@skyf0xx/hedgehog 5.1.3 → 5.1.5

package/bin/cli.mjs

@@ -17,7 +17,7 @@ import { cp, mkdir, access, readdir, stat, rm, readFile, writeFile } from 'node:
 import { constants, existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join, relative, resolve } from 'node:path';
-import { spawn } from 'node:child_process';
+import { spawn, execFileSync } from 'node:child_process';
 import { dbInit, DB_PATH, dbAbsPath, openDb } from '../src/db/init.mjs';
 import { loadCore, lintCore, isModuleAxis } from '../src/db/core.mjs';
 import { planTasks, CORE_INTENT_ID } from '../src/db/plan.mjs';
@@ -52,7 +52,12 @@ import { rebuildDb } from '../src/db/rebuild.mjs';
 import { loadOverrides, addOverride, orphanedOverrides, OVERRIDES_DIR } from '../src/db/overrides.mjs';
 import { HOSTS, HOST_FLAGS, DEFAULT_HOST, availableHosts } from '../src/hosts/index.mjs';
 import { recordHosts, installedHosts } from '../src/hosts/installed.mjs';
-import { recordVersion, checkForUpdate, installedVersion } from '../src/hosts/version.mjs';
+import {
+  recordVersion,
+  checkForUpdate,
+  checkBinaryStaleness,
+  installedVersion,
+} from '../src/hosts/version.mjs';
 import { loadRegistry, resolveCore } from '../src/registry/index.mjs';
 import { fetchCore, cachedCore, cachedVersions } from '../src/registry/fetch.mjs';
 import { recordCore, installedCore } from '../src/registry/installed.mjs';
@@ -681,7 +686,11 @@ async function init({ force, core, host = DEFAULT_HOST, hostOnly = false }) {
     dim(
       `     Read ${bold(`${agents}/planner.md`)} and follow it — it runs planning\n` +
         `     intake (${skills}/hedgehog-planning-intake/SKILL.md), then hands\n` +
-        `     off to ${agents}/bootstrap.md.`,
+        `     off to ${agents}/bootstrap.md.\n` +
+        `     Some hosts register agents/skills once, at session start: if a\n` +
+        `     later dispatch by name reports one of these as not found, read\n` +
+        `     its file directly instead — it becomes dispatchable by name after\n` +
+        `     a session restart or a fresh context.`,
     ),
   );
   console.log();
@@ -806,6 +815,14 @@ async function update({ hosts }) {
         'write-once content.',
     ),
   );
+  console.log(
+    dim(
+      'Some hosts register agents/skills once, at session start: a renamed or\n' +
+        'newly-added one may not be dispatchable by name until this session\n' +
+        'restarts or a fresh context starts — read its file directly if a\n' +
+        'name-based dispatch reports it as not found.',
+    ),
+  );
 }
 
 // Returned by resolveInstalledCore when the project has a core but its
@@ -1363,17 +1380,76 @@ async function noteAvailableUpdate() {
   if (process.env.HEDGEHOG_NO_UPDATE_CHECK) return;
   try {
     const { installed, latest, stale } = await checkForUpdate(DEST_ROOT);
-    if (!stale) return;
-    console.error(
-      `\n${yellow(bold('Hedgehog update available.'))} ${dim(
-        `${installed} → ${latest}. Run \`npx @skyf0xx/hedgehog@latest update\` to refresh this project's agents and skills.`,
-      )}`,
-    );
+    if (stale) {
+      console.error(
+        `\n${yellow(bold('Hedgehog update available.'))} ${dim(
+          `${installed} → ${latest}. Run \`npx @skyf0xx/hedgehog@latest update\` to refresh this project's agents and skills.`,
+        )}`,
+      );
+    }
   } catch {
     // Advisory only — a failed check is never worth failing a command over.
   }
 }
 
+// Hedgehog runs as a global install: every host (Claude Code, Cursor,
+// Gemini CLI) drives it through the `hedgehog` binary on PATH, and `npx
+// @skyf0xx/hedgehog` is expected to arrive at that same global install
+// rather than an ephemeral, unmanaged copy. This makes both halves of
+// that true on every invocation, before any command's real work starts:
+//
+// - **No global install yet** (a fresh `npx` fetch, or a dev checkout
+//   run directly): install the latest release globally now.
+// - **A global install exists but is behind latest** (the running code's
+//   own version, not any project's stamped `.hedgehog/version.json` —
+//   that stamp answers a different question, whether a project's payload
+//   is current): update it to latest now.
+//
+// Either way this reuses `latestVersion`'s day-long cache, so it costs a
+// network round trip at most once a day, not on every invocation. Runs
+// unattended — `npm install -g`, no confirmation prompt. Every caller of
+// this binary is either an agent driving it non-interactively or a human
+// who ran a command expecting it to just work, and there is no stdin
+// channel to prompt on in the general case. A failure here (offline,
+// permission-restricted global dir, npm itself missing) is swallowed the
+// same as a failed staleness check — the current process keeps running on
+// whatever code it already loaded rather than failing the command over
+// an advisory step.
+//
+// The install/update itself always runs regardless of `quiet` — silence
+// governs only whether this prints, matching `boundary --quiet`'s "exit
+// code only, nothing on either stream" contract for shell hooks.
+async function ensureGlobalInstall({ quiet = false } = {}) {
+  if (process.env.HEDGEHOG_NO_UPDATE_CHECK) return;
+  try {
+    const globalRoot = execFileSync('npm', ['root', '-g'], {
+      encoding: 'utf8',
+      timeout: 5_000,
+    }).trim();
+    const runningFromGlobal = PKG_ROOT === join(globalRoot, '@skyf0xx/hedgehog');
+    const { latest, stale } = await checkBinaryStaleness(DEST_ROOT, PKG_VERSION);
+    if (runningFromGlobal && !stale) return;
+    if (!latest) return;
+
+    execFileSync('npm', ['install', '-g', `@skyf0xx/hedgehog@${latest}`], {
+      stdio: 'ignore',
+      timeout: 60_000,
+    });
+    if (!quiet) {
+      console.error(
+        `\n${dim(
+          runningFromGlobal
+            ? `Updated hedgehog ${PKG_VERSION} → ${latest}. This run continues on ${PKG_VERSION}; the next command picks up ${latest}.`
+            : `Installed hedgehog ${latest} globally. Future commands resolve to it directly.`,
+        )}`,
+      );
+    }
+  } catch {
+    // Advisory only — a failed check or install is never worth failing a
+    // command over.
+  }
+}
+
 async function nextCommand() {
   await ensureDb();
 
@@ -2716,6 +2792,7 @@ async function main() {
     console.log(PKG_VERSION);
     return;
   }
+  await ensureGlobalInstall({ quiet: args.includes('--quiet') });
   const cmd = args[0];
   const force = args.includes('--force') || args.includes('-f');
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyf0xx/hedgehog",
-  "version": "5.1.3",
+  "version": "5.1.5",
   "description": "Install the Hedgehog build discipline (agents + skills) into a repo, for Claude Code, Cursor, or Gemini CLI.",
   "type": "module",
   "repository": {

package/src/hosts/claude/DISPATCH.md

@@ -6,6 +6,14 @@ context with its own tool grant. The skills in `.claude/skills/` are
 available the same way; invoke one by name rather than reimplementing what
 it describes.
 
+Claude Code reads that registration once, at session start — an agent or
+skill file written mid-session (by `hedgehog init` or `hedgehog update`
+just now) is not yet dispatchable by name in this session. If a name-based
+dispatch reports it as not found, read the file directly from
+`.claude/agents/` or `.claude/skills/` and follow it inline instead of
+retrying the dispatch; it becomes dispatchable by name after a session
+restart or a fresh context.
+
 Clear context with `/clear` at the unit boundaries described above —
 `hedgehog boundary` tells you whether you're at one (exit 0), and
 `hedgehog boundary --handoff` is what the next session starts from.

package/src/hosts/version.mjs

@@ -152,3 +152,26 @@ export async function checkForUpdate(root, { force = false } = {}) {
     stale: Boolean(installed && latest && isNewer(latest, installed)),
   };
 }
+
+/**
+ * Whether the CLI binary actually executing right now — `binaryVersion`,
+ * read from this package's own package.json, not from any project's
+ * `.hedgehog/version.json` — is behind the newest published release.
+ *
+ * This is a distinct question from `checkForUpdate`: that one compares a
+ * *project's* stamped version against latest, so a shadowed, stale global
+ * install (a `hedgehog` binary resolved from PATH ahead of the scoped
+ * `npx @skyf0xx/hedgehog` package) reads its own old code, sees the
+ * project's stamp already at-or-past whatever it thinks "latest" is, and
+ * says nothing — the exact case this function exists to catch instead, by
+ * comparing the running code's own version rather than a file the running
+ * code could itself be stale relative to.
+ */
+export async function checkBinaryStaleness(root, binaryVersion, { force = false } = {}) {
+  const latest = await latestVersion(root, { force });
+  return {
+    binaryVersion,
+    latest,
+    stale: Boolean(binaryVersion && latest && isNewer(latest, binaryVersion)),
+  };
+}