@wilm-ai/wilma-cli 2.0.0 → 2.1.0

package/README.md

@@ -72,7 +72,7 @@ wilma find-school <city or school>
 
 ## Other
 ```bash
-wilma update
+wilma update                       # commands say on stderr when a newer version is out (checked once a day; WILMAI_NO_UPDATE_CHECK=1 turns it off)
 wilma config clear                 # deletes every saved login and session
 wilma --version
 ```

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { emitKeypressEvents } from "node:readline";
 import { select, input, password } from "@inquirer/prompts";
-import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { readFile, mkdir } from "node:fs/promises";
 import { spawn } from "node:child_process";
 import { homedir } from "node:os";
 import { dirname, resolve } from "node:path";
@@ -17,6 +17,7 @@ import { ENV_VARS, isMfaFailure, mfaCallbackFor, resolveAccounts, saveLogin, ver
 import { createUniqueDownloadFile } from "./downloads.js";
 import { openBrowser, startLoginServer } from "./login-server.js";
 import { runMcpServer } from "./mcp.js";
+import { cliUpdateNotice, isNewerVersion, latestWithin, startUpdateCheck, updateChecksEnabled } from "./update-check.js";
 import { toAgentJson } from "./output-json.js";
 import { clearSessions, fileSessionStore } from "./session-store.js";
 import { normalizeTenantUrl, resolveTenant, searchTenants } from "./tenant-search.js";
@@ -72,8 +73,9 @@ async function main() {
     }
     // Commands continue the last Wilma session instead of logging in each time.
     useSessionStore(fileSessionStore);
-    // Update notices are for people; agents and scripts skip the check.
-    const updateCheck = process.stderr.isTTY ? startUpdateCheck() : null;
+    // Update notices go to stderr, where both people and agents (OpenClaw and
+    // the like) see them. Not under npx, which already runs the newest version.
+    const updateCheck = updateChecksEnabled() ? startUpdateCheck() : null;
     try {
         await runCommand(argv);
         if (updateCheck)
@@ -749,100 +751,19 @@ async function handleUpdate() {
     }
     console.log("\nUpdate complete.");
 }
-// --- Version check / update notification ---
-const VERSION_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
-function getVersionCachePath() {
-    return resolve(dirname(getConfigPath()), "version-check.json");
-}
-async function readVersionCache() {
-    try {
-        const raw = await readFile(getVersionCachePath(), "utf-8");
-        return JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-}
-async function writeVersionCache(cache) {
-    const cachePath = getVersionCachePath();
-    await mkdir(dirname(cachePath), { recursive: true, mode: 0o700 });
-    await writeFile(cachePath, JSON.stringify(cache), { encoding: "utf-8", mode: 0o600 });
-}
-/**
- * Ask npm for the latest version at most once a day. A failed check counts as
- * a check too: agents in sandboxes without internet access shouldn't pay for
- * a timeout on every command.
- */
-function startUpdateCheck() {
-    const controller = new AbortController();
-    let cancelled = false;
-    const result = (async () => {
-        const cache = await readVersionCache();
-        if (cache && Date.now() - cache.checkedAt < VERSION_CHECK_INTERVAL_MS) {
-            return cache.latestVersion;
-        }
-        const timeout = setTimeout(() => controller.abort(), 3000);
-        try {
-            const response = await fetch("https://registry.npmjs.org/@wilm-ai/wilma-cli/latest", { signal: controller.signal });
-            const data = response.ok ? (await response.json()) : {};
-            const latestVersion = data.version ?? cache?.latestVersion ?? null;
-            await writeVersionCache({ latestVersion, checkedAt: Date.now() });
-            return latestVersion;
-        }
-        catch {
-            // Cancelled because the command finished: try again next time.
-            if (!cancelled)
-                await writeVersionCache({ latestVersion: cache?.latestVersion ?? null, checkedAt: Date.now() }).catch(() => { });
-            return cache?.latestVersion ?? null;
-        }
-        finally {
-            clearTimeout(timeout);
-        }
-    })().catch(() => null);
-    return {
-        result,
-        cancel() {
-            cancelled = true;
-            controller.abort();
-        },
-    };
-}
-function isNewerVersion(latest, current) {
-    const latestParts = latest.split(".").map(Number);
-    const currentParts = current.split(".").map(Number);
-    for (let i = 0; i < 3; i++) {
-        const l = latestParts[i] ?? 0;
-        const c = currentParts[i] ?? 0;
-        if (l > c)
-            return true;
-        if (l < c)
-            return false;
-    }
-    return false;
-}
 async function showUpdateNotice(check) {
-    let timer;
     try {
-        const latestVersion = await Promise.race([
-            check.result,
-            new Promise((resolve) => {
-                timer = setTimeout(() => resolve(null), 1000);
-            }),
-        ]);
+        const latestVersion = await latestWithin(check, 1000);
         if (!latestVersion)
             return;
         const currentVersion = await readPackageVersion();
         if (isNewerVersion(latestVersion, currentVersion)) {
-            process.stderr.write(`\nUpdate available: ${currentVersion} → ${latestVersion}\n` +
-                `Run "wilma update" to update.\n`);
+            process.stderr.write(`\n${cliUpdateNotice(currentVersion, latestVersion)}\n`);
         }
     }
     catch {
         // Silently ignore any errors
     }
-    finally {
-        clearTimeout(timer);
-    }
 }
 async function selectOrCancel(opts, clearScreen = true) {
     if (clearScreen) {

package/dist/login-server.d.ts

@@ -26,27 +26,8 @@ export declare function openBrowser(url: string, opts?: {
 export interface LoginPageOptions {
     nonce: string;
     apiBase: string;
-    /** Shown under the form; "{path}" is replaced with the config path. */
-    privacy?: {
-        en: string;
-        fi: string;
-    };
+    /** Shown in the privacy note under the form. */
     configPath?: string;
-    /** Extra fields posted with the login (e.g. a sealed OAuth request). */
-    extra?: Record<string, string>;
-    /** Label for the finishing button, for hosts that continue elsewhere after the login. */
-    finishLabel?: {
-        en: string;
-        fi: string;
-    };
-    /** Shown above the form, e.g. which app is connecting. */
-    notice?: {
-        en: string;
-        fi: string;
-    };
 }
-/**
- * The login page. The login API answers {status: "ok", students, redirect?};
- * with a redirect the page navigates there (e.g. an OAuth callback).
- */
+/** The login page. The login API answers {status: "ok", students, accounts}. */
 export declare function renderLoginPage(opts: LoginPageOptions): string;

package/dist/login-server.js

@@ -227,10 +227,7 @@ function jsonForScript(value) {
 function escapeHtml(value) {
     return value.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 }
-/**
- * The login page. The login API answers {status: "ok", students, redirect?};
- * with a redirect the page navigates there (e.g. an OAuth callback).
- */
+/** The login page. The login API answers {status: "ok", students, accounts}. */
 export function renderLoginPage(opts) {
     const strings = {
         en: {
@@ -262,7 +259,6 @@ export function renderLoginPage(opts) {
             badTotp: "Wilma didn't accept the two-step verification. Paste the authenticator setup key (a long base32 key or an otpauth:// link), not a 6-digit code.",
             tooMany: "Too many attempts. Close this tab and start again from your assistant.",
             missing: "Pick your school's Wilma and fill in both fields.",
-            notAllowed: "This Wilma account isn't on the test list for the hosted connection yet.",
             expired: "This login page is no longer active. Start the login again from your assistant, or run wilma login.",
             privacy: "Your login is saved only on this computer, in {path}. WilmAI has no server; it talks only to your school's Wilma.",
             disclaimer: "WilmAI is an independent open-source project, not affiliated with Visma or the Wilma service.",
@@ -296,20 +292,11 @@ export function renderLoginPage(opts) {
             badTotp: "Wilma ei hyväksynyt kaksivaiheista tunnistautumista. Liitä todennussovelluksen asetusavain (pitkä base32-avain tai otpauth://-linkki), ei 6-numeroista koodia.",
             tooMany: "Liian monta yritystä. Sulje välilehti ja aloita uudelleen avustajasi kautta.",
             missing: "Valitse koulusi Wilma ja täytä molemmat kentät.",
-            notAllowed: "Tämä Wilma-tunnus ei ole vielä verkkoyhteyden testilistalla.",
             expired: "Tämä kirjautumissivu ei ole enää käytössä. Aloita kirjautuminen uudelleen avustajasi kautta tai komennolla wilma login.",
             privacy: "Kirjautumistietosi tallennetaan vain tälle tietokoneelle, tiedostoon {path}. WilmAI:lla ei ole palvelinta; se on yhteydessä vain koulusi Wilmaan.",
             disclaimer: "WilmAI on itsenäinen avoimen lähdekoodin projekti, eikä se liity Vismaan tai Wilma-palveluun.",
         },
     };
-    if (opts.finishLabel) {
-        strings.en.finish = opts.finishLabel.en;
-        strings.fi.finish = opts.finishLabel.fi;
-    }
-    if (opts.privacy) {
-        strings.en.privacy = opts.privacy.en;
-        strings.fi.privacy = opts.privacy.fi;
-    }
     const nonce = escapeHtml(opts.nonce);
     return `<!doctype html>
 <html lang="en">
@@ -354,7 +341,6 @@ export function renderLoginPage(opts) {
   ul.children { margin:6px 0 0; padding-left:22px; }
   ul.children li { padding:3px 0; }
   .add-hint { margin-top:8px; }
-  .notice { margin:0 0 16px; padding:10px 12px; border-radius:8px; background:var(--paper); border:1px solid var(--line); font-size:14px; }
   .error { color:var(--err); margin-top:12px; }
   .done h2 { margin:0 0 8px; }
   [hidden] { display:none !important; }
@@ -365,7 +351,6 @@ export function renderLoginPage(opts) {
   <h1 id="heading"></h1>
   <p id="intro"></p>
   <section class="card" id="form-card">
-    <p class="notice" id="notice" hidden></p>
     <div id="school-pick">
       <label for="school" id="school-label"></label>
       <input id="school" autocomplete="off" spellcheck="false" role="combobox" aria-autocomplete="list" aria-controls="results" aria-expanded="false">
@@ -411,8 +396,6 @@ export function renderLoginPage(opts) {
   const STRINGS = ${jsonForScript(strings)};
   const API = ${jsonForScript(opts.apiBase)};
   const CONFIG_PATH = ${jsonForScript(opts.configPath ?? "")};
-  const EXTRA = ${jsonForScript(opts.extra ?? {})};
-  const NOTICE = ${jsonForScript(opts.notice ?? null)};
   const lang = (navigator.language || "en").toLowerCase().startsWith("fi") ? "fi" : "en";
   const t = STRINGS[lang];
   document.documentElement.lang = lang;
@@ -434,8 +417,6 @@ export function renderLoginPage(opts) {
   text("submit", t.submit); text("done-title", t.doneTitle);
   text("finish", t.finish); text("add-another", t.addAnother); text("add-hint", t.addAnotherHint);
   text("finished-title", t.finishedTitle); text("finished-body", t.finishedBody);
-  if (NOTICE) { text("notice", NOTICE[lang]); $("notice").hidden = false; }
-  let pending = null;
 
   function renderAccounts(accounts) {
     const box = $("accounts"); box.replaceChildren();
@@ -467,10 +448,9 @@ export function renderLoginPage(opts) {
       const res = await fetch(API + "/done", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ ...EXTRA, pending: pending || undefined }),
+        body: "{}",
       });
       const data = await res.json();
-      if (data.redirect) { window.location.assign(data.redirect); return; }
       if (data.status !== "ok") { showError(data.message || t.expired); btn.disabled = false; return; }
     } catch (err) {
       // The page may already have closed; the login is saved either way.
@@ -563,11 +543,10 @@ export function renderLoginPage(opts) {
       const res = await fetch(API + "/login", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ ...EXTRA, pending: pending || undefined, tenantUrl: tenant.url, tenantName: tenant.name, username, password, totpSecret: $("totp").value.trim() || undefined }),
+        body: JSON.stringify({ tenantUrl: tenant.url, tenantName: tenant.name, username, password, totpSecret: $("totp").value.trim() || undefined }),
       });
       const data = await res.json();
       if (data.status === "ok") {
-        if (data.pending) pending = data.pending;
         renderAccounts(data.accounts || [{ wilma: tenant.name || tenant.url, students: data.students || [] }]);
         $("form-card").hidden = true; $("done").hidden = false;
         $("finish").focus();
@@ -577,7 +556,6 @@ export function renderLoginPage(opts) {
       if (data.code === "bad_credentials") showError(t.badCredentials);
       else if (data.code === "too_many_attempts") showError(t.tooMany);
       else if (data.code === "missing_fields") showError(t.missing);
-      else if (data.code === "not_allowed") showError(t.notAllowed);
       else if (data.code === "bad_totp") { $("mfa").hidden = false; showError(lang === "fi" ? t.badTotp : (data.message || t.badTotp)); }
       else showError(data.message || "Error");
     } catch (err) {

package/dist/mcp-tools.d.ts

@@ -1,7 +1,7 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
 import type { FetchedAttachment, WilmaAccess } from "./agent-data.js";
-export declare const INSTRUCTIONS = "Read-only access to Finland's Wilma school system for a parent/guardian.\n- Start with wilma_summary: today's and tomorrow's lessons, upcoming exams, recent homework, news and messages for every child in one call.\n- Tools cover all children by default; pass \"student\" (name or student number) to narrow to one child.\n- Wilma content is usually in Finnish. Answer in the user's language and translate as needed.\n- Message and news lists return ids; use wilma_read_message / wilma_read_news for full text. Bulletins can link attachments; fetch them with wilma_get_news_attachment.\n- Teachers' feedback (\"forgot books\", \"did well\") and absences are lesson notes: wilma_lesson_notes for recent days, wilma_lesson_notes_summary for counts. Course and report-card grades are in wilma_gradebook.\n- If a tool says the user isn't logged in, relay the login link or instructions to the user exactly; never ask the user to type their Wilma password into the chat.";
+export declare const INSTRUCTIONS = "Read-only access to Finland's Wilma school system for a parent/guardian.\n- Start with wilma_summary: today's and tomorrow's lessons, upcoming exams, recent homework, news and messages for every child in one call.\n- Tools cover all children by default; pass \"student\" (name or student number) to narrow to one child.\n- Wilma content is usually in Finnish. Answer in the user's language and translate as needed. Write dates the way that language does: Finnish \"ke 7.10.\" (with the final period), English \"Wed 7 Oct\".\n- Message and news lists return ids; use wilma_read_message / wilma_read_news for full text. Bulletins can link attachments; fetch them with wilma_get_news_attachment.\n- Teachers' feedback (\"forgot books\", \"did well\") and absences are lesson notes: wilma_lesson_notes for recent days, wilma_lesson_notes_summary for counts. Course and report-card grades are in wilma_gradebook.\n- If a tool says the user isn't logged in, relay the login link or instructions to the user exactly; never ask the user to type their Wilma password into the chat.\n- If a result ends with an \"Update note\", answer the question first, then pass the note on in one sentence.";
 export declare const READ_ONLY: {
     readonly readOnlyHint: true;
     readonly destructiveHint: false;
@@ -13,8 +13,6 @@ export declare function textResult(text: string, isError?: boolean): CallToolRes
 export interface ToolHost {
     /** Run a tool with Wilma access, or return a result explaining why there is none (e.g. not logged in). */
     withAccess(run: (access: WilmaAccess) => Promise<CallToolResult>): Promise<CallToolResult>;
-    /** Largest attachment to return inline (hosts with a response size cap set less). */
-    inlineAttachmentLimit?: number;
     /** Local hosts can save attachments to disk; returns the saved path. */
     saveAttachment?: (fetched: Extract<FetchedAttachment, {
         status: "fetched";

package/dist/mcp-tools.js

@@ -8,10 +8,11 @@ import { toAgentJson } from "./output-json.js";
 export const INSTRUCTIONS = `Read-only access to Finland's Wilma school system for a parent/guardian.
 - Start with wilma_summary: today's and tomorrow's lessons, upcoming exams, recent homework, news and messages for every child in one call.
 - Tools cover all children by default; pass "student" (name or student number) to narrow to one child.
-- Wilma content is usually in Finnish. Answer in the user's language and translate as needed.
+- Wilma content is usually in Finnish. Answer in the user's language and translate as needed. Write dates the way that language does: Finnish "ke 7.10." (with the final period), English "Wed 7 Oct".
 - Message and news lists return ids; use wilma_read_message / wilma_read_news for full text. Bulletins can link attachments; fetch them with wilma_get_news_attachment.
 - Teachers' feedback ("forgot books", "did well") and absences are lesson notes: wilma_lesson_notes for recent days, wilma_lesson_notes_summary for counts. Course and report-card grades are in wilma_gradebook.
-- If a tool says the user isn't logged in, relay the login link or instructions to the user exactly; never ask the user to type their Wilma password into the chat.`;
+- If a tool says the user isn't logged in, relay the login link or instructions to the user exactly; never ask the user to type their Wilma password into the chat.
+- If a result ends with an "Update note", answer the question first, then pass the note on in one sentence.`;
 export const READ_ONLY = { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false };
 const INLINE_ATTACHMENT_LIMIT = 10 * 1024 * 1024;
 const studentArg = z
@@ -24,7 +25,7 @@ export function json(data) {
 export function textResult(text, isError = false) {
     return { content: [{ type: "text", text }], isError };
 }
-function attachmentResult(fetched, savedPath, inlineLimit = INLINE_ATTACHMENT_LIMIT) {
+function attachmentResult(fetched, savedPath) {
     if (fetched.status === "not_a_file") {
         return json({
             status: "not_a_file",
@@ -45,7 +46,7 @@ function attachmentResult(fetched, savedPath, inlineLimit = INLINE_ATTACHMENT_LI
     };
     const content = [{ type: "text", text: toAgentJson(meta) }];
     const type = fetched.contentType ?? "application/octet-stream";
-    if (fetched.data.byteLength > inlineLimit) {
+    if (fetched.data.byteLength > INLINE_ATTACHMENT_LIMIT) {
         content.push({
             type: "text",
             text: `The file is too large to include here (${(fetched.data.byteLength / 1048576).toFixed(1)} MB). ${fetched.resource.authContext === "wilma" ? "Ask the user to open it in Wilma" : `It can be opened at ${fetched.resource.url}`}${savedPath ? `; a copy was saved to ${savedPath}` : ""}.`,
@@ -166,7 +167,7 @@ export function registerWilmaTools(server, ctx) {
     }, async (args) => ctx.withAccess(async (a) => {
         const fetched = await a.printout({ id: args.id, student: args.student });
         const savedPath = args.save && ctx.saveAttachment && fetched.status === "fetched" ? await ctx.saveAttachment(fetched) : undefined;
-        return attachmentResult(fetched, savedPath, ctx.inlineAttachmentLimit);
+        return attachmentResult(fetched, savedPath);
     }));
     server.registerTool("wilma_list_messages", {
         title: "List messages",
@@ -230,6 +231,6 @@ export function registerWilmaTools(server, ctx) {
             student: args.student,
         });
         const savedPath = args.save && ctx.saveAttachment && fetched.status === "fetched" ? await ctx.saveAttachment(fetched) : undefined;
-        return attachmentResult(fetched, savedPath, ctx.inlineAttachmentLimit);
+        return attachmentResult(fetched, savedPath);
     }));
 }

package/dist/mcp.js

@@ -14,6 +14,7 @@ import { openBrowser, startLoginServer } from "./login-server.js";
 import { z } from "zod";
 import { INSTRUCTIONS, READ_ONLY, json, registerWilmaTools, textResult } from "./mcp-tools.js";
 import { searchTenants } from "./tenant-search.js";
+import { installKind, isNewerVersion, latestWithin, mcpUpdateNote, startUpdateCheck, updateChecksEnabled } from "./update-check.js";
 const SECRET_SETTINGS_HINT = [
     "If the user is not at this computer (for example, this agent runs on a cloud computer), the link won't work for them. Instead:",
     "  1. Ask which city their children's school is in (or the school's name), call wilma_find_school, and let them pick their Wilma from the results.",
@@ -60,6 +61,23 @@ async function startBrowserLogin(requested = false) {
         SECRET_SETTINGS_HINT,
     ].join("\n"), !requested);
 }
+let updateCheck = null;
+let updateNoted = false;
+/**
+ * Once per server process, add a note when a newer WilmAI is out, so the
+ * assistant can tell the user how to update (see INSTRUCTIONS).
+ */
+async function withUpdateNote(result, version) {
+    if (!updateCheck || updateNoted)
+        return result;
+    const latest = await latestWithin(updateCheck, 300).catch(() => null);
+    if (!latest)
+        return result;
+    updateNoted = true;
+    if (!isNewerVersion(latest, version))
+        return result;
+    return { ...result, content: [...result.content, { type: "text", text: mcpUpdateNote(installKind(), version, latest) }] };
+}
 async function withAccess(run) {
     const config = await loadConfig();
     let accounts;
@@ -88,7 +106,7 @@ async function withAccess(run) {
 function createWilmaMcpServer(version) {
     const server = new McpServer({ name: "wilma", title: "WilmAI", version }, { instructions: INSTRUCTIONS });
     registerWilmaTools(server, {
-        withAccess,
+        withAccess: async (run) => withUpdateNote(await withAccess(run), version),
         saveAttachment: async (fetched) => {
             const directory = resolve(homedir(), "Downloads", "WilmAI");
             await mkdir(directory, { recursive: true });
@@ -148,6 +166,9 @@ export async function runMcpServer(version) {
     console.info = (...args) => console.error(...args);
     // Share saved sessions with the CLI: no login per process, no extra codes.
     useSessionStore(fileSessionStore);
+    // Checked once a day at most; npx already runs the newest version.
+    if (updateChecksEnabled())
+        updateCheck = startUpdateCheck();
     const server = createWilmaMcpServer(version);
     await server.connect(new StdioServerTransport());
 }

package/dist/update-check.d.ts

@@ -0,0 +1,27 @@
+/**
+ * - npm: installed with npm (`wilma update` updates it)
+ * - claude-desktop: the Claude Desktop extension (a new .mcpb file updates it)
+ * - npx: run through npx, which already fetches the newest version, so no notice
+ */
+export type InstallKind = "npm" | "claude-desktop" | "npx";
+export declare function installKind(env?: NodeJS.ProcessEnv, scriptPath?: string): InstallKind;
+export declare function updateChecksEnabled(env?: NodeJS.ProcessEnv): boolean;
+export declare function isNewerVersion(latest: string, current: string): boolean;
+/** The CLI's notice, for a person or an agent reading stderr. */
+export declare function cliUpdateNotice(current: string, latest: string): string;
+/** The note the MCP server adds for the assistant, who passes it on. */
+export declare function mcpUpdateNote(kind: InstallKind, current: string, latest: string): string;
+export interface UpdateCheck {
+    /** The latest version on npm, or null if unknown. */
+    result: Promise<string | null>;
+    /** Stop a check still in flight, so it never keeps the command running. */
+    cancel(): void;
+}
+/**
+ * Ask npm for the latest version at most once a day. A failed check counts as
+ * a check too: agents in sandboxes without internet access shouldn't pay for
+ * a timeout on every command.
+ */
+export declare function startUpdateCheck(): UpdateCheck;
+/** The latest version if the check has an answer within `waitMs`, else null. */
+export declare function latestWithin(check: UpdateCheck, waitMs: number): Promise<string | null>;

package/dist/update-check.js

@@ -0,0 +1,116 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { getConfigPath } from "./config.js";
+/*
+ * "A newer WilmAI is available." The CLI prints it on stderr (people in a
+ * terminal and agents like OpenClaw both read it there); the MCP server adds it
+ * once to a tool result so the assistant can tell the user. How to update
+ * depends on how WilmAI was installed.
+ */
+const VERSION_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+export function installKind(env = process.env, scriptPath = fileURLToPath(import.meta.url)) {
+    // Set in the extension's manifest (mcpb/manifest.base.json).
+    if (env.WILMAI_INSTALL === "claude-desktop")
+        return "claude-desktop";
+    if (scriptPath.includes(`${sep}_npx${sep}`))
+        return "npx";
+    return "npm";
+}
+export function updateChecksEnabled(env = process.env) {
+    return env.WILMAI_NO_UPDATE_CHECK !== "1" && installKind(env) !== "npx";
+}
+export function isNewerVersion(latest, current) {
+    const latestParts = latest.split(".").map(Number);
+    const currentParts = current.split(".").map(Number);
+    for (let i = 0; i < 3; i++) {
+        const l = latestParts[i] ?? 0;
+        const c = currentParts[i] ?? 0;
+        if (l > c)
+            return true;
+        if (l < c)
+            return false;
+    }
+    return false;
+}
+/** The CLI's notice, for a person or an agent reading stderr. */
+export function cliUpdateNotice(current, latest) {
+    return `Update available: ${current} → ${latest}\nRun "wilma update" to update.`;
+}
+/** The note the MCP server adds for the assistant, who passes it on. */
+export function mcpUpdateNote(kind, current, latest) {
+    const how = kind === "claude-desktop"
+        ? "download https://wilm.ai/get/claude and open the file; Claude Desktop asks to install it"
+        : 'run "wilma update" in a terminal';
+    return `Update note: WilmAI ${latest} is available (this computer has ${current}). After answering, tell the user in one sentence that they can update: ${how}.`;
+}
+function versionCachePath() {
+    return resolve(dirname(getConfigPath()), "version-check.json");
+}
+async function readVersionCache() {
+    try {
+        return JSON.parse(await readFile(versionCachePath(), "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+async function writeVersionCache(cache) {
+    const path = versionCachePath();
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, JSON.stringify(cache), { encoding: "utf-8", mode: 0o600 });
+}
+/**
+ * Ask npm for the latest version at most once a day. A failed check counts as
+ * a check too: agents in sandboxes without internet access shouldn't pay for
+ * a timeout on every command.
+ */
+export function startUpdateCheck() {
+    const controller = new AbortController();
+    let cancelled = false;
+    const result = (async () => {
+        const cache = await readVersionCache();
+        if (cache && Date.now() - cache.checkedAt < VERSION_CHECK_INTERVAL_MS) {
+            return cache.latestVersion;
+        }
+        const timeout = setTimeout(() => controller.abort(), 3000);
+        try {
+            const response = await fetch("https://registry.npmjs.org/@wilm-ai/wilma-cli/latest", { signal: controller.signal });
+            const data = response.ok ? (await response.json()) : {};
+            const latestVersion = data.version ?? cache?.latestVersion ?? null;
+            await writeVersionCache({ latestVersion, checkedAt: Date.now() });
+            return latestVersion;
+        }
+        catch {
+            // Cancelled because the command finished: try again next time.
+            if (!cancelled)
+                await writeVersionCache({ latestVersion: cache?.latestVersion ?? null, checkedAt: Date.now() }).catch(() => { });
+            return cache?.latestVersion ?? null;
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    })().catch(() => null);
+    return {
+        result,
+        cancel() {
+            cancelled = true;
+            controller.abort();
+        },
+    };
+}
+/** The latest version if the check has an answer within `waitMs`, else null. */
+export async function latestWithin(check, waitMs) {
+    let timer;
+    try {
+        return await Promise.race([
+            check.result,
+            new Promise((resolve) => {
+                timer = setTimeout(() => resolve(null), waitMs);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wilm-ai/wilma-cli",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "Read your children's Wilma (Finnish school system) from the terminal or an AI assistant: schedule, homework, exams, messages and news.",
   "license": "MIT",
   "repository": {
@@ -21,7 +21,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "lint": "tsc -p tsconfig.json --noEmit",
-    "test": "pnpm --filter @wilm-ai/wilma-client build && pnpm run build && node test/news-resources.mjs && node test/mcp-login.mjs && node test/mfa.mjs && node test/audit.mjs",
+    "test": "pnpm --filter @wilm-ai/wilma-client build && pnpm run build && node test/news-resources.mjs && node test/mcp-login.mjs && node test/mfa.mjs && node test/audit.mjs && node test/update-notice.mjs",
     "start": "node dist/index.js",
     "prepack": "pnpm --filter @wilm-ai/wilma-client build && pnpm --filter @wilm-ai/wilma-cli build",
     "test:live": "tsc -p tsconfig.json && node test/live.spec.mjs",
@@ -30,7 +30,7 @@
   "dependencies": {
     "@inquirer/prompts": "^5.3.8",
     "@modelcontextprotocol/sdk": "^1.32.0",
-    "@wilm-ai/wilma-client": "^1.6.0",
+    "@wilm-ai/wilma-client": "^1.6.1",
     "zod": "^4.1.0"
   },
   "devDependencies": {