agentic-relay 5.0.0 → 5.0.1

package/README.md

@@ -27,7 +27,9 @@ npx agentic-relay --all --api-key=am_live_xxx
 
 > One package, one command. `agentrelay` with no subcommand runs the installer; `agentrelay <cmd>` (e.g. `search`, `session`, `fetch`) runs the CLI. If the global link can't be created (e.g. an unwritable npm prefix), run `npm i -g agentic-relay` once yourself.
 >
-> **Reinstalling is always a clean, fresh install:** it removes the old global command and reinstalls the current code (from your local checkout when you're developing), rewrites the skill files, and re-checks your cached API key — replacing it only if it's no longer valid. Nothing stale is left behind.
+> **Reinstalling is always a clean, fresh install:** it removes the old global command and reinstalls `agentic-relay@latest` (or your local checkout when you're developing), rewrites the skill files, re-checks your cached API key (replacing it only if it's no longer valid), and clears this package's npx cache entry. Nothing stale is left behind.
+>
+> npx tip: `npx <name>` caches by bare name and won't auto-upgrade. If `npx agentic-relay` ever runs an old version, run `npx agentic-relay@latest` once (or `npm i -g agentic-relay@latest`) — after that the installer keeps itself current.
 
 Don't run `npm install` (as a dependency) — this is a CLI installer, not a library.
 

package/bin/install.mjs

@@ -44,6 +44,7 @@ import {
   globalPrefixWritable,
   npmCacheOwnedByOther,
   dirOnPath,
+  clearNpxCacheFor,
   USER_PREFIX_RECIPE,
   CACHE_CHOWN_RECIPE,
 } from "./lib/sysenv.mjs";
@@ -643,18 +644,15 @@ function getExistingKey() {
  *
  * Install source: from a DEV CHECKOUT (a .git dir next to the package) the
  * local path is installed FIRST so your edits actually go global; a normal
- * published run installs `agentic-relay@<version>` from the registry first, with
- * the path as fallback. Surfaces npm's actual error (EACCES etc.) and verifies
- * the global bin landed. System probes live in lib/sysenv.mjs.
+ * published run installs `agentic-relay@latest` from the registry first, with
+ * the path as fallback. `@latest` (not the running version) matters: a stale
+ * cached npx installer must still land the NEWEST global, not pin its own old
+ * version. Surfaces npm's actual error (EACCES etc.), verifies the global bin
+ * landed, then clears our npx cache entry so the next `npx` is fresh too.
+ * System probes live in lib/sysenv.mjs.
  */
 function linkGlobalCli() {
   const pkgRoot = join(__dirname, "..");
-  let version = null;
-  try {
-    version = JSON.parse(readFileSync(join(pkgRoot, "package.json"), "utf-8")).version;
-  } catch {
-    // unknown version — fall through to the path install
-  }
 
   // Preflight: detect the two environment breakages PROACTIVELY instead of
   // letting `npm install -g` fail with a buried stderr.
@@ -678,11 +676,13 @@ function linkGlobalCli() {
   } catch {}
 
   // Prefer the local path when this is a dev checkout, so local edits actually
-  // reach the global command; otherwise install the published version. Detect a
-  // checkout by the .git dir — a published tarball (incl. an npx run) never has
-  // one. (bin/test/ ships in the package, so it can't be the signal.)
+  // reach the global command; otherwise install @latest. Detect a checkout by
+  // the .git dir — a published tarball (incl. an npx run) never has one.
+  // (bin/test/ ships in the package, so it can't be the signal.) @latest, not
+  // @<version>: if a STALE cached npx installer runs this, it must still land
+  // the newest global rather than re-pinning its own old version.
   const isDevCheckout = existsSync(join(pkgRoot, ".git"));
-  const registrySpec = version ? `agentic-relay@${version}` : "agentic-relay";
+  const registrySpec = "agentic-relay@latest";
   const pathSpec = `"${pkgRoot}"`;
   const attempts = isDevCheckout ? [pathSpec, registrySpec] : [registrySpec, pathSpec];
   let lastErr = null;
@@ -715,6 +715,9 @@ function linkGlobalCli() {
   const shim = globalBinShimPath(prefix, "agentrelay");
   if (shim && existsSync(shim)) {
     success(`linked global \`agentrelay\` CLI (${installedFrom})`);
+    // Drop our stale npx cache entry so the next `npx agentic-relay` re-resolves
+    // the newest version instead of replaying an old cached installer.
+    clearNpxCacheFor("agentic-relay");
     if (!dirOnPath(binDir)) {
       warn(`note: ${binDir} doesn't appear to be on your PATH — add it to use \`agentrelay\` directly`);
       return "linked-offpath";

package/bin/lib/sysenv.mjs

@@ -9,7 +9,7 @@
  *  - npm's global bin dir may not be on the user's PATH
  */
 
-import { existsSync, accessSync, statSync, constants } from "fs";
+import { existsSync, accessSync, statSync, constants, readdirSync, rmSync } from "fs";
 import { homedir } from "os";
 import { join, dirname } from "path";
 import { execSync } from "child_process";
@@ -99,6 +99,32 @@ export function dirOnPath(dir, pathVar = process.env.PATH || "") {
   return pathVar.split(delim).map(norm).includes(norm(dir));
 }
 
+/**
+ * Remove ONLY this package's entries from npm's npx cache, so the next
+ * `npx <pkg>` re-resolves from the registry instead of replaying a stale cached
+ * copy (npx reuses its cache for a bare name and won't auto-upgrade). Scoped to
+ * `<npm cache>/_npx/<hash>` dirs whose node_modules contains pkgName — other
+ * tools' npx caches are left alone. Best-effort; never throws.
+ */
+export function clearNpxCacheFor(pkgName) {
+  try {
+    const cacheDir = execSync("npm config get cache", {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+    if (!cacheDir) return;
+    const npxDir = join(cacheDir, "_npx");
+    if (!existsSync(npxDir)) return;
+    for (const entry of readdirSync(npxDir)) {
+      if (existsSync(join(npxDir, entry, "node_modules", pkgName))) {
+        try {
+          rmSync(join(npxDir, entry), { recursive: true, force: true });
+        } catch {}
+      }
+    }
+  } catch {}
+}
+
 /** The official npm user-level-prefix recipe for EACCES on the global prefix. */
 export const USER_PREFIX_RECIPE = [
   "mkdir -p ~/.npm-global",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-relay",
-  "version": "5.0.0",
+  "version": "5.0.1",
   "description": "Install Agent Relay AI search across 17+ agents — Claude Code, Codex, Cursor, Gemini CLI, Goose, Windsurf, Cline, BoltAI, Claude Desktop, VS Code, Amazon Q, Roo Code, Witsy, LibreChat, OpenClaw, Tome, Raycast — plus the `agentrelay` CLI for live agent sessions and deliverable fetch",
   "bin": {
     "agentrelay": "bin/cli.mjs"