@somewhere-tech/cli 0.16.0 → 0.17.0

package/dist/commands/update.js

@@ -0,0 +1,62 @@
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { execSync } from 'node:child_process';
+import { dim, error, info, success, teal } from '../lib/output.js';
+const PACKAGE = '@somewhere-tech/cli';
+/** Read the installed CLI's own version from its package.json (dist/commands/ →
+ *  package root is two levels up). */
+function currentVersion() {
+    try {
+        const pkg = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'package.json'), 'utf8'));
+        return pkg.version;
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+export function registerUpdate(program) {
+    program
+        .command('update')
+        .description('Update the somewhere CLI to the latest published version (via npm).')
+        .option('--check', 'Only report whether an update is available; do not install.')
+        .action((opts) => {
+        const current = currentVersion();
+        let latest;
+        try {
+            latest = execSync(`npm view ${PACKAGE} version`, {
+                encoding: 'utf8',
+                stdio: ['ignore', 'pipe', 'ignore'],
+            }).trim();
+        }
+        catch {
+            error('Could not reach npm to check the latest version. Check your connection and try again.');
+            process.exit(1);
+        }
+        if (!latest) {
+            error('Could not determine the latest version from npm.');
+            process.exit(1);
+        }
+        if (latest === current) {
+            success(`You're on the latest version (${teal(current)}).`);
+            return;
+        }
+        info(`Update available: ${dim(current)} → ${teal(latest)}`);
+        if (opts.check) {
+            info(`Run ${teal('somewhere update')} to install it.`);
+            return;
+        }
+        info(`Updating ${PACKAGE} …`);
+        try {
+            // stdio inherited so npm's own progress shows; -g may need elevated perms,
+            // in which case npm's EACCES message is surfaced and we point at the manual fix.
+            execSync(`npm install -g ${PACKAGE}@latest`, { stdio: 'inherit' });
+        }
+        catch {
+            error(`Update failed. Try it manually:  npm install -g ${PACKAGE}@latest`);
+            process.exit(1);
+        }
+        success(`Updated to ${latest}. Run ${teal('somewhere --version')} to confirm.`);
+    });
+}
+//# sourceMappingURL=update.js.map

package/dist/commands/update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../src/commands/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAEnE,MAAM,OAAO,GAAG,qBAAqB,CAAC;AAEtC;sCACsC;AACtC,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CACzE,CAAC;QACzB,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,qEAAqE,CAAC;SAClF,MAAM,CAAC,SAAS,EAAE,6DAA6D,CAAC;SAChF,MAAM,CAAC,CAAC,IAAyB,EAAE,EAAE;QACpC,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QAEjC,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,QAAQ,CAAC,YAAY,OAAO,UAAU,EAAE;gBAC/C,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;aACpC,CAAC,CAAC,IAAI,EAAE,CAAC;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,uFAAuF,CAAC,CAAC;YAC/F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,CAAC,kDAAkD,CAAC,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,OAAO,CAAC,iCAAiC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,qBAAqB,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,YAAY,OAAO,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,2EAA2E;YAC3E,iFAAiF;YACjF,QAAQ,CAAC,kBAAkB,OAAO,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,mDAAmD,OAAO,SAAS,CAAC,CAAC;YAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,cAAc,MAAM,SAAS,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/index.js

@@ -24,6 +24,8 @@ import { registerCheck } from './commands/check.js';
 import { registerApi } from './commands/api.js';
 import { registerMcp } from './commands/mcp.js';
 import { registerSwpx } from './commands/swpx.js';
+import { registerUpdate } from './commands/update.js';
+import { collectNotices } from './lib/notify/index.js';
 const pkg = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json'), 'utf8'));
 const program = new Command()
     .name('somewhere')
@@ -55,5 +57,15 @@ registerCheck(program);
 registerApi(program);
 registerMcp(program);
 registerSwpx(program);
-program.parse();
+registerUpdate(program);
+// User-notification pipeline (update-available, advisories, announcements…).
+// Centrally gated to interactive, non-CI, non-pass-through commands and emitted to
+// STDERR as a parting line AFTER the command — never stdout, agent, or swpx/swpm
+// safety output. Fail-open: collectNotices swallows all errors.
+void (async () => {
+    const notices = await collectNotices(process.argv);
+    if (notices.length)
+        process.on('exit', () => process.stderr.write('\n' + notices.join('\n') + '\n'));
+    program.parse();
+})();
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CACnE,CAAC;AAEzB,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE;KAC1B,IAAI,CAAC,WAAW,CAAC;KACjB,WAAW,CAAC,wBAAwB,CAAC;KACrC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAExB,iFAAiF;AACjF,gFAAgF;AAChF,6EAA6E;AAC7E,OAAO,CAAC,uBAAuB,EAAE,CAAC;AAElC,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,YAAY,CAAC,OAAO,CAAC,CAAC;AAEtB,OAAO,CAAC,KAAK,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CACnE,CAAC;AAEzB,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE;KAC1B,IAAI,CAAC,WAAW,CAAC;KACjB,WAAW,CAAC,wBAAwB,CAAC;KACrC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAExB,iFAAiF;AACjF,gFAAgF;AAChF,6EAA6E;AAC7E,OAAO,CAAC,uBAAuB,EAAE,CAAC;AAElC,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,cAAc,CAAC,OAAO,CAAC,CAAC;AAExB,6EAA6E;AAC7E,mFAAmF;AACnF,iFAAiF;AACjF,gEAAgE;AAChE,KAAK,CAAC,KAAK,IAAI,EAAE;IACf,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACrG,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC,CAAC,EAAE,CAAC"}

package/dist/lib/notify/index.js

@@ -0,0 +1,54 @@
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { updateProvider } from './providers/update.js';
+// import { advisoryProvider } from './providers/advisory.js'; // dormant — see that file
+/** Registered notice sources. Add a provider here to surface a new kind of notice;
+ *  it inherits the gate + stderr emission below, so it can never reach stdout,
+ *  agent/piped output, or swpx/swpm verdict grading. */
+const PROVIDERS = [updateProvider];
+/** `somewhere <sub>` forms that must stay silent: the verdict/safety pass-throughs
+ *  (their own bins already bypass this entry, but `somewhere swpx …` reaches here)
+ *  and the machine-oriented npx/npm aliases. */
+const SKIP_SUBCOMMANDS = new Set(['swpx', 'swpm', 'x', 'm', 'npx', 'npm']);
+function currentVersion() {
+    try {
+        // dist/lib/notify/index.js → package root is three levels up.
+        const pkg = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', 'package.json'), 'utf8'));
+        return pkg.version;
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+/** The one gate every provider inherits. If this returns false, NO provider runs,
+ *  so notices can never appear on non-interactive output, in CI, during a
+ *  safety/pass-through command, or when the user opted out. */
+function notificationsAllowed(argv) {
+    if (!process.stderr.isTTY)
+        return false; // agents, pipes, redirects, files
+    if (process.env.CI)
+        return false; // CI logs
+    if (process.env.SOMEWHERE_NO_NOTIFICATIONS)
+        return false; // global opt-out
+    const sub = argv[2];
+    if (!sub || sub.startsWith('-') || SKIP_SUBCOMMANDS.has(sub))
+        return false;
+    return true;
+}
+/** Run every provider (gated, in parallel, fail-open) and return the notices to
+ *  display. Print these to STDERR after the command (e.g. via process.on('exit'))
+ *  so they never touch stdout and land as a parting line. */
+export async function collectNotices(argv) {
+    try {
+        if (!notificationsAllowed(argv))
+            return [];
+        const ctx = { argv, currentVersion: currentVersion() };
+        const results = await Promise.all(PROVIDERS.map((p) => p.getNotice(ctx).catch(() => null)));
+        return results.filter((n) => typeof n === 'string' && n.length > 0);
+    }
+    catch {
+        return []; // never let the notification pipeline break the CLI
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/lib/notify/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/notify/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,yFAAyF;AAEzF;;wDAEwD;AACxD,MAAM,SAAS,GAAqB,CAAC,cAAc,CAAC,CAAC;AAErD;;gDAEgD;AAChD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3E,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAC/E,CAAC;QACzB,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;+DAE+D;AAC/D,SAAS,oBAAoB,CAAC,IAAc;IAC1C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,kCAAkC;IAC3E,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,CAAC,UAAU;IAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B;QAAE,OAAO,KAAK,CAAC,CAAC,iBAAiB;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;6DAE6D;AAC7D,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAc;IACjD,IAAI,CAAC;QACH,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAkB,EAAE,IAAI,EAAE,cAAc,EAAE,cAAc,EAAE,EAAE,CAAC;QACtE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5F,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,oDAAoD;IACjE,CAAC;AACH,CAAC"}

package/dist/lib/notify/providers/advisory.js

@@ -0,0 +1,30 @@
+/** DORMANT — the pipe for "a package you previously ran through swpx/swpm now has
+ *  a security advisory." Not registered in ../index.ts yet; wire it when we want it.
+ *
+ *  How to turn it on (kept separate from the verdict path so it can never affect
+ *  safety grading):
+ *
+ *   1. RECORD USAGE — in the swpx/swpm bins, after a run resolves, append
+ *      {name, version, ts} to ~/.somewhere/used-packages.json. This write MUST be
+ *      fail-open and off the critical path (a try/catch around an async write); it
+ *      must never block the install or change the verdict output.
+ *
+ *   2. CHECK HERE — read that file, throttle (e.g. a `checkedAt` stamp, once / 6h),
+ *      batch-query the verdict API for those package@versions, and return a notice
+ *      if any flipped to suspicious/blocked SINCE the user used them (compare
+ *      against a stored last-seen verdict so we only alert on the transition, not
+ *      every run). Keep it to one line, e.g.:
+ *        "⚠ A package you used (foo@1.2.3) now has an advisory. swpx check foo@1.2.3"
+ *
+ *   3. REGISTER — add `advisoryProvider` to PROVIDERS in ../index.ts.
+ *
+ *  It inherits the central gate, so it's already stderr-only, interactive-only,
+ *  and silent during swpx/swpm runs — it surfaces as ambient awareness on normal
+ *  `somewhere` usage, never inline with a live verdict. */
+export const advisoryProvider = {
+    id: 'pkg-advisory',
+    async getNotice() {
+        return null; // pipe laid; dormant until the steps above are built
+    },
+};
+//# sourceMappingURL=advisory.js.map

package/dist/lib/notify/providers/advisory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisory.js","sourceRoot":"","sources":["../../../../src/lib/notify/providers/advisory.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;2DAsB2D;AAC3D,MAAM,CAAC,MAAM,gBAAgB,GAAmB;IAC9C,EAAE,EAAE,cAAc;IAClB,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,CAAC,CAAC,qDAAqD;IACpE,CAAC;CACF,CAAC"}

package/dist/lib/notify/providers/update.js

@@ -0,0 +1,85 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { dim, teal } from '../../output.js';
+const PACKAGE = '@somewhere-tech/cli';
+const CACHE_PATH = join(homedir(), '.somewhere', 'update-check.json');
+const REGISTRY = `https://registry.npmjs.org/${PACKAGE.replace('/', '%2F')}/latest`;
+const ONE_DAY = 24 * 60 * 60 * 1000;
+const FETCH_TIMEOUT_MS = 1000;
+/** Numeric major.minor.patch compare, ignoring pre-release tags. Returns true when
+ *  `a` is strictly newer than `b`, false on anything unparseable (exported for
+ *  tests — a string compare would call 1.9.0 newer than 1.10.0). */
+export function isNewer(a, b) {
+    const parse = (v) => v.split('-')[0].split('.').map((n) => Number(n));
+    const pa = parse(a);
+    const pb = parse(b);
+    if (pa.length < 3 || pb.length < 3 || [...pa, ...pb].some((n) => Number.isNaN(n)))
+        return false;
+    for (let i = 0; i < 3; i++) {
+        if (pa[i] !== pb[i])
+            return pa[i] > pb[i];
+    }
+    return false;
+}
+function readCache() {
+    try {
+        return JSON.parse(readFileSync(CACHE_PATH, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function writeCache(latest) {
+    try {
+        const dir = dirname(CACHE_PATH);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        writeFileSync(CACHE_PATH, JSON.stringify({ checkedAt: Date.now(), latest }) + '\n', { mode: 0o600 });
+    }
+    catch {
+        // best-effort cache; a failed write just means we re-check next time
+    }
+}
+async function fetchLatest() {
+    try {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+        const res = await fetch(REGISTRY, { signal: controller.signal, headers: { accept: 'application/json' } });
+        clearTimeout(timer);
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        return typeof body.version === 'string' ? body.version : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Notice provider: a newer @somewhere-tech/cli is published. Self-throttled to one
+ *  npm check per day (cached in ~/.somewhere/update-check.json). The pipeline's
+ *  central gate already ensured this only runs on interactive, non-CI, non-pass-
+ *  through commands, so this provider just answers "is there an update?". */
+export const updateProvider = {
+    id: 'cli-update',
+    async getNotice({ currentVersion }) {
+        try {
+            let cache = readCache();
+            if (!cache || Date.now() - cache.checkedAt > ONE_DAY) {
+                const latest = await fetchLatest();
+                if (latest) {
+                    writeCache(latest);
+                    cache = { checkedAt: Date.now(), latest };
+                }
+            }
+            if (!cache?.latest || !isNewer(cache.latest, currentVersion))
+                return null;
+            return (`  ${teal('▲ Update available')}  ${dim(currentVersion)} → ${teal(cache.latest)}\n` +
+                `  Run ${teal('somewhere update')} to upgrade.  ${dim('(SOMEWHERE_NO_NOTIFICATIONS=1 to silence)')}`);
+        }
+        catch {
+            return null;
+        }
+    },
+};
+//# sourceMappingURL=update.js.map

package/dist/lib/notify/providers/update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../../../src/lib/notify/providers/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAG5C,MAAM,OAAO,GAAG,qBAAqB,CAAC;AACtC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC;AACtE,MAAM,QAAQ,GAAG,8BAA8B,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC;AACpF,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAO9B;;oEAEoE;AACpE,MAAM,UAAU,OAAO,CAAC,CAAS,EAAE,CAAS;IAC1C,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAgB,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvG,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAC1G,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,OAAO,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;6EAG6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC5C,EAAE,EAAE,YAAY;IAChB,KAAK,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE;QAChC,IAAI,CAAC;YACH,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,OAAO,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,MAAM,WAAW,EAAE,CAAC;gBACnC,IAAI,MAAM,EAAE,CAAC;oBACX,UAAU,CAAC,MAAM,CAAC,CAAC;oBACnB,KAAK,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC;gBAC5C,CAAC;YACH,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1E,OAAO,CACL,KAAK,IAAI,CAAC,oBAAoB,CAAC,KAAK,GAAG,CAAC,cAAc,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI;gBACnF,SAAS,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,GAAG,CAAC,2CAA2C,CAAC,EAAE,CACrG,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/lib/notify/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/lib/notify/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/lib/notify/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@somewhere-tech/cli",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "CLI for somewhere.tech — auth, projects, deploy, pull, promote, db, logs, env, MCP bridge.",
   "keywords": [
     "somewhere",