bdy 1.23.15-dev-target-commands → 1.23.16-dev-target-commands

package/distTs/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bdy",
   "preferGlobal": false,
-  "version": "1.23.15-dev-target-commands",
+  "version": "1.23.16-dev-target-commands",
   "type": "commonjs",
   "license": "MIT",
   "homepage": "https://buddy.works/docs/cli",

package/distTs/src/agent/manager.js

@@ -161,6 +161,10 @@ class AgentManagerClass {
             }
             const current = (0, utils_1.getVersion)();
             const latest = await (0, utils_1.getLatestVersion)();
+            // Equality only, deliberately not "is latest newer": this runs on an explicit remote
+            // update action, whose meaning is "match what the channel publishes". Refusing an
+            // older latest would take away the only rollback the fleet has - moving the channel
+            // pointer back after a bad release.
             if (!latest || latest === '0.0.0' || latest === current) {
                 logger_1.default.info((0, texts_1.LOG_AGENT_UPDATE_NOT_NEEDED)(current));
                 // Nothing to do is not a failure, and showing it as one would make an update of
@@ -174,12 +178,15 @@ class AgentManagerClass {
             // - this is the value that stays behind if the restart never lands.
             this.agent?.reportUpdateStatus(tunnel_1.TUNNEL_AGENT_UPDATE_STATUS.STARTED);
             this.agent?.flushUpdateStatus();
-            const target = latest.match(/^\d+\.\d+\.\d+/);
+            // getLatestVersion already refuses a version it cannot parse, so this is belt and
+            // braces - kept because the download url is built from the triple, and shipping a
+            // malformed one would fail much further away from the cause.
+            const target = (0, utils_1.parseVersion)(latest);
             if (!target) {
                 logger_1.default.error(texts_1.LOG_AGENT_UPDATE_FAILED);
                 return report(tunnel_1.TUNNEL_AGENT_UPDATE_STATUS.FAILED);
             }
-            const swapped = await this.system.swapBinaryToVersion(target[0]);
+            const swapped = await this.system.swapBinaryToVersion(target.version);
             if (!swapped) {
                 logger_1.default.error((0, texts_1.LOG_AGENT_UPDATE_BINARY_INVALID)(latest));
                 return report(tunnel_1.TUNNEL_AGENT_UPDATE_STATUS.FAILED);

package/distTs/src/api/client.js

@@ -249,6 +249,12 @@ class ApiClient {
             }
         }
         else if (status === 204) {
+            // A no-content success still honors the raw-output contracts: callers
+            // stream the (empty) body instead of tripping over a null.
+            if (rawResponse)
+                return response;
+            if (rawResponseBody)
+                return responseBody;
             await responseBody.dump();
             return null;
         }
@@ -1247,11 +1253,20 @@ class ApiClient {
                 query += '&';
             query += encodeURIComponent(key) + '=' + encodeURIComponent(value);
         });
-        return await this.request({
+        const resolved = await this.request({
             method: 'GET',
             path: `/workspaces/${encodeURIComponent(workspace)}/identifiers${query}`,
             parseResponseBody: true,
         });
+        // A queried project must itself resolve: for some resources
+        // (environments, artifacts, distributions) the endpoint otherwise falls
+        // back to the workspace resource of the same identifier, silently
+        // answering for a different scope than asked (TARGET_API_REQUIREMENTS.md
+        // p6). project_identifier is present whenever the project exists.
+        if (params.project && !resolved.project_identifier) {
+            throw new Error(texts_1.ERR_PROJECT_NOT_FOUND);
+        }
+        return resolved;
     }
     async resolveIdentifiers(workspace, params) {
         let query = '';

package/distTs/src/command/api/request.js

@@ -159,14 +159,15 @@ const request = async (method, url, options) => {
         output_1.default.exitNormal('');
     }
     else {
-        // setEncoding keeps multibyte characters intact across chunk boundaries,
-        // and newLine=false keeps chunk boundaries out of the payload
+        // setEncoding keeps multibyte characters intact across chunk boundaries;
+        // the response is a 1:1 payload, so it bypasses terminal-kit (whose
+        // formatting corrupts % and ^ sequences, common in URL-encoded data)
         body.setEncoding('utf8');
         body.on('data', (data) => {
-            output_1.default.normal(data, false);
+            output_1.default.data(data, false);
         });
         body.on('close', () => {
-            output_1.default.normal('');
+            output_1.default.data('');
             output_1.default.exitNormal('');
         });
     }

package/distTs/src/command/environment/delete.js

@@ -18,7 +18,8 @@ commandEnvironmentDelete.addHelpText('after', `\nEXAMPLES:${texts_1.EXAMPLE_ENVI
 commandEnvironmentDelete.action(async (identifier, options) => {
     const workspace = input_1.default.restApiWorkspace(options.workspace);
     const client = input_1.default.restApiTokenClient();
-    const environment_id = await (0, resolve_1.resolveEnvironmentId)(client, workspace, identifier, options);
+    const environment_id = await (0, resolve_1.resolveEnvironmentId)(client, workspace, identifier, options, 
+    /* strictProject */ true);
     const confirmed = options.force ||
         (await output_1.default.confirm((0, texts_1.TXT_ENVIRONMENT_DELETE_CONFIRM)(identifier)));
     if (!confirmed)

package/distTs/src/command/environment/resolve.js

@@ -11,19 +11,29 @@ const input_1 = __importDefault(require("../../input"));
 // project context from flags/env -> /identifiers -> hash id, exiting on a
 // miss. Without a project the identifier resolves as a workspace
 // environment; with one, along the project line.
-const resolveEnvironmentId = async (client, workspace, identifier, options) => {
+//
+// strictProject is for mutating commands (update/delete): an explicit -p is
+// a statement "the environment of this project", so the resolved environment
+// must actually live there. Without it /identifiers silently falls back to
+// the workspace environment of the same identifier and the write lands on a
+// workspace-wide resource. Reads keep the fallback - that is how workspace
+// environments stay addressable from inside a project context.
+const resolveEnvironmentId = async (client, workspace, identifier, options, strictProject = false) => {
     const project = input_1.default.restApiProject(options.project, true);
     const resolved = await client.getEnvironmentByIdentifier(workspace, identifier, project);
-    // /identifiers falls back to the workspace environment even when the
-    // requested project does not exist - deadly for delete/update, which
-    // would then hit the workspace resource. A provided project must itself
-    // resolve.
-    if (project && !resolved.project_identifier) {
-        output_1.default.exitError(texts_1.ERR_PROJECT_NOT_FOUND);
-    }
+    // A nonexistent project is rejected by the API client
+    // (getResourceByIdentifier); here only the environment itself can miss.
     if (!resolved.environment_id) {
         output_1.default.exitError(texts_1.ERR_ENVIRONMENT_NOT_FOUND);
     }
+    if (strictProject && options.project) {
+        const environment = await client.getEnvironment(workspace, resolved.environment_id);
+        // a workspace environment carries no project, so this also fails the
+        // workspace-fallback case
+        if (environment.project?.name !== resolved.project_identifier) {
+            output_1.default.exitError(texts_1.ERR_ENVIRONMENT_NOT_FOUND);
+        }
+    }
     return resolved.environment_id;
 };
 exports.resolveEnvironmentId = resolveEnvironmentId;

package/distTs/src/command/environment/update.js

@@ -52,7 +52,8 @@ commandEnvironmentUpdate.action(async (identifier, options) => {
         output_1.default.exitError(texts_1.ERR_COMMAND_NO_UPDATE);
     }
     const client = input_1.default.restApiTokenClient();
-    const environment_id = await (0, resolve_1.resolveEnvironmentId)(client, workspace, identifier, options);
+    const environment_id = await (0, resolve_1.resolveEnvironmentId)(client, workspace, identifier, options, 
+    /* strictProject */ true);
     const result = await client.updateEnvironment(workspace, environment_id, body);
     output_1.default.exitSuccess((0, texts_1.TXT_ENVIRONMENT_UPDATED)(result.identifier, result.html_url));
 });

package/distTs/src/command/pre.js

@@ -46,14 +46,15 @@ const commandPre = async (_, command) => {
     if (!output_1.default.isTTY() || command.hideVersionUpdate || ['json', 'jsonl'].includes(command.opts()?.format)) {
         return;
     }
-    const newCli = !!command.latestVersion && command.currentVersion !== command.latestVersion;
-    const newAgent = !!command.agentStatus && !!command.latestVersion &&
-        command.agentStatus.version !== command.latestVersion;
-    if ((0, utils_1.isDocker)() && newCli && command.latestVersion) {
-        output_1.default.newCliDockerVersion(command.latestVersion);
-    }
-    else if (newCli && command.latestVersion) {
-        output_1.default.newCliVersion(command.latestVersion);
+    // No truthiness guards on the versions: an empty or unparsable one is never newer
+    const latest = command.latestVersion || '';
+    const newCli = (0, utils_1.isVersionNewer)(latest, command.currentVersion || '');
+    const newAgent = !!command.agentStatus && (0, utils_1.isVersionNewer)(latest, command.agentStatus.version);
+    if ((0, utils_1.isDocker)() && newCli) {
+        output_1.default.newCliDockerVersion(latest);
+    }
+    else if (newCli) {
+        output_1.default.newCliVersion(latest);
     }
     else if (newAgent) {
         output_1.default.newAgentVersion();

package/distTs/src/command/project/git/credential.js

@@ -60,10 +60,12 @@ commandProjectGitCredential.action(async (action) => {
                     projects.projects[0].html_url.includes(input.host);
         }
         if (myHost) {
-            output_1.default.normal(`protocol=${input.protocol || 'https'}`);
-            output_1.default.normal(`host=${input.host}`);
-            output_1.default.normal(`username=${client.token}`);
-            output_1.default.normal(`password=`);
+            // git credential protocol output - a machine-read payload, so it
+            // bypasses terminal-kit formatting
+            output_1.default.data(`protocol=${input.protocol || 'https'}`);
+            output_1.default.data(`host=${input.host}`);
+            output_1.default.data(`username=${client.token}`);
+            output_1.default.data(`password=`);
         }
     }
     catch {

package/distTs/src/command/sandbox/exec/command.js

@@ -43,7 +43,7 @@ commandSandboxExecCommand.action(async (identifier, command, options) => {
                     str.forEach((s) => {
                         const json = JSON.parse(s);
                         if (json.data)
-                            output_1.default.normal(json.data);
+                            output_1.default.data(json.data);
                     });
                 }
                 catch {

package/distTs/src/command/sandbox/exec/logs.js

@@ -31,7 +31,7 @@ commandSandboxExecLogs.action(async (identifier, commandId, options) => {
                 str.forEach((s) => {
                     const json = JSON.parse(s);
                     if (json.data)
-                        output_1.default.normal(json.data);
+                        output_1.default.data(json.data);
                 });
             }
             catch {

package/distTs/src/command/target/delete.js

@@ -20,7 +20,8 @@ commandTargetDelete.addHelpText('after', `\nEXAMPLES:${texts_1.EXAMPLE_TARGET_DE
 commandTargetDelete.action(async (identifier, options) => {
     const workspace = input_1.default.restApiWorkspace(options.workspace);
     const client = input_1.default.restApiTokenClient();
-    const target_id = await (0, scope_1.resolveTargetId)(client, workspace, identifier, options);
+    const target_id = await (0, scope_1.resolveTargetId)(client, workspace, identifier, options, 
+    /* strictLine */ true);
     const confirmed = options.force || (await output_1.default.confirm((0, texts_1.TXT_TARGET_DELETE_CONFIRM)(identifier)));
     if (!confirmed)
         output_1.default.exitNormal();

package/distTs/src/command/target/exec/command.js

@@ -41,7 +41,8 @@ commandTargetExecCommand.action(async (identifier, command, options) => {
     }
     const workspace = input_1.default.restApiWorkspace(options.workspace);
     const client = input_1.default.restApiTokenClient();
-    const target_id = await (0, scope_1.resolveTargetId)(client, workspace, identifier, options);
+    const target_id = await (0, scope_1.resolveTargetId)(client, workspace, identifier, options, 
+    /* strictLine */ true);
     let exec = await client.executeTargetCommand(workspace, target_id, {
         command: cmd,
     });

package/distTs/src/command/target/scope.js

@@ -10,14 +10,42 @@ const output_1 = __importDefault(require("../../output"));
 const input_1 = __importDefault(require("../../input"));
 // Shared resolve preamble for commands taking a target identifier: line
 // context from flags/env -> /identifiers -> hash id, exiting on a miss.
-const resolveTargetId = async (client, workspace, identifier, options) => {
+//
+// strictLine is for mutating commands (update/delete/exec command): an
+// explicit line flag is a statement "the target of this project/pipeline/
+// environment", yet /identifiers falls back to the workspace target of the
+// same identifier when the requested line exists but does not hold it - the
+// operation would silently land on a workspace-wide resource. Reads keep
+// the fallback (workspace targets stay addressable from a line context).
+const resolveTargetId = async (client, workspace, identifier, options, strictLine = false) => {
     const project = input_1.default.restApiProject(options.project, true);
     const line = input_1.default.targetLine(project, options.pipeline, options.environment);
-    const { target_id } = await client.getTargetByIdentifier(workspace, identifier, line);
-    if (!target_id) {
+    const resolved = await client.getTargetByIdentifier(workspace, identifier, line);
+    if (!resolved.target_id) {
         output_1.default.exitError(texts_1.ERR_TARGET_NOT_FOUND);
     }
-    return target_id;
+    if (strictLine) {
+        const requested = options.pipeline
+            ? utils_1.TARGET_SCOPE.PIPELINE
+            : options.environment
+                ? utils_1.TARGET_SCOPE.ENVIRONMENT
+                : options.project
+                    ? utils_1.TARGET_SCOPE.PROJECT
+                    : null;
+        if (requested) {
+            const target = await client.getTarget(workspace, resolved.target_id);
+            const matches = requested === utils_1.TARGET_SCOPE.PIPELINE
+                ? String(target.pipeline?.id) === String(resolved.pipeline_id)
+                : requested === utils_1.TARGET_SCOPE.ENVIRONMENT
+                    ? target.environment?.id === resolved.environment_id
+                    : (0, exports.targetScopeOf)(target) === utils_1.TARGET_SCOPE.PROJECT &&
+                        target.project?.name === resolved.project_identifier;
+            if (!matches) {
+                output_1.default.exitError(texts_1.ERR_TARGET_NOT_FOUND);
+            }
+        }
+    }
+    return resolved.target_id;
 };
 exports.resolveTargetId = resolveTargetId;
 // Lines the CLI requests per log fetch.
@@ -96,12 +124,7 @@ const resolveTargetScope = async (client, workspace, project, scope, options) =>
         if (project)
             query.project = project;
         const resolved = await client.getResourceByIdentifier(workspace, query);
-        // /identifiers falls back to the workspace environment even when the
-        // requested project does not exist; a provided project must itself
-        // resolve or the scope would silently point elsewhere.
-        if (project && !resolved.project_identifier) {
-            output_1.default.exitError(texts_1.ERR_PROJECT_NOT_FOUND);
-        }
+        // a nonexistent project is rejected by getResourceByIdentifier itself
         if (!resolved.environment_id) {
             output_1.default.exitError(texts_1.ERR_TARGET_ENVIRONMENT_NOT_FOUND);
         }

package/distTs/src/command/target/update.js

@@ -21,7 +21,8 @@ commandTargetUpdate.action(async (identifier, options) => {
     const yaml = input_1.default.restApiYaml(options.yaml);
     const workspace = input_1.default.restApiWorkspace(options.workspace);
     const client = input_1.default.restApiTokenClient();
-    const target_id = await (0, scope_1.resolveTargetId)(client, workspace, identifier, options);
+    const target_id = await (0, scope_1.resolveTargetId)(client, workspace, identifier, options, 
+    /* strictLine */ true);
     const body = {
         yaml: Buffer.from(yaml, 'utf8').toString('base64'),
     };

package/distTs/src/command/version.js

@@ -78,7 +78,7 @@ commandVersion.action(async () => {
     const currVersion = commandVersion.currentVersion || '';
     const lastVersion = commandVersion.latestVersion || '';
     const env = commandVersion.env || '';
-    if (currVersion !== lastVersion) {
+    if ((0, utils_1.isVersionNewer)(lastVersion, currVersion)) {
         const platform = (0, utils_1.getPlatform)();
         const isMac = platform === 'darwin';
         const isWin = platform === 'win32';

package/distTs/src/command/yaml.js

@@ -8,11 +8,9 @@ const texts_1 = require("../texts");
 const pipeline_1 = __importDefault(require("./yaml/pipeline"));
 const actions_1 = __importDefault(require("./yaml/actions"));
 const validate_1 = __importDefault(require("./yaml/validate"));
-const init_1 = __importDefault(require("./yaml/init"));
 const commandYaml = (0, utils_1.newCommand)('yaml', texts_1.DESC_COMMAND_YAML);
 commandYaml.addCommand(pipeline_1.default);
 commandYaml.addCommand(actions_1.default);
 commandYaml.addCommand(validate_1.default);
-commandYaml.addCommand(init_1.default);
-commandYaml.addHelpText('after', texts_1.EXAMPLE_YAML);
+commandYaml.addHelpText('after', `\nEXAMPLES:${texts_1.EXAMPLE_YAML}`);
 exports.default = commandYaml;

package/distTs/src/index.js

@@ -16,7 +16,14 @@ process.title = 'bdy';
 for (const s of [process.stdout, process.stderr]) {
     s._handle?.setBlocking?.(true);
 }
+// The cost of blocking mode: a reader that closes early (`bdy ... | head`)
+// turns further writes into EPIPE errors, which surface here as uncaught
+// exceptions. That is the reader saying "got enough", not a failure - end
+// quietly like any well-behaved pipe writer.
+const isEpipe = (err) => err?.code === 'EPIPE' || err?.cause?.code === 'EPIPE';
 process.on('uncaughtException', (err) => {
+    if (isEpipe(err))
+        process.exit(0);
     logger_1.default.fatal(err);
     output_1.default.exitError(err);
 });

package/distTs/src/output/pipeline.js

@@ -1191,7 +1191,9 @@ class OutputPipeline {
                         this.jsonLog(logs[actionLogsStart]);
                     }
                     else {
-                        output_1.default.normal(output_1.default.getTermKitDimColor(`  ${logs[actionLogsStart]}`));
+                        // log lines are payload inside markup - escape so % and ^
+                        // sequences in build output render verbatim
+                        output_1.default.normal(output_1.default.getTermKitDimColor(`  ${output_1.default.escapeTermKit(logs[actionLogsStart])}`));
                     }
                 }
                 if (action &&
@@ -1221,9 +1223,9 @@ class OutputPipeline {
                             let line = '';
                             if (i > 0)
                                 line += '                ';
-                            line += output_1.default.getTermKitMutedColor(v.key);
+                            line += output_1.default.getTermKitMutedColor(output_1.default.escapeTermKit(v.key));
                             line += output_1.default.getTermKitDimColor(` = "`);
-                            line += output_1.default.getTermKitBlueColor(v.value);
+                            line += output_1.default.getTermKitBlueColor(output_1.default.escapeTermKit(v.value));
                             line += output_1.default.getTermKitDimColor('"');
                             output_1.default.normal(line);
                         });

package/distTs/src/output.js

@@ -136,9 +136,18 @@ class Output {
     }
     // Payload output (command results, logs, JSON): bypasses terminal-kit,
     // whose printf-style formatting and ^-markup corrupt data containing
-    // % or ^ sequences.
-    static data(txt) {
-        process.stdout.write(`${txt}\n`);
+    // % or ^ sequences. newLine=false emits a mid-stream chunk, keeping
+    // chunk boundaries out of the payload.
+    static data(txt, newLine = true) {
+        process.stdout.write(newLine ? `${txt}\n` : txt);
+    }
+    // For payload embedded in terminal-kit markup (e.g. a dimmed log line):
+    // neutralizes the ^-markup and %-formatting the payload would otherwise
+    // trigger, so it renders verbatim while the surrounding markup still
+    // works. Only for strings printed via terminal() - ScreenBuffer.put does
+    // not printf-format, so there %% would render double.
+    static escapeTermKit(txt) {
+        return txt.replace(/[%^]/g, '$&$&');
     }
     static writeStderr(txt) {
         process.stderr.write(`${txt}\n`);

package/distTs/src/utils.js

@@ -37,7 +37,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getRootDir = exports.TARGET_ONLY_PORT_REGEX = exports.TARGET_HTTP_REGEX = exports.TARGET_TCP_TLS_REGEX = exports.ApiErrorTunnelsDisabled = exports.ApiErrorWorkspaceFlagged = exports.ApiErrorTunnelLimitReached = exports.ApiErrorAgentLimitReached = exports.ApiErrorDomainRestricted = exports.ApiErrorTargetInvalid = exports.ApiErrorWrongToken = exports.ApiErrorFailedToConnect = exports.ApiErrorAgentNotFound = exports.ARTIFACT_AUTH_TYPE = exports.TARGET_EXEC_STATUS = exports.TARGET_SCOPE = exports.ARTIFACT_TYPE = exports.SANDBOX_SNAPSHOT_STATUS = exports.SANDBOX_APP_STATUS = exports.SANDBOX_SETUP_STATUS = exports.SANDBOX_EXEC_STATUS = exports.SANDBOX_EXEC_RUNTIME = exports.SANDBOX_STATUS = exports.REST_API_ENDPOINT = exports.REST_API_REGION = exports.DEFAULT_SANDBOX_CP_USER = exports.ARTIFACT_DEFAULT_VERSION = exports.SUGGESTED_BROWSER_VERSION = exports.AGENT_UPDATE_STATUS_TTL_MS = exports.AGENT_UPDATE_PROBATION_MS = exports.AGENT_UPDATE_MAX_ATTEMPTS = exports.AGENT_FETCH_RETRY_MAX = exports.AGENT_FETCH_RETRY_MIN = exports.SSH_HANDSHAKE_TIMEOUT = exports.DEFAULT_TIMEOUT = exports.getSshIdent = exports.TUNNEL_SSH_IDENT_SHARED_H2 = exports.TUNNEL_CLIENT_IP_HEADER = exports.TUNNEL_HTTP2_SHED_LOG_INTERVAL = exports.TUNNEL_HTTP2_MAX_SESSIONS = exports.TUNNEL_HTTP2_SESSION_IDLE_TIMEOUT = exports.TUNNEL_HTTP_RETRY_AFTER = exports.TUNNEL_HTTP_MAX_INFLIGHT = exports.TUNNEL_HTTP_CB_MIN_REQUESTS = exports.TUNNEL_HTTP_CB_WINDOW = exports.TUNNEL_MAX_REQUEST_SIZE_TO_SYNC = exports.TUNNEL_HTTP_LOG_MAX_REQUESTS = exports.TUNNEL_HTTP_LOG_MAX_BODY = exports.TUNNEL_HTTP_RATE_WINDOW = exports.TUNNEL_HTTP_RATE_LIMIT = void 0;
-exports.getGitName = exports.getGitEmail = exports.MCP_TOOL_CATEGORIES = exports.getBasicCommandTls = exports.getBasicCommandHttp = exports.getBasicCommandSandboxEndpoint = exports.getBasicCommandTcp = exports.getCurrentUser = exports.getServiceUser = exports.getRealTargetHost = exports.isWindows = exports.isLinux = exports.isOsx = exports.isDocker = exports.truncate = exports.sleep = exports.getLatestVersion = exports.getVersionEnv = exports.getCurrentVersionWithoutEnv = exports.getVersionWithoutEnv = exports.getVersion = exports.isInstalledByChoco = exports.isInstalledByApt = exports.isInstalledByBrew = exports.isInstalledByNpm = exports.isNpmGlobalWritable = exports.isPathWritable = exports.tryGetEmail = exports.execLocally = exports.getHomeDirectory = exports.HOME_DIR_NAME = exports.chownToHomeOwner = exports.isDomainAvailable = exports.newCommand = exports.formatBytes = exports.formatHelp = exports.getPlatform = exports.getHostname = exports.isStringRegExp = exports.getWorkingDir = void 0;
+exports.getGitName = exports.getGitEmail = exports.MCP_TOOL_CATEGORIES = exports.getBasicCommandTls = exports.getBasicCommandHttp = exports.getBasicCommandSandboxEndpoint = exports.getBasicCommandTcp = exports.getCurrentUser = exports.getServiceUser = exports.getRealTargetHost = exports.isWindows = exports.isLinux = exports.isOsx = exports.isDocker = exports.truncate = exports.sleep = exports.getLatestVersion = exports.getVersionEnv = exports.getCurrentVersionWithoutEnv = exports.isVersionNewer = exports.getVersionWithoutEnv = exports.parseVersion = exports.getVersion = exports.isInstalledByChoco = exports.isInstalledByApt = exports.isInstalledByBrew = exports.isInstalledByNpm = exports.isNpmGlobalWritable = exports.isPathWritable = exports.tryGetEmail = exports.execLocally = exports.getHomeDirectory = exports.HOME_DIR_NAME = exports.chownToHomeOwner = exports.isDomainAvailable = exports.newCommand = exports.formatBytes = exports.formatHelp = exports.getPlatform = exports.getHostname = exports.isStringRegExp = exports.getWorkingDir = void 0;
 exports.apiErrorCodeToClass = apiErrorCodeToClass;
 exports.isFile = isFile;
 exports.getAppWorkspaceUrl = getAppWorkspaceUrl;
@@ -599,19 +599,44 @@ const getVersion = () => {
     return cachedVersion;
 };
 exports.getVersion = getVersion;
+// The one place that knows what a version string looks like: `x.y.z` optionally followed by
+// a channel suffix. AgentSystem.verifyBinary keeps a regex of its own on purpose - it fishes
+// a version out of selftest output rather than parsing one, so it must not be anchored.
+const parseVersion = (version) => {
+    const m = (version || '').match(/^(\d+)\.(\d+)\.(\d+)/);
+    if (!m)
+        return null;
+    return {
+        version: m[0],
+        major: Number(m[1]),
+        minor: Number(m[2]),
+        patch: Number(m[3]),
+    };
+};
+exports.parseVersion = parseVersion;
 const getVersionWithoutEnv = (version) => {
-    const m = version.match(/^\d+\.\d+\.\d+/);
-    if (m)
-        return m[0];
-    return '0.0.0';
+    return (0, exports.parseVersion)(version)?.version || '0.0.0';
 };
 exports.getVersionWithoutEnv = getVersionWithoutEnv;
+// An update is only an update when the other side is actually ahead. Comparing the strings
+// for inequality also fired on a build that is newer than what the channel publishes - a
+// local dev build, or a machine that got the release before es.buddy.works did - and told
+// the user to "update" to an older version. Both sides carry the same env suffix (latest is
+// fetched per env), so the numeric triple decides.
+const isVersionNewer = (version, than) => {
+    const a = (0, exports.parseVersion)(version);
+    const b = (0, exports.parseVersion)(than);
+    if (!a || !b)
+        return false;
+    if (a.major !== b.major)
+        return a.major > b.major;
+    if (a.minor !== b.minor)
+        return a.minor > b.minor;
+    return a.patch > b.patch;
+};
+exports.isVersionNewer = isVersionNewer;
 const getCurrentVersionWithoutEnv = () => {
-    const v = (0, exports.getVersion)();
-    const m = v.match(/^\d+\.\d+\.\d+/);
-    if (m)
-        return m[0];
-    return '0.0.0';
+    return (0, exports.getVersionWithoutEnv)((0, exports.getVersion)());
 };
 exports.getCurrentVersionWithoutEnv = getCurrentVersionWithoutEnv;
 const getVersionEnv = () => {
@@ -640,10 +665,20 @@ const getLatestVersion = async () => {
         });
         if (response.status === 200) {
             const data = await response.text();
-            const v = data.trim();
+            // A 200 whose body is not a version - a padded value, an error page from something in
+            // front of the bucket - is nothing a caller can act on, so it fails here rather than
+            // downstream, where every comparison would read it as "no update". The parsed triple
+            // is what gets returned, not the body: the regex is unanchored at the end, so a body
+            // that merely starts with a version would otherwise carry its tail into the banners,
+            // the update log and the equality test in AgentManager.remoteUpdate.
+            // Only the agent's remote update surfaces this - `commandPre` swallows it, so the CLI
+            // stays quiet about a channel it could not read.
+            const parsed = (0, exports.parseVersion)(data.trim());
+            if (!parsed)
+                throw new Error(texts_1.ERR_FETCH_VERSION);
             if (env === 'prod')
-                return v;
-            return `${v}-${env}`;
+                return parsed.version;
+            return `${parsed.version}-${env}`;
         }
         else {
             return '0.0.0';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bdy",
   "preferGlobal": false,
-  "version": "1.23.15-dev-target-commands",
+  "version": "1.23.16-dev-target-commands",
   "type": "commonjs",
   "license": "MIT",
   "homepage": "https://buddy.works/docs/cli",