@trendai-crem/claude-skills 0.4.0 → 0.5.1

package/cli.js

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
 
 import { execFileSync } from 'child_process';
-import { readFileSync, readdirSync } from 'fs';
+import { readFileSync, readdirSync, writeFileSync, copyFileSync, mkdirSync, existsSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
+import { homedir, tmpdir } from 'os';
+import { renameSync } from 'fs';
 
 const __dir = dirname(fileURLToPath(import.meta.url));
 
@@ -55,13 +57,106 @@ if (externalFailed.length > 0) {
   console.warn(`\nWARN: ${externalFailed.length} external source(s) failed — team skills installed successfully.`);
 }
 
-// Check for updates
-try {
-  const { version: current } = JSON.parse(readFileSync(join(__dir, 'package.json'), 'utf8'));
-  const res = await fetch('https://registry.npmjs.org/@trendai-crem/claude-skills/latest');
-  const { version: latest } = await res.json();
-  if (current !== latest) {
-    console.log(`\nUpdate available: ${current} → ${latest}`);
-    console.log(`Run: npx @trendai-crem/claude-skills@latest`);
+// Configure auto-update hook in ~/.claude/settings.json
+setupAutoUpdate();
+
+function setupAutoUpdate() {
+  const { version: installedVersion } = JSON.parse(
+    readFileSync(join(__dir, 'package.json'), 'utf8')
+  );
+
+  const claudeDir    = join(homedir(), '.claude');
+  const hooksDir     = join(claudeDir, 'hooks');
+  const hookScript   = join(hooksDir, 'auto-update-claude-skills.sh');
+  const stampFile    = join(homedir(), '.cache', 'claude-skills-update.json');
+  const settingsPath = join(claudeDir, 'settings.json');
+
+  // Write the auto-update hook script
+  mkdirSync(hooksDir, { recursive: true });
+  writeFileSync(hookScript, buildHookScript(stampFile, installedVersion), { mode: 0o755 });
+
+  // Merge SessionStart hook into ~/.claude/settings.json (idempotent)
+  let settings = {};
+  if (existsSync(settingsPath)) {
+    try {
+      settings = JSON.parse(readFileSync(settingsPath, 'utf8'));
+    } catch (err) {
+      // Back up corrupt file rather than silently overwriting
+      const backup = `${settingsPath}.bak.${Date.now()}`;
+      copyFileSync(settingsPath, backup);
+      console.warn(`\nWARN: ~/.claude/settings.json has invalid JSON — backed up to ${backup}`);
+      console.warn('A fresh settings file will be created with the auto-update hook only.');
+      console.warn('Manually merge your settings from the backup if needed.\n');
+    }
   }
-} catch { /* ignore update check failures */ }
+
+  settings.hooks ??= {};
+  settings.hooks.SessionStart ??= [];
+  settings.hooks.SessionStart = settings.hooks.SessionStart.filter(
+    e => !e.hooks?.some(h => typeof h.command === 'string' && h.command === hookScript)
+  );
+  settings.hooks.SessionStart.push({
+    hooks: [{ type: 'command', command: hookScript }]
+  });
+
+  // Atomic write — prevents corruption if process is killed mid-write
+  const tmpPath = join(tmpdir(), `claude-settings-${process.pid}.json`);
+  writeFileSync(tmpPath, JSON.stringify(settings, null, 2) + '\n');
+  renameSync(tmpPath, settingsPath);
+
+  console.log('\n✓ Auto-update configured (runs daily at session start)');
+}
+
+function buildHookScript(stampFile, installedVersion) {
+  // Validate installedVersion is semver before embedding in bash
+  if (!/^\d+\.\d+\.\d+(-[\w.]+)?$/.test(installedVersion)) {
+    throw new Error(`Invalid version format in package.json: ${installedVersion}`);
+  }
+
+  return `#!/usr/bin/env bash
+# Auto-update @trendai-crem/claude-skills at Claude Code session start (max once per 24h).
+set -euo pipefail
+
+STAMP="${stampFile}"
+PACKAGE="@trendai-crem/claude-skills"
+MIN_INTERVAL=$((60 * 60 * 24))
+LOG="$(dirname "$STAMP")/claude-skills-update.log"
+
+mkdir -p "$(dirname "$STAMP")"
+
+# Read stamp using sys.argv to avoid shell injection
+LAST_TS=0
+CURRENT_VER="${installedVersion}"
+if [ -f "$STAMP" ]; then
+  LAST_TS=$(python3 -c "import json,sys; print(json.load(open(sys.argv[1])).get('ts',0))" "$STAMP" 2>/dev/null || echo 0)
+  CURRENT_VER=$(python3 -c "import json,sys; print(json.load(open(sys.argv[1])).get('version',sys.argv[2]))" "$STAMP" "${installedVersion}" 2>/dev/null || echo "${installedVersion}")
+fi
+
+# Guard against corrupt stamp values
+[[ "$LAST_TS" =~ ^[0-9]+$ ]] || LAST_TS=0
+
+NOW=$(date +%s)
+[ $(( NOW - LAST_TS )) -lt $MIN_INTERVAL ] && exit 0
+
+# Write timestamp now to prevent parallel session runs
+python3 -c "import json,sys; json.dump({'ts': int(sys.argv[1]), 'version': sys.argv[2]}, open(sys.argv[3],'w'))" "$NOW" "$CURRENT_VER" "$STAMP"
+
+LATEST=$(npm view "$PACKAGE" version 2>/dev/null || echo "")
+{ [ -z "$LATEST" ] || [ "$LATEST" = "$CURRENT_VER" ]; } && exit 0
+
+# Validate LATEST is semver before executing
+[[ "$LATEST" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]] || { echo "[$(date -Iseconds)] Invalid version from npm: $LATEST" >> "$LOG"; exit 1; }
+
+# Update in background — stamp written only on success
+echo "🔄 Auto-updating claude-skills: $CURRENT_VER → $LATEST"
+(
+  echo "[$(date -Iseconds)] Updating $CURRENT_VER → $LATEST" >> "$LOG"
+  if npx --yes "${PACKAGE}@${LATEST}" >> "$LOG" 2>&1; then
+    python3 -c "import json,sys; json.dump({'ts': int(sys.argv[1]), 'version': sys.argv[2]}, open(sys.argv[3],'w'))" "$NOW" "$LATEST" "$STAMP"
+    echo "[$(date -Iseconds)] Update successful" >> "$LOG"
+  else
+    echo "[$(date -Iseconds)] Update failed — will retry next session" >> "$LOG"
+  fi
+) &
+`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trendai-crem/claude-skills",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "Claude Code skills installer for the trendai-crem team",
   "license": "UNLICENSED",
   "repository": {
@@ -18,6 +18,9 @@
   "engines": {
     "node": ">=20"
   },
+  "scripts": {
+    "prepare": "git config core.hooksPath .githooks"
+  },
   "dependencies": {
     "skills": "1.4.5"
   }