aiden-runtime 4.1.5 → 4.5.0

package/dist/core/v4/update/checkUpdate.js

@@ -38,12 +38,17 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.compareVersions = compareVersions;
+exports.updateCacheFile = updateCacheFile;
 exports.checkForUpdate = checkForUpdate;
 exports.formatUpdateLine = formatUpdateLine;
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
 const REGISTRY_URL = 'https://registry.npmjs.org/aiden-runtime/latest';
-const CACHE_TTL_MS = 6 * 60 * 60 * 1000; // 6 h
+// v4.5 update system — TTL bumped 6h → 24h per spec. The old 6h
+// supported the firstRun loud-warn UX; the new interactive boot
+// prompt makes the prompt itself the prominent surface, so we can
+// relax the refresh cadence.
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 const REGISTRY_TIMEOUT_MS = 4000;
 /** Cache file path. Co-located with other Aiden home dotfiles. */
 function defaultCacheFile(paths) {
@@ -109,6 +114,28 @@ async function writeCache(file, cache) {
         /* swallow — cache write is best-effort */
     }
 }
+/**
+ * v4.5 update system — public cache writer for the skip-state +
+ * release-notes machinery. `mutate` receives the current cache
+ * (or a fresh empty shell when none exists) and returns the new
+ * cache content; this function persists. Used by:
+ *
+ *   - `/update skip <v>` slash command (writes skippedVersion)
+ *   - boot prompt path (writes skippedVersion on 'n')
+ *   - registry probe path (writes releaseNotes / releaseUrl)
+ *
+ * Never throws — best-effort I/O.
+ */
+async function updateCacheFile(paths, mutate) {
+    const file = defaultCacheFile(paths);
+    const current = (await readCache(file)) ?? {
+        ts: 0,
+        latest: null,
+        installed: '',
+    };
+    const next = mutate(current);
+    await writeCache(file, next);
+}
 /** Default fetch wrapper with a 4-second AbortController timeout. */
 async function defaultFetch(url) {
     const controller = new AbortController();
@@ -152,6 +179,7 @@ async function checkForUpdate(opts) {
             updateAvailable: false,
             fromCache: false,
             firstRun: false,
+            skipped: false,
         };
     }
     const cacheFile = opts.cacheFile ?? defaultCacheFile(opts.paths);
@@ -161,12 +189,22 @@ async function checkForUpdate(opts) {
     const firstRun = cached === null;
     if (cached && now - cached.ts < ttl && cached.installed === installed) {
         const updateAvailable = cached.latest !== null && safeCompare(cached.latest, installed) > 0;
+        // v4.5 — surface skip-state lazily so the boot prompt can decide
+        // whether to render the box at all. The compare is cheap; we
+        // avoid pulling skipState.ts module-level to keep this file's
+        // dep graph minimal.
+        const skipped = typeof cached.skippedVersion === 'string' &&
+            cached.latest !== null &&
+            safeCompare(cached.skippedVersion, cached.latest) >= 0;
         return {
             installed,
             latest: cached.latest,
             updateAvailable,
             fromCache: true,
             firstRun: false,
+            releaseNotes: cached.releaseNotes,
+            releaseUrl: cached.releaseUrl,
+            skipped,
         };
     }
     let latest = null;
@@ -178,9 +216,31 @@ async function checkForUpdate(opts) {
     catch {
         latest = null;
     }
-    await writeCache(cacheFile, { ts: now, latest, installed });
+    // v4.5 — preserve skippedVersion + release-notes across cache
+    // refreshes. The fresh probe overwrites the {ts, latest, installed}
+    // triple; everything else carries forward from the prior cache.
+    await writeCache(cacheFile, {
+        ts: now,
+        latest,
+        installed,
+        releaseNotes: cached?.releaseNotes,
+        releaseUrl: cached?.releaseUrl,
+        skippedVersion: cached?.skippedVersion,
+    });
     const updateAvailable = latest !== null && safeCompare(latest, installed) > 0;
-    return { installed, latest, updateAvailable, fromCache: false, firstRun };
+    const skipped = typeof cached?.skippedVersion === 'string' &&
+        latest !== null &&
+        safeCompare(cached.skippedVersion, latest) >= 0;
+    return {
+        installed,
+        latest,
+        updateAvailable,
+        fromCache: false,
+        firstRun,
+        releaseNotes: cached?.releaseNotes,
+        releaseUrl: cached?.releaseUrl,
+        skipped,
+    };
 }
 /** Wrap `compareVersions` so unparseable strings don't blow up the boot path. */
 function safeCompare(a, b) {

package/dist/core/v4/update/installMethodDetect.js

@@ -0,0 +1,115 @@
+"use strict";
+/**
+ * Copyright (c) 2026 Shiva Deore (Taracod).
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ *
+ * Aiden — local-first agent.
+ */
+/**
+ * core/v4/update/installMethodDetect.ts — v4.5 update system.
+ *
+ * Identify how the user installed Aiden so the update path can do
+ * the right thing without false promises:
+ *
+ *   npm-global        — `npm install -g aiden-runtime`
+ *                       → run `npm install -g aiden-runtime@<v>`
+ *   npm-local         — local install in a project's node_modules
+ *                       → run `npm install aiden-runtime@<v>` in that
+ *                          project (printed to user; we don't dispatch
+ *                          a project-local install from the global path)
+ *   npx               — running via `npx aiden-runtime`
+ *                       → tell user to re-run with the new version pinned
+ *   standalone-binary — packaged binary (aiden-releases artefact)
+ *                       → point at the GitHub releases page
+ *   unknown           — fallback: print the install command verbatim
+ *
+ * Pure detection logic — no I/O, no spawning. Caller dispatches.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectInstallMethod = detectInstallMethod;
+const node_path_1 = __importDefault(require("node:path"));
+const NPX_CACHE_HINT = /[/\\]_npx[/\\]/;
+const NPM_GLOBAL_HINTS = [
+    /[/\\]npm[/\\]node_modules[/\\]aiden-runtime\b/,
+    /[/\\]npm-global[/\\]/,
+    /[/\\]\.nvm[/\\]versions[/\\]node[/\\][^/\\]+[/\\]lib[/\\]node_modules\b/,
+    /Program Files[/\\]nodejs[/\\]node_modules[/\\]aiden-runtime\b/i,
+];
+function inferDirs(input) {
+    return {
+        execPath: input.execPath ?? process.execPath,
+        moduleDir: input.moduleDir ?? (typeof __dirname === 'string' ? __dirname : ''),
+        argvScript: input.argvScript ?? (process.argv[1] ?? ''),
+    };
+}
+/**
+ * Pure detection. Order matters — npx and standalone-binary are
+ * checked first because they have distinctive path markers; npm
+ * variants are detected by their node_modules location.
+ */
+function detectInstallMethod(input = {}) {
+    const { moduleDir, argvScript } = inferDirs(input);
+    const platform = input.platform ?? process.platform;
+    const env = input.env ?? process.env;
+    void platform;
+    // npx — running from npm's npx cache directory.
+    if (NPX_CACHE_HINT.test(moduleDir) || NPX_CACHE_HINT.test(argvScript)) {
+        return {
+            method: 'npx',
+            inProcessInstallSupported: false,
+            description: 'running via npx (no installed copy to update)',
+            updateCommand: (v) => `npx aiden-runtime@${v}    # re-run the CLI with the pinned version`,
+        };
+    }
+    // Standalone binary — env var set by the release scripts when
+    // packaging via pkg / nexe / similar. Future-proof; no current
+    // releases set it, so we don't accidentally classify a normal
+    // node install as standalone.
+    if (env.AIDEN_STANDALONE_BINARY === '1') {
+        return {
+            method: 'standalone-binary',
+            inProcessInstallSupported: false,
+            description: 'standalone binary install (not from npm)',
+            updateCommand: (_v) => 'Download the latest release from https://github.com/taracodlabs/aiden/releases',
+        };
+    }
+    // npm-global — moduleDir / argvScript live under a global
+    // node_modules path.
+    const haystack = `${moduleDir} ${argvScript}`;
+    if (NPM_GLOBAL_HINTS.some((rx) => rx.test(haystack))) {
+        return {
+            method: 'npm-global',
+            inProcessInstallSupported: true,
+            description: 'global npm install (aiden-runtime)',
+            updateCommand: (v) => `npm install -g aiden-runtime@${v}`,
+        };
+    }
+    // npm-local — `node_modules/aiden-runtime/` somewhere in the
+    // moduleDir's ancestry but NOT under npm/global paths above.
+    if (/[/\\]node_modules[/\\]aiden-runtime\b/.test(moduleDir) ||
+        /[/\\]node_modules[/\\]aiden-runtime\b/.test(argvScript)) {
+        // Walk up to find the project root (parent of `node_modules`).
+        const idx = moduleDir.search(/[/\\]node_modules[/\\]aiden-runtime\b/);
+        const projectRoot = idx >= 0 ? moduleDir.slice(0, idx) : '<project>';
+        return {
+            method: 'npm-local',
+            inProcessInstallSupported: false,
+            description: `local npm install in project (${node_path_1.default.basename(projectRoot)})`,
+            updateCommand: (v) => `cd ${projectRoot} && npm install aiden-runtime@${v}`,
+        };
+    }
+    // Unknown — fallback to the verbatim global-install command. The
+    // user sees it; we don't spawn. Most accurate default for a
+    // fresh `npx tsx cli/v4/aidenCLI.ts` dev-mode invocation, which
+    // is also the path the maintainer (and many CI environments)
+    // use day-to-day.
+    return {
+        method: 'unknown',
+        inProcessInstallSupported: false,
+        description: 'install method not detected (running from source?)',
+        updateCommand: (v) => `npm install -g aiden-runtime@${v}    # if installed via npm, otherwise see docs`,
+    };
+}

package/dist/core/v4/update/registryClient.js

@@ -0,0 +1,121 @@
+"use strict";
+/**
+ * Copyright (c) 2026 Shiva Deore (Taracod).
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ *
+ * Aiden — local-first agent.
+ */
+/**
+ * core/v4/update/registryClient.ts — v4.5 update system.
+ *
+ * Q-U1(c) two-source strategy:
+ *
+ *   1. npm registry — `registry.npmjs.org/aiden-runtime/latest` →
+ *      `{ version, dist.tarball, _id, ... }`. No auth, fast, the
+ *      authoritative source for "what's the newest published version".
+ *
+ *   2. GitHub releases — `api.github.com/repos/taracodlabs/aiden/
+ *      releases/latest` → rich markdown body for the user-facing
+ *      "What's new" line. Optional; falls through gracefully when
+ *      anonymous-rate-limited or the repo doesn't mirror npm tags.
+ *
+ * Both fetches share a 4-second timeout per request. Network failure
+ * on either side returns null rather than throwing — the boot prompt
+ * just won't include release-notes context when we couldn't fetch it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchUpdateInfo = fetchUpdateInfo;
+exports.firstLineOf = firstLineOf;
+const NPM_REGISTRY_URL = 'https://registry.npmjs.org/aiden-runtime/latest';
+const GITHUB_RELEASES_URL = 'https://api.github.com/repos/taracodlabs/aiden/releases/latest';
+const REGISTRY_TIMEOUT_MS = 4000;
+/**
+ * Probe both sources in parallel. Returns whatever succeeded; either
+ * (or both) may be null on network failure.
+ */
+async function fetchUpdateInfo(opts = {}) {
+    const npmFetch = opts.npmFetch ?? (() => defaultNpmFetch(opts.timeoutMs));
+    const githubFetch = opts.githubFetch ?? (() => defaultGithubFetch(opts.timeoutMs));
+    const [probe, notes] = await Promise.all([
+        npmFetch().catch(() => null),
+        githubFetch().catch(() => null),
+    ]);
+    return { probe, notes };
+}
+// ── Default fetchers ──────────────────────────────────────────────────────
+async function defaultNpmFetch(timeoutMs = REGISTRY_TIMEOUT_MS) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetch(NPM_REGISTRY_URL, {
+            headers: {
+                Accept: 'application/json',
+                'User-Agent': 'aiden-runtime update check',
+            },
+            signal: controller.signal,
+        });
+        if (!res.ok)
+            return null;
+        const json = (await res.json());
+        if (typeof json.version !== 'string')
+            return null;
+        return {
+            version: json.version,
+            tarballUrl: typeof json.dist?.tarball === 'string' ? json.dist.tarball : undefined,
+        };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function defaultGithubFetch(timeoutMs = REGISTRY_TIMEOUT_MS) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetch(GITHUB_RELEASES_URL, {
+            headers: {
+                Accept: 'application/vnd.github+json',
+                'User-Agent': 'aiden-runtime update check',
+            },
+            signal: controller.signal,
+        });
+        // 404 = repo doesn't expose releases yet; 403 = anonymous rate limit.
+        // Both → null + boot proceeds without notes.
+        if (!res.ok)
+            return null;
+        const json = (await res.json());
+        if (typeof json.tag_name !== 'string')
+            return null;
+        const body = typeof json.body === 'string' ? json.body : '';
+        return {
+            tag: json.tag_name,
+            url: typeof json.html_url === 'string' ? json.html_url : '',
+            blurb: firstLineOf(body, 120),
+        };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** First non-blank line of a multi-line string, truncated to maxChars. */
+function firstLineOf(text, maxChars) {
+    if (typeof text !== 'string' || text.length === 0)
+        return '';
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        // Skip markdown heading lines (`## What's new` etc.) so the blurb
+        // is actually descriptive prose, not a section heading.
+        if (line.length === 0 || line.startsWith('#'))
+            continue;
+        if (line.length <= maxChars)
+            return line;
+        return line.slice(0, maxChars - 1) + '…';
+    }
+    return '';
+}

package/dist/core/v4/update/skipState.js

@@ -0,0 +1,75 @@
+"use strict";
+/**
+ * Copyright (c) 2026 Shiva Deore (Taracod).
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ *
+ * Aiden — local-first agent.
+ */
+/**
+ * core/v4/update/skipState.ts — v4.5 update system.
+ *
+ * Persistent "user said no thanks to this update" memory. Q-U7(b)
+ * semantics: a single `skippedVersion` slot meaning "stop nagging
+ * about THIS version; resume when something newer ships."
+ *
+ *   Store: 4.5.1     → prompt for 4.5.1 suppressed
+ *                       prompt for 4.5.2 fires (4.5.2 > 4.5.1)
+ *
+ * Per-version-list (skip multiple specific versions) is v4.6
+ * polish if real usage shows people want it.
+ *
+ * Storage: piggyback on the existing `.update_check.json` cache so
+ * we don't add a second dotfile. The cache file already lives at
+ * `<aiden-home>/.update_check.json` (created by checkUpdate.ts).
+ *
+ * Pure module — every function takes the cache content as input
+ * and returns the new content. The actual disk read/write stays
+ * inside checkUpdate.ts to keep one source of truth for the cache
+ * lifecycle.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isVersionSkipped = isVersionSkipped;
+exports.applySkip = applySkip;
+exports.clearSkip = clearSkip;
+const checkUpdate_1 = require("./checkUpdate");
+/**
+ * Is `latest` suppressed by the user's prior skip choice?
+ *
+ *   skip empty           → never suppress
+ *   skip = latest        → suppress
+ *   skip < latest        → don't suppress (newer version available)
+ *   skip > latest        → suppress (defensive — user already passed
+ *                          this version; treat as still-skipped)
+ *
+ * Returns false when either input is empty/unparseable — never
+ * silently swallow a "should-have-prompted".
+ */
+function isVersionSkipped(skippedVersion, latest) {
+    if (!skippedVersion || !latest)
+        return false;
+    try {
+        const cmp = (0, checkUpdate_1.compareVersions)(skippedVersion, latest);
+        return cmp >= 0;
+    }
+    catch {
+        // Unparseable version on either side → fail safe to "not skipped"
+        // so the user gets the prompt rather than silent suppression.
+        return false;
+    }
+}
+/**
+ * Update the cache content with a fresh skipped version. Pure —
+ * caller persists.
+ */
+function applySkip(cache, version) {
+    return { ...cache, skippedVersion: version };
+}
+/**
+ * Clear the skipped-version slot — user typed `/update auto on` or
+ * explicitly opted back in. Pure.
+ */
+function clearSkip(cache) {
+    const next = { ...cache };
+    delete next.skippedVersion;
+    return next;
+}