiring (default 5min). */
-    loginTtlMs?: number;
-}
-export declare const LOGIN_URL_TIMEOUT_MS = 20000;
-export declare const LOGIN_TTL_MS: number;
-export declare class ClaudeAuthService {
-    private readonly deps;
-    private pending?;
-    constructor(deps: ClaudeAuthDeps);
-    /** Current `claude auth status` (which account is signed in). Never rejects → {loggedIn:false} on error. */
-    status(): Promise<ClaudeAuthStatus>;
-    /**
-     * Start a login: spawn `claude auth login --claudeai`, resolve with the authorize URL once it's printed.
-     * Supersedes any prior in-flight login. Rejects if the URL never appears (timeout / immediate exit).
-     */
-    startLogin(): Promise<{
-        loginId: string;
-        url: string;
-    }>;
-    /**
-     * Submit the pasted authorization code for an in-flight login: write it to the subprocess stdin and
-     * resolve once `claude` finishes the exchange. {ok:true} on a clean exit (fresh creds saved); {ok:false}
-     * + message otherwise. `loginId` must match the in-flight login (else it's stale/unknown).
-     */
-    submitCode(loginId: string, code: string): Promise<{
-        ok: boolean;
-        message?: string;
-    }>;
-    /** Abandon any in-flight login (e.g. the user cancels). */
-    cancel(): void;
-    private cancelIf;
-}
-/** Production wiring: spawn `claude <args>` with the server env (ANTHROPIC_API_KEY stripped → subscription
- *  auth, mirroring the chat/usage spawns). stdin is piped so the code can be written for the login flow. */
-export declare function createClaudeAuthService(opts: {
-    claudeBin: string;
-    env?: NodeJS.ProcessEnv;
-    now?: () => number;
-}): ClaudeAuthService;

package/dist/claude-auth-service.js

@@ -1,217 +0,0 @@
-import { spawn as nodeSpawn } from "node:child_process";
-import { randomUUID } from "node:crypto";
-/** Parse `claude auth status` JSON output into a status. Returns {loggedIn:false} on any unparhseable/empty. */
-export function parseAuthStatus(stdout) {
-    try {
-        const o = JSON.parse(stdout);
-        return {
-            loggedIn: o.loggedIn === true,
-            email: typeof o.email === "string" ? o.email : undefined,
-            subscriptionType: typeof o.subscriptionType === "string" ? o.subscriptionType : undefined,
-            authMethod: typeof o.authMethod === "string" ? o.authMethod : undefined,
-            orgName: typeof o.orgName === "string" ? o.orgName : undefined,
-        };
-    }
-    catch {
-        return { loggedIn: false };
-    }
-}
-/** Pull the authorize URL out of `claude auth login` output ("…visit: https://…/oauth/authorize?…"). */
-export function extractLoginUrl(output) {
-    const m = /(https:\/\/[^\s]+oauth\/authorize[^\s]*)/i.exec(output);
-    return m ? m[1] : undefined;
-}
-export const LOGIN_URL_TIMEOUT_MS = 20_000;
-export const LOGIN_TTL_MS = 5 * 60_000;
-const STATUS_TIMEOUT_MS = 15_000;
-export class ClaudeAuthService {
-    deps;
-    pending;
-    constructor(deps) {
-        this.deps = {
-            spawn: deps.spawn,
-            now: deps.now,
-            urlTimeoutMs: deps.urlTimeoutMs ?? LOGIN_URL_TIMEOUT_MS,
-            loginTtlMs: deps.loginTtlMs ?? LOGIN_TTL_MS,
-        };
-    }
-    /** Current `claude auth status` (which account is signed in). Never rejects → {loggedIn:false} on error. */
-    async status() {
-        return new Promise((resolve) => {
-            let child;
-            try {
-                child = this.deps.spawn(["auth", "status"]);
-            }
-            catch {
-                resolve({ loggedIn: false });
-                return;
-            }
-            let out = "";
-            let settled = false;
-            const done = (s) => {
-                if (settled)
-                    return;
-                settled = true;
-                clearTimeout(timer);
-                resolve(s);
-            };
-            const timer = setTimeout(() => {
-                try {
-                    child.kill("SIGKILL");
-                }
-                catch {
-                    /* gone */
-                }
-                done({ loggedIn: false });
-            }, STATUS_TIMEOUT_MS);
-            child.stdout?.on("data", (d) => (out += d.toString()));
-            child.on("error", () => done({ loggedIn: false }));
-            child.on("close", () => done(parseAuthStatus(out)));
-        });
-    }
-    /**
-     * Start a login: spawn `claude auth login --claudeai`, resolve with the authorize URL once it's printed.
-     * Supersedes any prior in-flight login. Rejects if the URL never appears (timeout / immediate exit).
-     */
-    async startLogin() {
-        this.cancel(); // one in-flight login at a time
-        return new Promise((resolve, reject) => {
-            let child;
-            try {
-                child = this.deps.spawn(["auth", "login", "--claudeai"]);
-            }
-            catch (err) {
-                reject(err instanceof Error ? err : new Error("failed to spawn claude"));
-                return;
-            }
-            const id = randomUUID();
-            let settled = false;
-            let buf = "";
-            const onData = (d) => {
-                buf += d.toString();
-                const url = extractLoginUrl(buf);
-                if (url && !settled) {
-                    settled = true;
-                    clearTimeout(timer);
-                    // Hand off to a PendingLogin that lives until the code arrives (or it self-expires).
-                    const expiry = setTimeout(() => this.cancelIf(id), this.deps.loginTtlMs);
-                    this.pending = { id, child, output: buf, startedAt: this.deps.now(), expiry };
-                    // Keep accumulating output (the success/error after the code is submitted).
-                    child.stdout?.on("data", (x) => this.pending && (this.pending.output += x.toString()));
-                    child.stderr?.on("data", (x) => this.pending && (this.pending.output += x.toString()));
-                    resolve({ loginId: id, url });
-                }
-            };
-            const fail = (msg) => {
-                if (settled)
-                    return;
-                settled = true;
-                clearTimeout(timer);
-                try {
-                    child.kill("SIGKILL");
-                }
-                catch {
-                    /* gone */
-                }
-                reject(new Error(msg));
-            };
-            const timer = setTimeout(() => fail("timed out waiting for the sign-in URL"), this.deps.urlTimeoutMs);
-            child.stdout?.on("data", onData);
-            child.stderr?.on("data", onData);
-            child.on("error", (e) => fail(e.message));
-            child.on("close", () => fail(buf.trim() || "claude exited before printing a sign-in URL"));
-        });
-    }
-    /**
-     * Submit the pasted authorization code for an in-flight login: write it to the subprocess stdin and
-     * resolve once `claude` finishes the exchange. {ok:true} on a clean exit (fresh creds saved); {ok:false}
-     * + message otherwise. `loginId` must match the in-flight login (else it's stale/unknown).
-     */
-    async submitCode(loginId, code) {
-        const p = this.pending;
-        if (!p || p.id !== loginId)
-            return { ok: false, message: "no sign-in is in progress (it may have expired)" };
-        const trimmed = code.trim();
-        if (!trimmed)
-            return { ok: false, message: "the code is empty" };
-        return new Promise((resolve) => {
-            let settled = false;
-            const done = (r) => {
-                if (settled)
-                    return;
-                settled = true;
-                clearTimeout(timer);
-                if (this.pending === p) {
-                    clearTimeout(p.expiry);
-                    this.pending = undefined;
-                }
-                resolve(r);
-            };
-            const timer = setTimeout(() => {
-                try {
-                    p.child.kill("SIGKILL");
-                }
-                catch {
-                    /* gone */
-                }
-                done({ ok: false, message: "timed out completing sign-in" });
-            }, STATUS_TIMEOUT_MS);
-            p.child.on("close", (codeNum) => {
-                // A clean exit (0) means the token exchange succeeded. Otherwise surface the tail of the output.
-                if (codeNum === 0)
-                    done({ ok: true });
-                else
-                    done({ ok: false, message: tail(p.output) || `sign-in failed (exit ${codeNum ?? "?"})` });
-            });
-            p.child.on("error", (e) => done({ ok: false, message: e.message }));
-            try {
-                p.child.stdin?.write(trimmed + "\n");
-                p.child.stdin?.end();
-            }
-            catch (e) {
-                done({ ok: false, message: e instanceof Error ? e.message : "failed to submit the code" });
-            }
-        });
-    }
-    /** Abandon any in-flight login (e.g. the user cancels). */
-    cancel() {
-        const p = this.pending;
-        if (!p)
-            return;
-        clearTimeout(p.expiry);
-        try {
-            p.child.kill("SIGKILL");
-        }
-        catch {
-            /* gone */
-        }
-        this.pending = undefined;
-    }
-    cancelIf(id) {
-        if (this.pending?.id === id)
-            this.cancel();
-    }
-}
-/** Last non-empty line of output (the error/success message claude prints), capped. */
-function tail(output) {
-    const line = output
-        .split("\n")
-        .map((l) => l.trim())
-        .filter(Boolean)
-        .pop();
-    if (!line)
-        return "";
-    return line.length > 200 ? line.slice(0, 197) + "…" : line;
-}
-/** Production wiring: spawn `claude <args>` with the server env (ANTHROPIC_API_KEY stripped → subscription
- *  auth, mirroring the chat/usage spawns). stdin is piped so the code can be written for the login flow. */
-export function createClaudeAuthService(opts) {
-    return new ClaudeAuthService({
-        spawn: (args) => {
-            const env = { ...(opts.env ?? process.env) };
-            delete env.ANTHROPIC_API_KEY;
-            return nodeSpawn(opts.claudeBin, args, { env, stdio: ["pipe", "pipe", "pipe"] });
-        },
-        now: opts.now ?? (() => Date.now()),
-    });
-}

package/dist/claude-latest-service.d.ts

@@ -1,34 +0,0 @@
-/**
- * The LATEST published `claude` CLI version, for update-awareness: the UI compares a session's
- * `claudeVersion` (what it spawned with) against this to show a subtle "update available" hint when a
- * chat is running an older Claude than what's out.
- *
- * Source: the npm registry's dist-tag for `@anthropic-ai/claude-code` (the same release train as the
- * native installer), fetched best-effort and TTL-cached so the rare /claude/version poll is cheap. Any
- * failure (offline, timeout, registry hiccup) degrades to the last good value, or undefined — the UI
- * simply hides the hint, never errors. The fetch is an INJECTABLE seam so the cache logic is unit-testable.
- */
-export declare const CLAUDE_LATEST_CACHE_MS: number;
-/** Resolve the latest version string (e.g. "2.1.195"). NEVER rejects — resolves undefined on any failure. */
-export type FetchLatest = () => Promise<string | undefined>;
-export interface ClaudeLatestDeps {
-    fetchLatest: FetchLatest;
-    now: () => number;
-    ttlMs?: number;
-}
-/** Pull `version` out of an npm dist-tag document (`{ "version": "2.1.195", … }`). */
-export declare function parseNpmLatest(json: unknown): string | undefined;
-export declare class ClaudeLatestService {
-    private readonly fetchLatest;
-    private readonly now;
-    private readonly ttlMs;
-    private cache?;
-    constructor(deps: ClaudeLatestDeps);
-    /** The latest version, TTL-cached. A failed refresh keeps the last good value (or undefined). */
-    getLatest(): Promise<string | undefined>;
-}
-/** The real fetch adapter: GET the npm dist-tag doc with a short timeout. Resolves undefined on any error. */
-export declare function createClaudeLatestService(opts?: {
-    now?: () => number;
-    ttlMs?: number;
-}): ClaudeLatestService;

package/dist/claude-latest-service.js

@@ -1,61 +0,0 @@
-/**
- * The LATEST published `claude` CLI version, for update-awareness: the UI compares a session's
- * `claudeVersion` (what it spawned with) against this to show a subtle "update available" hint when a
- * chat is running an older Claude than what's out.
- *
- * Source: the npm registry's dist-tag for `@anthropic-ai/claude-code` (the same release train as the
- * native installer), fetched best-effort and TTL-cached so the rare /claude/version poll is cheap. Any
- * failure (offline, timeout, registry hiccup) degrades to the last good value, or undefined — the UI
- * simply hides the hint, never errors. The fetch is an INJECTABLE seam so the cache logic is unit-testable.
- */
-const NPM_LATEST_URL = "https://registry.npmjs.org/@anthropic-ai/claude-code/latest";
-export const CLAUDE_LATEST_CACHE_MS = 6 * 60 * 60 * 1000;
-const FETCH_TIMEOUT_MS = 8000;
-/** Pull `version` out of an npm dist-tag document (`{ "version": "2.1.195", … }`). */
-export function parseNpmLatest(json) {
-    if (json && typeof json === "object" && typeof json.version === "string") {
-        return json.version;
-    }
-    return undefined;
-}
-export class ClaudeLatestService {
-    fetchLatest;
-    now;
-    ttlMs;
-    cache;
-    constructor(deps) {
-        this.fetchLatest = deps.fetchLatest;
-        this.now = deps.now;
-        this.ttlMs = deps.ttlMs ?? CLAUDE_LATEST_CACHE_MS;
-    }
-    /** The latest version, TTL-cached. A failed refresh keeps the last good value (or undefined). */
-    async getLatest() {
-        const now = this.now();
-        if (this.cache && now - this.cache.at < this.ttlMs)
-            return this.cache.value;
-        const fetched = await this.fetchLatest().catch(() => undefined);
-        const value = fetched ?? this.cache?.value;
-        this.cache = { at: now, value };
-        return value;
-    }
-}
-/** The real fetch adapter: GET the npm dist-tag doc with a short timeout. Resolves undefined on any error. */
-export function createClaudeLatestService(opts = {}) {
-    const fetchLatest = async () => {
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
-        try {
-            const res = await fetch(NPM_LATEST_URL, { signal: controller.signal });
-            if (!res.ok)
-                return undefined;
-            return parseNpmLatest(await res.json());
-        }
-        catch {
-            return undefined;
-        }
-        finally {
-            clearTimeout(timer);
-        }
-    };
-    return new ClaudeLatestService({ fetchLatest, now: opts.now ?? (() => Date.now()), ttlMs: opts.ttlMs });
-}