@zephyrdeng/pi-review 0.7.1 → 0.8.1

package/dist/ui-server.test.js

@@ -0,0 +1,236 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import http from "node:http";
+import os from "node:os";
+import path from "node:path";
+import { test, afterEach } from "vitest";
+import { createDashboardRequestListener, createRunDirectory, formatSseEvent, generateCapabilityToken, isAllowedHost, isAllowedOrigin, isValidToken, securityHeaders, splitCompleteLines, writeUrlFileAtomic, } from "./ui-server.js";
+// ---------------------------------------------------------------------------
+// Pure helpers
+// ---------------------------------------------------------------------------
+test("generateCapabilityToken returns high-entropy, unique, URL-safe tokens", () => {
+    const a = generateCapabilityToken();
+    const b = generateCapabilityToken();
+    assert.notEqual(a, b);
+    assert.ok(a.length >= 40);
+    assert.match(a, /^[A-Za-z0-9_-]+$/);
+});
+test("isValidToken accepts only an exact match and rejects undefined/short candidates", () => {
+    const token = generateCapabilityToken();
+    assert.equal(isValidToken(token, token), true);
+    assert.equal(isValidToken(`${token}x`, token), false);
+    assert.equal(isValidToken(token.slice(0, -1), token), false);
+    assert.equal(isValidToken(undefined, token), false);
+    assert.equal(isValidToken("", token), false);
+});
+test("isAllowedHost accepts only loopback hostnames bound to the server's own port", () => {
+    assert.equal(isAllowedHost("127.0.0.1:4100", 4100), true);
+    assert.equal(isAllowedHost("localhost:4100", 4100), true);
+    assert.equal(isAllowedHost("LOCALHOST:4100", 4100), true);
+    assert.equal(isAllowedHost("[::1]:4100", 4100), true);
+    assert.equal(isAllowedHost("127.0.0.1:9999", 4100), false);
+    assert.equal(isAllowedHost("evil.example:4100", 4100), false);
+    assert.equal(isAllowedHost("127.0.0.1", 4100), false);
+    assert.equal(isAllowedHost(undefined, 4100), false);
+    assert.equal(isAllowedHost("[::1", 4100), false);
+});
+test("isAllowedOrigin allows a missing Origin and exact loopback matches only", () => {
+    assert.equal(isAllowedOrigin(undefined, 4100), true);
+    assert.equal(isAllowedOrigin("http://127.0.0.1:4100", 4100), true);
+    assert.equal(isAllowedOrigin("http://localhost:4100", 4100), true);
+    assert.equal(isAllowedOrigin("http://[::1]:4100", 4100), true);
+    assert.equal(isAllowedOrigin("http://127.0.0.1:9999", 4100), false);
+    assert.equal(isAllowedOrigin("https://evil.example", 4100), false);
+    assert.equal(isAllowedOrigin("null", 4100), false);
+});
+test("securityHeaders disables framing, remote assets, and caching", () => {
+    const headers = securityHeaders();
+    assert.match(headers["Content-Security-Policy"], /default-src 'none'/);
+    assert.match(headers["Content-Security-Policy"], /frame-ancestors 'none'/);
+    assert.equal(headers["X-Frame-Options"], "DENY");
+    assert.equal(headers["Cache-Control"], "no-store");
+});
+test("createRunDirectory creates an owner-only directory", () => {
+    const dir = createRunDirectory(`test-${generateCapabilityToken()}`, os.tmpdir());
+    try {
+        const stat = fs.statSync(dir);
+        assert.ok(stat.isDirectory());
+        if (process.platform !== "win32") {
+            assert.equal(stat.mode & 0o777, 0o700);
+        }
+    }
+    finally {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+});
+test("writeUrlFileAtomic leaves only the final file with no temp remnants", () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-review-ui-test-"));
+    try {
+        const target = path.join(dir, "url.txt");
+        writeUrlFileAtomic(target, "http://127.0.0.1:4100/run/abc");
+        assert.equal(fs.readFileSync(target, "utf8"), "http://127.0.0.1:4100/run/abc\n");
+        const remaining = fs.readdirSync(dir);
+        assert.deepEqual(remaining, ["url.txt"]);
+    }
+    finally {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+});
+test("formatSseEvent emits an id: line for Last-Event-ID replay plus a data: line", () => {
+    const frame = formatSseEvent(3, { type: "reviewer.started" });
+    assert.equal(frame, 'id: 3\ndata: {"type":"reviewer.started"}\n\n');
+});
+test("splitCompleteLines buffers a trailing partial line across chunks", () => {
+    const first = splitCompleteLines("", 'line-a\nline-b\npart');
+    assert.deepEqual(first.lines, ["line-a", "line-b"]);
+    assert.equal(first.leftover, "part");
+    const second = splitCompleteLines(first.leftover, "ial\nline-c\n");
+    assert.deepEqual(second.lines, ["partial", "line-c"]);
+    assert.equal(second.leftover, "");
+});
+function httpGet(port, requestPath, headers = {}) {
+    return new Promise((resolve, reject) => {
+        const req = http.request({ host: "127.0.0.1", port, path: requestPath, headers }, (res) => {
+            let body = "";
+            res.on("data", (c) => (body += c));
+            res.on("end", () => resolve({ status: res.statusCode ?? 0, headers: res.headers, body }));
+        });
+        req.on("error", reject);
+        req.end();
+    });
+}
+/** Collect SSE frames until `minFrames` arrive or the timeout fires, then close the connection. */
+function collectSse(port, requestPath, headers, minFrames) {
+    return new Promise((resolve, reject) => {
+        const req = http.request({ host: "127.0.0.1", port, path: requestPath, headers }, (res) => {
+            let body = "";
+            const timer = setTimeout(() => {
+                req.destroy();
+                resolve(body);
+            }, 2000);
+            res.on("data", (c) => {
+                body += c;
+                if ((body.match(/^id: /gm) ?? []).length >= minFrames) {
+                    clearTimeout(timer);
+                    req.destroy();
+                    resolve(body);
+                }
+            });
+            res.on("error", () => resolve(body));
+        });
+        req.on("error", reject);
+        req.end();
+    });
+}
+let activeServer;
+let activeDir;
+afterEach(() => {
+    if (activeServer) {
+        activeServer.closeAllConnections();
+        activeServer.close();
+        activeServer = undefined;
+    }
+    if (activeDir) {
+        fs.rmSync(activeDir, { recursive: true, force: true });
+        activeDir = undefined;
+    }
+});
+async function startTestServer(overrides = {}) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-review-ui-test-"));
+    activeDir = dir;
+    const eventsPath = path.join(dir, "events.jsonl");
+    fs.writeFileSync(eventsPath, "");
+    const token = generateCapabilityToken();
+    const server = http.createServer();
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const port = server.address().port;
+    const ctx = {
+        token,
+        port,
+        eventsPath,
+        html: "<!doctype html><title>pi-review dashboard</title>",
+        staticAssets: { "panel-view.js": { contentType: "text/javascript; charset=utf-8", body: "export const x = 1;" } },
+        pollIntervalMs: 20,
+        ...overrides,
+    };
+    server.on("request", createDashboardRequestListener(ctx));
+    activeServer = server;
+    return { port, token, eventsPath };
+}
+test("dashboard serves the HTML page for a valid capability token", async () => {
+    const { port, token } = await startTestServer();
+    const res = await httpGet(port, `/run/${token}`, { Host: `127.0.0.1:${port}` });
+    assert.equal(res.status, 200);
+    assert.match(res.headers["content-type"] ?? "", /text\/html/);
+    assert.match(res.body, /pi-review dashboard/);
+    assert.equal(res.headers["x-frame-options"], "DENY");
+    assert.match(String(res.headers["content-security-policy"] ?? ""), /frame-ancestors 'none'/);
+});
+test("dashboard rejects an invalid or wrong-length capability token with 404", async () => {
+    const { port, token } = await startTestServer();
+    const wrong = await httpGet(port, `/run/${token}x`, { Host: `127.0.0.1:${port}` });
+    assert.equal(wrong.status, 404);
+    const garbage = await httpGet(port, "/run/not-a-token", { Host: `127.0.0.1:${port}` });
+    assert.equal(garbage.status, 404);
+});
+test("dashboard rejects a non-loopback Host header", async () => {
+    const { port, token } = await startTestServer();
+    const res = await httpGet(port, `/run/${token}`, { Host: "evil.example" });
+    assert.equal(res.status, 400);
+});
+test("dashboard rejects a cross-origin request but allows a missing Origin", async () => {
+    const { port, token } = await startTestServer();
+    const bad = await httpGet(port, `/run/${token}`, { Host: `127.0.0.1:${port}`, Origin: "https://evil.example" });
+    assert.equal(bad.status, 403);
+    const ok = await httpGet(port, `/run/${token}`, { Host: `127.0.0.1:${port}`, Origin: `http://127.0.0.1:${port}` });
+    assert.equal(ok.status, 200);
+    const missing = await httpGet(port, `/run/${token}`, { Host: `127.0.0.1:${port}` });
+    assert.equal(missing.status, 200);
+});
+test("dashboard serves a static asset under the token boundary and 404s unknown assets", async () => {
+    const { port, token } = await startTestServer();
+    const res = await httpGet(port, `/run/${token}/static/panel-view.js`, { Host: `127.0.0.1:${port}` });
+    assert.equal(res.status, 200);
+    assert.match(res.headers["content-type"] ?? "", /javascript/);
+    assert.match(res.body, /export const x/);
+    const missing = await httpGet(port, `/run/${token}/static/does-not-exist.js`, { Host: `127.0.0.1:${port}` });
+    assert.equal(missing.status, 404);
+});
+test("dashboard SSE stream replays existing events then tails new appends in seq order", async () => {
+    const { port, token, eventsPath } = await startTestServer();
+    fs.appendFileSync(eventsPath, `${JSON.stringify({ v: 1, runId: "r1", seq: 1, at: 1, type: "panel.started" })}\n`);
+    fs.appendFileSync(eventsPath, `${JSON.stringify({ v: 1, runId: "r1", seq: 2, at: 2, type: "reviewer.queued" })}\n`);
+    const collecting = collectSse(port, `/run/${token}/events`, { Host: `127.0.0.1:${port}` }, 3);
+    await new Promise((resolve) => setTimeout(resolve, 60));
+    fs.appendFileSync(eventsPath, `${JSON.stringify({ v: 1, runId: "r1", seq: 3, at: 3, type: "reviewer.started" })}\n`);
+    const body = await collecting;
+    assert.match(body, /id: 1\n/);
+    assert.match(body, /id: 2\n/);
+    assert.match(body, /id: 3\n/);
+    assert.match(body, /"type":"panel.started"/);
+    assert.match(body, /"type":"reviewer.started"/);
+});
+test("dashboard SSE stream honors Last-Event-ID and only replays newer events", async () => {
+    const { port, token, eventsPath } = await startTestServer();
+    fs.appendFileSync(eventsPath, `${JSON.stringify({ v: 1, runId: "r1", seq: 1, at: 1, type: "panel.started" })}\n`);
+    fs.appendFileSync(eventsPath, `${JSON.stringify({ v: 1, runId: "r1", seq: 2, at: 2, type: "reviewer.queued" })}\n`);
+    fs.appendFileSync(eventsPath, `${JSON.stringify({ v: 1, runId: "r1", seq: 3, at: 3, type: "reviewer.started" })}\n`);
+    const body = await collectSse(port, `/run/${token}/events`, { Host: `127.0.0.1:${port}`, "Last-Event-ID": "2" }, 1);
+    assert.doesNotMatch(body, /id: 1\n/);
+    assert.doesNotMatch(body, /id: 2\n/);
+    assert.match(body, /id: 3\n/);
+});
+test("dashboard rejects non-GET/HEAD methods", async () => {
+    const { port, token } = await startTestServer();
+    const res = await new Promise((resolve, reject) => {
+        const req = http.request({ host: "127.0.0.1", port, path: `/run/${token}`, method: "POST", headers: { Host: `127.0.0.1:${port}` } }, (r) => {
+            let body = "";
+            r.on("data", (c) => (body += c));
+            r.on("end", () => resolve({ status: r.statusCode ?? 0, headers: r.headers, body }));
+        });
+        req.on("error", reject);
+        req.end();
+    });
+    assert.equal(res.status, 405);
+});
+//# sourceMappingURL=ui-server.test.js.map

package/dist/ui-server.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui-server.test.js","sourceRoot":"","sources":["../src/ui-server.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,aAAa,EACb,eAAe,EACf,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAGxB,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,IAAI,CAAC,uEAAuE,EAAE,GAAG,EAAE;IACjF,MAAM,CAAC,GAAG,uBAAuB,EAAE,CAAC;IACpC,MAAM,CAAC,GAAG,uBAAuB,EAAE,CAAC;IACpC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtB,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC1B,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACtC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iFAAiF,EAAE,GAAG,EAAE;IAC3F,MAAM,KAAK,GAAG,uBAAuB,EAAE,CAAC;IACxC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,KAAK,GAAG,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8EAA8E,EAAE,GAAG,EAAE;IACxF,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,mBAAmB,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yEAAyE,EAAE,GAAG,EAAE;IACnF,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,uBAAuB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACnE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,uBAAuB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACnE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,mBAAmB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,uBAAuB,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACpE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,sBAAsB,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACnE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8DAA8D,EAAE,GAAG,EAAE;IACxE,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACvE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC3E,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAC9D,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,uBAAuB,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IACjF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;IAC/E,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACzC,kBAAkB,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,iCAAiC,CAAC,CAAC;QACjF,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3C,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6EAA6E,EAAE,GAAG,EAAE;IACvF,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,8CAA8C,CAAC,CAAC;AACtE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAC5E,MAAM,KAAK,GAAG,kBAAkB,CAAC,EAAE,EAAE,sBAAsB,CAAC,CAAC;IAC7D,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACnE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAYH,SAAS,OAAO,CAAC,IAAY,EAAE,WAAmB,EAAE,UAAkC,EAAE;IACtF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YACxF,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;YACnC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5F,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,SAAS,UAAU,CAAC,IAAY,EAAE,WAAmB,EAAE,OAA+B,EAAE,SAAiB;IACvG,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YACxF,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,EAAE,IAAI,CAAC,CAAC;YACT,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;gBACnB,IAAI,IAAI,CAAC,CAAC;gBACV,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;oBACtD,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,YAAqC,CAAC;AAC1C,IAAI,SAA6B,CAAC;AAElC,SAAS,CAAC,GAAG,EAAE;IACb,IAAI,YAAY,EAAE,CAAC;QACjB,YAAY,CAAC,mBAAmB,EAAE,CAAC;QACnC,YAAY,CAAC,KAAK,EAAE,CAAC;QACrB,YAAY,GAAG,SAAS,CAAC;IAC3B,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,SAAS,GAAG,SAAS,CAAC;IACxB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,eAAe,CAAC,YAA6C,EAAE;IAC5E,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACzE,SAAS,GAAG,GAAG,CAAC;IAChB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAClD,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,uBAAuB,EAAE,CAAC;IAExC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACnC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IAEzD,MAAM,GAAG,GAA2B;QAClC,KAAK;QACL,IAAI;QACJ,UAAU;QACV,IAAI,EAAE,mDAAmD;QACzD,YAAY,EAAE,EAAE,eAAe,EAAE,EAAE,WAAW,EAAE,gCAAgC,EAAE,IAAI,EAAE,qBAAqB,EAAE,EAAE;QACjH,cAAc,EAAE,EAAE;QAClB,GAAG,SAAS;KACb,CAAC;IACF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,YAAY,GAAG,MAAM,CAAC;IACtB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AACrC,CAAC;AAED,IAAI,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;IAC7E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,QAAQ,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC,CAAC;IAChF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,yBAAyB,CAAC,IAAI,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC;AAC/F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;IACxF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,QAAQ,KAAK,GAAG,EAAE,EAAE,IAAI,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC,CAAC;IACnF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC,CAAC;IACvF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;IAC9D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,QAAQ,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3E,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;IACtF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,QAAQ,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,IAAI,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAChH,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,QAAQ,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,IAAI,EAAE,EAAE,MAAM,EAAE,oBAAoB,IAAI,EAAE,EAAE,CAAC,CAAC;IACnH,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,QAAQ,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC,CAAC;IACpF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;IAClG,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,QAAQ,KAAK,uBAAuB,EAAE,EAAE,IAAI,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC,CAAC;IACrG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,QAAQ,KAAK,2BAA2B,EAAE,EAAE,IAAI,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC,CAAC;IAC7G,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;IAClG,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAC5D,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC;IAClH,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC;IAEpH,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9F,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACxD,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,IAAI,CAAC,CAAC;IAErH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC;IAC9B,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9B,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9B,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9B,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;IACzF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAC5D,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC;IAClH,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC;IACpH,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,IAAI,CAAC,CAAC;IAErH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,QAAQ,KAAK,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,IAAI,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IACpH,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACrC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACrC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;IACxD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CACtB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,IAAI,EAAE,EAAE,EAAE,EAC1G,CAAC,CAAC,EAAE,EAAE;YACJ,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;YACjC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC"}

package/dist/update.d.ts

@@ -1,2 +1,4 @@
+/** Compare numeric semver cores (1.2.3[-tag] → major.minor.patch). Returns -1/0/1. */
+export declare function compareSemver(a: string, b: string): number;
 export declare function runUpdate(): void;
 //# sourceMappingURL=update.d.ts.map

package/dist/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../src/update.ts"],"names":[],"mappings":"AA6BA,wBAAgB,SAAS,IAAI,IAAI,CA4ChC"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../src/update.ts"],"names":[],"mappings":"AAoBA,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAgB1D;AA4BD,wBAAgB,SAAS,IAAI,IAAI,CAkFhC"}

package/dist/update.js

@@ -1,5 +1,6 @@
 import { spawnSync } from "node:child_process";
 import { createRequire } from "node:module";
+import { runUpdateSkill } from "./skill.js";
 const PKG_NAME = "@zephyrdeng/pi-review";
 function getCurrentVersion() {
     const require = createRequire(import.meta.url);
@@ -13,6 +14,26 @@ function getLatestVersion() {
     });
     return result.status === 0 ? result.stdout.trim() : null;
 }
+/** Compare numeric semver cores (1.2.3[-tag] → major.minor.patch). Returns -1/0/1. */
+export function compareSemver(a, b) {
+    const parse = (v) => {
+        const core = v.trim().replace(/^v/i, "").split("-")[0] ?? "";
+        const parts = core.split(".").map((p) => {
+            const n = Number.parseInt(p, 10);
+            return Number.isFinite(n) ? n : 0;
+        });
+        return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];
+    };
+    const pa = parse(a);
+    const pb = parse(b);
+    for (let i = 0; i < 3; i++) {
+        if (pa[i] < pb[i])
+            return -1;
+        if (pa[i] > pb[i])
+            return 1;
+    }
+    return 0;
+}
 function box(lines) {
     const width = Math.max(...lines.map((l) => l.length));
     const pad = (s) => s + " ".repeat(width - s.length);
@@ -22,6 +43,19 @@ function box(lines) {
     const body = lines.map((l) => `│ ${pad(l)} │`).join("\n");
     return `${top}\n${empty}\n${body}\n${empty}\n${bot}\n`;
 }
+function refreshSkill() {
+    const skill = runUpdateSkill();
+    if (!skill.ok) {
+        process.stderr.write(box([
+            "Skill refresh failed.",
+            "",
+            "Retry with:",
+            "  pi-review install-skill",
+        ]));
+        return false;
+    }
+    return true;
+}
 export function runUpdate() {
     const current = getCurrentVersion();
     const latest = getLatestVersion();
@@ -29,36 +63,62 @@ export function runUpdate() {
         process.stderr.write(box(["Failed to fetch latest version from npm registry"]));
         process.exit(1);
     }
-    if (current === latest) {
+    const cmp = compareSemver(current, latest);
+    let packageLine;
+    if (cmp === 0) {
+        packageLine = `Package already up to date (v${current})`;
         process.stdout.write(box([
             `pi-review v${current}`,
             "",
-            "Already up to date ✓",
+            "Package already up to date ✓",
+            "Refreshing agent skill...",
         ]));
-        return;
     }
-    process.stdout.write(box([
-        `Update available: ${current} → ${latest}`,
-        "",
-        "Updating...",
-    ]));
-    const install = spawnSync("npm", ["install", "-g", `${PKG_NAME}@latest`], {
-        encoding: "utf8",
-        stdio: "inherit",
-        timeout: 60_000,
-    });
-    if (install.status !== 0) {
-        process.stderr.write(box([
-            "Update failed. Run manually:",
+    else if (cmp > 0) {
+        // Local/dev build is ahead of the registry — do not reinstall @latest (would downgrade).
+        packageLine = `Local v${current} is newer than npm v${latest}`;
+        process.stdout.write(box([
+            packageLine,
             "",
-            `npm install -g ${PKG_NAME}@latest`,
+            "Skipping package install (would downgrade)",
+            "Refreshing agent skill...",
+        ]));
+    }
+    else {
+        process.stdout.write(box([
+            `Update available: ${current} → ${latest}`,
+            "",
+            "Updating package...",
+        ]));
+        const install = spawnSync("npm", ["install", "-g", `${PKG_NAME}@latest`], {
+            encoding: "utf8",
+            stdio: "inherit",
+            timeout: 60_000,
+        });
+        if (install.status !== 0) {
+            process.stderr.write(box([
+                "Update failed. Run manually:",
+                "",
+                `npm install -g ${PKG_NAME}@latest`,
+            ]));
+            process.exit(1);
+        }
+        packageLine = `Package updated: ${current} → ${latest}`;
+        process.stdout.write(box([
+            packageLine,
+            "",
+            "Refreshing agent skill...",
         ]));
-        process.exit(1);
     }
+    // skills CLI pulls latest skill content from the source repo; the direct
+    // fallback copies from this package tree (refreshed on disk after npm -g).
+    const skillOk = refreshSkill();
     process.stdout.write(box([
-        `Updated: ${current} → ${latest}`,
+        packageLine,
+        skillOk ? "Skill refreshed ✓" : "Skill refresh failed",
         "",
-        "Done ✓",
+        skillOk ? "Done ✓" : "Package ok; skill needs manual install-skill",
     ]));
+    process.exit(skillOk ? 0 : 1);
 }
 //# sourceMappingURL=update.js.map

package/dist/update.js.map

@@ -1 +1 @@
-{"version":3,"file":"update.js","sourceRoot":"","sources":["../src/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,QAAQ,GAAG,uBAAuB,CAAC;AAEzC,SAAS,iBAAiB;IACxB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE;QAC7D,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,SAAS,GAAG,CAAC,KAAe;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,GAAG,GAAG,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK,GAAG,IAAI,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IAEpC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,CAAC;QAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;YACvB,cAAc,OAAO,EAAE;YACvB,EAAE;YACF,sBAAsB;SACvB,CAAC,CAAC,CAAC;QACJ,OAAO;IACT,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;QACvB,qBAAqB,OAAO,MAAM,MAAM,EAAE;QAC1C,EAAE;QACF,aAAa;KACd,CAAC,CAAC,CAAC;IAEJ,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,QAAQ,SAAS,CAAC,EAAE;QACxE,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;YACvB,8BAA8B;YAC9B,EAAE;YACF,kBAAkB,QAAQ,SAAS;SACpC,CAAC,CAAC,CAAC;QACJ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;QACvB,YAAY,OAAO,MAAM,MAAM,EAAE;QACjC,EAAE;QACF,QAAQ;KACT,CAAC,CAAC,CAAC;AACN,CAAC"}
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../src/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,QAAQ,GAAG,uBAAuB,CAAC;AAEzC,SAAS,iBAAiB;IACxB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;IAC9D,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE;QAC7D,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,KAAK,GAAG,CAAC,CAAS,EAAY,EAAE;QACpC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACtC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,CAAC,CAAE,GAAG,EAAE,CAAC,CAAC,CAAE;YAAE,OAAO,CAAC,CAAC,CAAC;QAC/B,IAAI,EAAE,CAAC,CAAC,CAAE,GAAG,EAAE,CAAC,CAAC,CAAE;YAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,GAAG,CAAC,KAAe;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,GAAG,GAAG,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK,GAAG,IAAI,CAAC;AACzD,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,CAAC;YACF,uBAAuB;YACvB,EAAE;YACF,aAAa;YACb,2BAA2B;SAC5B,CAAC,CACH,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IAEpC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,CAAC;QAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,WAAmB,CAAC;IAExB,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,WAAW,GAAG,gCAAgC,OAAO,GAAG,CAAC;QACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,CAAC;YACF,cAAc,OAAO,EAAE;YACvB,EAAE;YACF,8BAA8B;YAC9B,2BAA2B;SAC5B,CAAC,CACH,CAAC;IACJ,CAAC;SAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACnB,yFAAyF;QACzF,WAAW,GAAG,UAAU,OAAO,uBAAuB,MAAM,EAAE,CAAC;QAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,CAAC;YACF,WAAW;YACX,EAAE;YACF,4CAA4C;YAC5C,2BAA2B;SAC5B,CAAC,CACH,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,CAAC;YACF,qBAAqB,OAAO,MAAM,MAAM,EAAE;YAC1C,EAAE;YACF,qBAAqB;SACtB,CAAC,CACH,CAAC;QAEF,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,QAAQ,SAAS,CAAC,EAAE;YACxE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,CAAC;gBACF,8BAA8B;gBAC9B,EAAE;gBACF,kBAAkB,QAAQ,SAAS;aACpC,CAAC,CACH,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,WAAW,GAAG,oBAAoB,OAAO,MAAM,MAAM,EAAE,CAAC;QACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,CAAC;YACF,WAAW;YACX,EAAE;YACF,2BAA2B;SAC5B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAE/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,CAAC;QACF,WAAW;QACX,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,sBAAsB;QACtD,EAAE;QACF,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,8CAA8C;KACpE,CAAC,CACH,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC"}

package/dist/update.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=update.test.d.ts.map

package/dist/update.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.test.d.ts","sourceRoot":"","sources":["../src/update.test.ts"],"names":[],"mappings":""}

package/dist/update.test.js

@@ -0,0 +1,17 @@
+import assert from "node:assert/strict";
+import { test } from "vitest";
+import { compareSemver } from "./update.js";
+test("compareSemver orders patch/minor/major", () => {
+    assert.equal(compareSemver("0.7.1", "0.8.0"), -1);
+    assert.equal(compareSemver("0.8.0", "0.7.1"), 1);
+    assert.equal(compareSemver("0.8.0", "0.8.0"), 0);
+    assert.equal(compareSemver("1.0.0", "0.9.9"), 1);
+    assert.equal(compareSemver("v0.8.0", "0.8.0"), 0);
+});
+test("compareSemver treats update direction as current → latest only when latest is newer", () => {
+    const current = "0.7.1";
+    const latest = "0.8.0";
+    assert.ok(compareSemver(current, latest) < 0, "registry newer → should upgrade");
+    assert.ok(compareSemver(latest, current) > 0, "local newer → must not install @latest");
+});
+//# sourceMappingURL=update.test.js.map

package/dist/update.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.test.js","sourceRoot":"","sources":["../src/update.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,IAAI,CAAC,wCAAwC,EAAE,GAAG,EAAE;IAClD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qFAAqF,EAAE,GAAG,EAAE;IAC/F,MAAM,OAAO,GAAG,OAAO,CAAC;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,iCAAiC,CAAC,CAAC;IACjF,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,wCAAwC,CAAC,CAAC;AAC1F,CAAC,CAAC,CAAC"}