@saltpub/xiaojiu-agent-bridge 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # xiaojiu-agent-bridge
 
+## 0.1.1
+
+### Highlights
+
+- Harden npm update checks, terminal output, and semantic version handling.
+- Keep release artifacts free of private repository metadata.
+
+### Changed
+
+- Run automatic update checks after interactive commands finish and keep explicit checks separate.
+- Require strict SemVer comparison for release discovery.
+- Sanitize and bound release metadata before writing it to the terminal.
+
+### Fixed
+
+- Show security-update metadata and keep manual update output on stdout.
+- Avoid caching failed Registry checks for 24 hours.
+- Match changelog versions exactly while retaining historical entries.
+- Stop persisting write-capable GitHub credentials during release dependency installation.
+
 ## 0.1.0
 
 ### Highlights
@@ -23,3 +43,18 @@
 ### Fixed
 
 - Prevent private repository URLs, credentials, and source artifacts from entering the npm package.
+
+## 0.0.2
+
+### Highlights
+
+- Omit repository metadata from the published npm package and reject source files in the tarball.
+
+### Added
+
+- Align Xiaojiu IM APIs with the handbook.
+
+### Fixed
+
+- Add `removeReaction` support for typecheck compatibility.
+- Stream Markdown replies as cards.

package/README.md

@@ -66,6 +66,7 @@ pnpm build
 npm install -g .
 ```
 
+
 ### 启动第一个 profile
 
 把占位符换成你的 Bot 凭据与 Bot Owner 工号：
@@ -131,10 +132,10 @@ xiaojiu-agent-bridge stop
 
 ## 版本更新
 
-CLI 在交互式终端中每 24 小时异步检查一次 npm Registry，不阻塞当前命令。也可以手动检查和查看随包发布的更新记录：
+CLI 在交互式终端中每 24 小时检查一次 npm Registry，不阻塞命令启动。为避免干扰首次配置或交互式界面，提示只会在支持的终端会话中显示，并可随时手动检查和查看随包发布的更新记录：
 
 ```bash
-xiaojiu-agent-bridge update --check
+xiaojiu-agent-bridge update
 xiaojiu-agent-bridge changelog
 npm install -g @saltpub/xiaojiu-agent-bridge@latest
 ```

package/dist/cli.js

@@ -578,13 +578,30 @@ function compareVersions(left, right) {
     const difference = (a.numbers[index] ?? 0) - (b.numbers[index] ?? 0);
     if (difference !== 0) return difference;
   }
-  if (a.prerelease === b.prerelease) return 0;
-  if (!a.prerelease) return 1;
-  if (!b.prerelease) return -1;
-  return a.prerelease.localeCompare(b.prerelease, void 0, { numeric: true });
+  if (a.prerelease.length === 0 && b.prerelease.length === 0) return 0;
+  if (a.prerelease.length === 0) return 1;
+  if (b.prerelease.length === 0) return -1;
+  const length = Math.max(a.prerelease.length, b.prerelease.length);
+  for (let index = 0; index < length; index += 1) {
+    const leftPart = a.prerelease[index];
+    const rightPart = b.prerelease[index];
+    if (leftPart === void 0) return -1;
+    if (rightPart === void 0) return 1;
+    if (leftPart === rightPart) continue;
+    const leftNumeric = /^\d+$/.test(leftPart);
+    const rightNumeric = /^\d+$/.test(rightPart);
+    if (leftNumeric && rightNumeric) return Number(leftPart) - Number(rightPart);
+    if (leftNumeric) return -1;
+    if (rightNumeric) return 1;
+    return leftPart < rightPart ? -1 : 1;
+  }
+  return 0;
 }
 function parseUpdateInfo(metadata, currentVersion = version) {
-  if (typeof metadata.version !== "string" || compareVersions(metadata.version, currentVersion) <= 0) {
+  if (typeof metadata.version !== "string") return void 0;
+  try {
+    if (compareVersions(metadata.version, currentVersion) <= 0) return void 0;
+  } catch {
     return void 0;
   }
   const update = metadata.xiaojiu?.update;
@@ -608,10 +625,14 @@ async function fetchUpdateInfo(options = {}) {
       headers: { accept: "application/json" },
       signal: controller.signal
     });
-    if (!response.ok) return void 0;
+    if (!response.ok) {
+      if (options.throwOnError) throw new Error(`npm Registry returned ${response.status}`);
+      return void 0;
+    }
     const metadata = await response.json();
     return parseUpdateInfo(metadata, options.currentVersion ?? version);
-  } catch {
+  } catch (error) {
+    if (options.throwOnError) throw error;
     return void 0;
   } finally {
     clearTimeout(timer);
@@ -622,19 +643,25 @@ async function maybeShowUpdateNotice() {
   const state = await readState();
   const lastChecked = Date.parse(state.lastCheckedAt ?? "");
   if (Number.isFinite(lastChecked) && Date.now() - lastChecked < CHECK_INTERVAL_MS) return;
-  const info = await fetchUpdateInfo();
-  await writeState({ ...state, lastCheckedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  let info;
+  try {
+    info = await fetchUpdateInfo({ throwOnError: true });
+  } catch {
+    return;
+  }
+  const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+  await writeState({ ...state, lastCheckedAt: checkedAt });
   if (!info || info.latestVersion === state.lastNotifiedVersion || info.latestVersion === state.skippedVersion) return;
-  await writeState({ ...state, lastCheckedAt: (/* @__PURE__ */ new Date()).toISOString(), lastNotifiedVersion: info.latestVersion });
-  printUpdateNotice(info);
+  await writeState({ ...state, lastCheckedAt: checkedAt, lastNotifiedVersion: info.latestVersion });
+  printUpdateNotice(info, process.stderr);
 }
 async function runUpdateCheck() {
   const info = await fetchUpdateInfo();
   if (!info) {
-    console.log(`xiaojiu-agent-bridge ${version} is up to date, or the npm Registry is unavailable.`);
+    console.log(`${packageName} ${version} is up to date, or the npm Registry is unavailable.`);
     return;
   }
-  printUpdateNotice(info);
+  printUpdateNotice(info, process.stdout);
 }
 async function runChangelog(requestedVersion) {
   const changelog = await readFile(changelogPath(), "utf8");
@@ -647,21 +674,24 @@ async function runChangelog(requestedVersion) {
 `);
 }
 function extractChangelogSection(markdown, requestedVersion) {
-  const heading = `## ${requestedVersion}`;
-  const start = markdown.indexOf(heading);
-  if (start < 0) return void 0;
-  const after = markdown.slice(start + heading.length);
+  const escapedVersion = requestedVersion.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const match = new RegExp(`^## ${escapedVersion}\\s*$`, "m").exec(markdown);
+  if (!match || match.index === void 0) return void 0;
+  const start = match.index;
+  const after = markdown.slice(start + match[0].length);
   const next = after.search(/\n## /);
   const body = next < 0 ? after : after.slice(0, next);
-  return `${heading}${body}`.trim();
+  return `${match[0]}${body}`.trim();
 }
-function printUpdateNotice(info) {
+function printUpdateNotice(info, stream2) {
   const lines = [`A new version of ${packageName} is available: ${info.currentVersion} -> ${info.latestVersion}`, "", "Run:", `  npm install -g ${packageName}@latest`];
+  if (info.securityFix) lines.push("", "Security update: updating promptly is recommended.");
   if (info.requiresRestart) lines.push("", "Restart the bridge after updating: `xiaojiu-agent-bridge restart`");
   if (info.breakingChanges.length > 0) lines.push("", "Breaking changes:", ...info.breakingChanges.map((item) => `  - ${item}`));
   if (info.highlights.length > 0) lines.push("", "What's new:", ...info.highlights.map((item) => `  - ${item}`));
   lines.push("", "View details with:", "  xiaojiu-agent-bridge changelog");
-  console.error(lines.join("\n"));
+  stream2.write(`${lines.join("\n")}
+`);
 }
 function isUpdateCheckDisabled() {
   return process.env.XIAOJIU_BRIDGE_NO_UPDATE_CHECK === "1" || process.env.CI === "true" || process.env.TERM === "dumb" || !process.stdin.isTTY || !process.stdout.isTTY;
@@ -696,15 +726,18 @@ async function writeState(state) {
   }
 }
 function parseVersion(value) {
-  const match = value.trim().replace(/^v/, "").match(/^(\d+)(?:\.(\d+))?(?:\.(\d+))?(?:-([^+]+))?/);
-  if (!match) return { numbers: [0], prerelease: value };
+  const match = value.trim().match(
+    /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/
+  );
+  if (!match) throw new Error(`invalid semantic version: ${value}`);
   return {
-    numbers: [Number(match[1]), Number(match[2] ?? 0), Number(match[3] ?? 0)],
-    prerelease: match[4] ?? ""
+    numbers: [Number(match[1]), Number(match[2]), Number(match[3])],
+    prerelease: match[4]?.split(".") ?? []
   };
 }
 function stringList(value) {
-  return Array.isArray(value) ? value.filter((item) => typeof item === "string" && item.trim().length > 0) : [];
+  if (!Array.isArray(value)) return [];
+  return value.filter((item) => typeof item === "string").map((item) => item.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").trim().slice(0, 200)).filter((item) => item.length > 0).slice(0, 5);
 }
 
 // src/runtime/listen-sidecar.ts
@@ -16634,7 +16667,7 @@ function openBrowser(url) {
 // src/cli/index.ts
 var program = new Command();
 program.name("xiaojiu-agent-bridge").description(`Bridge Xiaojiu IM with local CLI coding agents (${packageName})`).version(version, "-v, --version");
-program.command("update").description("Check for a newer npm package version").option("--check", "check without installing").action(async (opts) => {
+program.command("update").description("Check for a newer npm package version").action(async () => {
   await runUpdateCheck();
 });
 program.command("changelog [version]").description("Show release notes for the installed version").action(async (requestedVersion) => {
@@ -16704,8 +16737,11 @@ secrets.command("list").description("List the IDs of secrets in the encrypted ke
 secrets.command("remove").description("Delete an entry from the encrypted keystore").requiredOption("--app-id <id>", "App ID to remove").option("--profile <name>", "profile name (defaults to active profile)").action(async (opts) => {
   await runSecretsRemove(opts.appId, { profile: opts.profile });
 });
-void maybeShowUpdateNotice();
-program.parseAsync(process.argv).catch((err) => {
+program.parseAsync(process.argv).then(async () => {
+  if (process.argv[2] !== "update" && process.argv[2] !== "changelog") {
+    await maybeShowUpdateNotice();
+  }
+}).catch((err) => {
   const diagnostic = getAgentPreflightDiagnostic(err);
   if (diagnostic) {
     console.error(formatAgentPreflightDiagnostic(diagnostic));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saltpub/xiaojiu-agent-bridge",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Bridge Xiaojiu IM with local CLI coding agents",
   "type": "module",
   "packageManager": "pnpm@10.33.0",
@@ -108,11 +108,11 @@
       "schemaVersion": 1,
       "channel": "stable",
       "highlights": [
-        "Add npm-based update checks and a local changelog command.",
-        "Publish the first scoped package under the SaltPub organization."
+        "Harden npm update checks, terminal output, and semantic version handling.",
+        "Keep release artifacts free of private repository metadata."
       ],
       "breakingChanges": [],
-      "securityFix": false,
+      "securityFix": true,
       "requiresRestart": false
     }
   }