@shardflux/cli 0.15.0 → 0.15.2

package/dist/update-check.js

@@ -1,11 +1,12 @@
 /**
- * `shard` tells its user when it is outdated or no longer supported (0.5.0+). The API's
- * GET /v1/client-versions names the latest published version of every client and the oldest one it still serves.
+ * `shard` tells its user when it is outdated or no longer supported (0.5.0+). The latest version comes from the
+ * registry (0.15.2+: npm's `latest` dist-tag, see registry.ts); the API's GET /v1/client-versions names the oldest
+ * version it still serves and, optionally, a version to stop recommending (`hold`).
  *
- * - At most one request per 24 hours per API URL and package: the answer is cached in
- *   <config dir>/update-check.json (`checked_at`, `latest`, `minimum_supported`, `upgrade_command`). The attempt is
- *   recorded before the request, so an unreachable API is not asked again for a day either.
- * - Started in parallel with the command (the SDK's checkClientVersion: one request, 3 s timeout, never throws) and
+ * - At most one check per 12 hours per API URL and package: the answer is cached in <config dir>/update-check.json
+ *   (`checked_at`, `latest`, `minimum_supported`, `upgrade_command`, and what each source said, with the registry's
+ *   ETag). The attempt is recorded before the requests, so an unreachable network is not asked again for 12 hours.
+ * - Started in parallel with the command (two requests in parallel, 3 s timeout each, never throws) and
  *   printed on stderr after it. When the command ends first, `shard` waits at most ~300 ms and otherwise skips the
  *   notice (the next run uses what this one cached). Never changes the exit code; never printed after a command that
  *   failed with --json (the error document stays the only stderr content).
@@ -14,13 +15,16 @@
  * - Off with SHARDFLUX_NO_UPDATE_CHECK=1 (also true/yes/on) or NO_UPDATE_NOTIFIER (the SDK's rules);
  *   `shard version --check` still asks.
  */
-import { checkClientVersion, clientVersionStatus, versionCheckDisabledByEnv } from '@shardflux/sdk';
+import { clientVersionStatus, versionCheckDisabledByEnv } from '@shardflux/sdk';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { CLI_VERSION } from "./args.js";
 import { writePrivateFile } from "./credentials.js";
+import { NPM_REGISTRY, npmLatest, withRegistryLatest } from "./registry.js";
 export const UPDATE_CHECK_FILE = 'update-check.json';
-export const CHECK_INTERVAL_MS = 24 * 3600 * 1000;
+export const CHECK_INTERVAL_MS = 12 * 3600 * 1000;
+/** The catalog request's timeout (ms). */
+const CATALOG_TIMEOUT_MS = 3_000;
 /** How long the end of a command waits for a check that is still running. */
 export const NOTICE_WAIT_MS = 300;
 export const CLI_DISTRIBUTION = { package: '@shardflux/cli', version: CLI_VERSION };
@@ -44,7 +48,26 @@ function entryOf(doc, apiUrl, pkg) {
     const e = doc.checks[apiUrl]?.[pkg];
     if (!isObj(e) || typeof e.checked_at !== 'string' || Number.isNaN(Date.parse(e.checked_at)))
         return null;
-    return { checked_at: e.checked_at, latest: strOrNull(e.latest), minimum_supported: strOrNull(e.minimum_supported), upgrade_command: strOrNull(e.upgrade_command), release_notes_url: strOrNull(e.release_notes_url) };
+    return {
+        checked_at: e.checked_at, latest: strOrNull(e.latest), minimum_supported: strOrNull(e.minimum_supported), upgrade_command: strOrNull(e.upgrade_command), release_notes_url: strOrNull(e.release_notes_url),
+        // An entry written before 0.15.2 has no sources: its `latest` came from the catalog.
+        catalog_latest: 'catalog_latest' in e ? strOrNull(e.catalog_latest) : strOrNull(e.latest), hold: strOrNull(e.hold), registry_latest: strOrNull(e.registry_latest), registry_etag: strOrNull(e.registry_etag),
+    };
+}
+/** GET /v1/client-versions, or null when the API did not answer with JSON (never throws). */
+async function fetchCatalog(apiUrl, f, userAgent) {
+    try {
+        const res = await f(new URL('/v1/client-versions', `${apiUrl.replace(/\/+$/, '')}/`), { method: 'GET', headers: { accept: 'application/json', 'user-agent': userAgent }, signal: AbortSignal.timeout(CATALOG_TIMEOUT_MS) });
+        if (!res.ok) {
+            await res.body?.cancel().catch(() => undefined);
+            return null;
+        }
+        const body = JSON.parse(await res.text());
+        return isObj(body) && Array.isArray(body.clients) ? body : null;
+    }
+    catch {
+        return null;
+    }
 }
 /** The status the cached answer gives this distribution (the same rules as the SDK; no request). */
 export function statusFromEntry(entry, d) {
@@ -71,7 +94,7 @@ export class UpdateCheck {
         const cached = entryOf(readCache(this.#file), this.#o.apiUrl, this.#o.distribution.package);
         return cached ? { status: statusFromEntry(cached, this.#o.distribution), checkedAt: cached.checked_at } : null;
     }
-    /** Starts the check: from the cache when it is younger than 24 h (unless `force`), else one request. */
+    /** Starts the check: from the cache when it is younger than 12 h (unless `force`), else the registry and the API. */
     start(force = false) {
         const { apiUrl, distribution: d } = this.#o;
         const now = (this.#o.now ?? Date.now)();
@@ -82,14 +105,29 @@ export class UpdateCheck {
             return;
         }
         const checkedAt = new Date(now).toISOString();
-        // Record the attempt first: a request that never finishes (the command ended, the API is unreachable) still
-        // counts, and the previous answer stays until a new one arrives.
+        // Record the attempt first: requests that never finish (the command ended, the network is down) still count,
+        // and the previous answer stays until a new one arrives.
         this.#write(doc, { ...(cached ?? { latest: null, minimum_supported: null, upgrade_command: null, release_notes_url: null }), checked_at: checkedAt });
-        this.#pending = checkClientVersion({ baseUrl: apiUrl, fetch: this.#o.fetch, package: d.package, version: d.version, ecosystem: 'npm', userAgent: this.#o.userAgent }).then((status) => {
-            const answered = status.latest !== null || status.minimumSupported !== null;
-            if (!answered)
-                return { status: cached ? statusFromEntry(cached, d) : status, checkedAt: cached ? cached.checked_at : null };
-            this.#write(readCache(this.#file), { checked_at: checkedAt, latest: status.latest, minimum_supported: status.minimumSupported, upgrade_command: status.upgradeCommand, release_notes_url: status.releaseNotesUrl });
+        const f = this.#o.fetch;
+        this.#pending = Promise.all([
+            fetchCatalog(apiUrl, f, this.#o.userAgent),
+            npmLatest(d.package, { fetch: f, registry: this.#o.registry ?? NPM_REGISTRY, etag: cached?.registry_latest ? cached.registry_etag : null, userAgent: this.#o.userAgent }),
+        ]).then(([catalog, registry]) => {
+            const registryLatest = registry?.notModified ? (cached?.registry_latest ?? null) : (registry?.latest ?? null);
+            if (catalog === null && registryLatest === null) {
+                // Nobody answered: the last answer stands.
+                return { status: cached ? statusFromEntry(cached, d) : statusFromEntry(null, d), checkedAt: cached ? cached.checked_at : null };
+            }
+            // A catalog that did not answer this time: what it said last time (minimum_supported, hold) still applies.
+            const base = catalog ?? (cached ? { clients: [{ package: d.package, ecosystem: 'npm', latest: cached.catalog_latest ?? null, minimum_supported: cached.minimum_supported, upgrade_command: cached.upgrade_command, release_notes_url: cached.release_notes_url, hold: cached.hold ?? null }] } : null);
+            const merged = withRegistryLatest(base, registryLatest ? { [d.package]: registryLatest } : {});
+            const own = merged.clients.find((c) => c.ecosystem === 'npm' && c.package === d.package);
+            const status = clientVersionStatus(merged, { package: d.package, version: d.version, ecosystem: 'npm' });
+            const raw = base?.clients.find((c) => c.ecosystem === 'npm' && c.package === d.package);
+            this.#write(readCache(this.#file), {
+                checked_at: checkedAt, latest: own?.latest ?? null, minimum_supported: own?.minimum_supported ?? null, upgrade_command: own?.upgrade_command ?? null, release_notes_url: own?.release_notes_url ?? null,
+                catalog_latest: strOrNull(raw?.latest), hold: own?.hold ?? null, registry_latest: registryLatest, registry_etag: registry?.etag ?? cached?.registry_etag ?? null,
+            });
             return { status, checkedAt };
         });
     }

package/dist/update.d.ts

@@ -52,6 +52,8 @@ export interface UpdateDeps {
     run?: Runner;
     menubar?: MenubarManager;
 }
+/** True when nothing is behind but the menu bar app, and the app the npm package carries is already that version. */
+export declare function onlyAppToSwap(pending: Component[], packagedApp: string | null): boolean;
 export declare function update(ctx: Ctx, values: Record<string, unknown>, deps?: UpdateDeps): Promise<number>;
 /** Records where `shard` runs, for the menu bar's update button. Written on macOS, only when it changed. */
 export declare function recordInstall(dir: string, runtime: Runtime, distribution: {

package/dist/update.js

@@ -1,7 +1,7 @@
 /**
  * `shard update` (0.13.5+): brings this computer's Shardflux install up to date in one step. It checks every local
- * piece against GET /v1/client-versions — the package that runs `shard` (the `shardflux` bundle or `@shardflux/cli`),
- * the CLI and SDK inside it, the macOS menu bar app and a globally installed `@shardflux/mcp` — then runs one install
+ * piece against the latest versions on npm (0.15.2+; GET /v1/client-versions adds minimum_supported and hold) — the
+ * package that runs `shard` (the `shardflux` bundle or `@shardflux/cli`), the CLI and SDK inside it, the macOS menu bar app and a globally installed `@shardflux/mcp` — then runs one install
  * of the latest versions with the package manager that installed `shard`, checks the result with the new `shard`,
  * and restarts the menu bar on its new app. `--check` only reports.
  *
@@ -18,7 +18,7 @@ import { AgentStateStore } from "./agent-state.js";
 import { writePrivateFile } from "./credentials.js";
 import { CodedError } from "./errors.js";
 import { json } from "./format.js";
-import { compareBundleVersions, MenubarManager } from "./menubar.js";
+import { compareAppVersions, MenubarManager, packagedAppPath } from "./menubar.js";
 export const INSTALL_FILE = 'install.json';
 export const LAST_UPDATE_FILE = 'last-update.json';
 const LOCK_FILE = 'update.lock';
@@ -175,6 +175,10 @@ function npmFor(node) {
     const sibling = join(dirname(node), process.platform === 'win32' ? 'npm.cmd' : 'npm');
     return existsSync(sibling) ? sibling : 'npm';
 }
+/** True when nothing is behind but the menu bar app, and the app the npm package carries is already that version. */
+export function onlyAppToSwap(pending, packagedApp) {
+    return pending.every(c => c.package === MENUBAR && packagedApp !== null && c.latest !== null && compareAppVersions(packagedApp, c.latest) >= 0);
+}
 export async function update(ctx, values, deps = {}) {
     const run = deps.run ?? runProcess;
     const menubar = deps.menubar ?? menubarManager(ctx);
@@ -193,10 +197,15 @@ export async function update(ctx, values, deps = {}) {
             : `Shardflux is up to date (${versions}).\n`);
         return 0;
     }
-    if (!pending.length) {
-        // The npm package may already carry a newer menu bar app than the one running.
+    // The npm package may already carry the latest menu bar app (installed with npm, not yet swapped in): no install.
+    const packagedApp = pending.some(c => c.package === MENUBAR) ? await menubar.packagedVersion().catch(() => null) : null;
+    if (onlyAppToSwap(pending, packagedApp)) {
         const refreshed = await refreshMenubar(ctx, menubar);
-        ctx.io.stdout.write(ctx.json ? json({ ...view, updated: false, menubar: refreshed }) : `Shardflux is up to date (${versions}).\n`);
+        const changes = refreshed.status === 'restarted' ? pending.map(c => ({ package: c.package, label: c.label, from: c.current, to: refreshed.version ?? null })) : [];
+        if (changes.length)
+            writeLastUpdate(ctx.store.dir, { status: 'ok', changes, message: `Updated ${changesText(changes)}`, command });
+        ctx.io.stdout.write(ctx.json ? json({ ...view, updated: changes.length > 0, ...(changes.length ? { changes } : {}), menubar: refreshed.status })
+            : changes.length ? `Updated ${changesText(changes)}.\n` : `Shardflux is up to date (${versions}).\n`);
         return 0;
     }
     const argv = installArgv(install, specs, runtime ? npmFor(runtime.node) : 'npm');
@@ -269,7 +278,7 @@ async function refreshMenubar(ctx, menubar, runtime, run, env) {
     }
     else {
         const packaged = await menubar.packagedVersion().catch(() => null);
-        if (!packaged || !before.version || compareBundleVersions(before.version, packaged) >= 0)
+        if (!packaged || !before.version || compareAppVersions(before.version, packaged) >= 0)
             return { status: 'current' };
         await menubar.start(ctx.store.dir, ctx.apiUrl);
     }
@@ -283,7 +292,16 @@ export function recordInstall(dir, runtime, distribution) {
         script = realpathSync(script);
     }
     catch { /* keep the path */ }
-    const doc = { version: 1, node: runtime.node, script, package: distribution.package, package_version: distribution.version, cli_version: CLI_VERSION };
+    // The app this CLI's npm package carries (0.15.2+): the menu bar compares itself with it and swaps itself in.
+    let menubarApp = packagedAppPath();
+    try {
+        if (menubarApp)
+            menubarApp = realpathSync(menubarApp);
+    }
+    catch {
+        menubarApp = null;
+    }
+    const doc = { version: 1, node: runtime.node, script, package: distribution.package, package_version: distribution.version, cli_version: CLI_VERSION, ...(menubarApp ? { menubar_app: menubarApp } : {}) };
     const text = `${JSON.stringify(doc, null, 2)}\n`;
     try {
         if (readFileSync(join(dir, INSTALL_FILE), 'utf8') === text)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shardflux/cli",
-  "version": "0.15.0",
+  "version": "0.15.2",
   "type": "module",
   "description": "shard: the Shardflux command line. Create an account, sign in, set up keys and billing, then open, run commands in, move files to, suspend, resume and fork serverless agent workspaces.",
   "license": "Apache-2.0",
@@ -58,7 +58,7 @@
     "typescript-eslint": "8.70.1"
   },
   "optionalDependencies": {
-    "@shardflux/menubar-darwin": "^0.3.0"
+    "@shardflux/menubar-darwin": "^0.3.2"
   },
   "scripts": {
     "build": "node scripts/build.mjs",