@usagefleet/cli 1.2.91 → 1.2.93

package/dist/release.js

@@ -1,2 +1,2 @@
 // Generated by .github/workflows/release.yml.
-export const RELEASE_VERSION = "1.2.91";
+export const RELEASE_VERSION = "1.2.93";

package/dist/update.js

@@ -1,7 +1,8 @@
 import { spawn } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { basename, delimiter, dirname, join } from 'node:path';
 import { RELEASE_VERSION } from './release.js';
+import { tilde } from './ui.js';
 /** The published package: one artifact for every OS, installed with
  *  `npm i -g @usagefleet/cli`. */
 const PACKAGE = '@usagefleet/cli';
@@ -19,18 +20,100 @@ function npmCommand() {
     const sibling = join(dirname(process.execPath), process.platform === 'win32' ? 'npm.cmd' : 'npm');
     return existsSync(sibling) ? sibling : 'npm';
 }
+/** Every global install is a little project directory, and the lockfile at its
+ *  root names the manager that owns it. npm is the one that leaves none behind,
+ *  so "no lockfile" is what makes it the default rather than a guess. */
+const MANAGERS = [
+    { lockfile: 'bun.lock', bin: 'bun', install: ['add', '--global'] },
+    { lockfile: 'bun.lockb', bin: 'bun', install: ['add', '--global'] },
+    { lockfile: 'pnpm-lock.yaml', bin: 'pnpm', install: ['add', '--global'] },
+    { lockfile: 'yarn.lock', bin: 'yarn', install: ['global', 'add'] },
+];
+/** The directory a global install was unpacked into: the parent of the
+ *  `node_modules` holding the running code. null outside a node_modules, which
+ *  is a dev checkout or a bundle — neither is ours to upgrade. */
+function installRoot(script) {
+    try {
+        const pkg = dirname(dirname(realpathSync(script))); // <root>/node_modules/@usagefleet/cli
+        const modules = dirname(dirname(pkg));
+        return basename(modules) === 'node_modules' ? dirname(modules) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The version sitting on disk behind the running script — its own package.json,
+ *  read fresh rather than from the baked-in RELEASE_VERSION, so it reports what
+ *  an install just wrote instead of what this process started as. null when it
+ *  can't be resolved, which means "don't judge". */
+function installedVersion(script) {
+    const root = installRoot(script);
+    if (!root) {
+        return null;
+    }
+    try {
+        const manifest = join(root, 'node_modules', PACKAGE, 'package.json');
+        return JSON.parse(readFileSync(manifest, 'utf-8')).version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/** A manager binary sitting next to its own global root (`~/.bun/bin/bun`,
+ *  `~/.local/share/pnpm/pnpm`) beats hoping the bare name resolves: launchd and
+ *  systemd hand the collector a minimal PATH that has none of them on it. */
+function managerBinary(root, bin) {
+    const exe = process.platform === 'win32' ? `${bin}.cmd` : bin;
+    for (let dir = root; dir !== dirname(dir); dir = dirname(dir)) {
+        const found = [join(dir, exe), join(dir, 'bin', exe)].find(candidate => existsSync(candidate));
+        if (found) {
+            return found;
+        }
+    }
+    return bin;
+}
+/** The upgrade command for the install this collector actually runs from.
+ *
+ *  It matters because `npm install --global` only ever writes to npm's own
+ *  prefix: told to upgrade a collector that bun or pnpm put on the machine, npm
+ *  installs a second copy somewhere else and exits 0. The service keeps running
+ *  the untouched original, so the collector re-runs a "successful" upgrade every
+ *  six hours and never moves off its version. */
+function updateCommand(script, version) {
+    const spec = `${PACKAGE}@${version}`;
+    const root = installRoot(script);
+    const manager = root ? MANAGERS.find(m => existsSync(join(root, m.lockfile))) : undefined;
+    return manager && root
+        ? { cmd: managerBinary(root, manager.bin), args: [...manager.install, spec] }
+        : { cmd: npmCommand(), args: ['install', '--global', spec] };
+}
 /** An `npm install` that never returns would hang the watch loop forever, since
  *  the update check is awaited inline before the next tick is scheduled: the
  *  daemon would still be "running" while collecting nothing, with an empty log.
  *  Generous enough for a slow registry on a cold cache. */
 const RUN_TIMEOUT_MS = 10 * 60_000;
+/** The environment with our own node on PATH.
+ *
+ *  Not a nicety: launchd hands a service PATH=/usr/bin:/bin:/usr/sbin:/sbin and
+ *  npm is a script starting `#!/usr/bin/env node`, so unless node happens to sit
+ *  in /usr/bin — it doesn't for Homebrew, nvm, fnm, volta or asdf — the update
+ *  dies with exit 127 on every tick, forever, and the device sits on the version
+ *  it was installed at. */
+function pathWithNode() {
+    const env = { ...process.env };
+    // Windows enumerates it as `Path`; writing a second `PATH` key would leave the
+    // child with two, and which one wins is anyone's guess.
+    const key = Object.keys(env).find(name => name.toUpperCase() === 'PATH') ?? 'PATH';
+    env[key] = [dirname(process.execPath), env[key]].filter(Boolean).join(delimiter);
+    return env;
+}
 /** Exit code of a finished child, or null when it could not be started, was
  *  killed for exceeding RUN_TIMEOUT_MS, or died on a signal. */
 function run(cmd, args) {
     return new Promise(resolve => {
         // shell on Windows: node refuses to spawn a .cmd directly since the 2024
         // argument-injection fix. Every argument here is a literal or VERSION-checked.
-        const child = spawn(cmd, args, { shell: process.platform === 'win32', stdio: 'ignore' });
+        const child = spawn(cmd, args, { shell: process.platform === 'win32', stdio: 'ignore', env: pathWithNode() });
         const timer = setTimeout(() => child.kill(), RUN_TIMEOUT_MS);
         // Node emits 'close' after 'error' for a failed spawn, so both handlers can
         // run; `settled` makes the first one win. oxlint's promise rule sees the two
@@ -106,17 +189,28 @@ export async function checkForUpdate(log, force = false) {
         }
         return null;
     }
-    log('ok', `${RELEASE_VERSION} → ${latest} · installing ${PACKAGE}…`);
-    const code = await run(npmCommand(), ['install', '--global', `${PACKAGE}@${latest}`]);
+    const { cmd, args } = updateCommand(self, latest);
+    const manager = basename(cmd).replace(/\.cmd$/, '');
+    log('ok', `${RELEASE_VERSION} → ${latest} · installing ${PACKAGE} with ${manager}…`);
+    const code = await run(cmd, args);
     if (code !== 0) {
         log('warn', code === null
-            ? 'npm not available · reinstall with `npm i -g @usagefleet/cli`'
-            : `npm install failed (exit ${code}) · if the global prefix needs root, run it yourself`);
+            ? `${manager} not available · reinstall with \`${manager} ${args.join(' ')}\``
+            : `${manager} install failed (exit ${code}) · if the global prefix needs root, run it yourself`);
+        return null;
+    }
+    // A package manager exits 0 for an install it wrote somewhere this collector
+    // does not run from, so "success" is not the same as the new version being
+    // live. Restarting on that would bounce the service back onto the very same
+    // old code, every six hours, forever.
+    const onDisk = installedVersion(self);
+    if (onDisk && onDisk !== latest) {
+        log('warn', `still ${onDisk} at ${tilde(self)} · ${manager} updated a different install · reinstall it there`);
         return null;
     }
     // Detached: `login` rewrites the service definition and restarts it, which
-    // kills this process tree. npm replaced the file behind `self`, so this is
-    // already the new version.
+    // kills this process tree. The install replaced the file behind `self`, so
+    // this is already the new version.
     spawn(process.execPath, [self, 'login'], { detached: true, stdio: 'ignore' }).unref();
     log('ok', `installed ${latest} · restarting service`);
     return latest;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@usagefleet/cli",
-	"version": "1.2.91",
+	"version": "1.2.93",
 	"description": "Tails Claude Code, Claude Desktop, and pi agent JSONL logs and reports token usage to a UsageFleet server.",
 	"keywords": [
 		"claude",