@withone/cli 1.44.1 → 1.44.2

package/README.md

@@ -548,6 +548,20 @@ Settings propagate automatically to all installed agent configs.
 
 Auto-sync refuses to resurrect skills if you opted out of skill installation during `one init` — the canonical dir has to already exist.
 
+### `one update`
+
+Updates the CLI to the latest version (`npm install -g @withone/cli@latest`).
+
+The CLI also **auto-updates in the background**: when a newer version has been published for more than 30 minutes, the next `one` command silently kicks off a global install. This is hardened against concurrent runs — a lock file in `~/.one/` ensures at most one install runs at a time (so parallel agent invocations can't collide and wedge npm), and the lock self-heals after 10 minutes if an install ever crashes or hangs.
+
+To disable background auto-updates entirely (e.g. on CI or a shared agent host), set:
+
+```bash
+export ONE_NO_AUTO_UPDATE=1
+```
+
+Run `one update` manually whenever you want to upgrade.
+
 ### Project config (`.onerc`)
 
 Drop a `.onerc` file in your project root to override global settings per-project. Simple `KEY=VALUE` format; `#` for comments. Read from the current working directory (no parent lookup).

package/dist/index.js

@@ -621,14 +621,17 @@ import { fileURLToPath } from "url";
 // src/commands/update.ts
 import { createRequire } from "module";
 import { spawn } from "child_process";
-import { readFileSync, writeFileSync, mkdirSync } from "fs";
+import { readFileSync, writeFileSync, mkdirSync, rmSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
 var require2 = createRequire(import.meta.url);
 var { version: currentVersion } = require2("../package.json");
-var CACHE_PATH = join(homedir(), ".one", "update-check.json");
+var ONE_DIR = join(homedir(), ".one");
+var CACHE_PATH = join(ONE_DIR, "update-check.json");
+var LOCK_PATH = join(ONE_DIR, "auto-update.lock");
 var CHECK_INTERVAL_MS = 4 * 60 * 60 * 1e3;
 var AGE_GATE_MS = 30 * 60 * 1e3;
+var LOCK_TTL_MS = 10 * 60 * 1e3;
 async function fetchLatestVersionInfo() {
   try {
     const res = await fetch("https://registry.npmjs.org/@withone/cli");
@@ -725,16 +728,52 @@ function isNewerVersion(latest, current) {
   if (lMin !== cMin) return lMin > cMin;
   return lPat > cPat;
 }
+function isAutoUpdateDisabled() {
+  const v = process.env.ONE_NO_AUTO_UPDATE ?? process.env.ONE_DISABLE_AUTO_UPDATE;
+  return v === "1" || v === "true";
+}
+function acquireUpdateLock(targetVersion) {
+  try {
+    mkdirSync(ONE_DIR, { recursive: true });
+  } catch {
+  }
+  try {
+    const lock = JSON.parse(readFileSync(LOCK_PATH, "utf8"));
+    const startedAt = typeof lock.startedAt === "number" ? lock.startedAt : 0;
+    if (Date.now() - startedAt < LOCK_TTL_MS) return false;
+    rmSync(LOCK_PATH, { force: true });
+  } catch {
+  }
+  try {
+    writeFileSync(
+      LOCK_PATH,
+      JSON.stringify({ pid: process.pid, startedAt: Date.now(), targetVersion }),
+      { flag: "wx" }
+      // fail if another invocation created it first
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
 function autoUpdate(targetVersion, publishedAt) {
+  if (isAutoUpdateDisabled()) return;
   if (publishedAt) {
     const age = Date.now() - new Date(publishedAt).getTime();
     if (age < AGE_GATE_MS) return;
   }
+  if (!acquireUpdateLock(targetVersion)) return;
   const child = spawn("npm", ["install", "-g", `@withone/cli@${targetVersion}`], {
     detached: true,
     stdio: "ignore",
     shell: true
   });
+  child.on("error", () => {
+    try {
+      rmSync(LOCK_PATH, { force: true });
+    } catch {
+    }
+  });
   child.unref();
 }
 
@@ -11135,7 +11174,7 @@ program.command("guide [topic]").description("Full CLI usage guide for agents (t
 program.command("onboard").description("Agent onboarding \u2014 teaches your agent what the One CLI can do").option("--step <number>", "Run a specific onboarding step (1, 2, or 3)").action(async (options) => {
   await onboardCommand(options.step ? parseInt(options.step, 10) : void 0);
 });
-program.command("update").description("Update the One CLI to the latest version").action(async () => {
+program.command("update").description("Update the One CLI to the latest version (background auto-update can be disabled with ONE_NO_AUTO_UPDATE=1)").action(async () => {
   await updateCommand();
 });
 program.command("whoami").description("Show the user, organization, and project for the current API key").action(async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/cli",
-  "version": "1.44.1",
+  "version": "1.44.2",
   "description": "CLI for managing One",
   "type": "module",
   "files": [