@vatio-ai/cli 0.49.0 → 0.50.0

package/bin/vatio.mjs

@@ -24,6 +24,7 @@ import { kb } from "../lib/commands/knowledge.mjs";
 import { instagram, whatsapp } from "../lib/commands/channels.mjs";
 import { docs, issue } from "../lib/commands/support-commands.mjs";
 import { mcp } from "../lib/commands/mcp.mjs";
+import { printUpdateNotice, startUpdateCheck } from "../lib/update-notice.mjs";
 
 // Two commands that existed and are gone, answered by name rather than as
 // unknown: one was removed from the product, the other is what npm does.
@@ -38,6 +39,12 @@ const RETIRED = {
 async function main(argv) {
   const args = argv.slice(2);
   const command = args.shift();
+  const updateCheck = startUpdateCheck(command);
+  await run(command, args);
+  await printUpdateNotice(updateCheck);
+}
+
+async function run(command, args) {
   const config = new Config({ startDir: process.cwd() });
 
   switch (command) {

package/lib/commands/workspace-admin.mjs

@@ -7,7 +7,7 @@
 // vatio.yml and all of them are here.
 
 import { deployClient } from "./deploy.mjs";
-import { fail, takeValue } from "../support.mjs";
+import { askSecret, fail, paint, takeValue } from "../support.mjs";
 
 // live, preview, or a named preview like pr-42. This used to accept only the
 // first two, which meant a workspace could deploy to `pr-42` and then have no
@@ -46,10 +46,13 @@ export async function secrets(config, args) {
   }
   if (sub === "set") {
     const key = args.shift();
-    const value = args.shift();
-    if (!key || value === undefined) fail("Usage: vatio secrets set KEY VALUE");
+    if (!key) fail("Usage: vatio secrets set KEY [VALUE]");
+    // Asked for rather than typed on the command line, where it would stay in
+    // shell history.
+    const value = args.shift() ?? (await askSecret(`${paint("green", "?")} Paste your secret: `));
+    if (value === "") fail(`No value given for ${key}`);
     await client.upsertSecret({ key, value });
-    console.log(`Set ${key} on workspace ${workspace}`);
+    console.log(`${paint("green", "✓")} Set secret ${key} on workspace ${workspace}`);
     return;
   }
   if (sub === "rm" || sub === "remove" || sub === "delete") {
@@ -60,7 +63,7 @@ export async function secrets(config, args) {
     return;
   }
 
-  fail("Usage: vatio secrets list|set KEY VALUE|rm KEY");
+  fail("Usage: vatio secrets list|set KEY [VALUE]|rm KEY");
 }
 
 export async function tokens(config, args) {

package/lib/help.mjs

@@ -51,7 +51,8 @@ flag, the directory decides.
     kb unfollow BASE URL | refresh BASE [URL]
 
   Credentials and the widget:
-    secrets list|set KEY VALUE|rm KEY
+    secrets list|set KEY [VALUE]|rm KEY
+                               Without VALUE, set asks for it with the input hidden
     tokens list|create [--env NAME] [--label NAME]|revoke PREFIX
     widget [--env NAME]        What the platform enforces, and the tokens there are
     auth --new-key             Keypair that signs the JWT saying who a visitor is
@@ -69,7 +70,7 @@ flag, the directory decides.
     config show|get KEY|set KEY VALUE|unset KEY
                                Keys: base_url, token
 
-  Environment: VATIO_BASE_URL, VATIO_TOKEN, VATIO_HOME
+  Environment: VATIO_BASE_URL, VATIO_TOKEN, VATIO_HOME, VATIO_NO_UPDATE_NOTIFIER
 
   Docs: https://docs.vatio.ai
 `;

package/lib/support.mjs

@@ -118,3 +118,59 @@ export async function ask(question) {
     rl.close();
   }
 }
+
+const COLORS = { green: 32, yellow: 33, cyan: 36 };
+
+export function paint(color, text) {
+  if (process.env.NO_COLOR || !process.stderr.isTTY) return text;
+  return `\x1b[${COLORS[color]}m${text}\x1b[0m`;
+}
+
+// A value typed or pasted with a star echoed per character, gh-style, so a
+// secret never lands in shell history or terminal scrollback. Off a terminal
+// the value is whatever arrives on stdin: `op read … | vatio secrets set KEY`.
+export async function askSecret(question) {
+  if (!process.stdin.isTTY) return (await readStdin()).replace(/\r?\n$/, "");
+
+  const input = process.stdin;
+  const output = process.stderr;
+  output.write(question);
+  input.setRawMode(true);
+  input.setEncoding("utf8");
+  input.resume();
+
+  return await new Promise((resolve, reject) => {
+    let value = "";
+    const finish = (error) => {
+      input.removeListener("data", onData);
+      input.setRawMode(false);
+      input.pause();
+      output.write("\n");
+      if (error) reject(error);
+      else resolve(value);
+    };
+    const onData = (chunk) => {
+      for (const char of chunk) {
+        if (char === "\r" || char === "\n") return finish();
+        if (char === "\u0003") return finish(new UserError("Cancelled"));
+        if (char === "\u007f" || char === "\b") {
+          if (value.length > 0) {
+            value = [...value].slice(0, -1).join("");
+            output.write("\b \b");
+          }
+          continue;
+        }
+        if (char < " ") continue;
+        value += char;
+        output.write("*");
+      }
+    };
+    input.on("data", onData);
+  });
+}
+
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}

package/lib/update-notice.mjs

@@ -0,0 +1,99 @@
+// "A new release of vatio is available", after a command, the way gh does it.
+//
+// The registry is asked at most once a day and the answer is kept in
+// ~/.vatio/update-check.json, so only the run that refreshes it makes a
+// request -- and that request runs alongside the command, not before it.
+// Nothing prints unless stderr is a terminal: a pipe, CI, or `vatio mcp`
+// (whose children write to a pipe) never sees it.
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+import { configHome } from "./config.mjs";
+import { VERSION } from "./version.mjs";
+import { paint } from "./support.mjs";
+
+const PACKAGE = "@vatio-ai/cli";
+const LATEST_URL = `https://registry.npmjs.org/${PACKAGE}/latest`;
+const CHECK_EVERY_MS = 24 * 60 * 60 * 1000;
+const FETCH_TIMEOUT_MS = 1_500;
+const SKIPPED_COMMANDS = ["mcp", "version", "--version", "-v"];
+
+export function startUpdateCheck(command) {
+  if (!shouldCheck(command)) return null;
+
+  const path = join(configHome(), "update-check.json");
+  const cached = readState(path);
+  if (cached && Date.now() - Date.parse(cached.checked_at) < CHECK_EVERY_MS) {
+    return Promise.resolve(cached.latest);
+  }
+  return fetchLatest().then((latest) => {
+    if (latest) writeState(path, { checked_at: new Date().toISOString(), latest });
+    return latest ?? cached?.latest ?? null;
+  });
+}
+
+export async function printUpdateNotice(check) {
+  if (!check) return;
+  const latest = await check.catch(() => null);
+  if (!latest || !isNewer(latest, VERSION)) return;
+
+  // npx sets npm_command=exec; a global install has no npm around it at all.
+  const upgrade = process.env.npm_command === "exec"
+    ? `npx ${PACKAGE}@latest`
+    : `npm install -g ${PACKAGE}@latest`;
+  process.stderr.write(
+    `\n${paint("yellow", `A new release of vatio is available: ${VERSION} → ${latest}`)}\n` +
+    `To upgrade, run: ${upgrade}\n` +
+    `${paint("cyan", "https://docs.vatio.ai/changelog")}\n`
+  );
+}
+
+function shouldCheck(command) {
+  if (SKIPPED_COMMANDS.includes(command)) return false;
+  if (!process.stderr.isTTY) return false;
+  if (process.env.CI || process.env.VATIO_NO_UPDATE_NOTIFIER) return false;
+  return true;
+}
+
+async function fetchLatest() {
+  try {
+    const response = await fetch(LATEST_URL, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+    if (!response.ok) return null;
+    const version = (await response.json())?.version;
+    return typeof version === "string" ? version : null;
+  } catch {
+    return null;
+  }
+}
+
+function readState(path) {
+  if (!existsSync(path)) return null;
+  try {
+    const state = JSON.parse(readFileSync(path, "utf8"));
+    return typeof state?.latest === "string" && typeof state?.checked_at === "string" ? state : null;
+  } catch {
+    return null;
+  }
+}
+
+function writeState(path, state) {
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `${JSON.stringify(state)}\n`);
+  } catch {
+    // A read-only home only means the next run asks the registry again.
+  }
+}
+
+// Plain x.y.z; a prerelease on either side is never announced.
+function isNewer(candidate, current) {
+  const parse = (value) => /^(\d+)\.(\d+)\.(\d+)$/.exec(value)?.slice(1).map(Number);
+  const a = parse(candidate);
+  const b = parse(current);
+  if (!a || !b) return false;
+  for (let i = 0; i < 3; i += 1) {
+    if (a[i] !== b[i]) return a[i] > b[i];
+  }
+  return false;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vatio-ai/cli",
-  "version": "0.49.0",
+  "version": "0.50.0",
   "description": "Vatio CLI — deploy and manage Vatio agent workspaces",
   "keywords": [
     "vatio",