@zeph-to/cli 1.15.2 → 1.15.3

package/dist/agent-rules-fetch.d.ts

@@ -8,6 +8,13 @@ export declare const RULES_REFRESH_INTERVAL_MS: number;
  * back to bundled rules.
  */
 export declare const validateManifest: (value: unknown) => DetectionManifest | null;
+/**
+ * Segment-wise numeric compare of dotted date versions
+ * ("2026.07.04.3"). Plain string compare fails on ".10" vs ".9";
+ * non-numeric segments compare as equal so a malformed version can
+ * never crash the refresh path.
+ */
+export declare const compareManifestVersions: (a: string, b: string) => number;
 export type ManifestSource = 'remote' | 'cache' | 'bundled';
 export declare const getActiveManifest: () => DetectionManifest;
 export declare const getActiveManifestSource: () => ManifestSource;
@@ -21,7 +28,7 @@ export declare const loadManifestFromCache: () => ManifestSource;
 export declare const rulesUrl: () => string;
 export interface RefreshResult {
     source: ManifestSource;
-    /** 'updated' | 'not-modified' | 'invalid' | 'error' — for verbose logs. */
+    /** 'updated' | 'not-modified' | 'stale-ignored' | 'invalid' | 'error' — for verbose logs. */
     outcome: string;
     version?: string;
 }

package/dist/agent-rules-fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-rules-fetch.d.ts","sourceRoot":"","sources":["../src/agent-rules-fetch.ts"],"names":[],"mappings":"AAeA,OAAO,EAEH,KAAK,iBAAiB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,eAAO,MAAM,gBAAgB,QAAuC,CAAC;AACrE,eAAO,MAAM,yBAAyB,QAAqB,CAAC;AA6C5D;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,OAAO,KAAG,iBAAiB,GAAG,IAWrE,CAAC;AAIF,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAK5D,eAAO,MAAM,iBAAiB,QAAO,iBAAmC,CAAC;AACzE,eAAO,MAAM,uBAAuB,QAAO,cAA8B,CAAC;AAS1E,iBAAiB;AACjB,eAAO,MAAM,mBAAmB,QAAO,IAEtC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAO,cAWxC,CAAC;AAWF,eAAO,MAAM,QAAQ,QAAO,MAK3B,CAAC;AAEF,MAAM,WAAW,aAAa;IAC1B,MAAM,EAAE,cAAc,CAAC;IACvB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,GAAU,YAAW,OAAO,KAAa,KAAG,OAAO,CAAC,aAAa,CAsC5F,CAAC"}
+{"version":3,"file":"agent-rules-fetch.d.ts","sourceRoot":"","sources":["../src/agent-rules-fetch.ts"],"names":[],"mappings":"AAuBA,OAAO,EAEH,KAAK,iBAAiB,EACzB,MAAM,kBAAkB,CAAC;AAG1B,eAAO,MAAM,gBAAgB,QAAuC,CAAC;AACrE,eAAO,MAAM,yBAAyB,QAAqB,CAAC;AA6C5D;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,OAAO,KAAG,iBAAiB,GAAG,IAWrE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,KAAG,MAU9D,CAAC;AAIF,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAK5D,eAAO,MAAM,iBAAiB,QAAO,iBAAmC,CAAC;AACzE,eAAO,MAAM,uBAAuB,QAAO,cAA8B,CAAC;AAS1E,iBAAiB;AACjB,eAAO,MAAM,mBAAmB,QAAO,IAEtC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAO,cAWxC,CAAC;AAWF,eAAO,MAAM,QAAQ,QAAO,MAK3B,CAAC;AAEF,MAAM,WAAW,aAAa;IAC1B,MAAM,EAAE,cAAc,CAAC;IACvB,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,GAAU,YAAW,OAAO,KAAa,KAAG,OAAO,CAAC,aAAa,CA4C5F,CAAC"}

package/dist/agent-rules-fetch.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.refreshManifest = exports.rulesUrl = exports.loadManifestFromCache = exports.resetActiveManifest = exports.getActiveManifestSource = exports.getActiveManifest = exports.validateManifest = exports.RULES_REFRESH_INTERVAL_MS = exports.RULES_CACHE_FILE = void 0;
+exports.refreshManifest = exports.rulesUrl = exports.loadManifestFromCache = exports.resetActiveManifest = exports.getActiveManifestSource = exports.getActiveManifest = exports.compareManifestVersions = exports.validateManifest = exports.RULES_REFRESH_INTERVAL_MS = exports.RULES_CACHE_FILE = void 0;
 /**
  * OTA delivery for agent detection rules (SPEC-AGENT-AWARENESS §S7).
  *
@@ -12,6 +12,14 @@ exports.refreshManifest = exports.rulesUrl = exports.loadManifestFromCache = exp
  * hostile payload can never leave the listener without rules, and
  * `disabledRuleIds` in a fetched manifest acts as a same-day
  * kill-switch for a misfiring rule (no release, no restart).
+ *
+ * Version precedence: a fetched/cached manifest only activates when
+ * its version is >= the bundled one. npm publishes land in minutes
+ * while the server manifest ships with a full deploy, so a fresh cli
+ * routinely carries NEWER rules than the endpoint — without the gate,
+ * the older remote manifest would shadow every bundled rule fix until
+ * the server caught up. Server-side rollback still works: the server
+ * bumps the version even when reverting rule content.
  */
 const fs_1 = require("fs");
 const path_1 = require("path");
@@ -90,6 +98,26 @@ const validateManifest = (value) => {
     return value;
 };
 exports.validateManifest = validateManifest;
+/**
+ * Segment-wise numeric compare of dotted date versions
+ * ("2026.07.04.3"). Plain string compare fails on ".10" vs ".9";
+ * non-numeric segments compare as equal so a malformed version can
+ * never crash the refresh path.
+ */
+const compareManifestVersions = (a, b) => {
+    const as = a.split('.').map(Number);
+    const bs = b.split('.').map(Number);
+    const len = Math.max(as.length, bs.length);
+    for (let i = 0; i < len; i++) {
+        const d = (as[i] ?? 0) - (bs[i] ?? 0);
+        if (Number.isNaN(d))
+            continue;
+        if (d !== 0)
+            return d < 0 ? -1 : 1;
+    }
+    return 0;
+};
+exports.compareManifestVersions = compareManifestVersions;
 let activeManifest = agent_rules_default_js_1.DEFAULT_MANIFEST;
 let activeSource = 'bundled';
 const getActiveManifest = () => activeManifest;
@@ -115,7 +143,7 @@ const loadManifestFromCache = () => {
     try {
         const cache = JSON.parse((0, fs_1.readFileSync)(exports.RULES_CACHE_FILE, 'utf-8'));
         const manifest = (0, exports.validateManifest)(cache.manifest);
-        if (manifest) {
+        if (manifest && (0, exports.compareManifestVersions)(manifest.version, agent_rules_default_js_1.DEFAULT_MANIFEST.version) >= 0) {
             activateManifest(manifest, 'cache');
         }
     }
@@ -180,6 +208,12 @@ const refreshManifest = async (fetchImpl = fetch) => {
             // Cache write failure is non-fatal: the manifest still
             // activates for this process lifetime.
         }
+        if ((0, exports.compareManifestVersions)(manifest.version, agent_rules_default_js_1.DEFAULT_MANIFEST.version) < 0) {
+            // Endpoint hasn't caught up to this build's bundled rules.
+            // Cache is still written above (the ETag stops refetch churn)
+            // but startup applies the same gate, so bundled stays active.
+            return { source: activeSource, outcome: 'stale-ignored', version: manifest.version };
+        }
         activateManifest(manifest, 'remote');
         return { source: 'remote', outcome: 'updated', version: manifest.version };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeph-to/cli",
-  "version": "1.15.2",
+  "version": "1.15.3",
   "description": "Zeph CLI + push notification SDK for AI agents",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",