codebase-snapshot 0.9.4 → 0.9.6

package/CHANGELOG.md

@@ -21,6 +21,90 @@ Two versions exist on the registry that are not releases, and both are deprecate
 Deleting them requires account-level rights that the release pipeline does not have, so they are
 deprecated with an explanatory message instead. `latest` has pointed at 0.9.0 since it existed.
 
+## 0.9.6
+
+### It tells you when it is out of date
+
+The tool's claim is that you can prove a thing is current, so it now asks that about itself. After
+a command finishes, if a newer release is published, it says so on stderr:
+
+```
+↑ codebase-snapshot 0.9.6 is available — you have 0.9.5.
+  npm install -g codebase-snapshot
+```
+
+The constraints matter more than the feature, because this is a network call in a tool people run
+in CI and behind firewalls:
+
+- **One GET, no identifier.** `registry.npmjs.org/codebase-snapshot/latest` and nothing else. The
+  registry learns that some machine ran this version; there is no telemetry, query string or install
+  id.
+- **It never runs where it costs something.** Not when stdout is not a terminal, not in CI, not in
+  any `--format json` invocation, and never in `mcp` — the server still makes no outbound
+  connections at all, which `docs/mcp.md` promises.
+- **It cannot break a command.** A 1.2 s cap, every failure returns null, and a cold cache is a miss
+  rather than an error. The request starts before the command and is awaited after it, so on real
+  work it overlaps entirely and adds no wall time.
+- **One request per machine per day.** A 24 h cache holds the answer; a *failed* check is remembered
+  for one hour, so a single blip neither hides a release for a day nor retries on every run.
+- **Off if you want.** `--no-update-check` or `CODEBASE_SNAPSHOT_NO_UPDATE_CHECK=1`.
+
+### A tool argument that arrived as a string is no longer rejected
+
+Reported from a real client session: the same `snapshot_read` call worked through one code path and
+failed through another because the client serialised `fromLine` as `"1"`. A digit string is the same
+value in a different spelling, and the caller cannot fix what their client did — so numeric fields
+now accept it.
+
+This is not a loosening of validation: only fields the schema declares as numbers are converted, only
+strings that parse to a finite number are converted, and `"ten"` still fails with the type message.
+`"1.5"` for an integer field still fails too.
+
+### Also
+
+- `--no-update-check` is scoped to the commands that can show the notice; it is not accepted by
+  `describe`, `skill` or `mcp`, whose scope would make it a flag that does nothing.
+- The `describe` contract gained the option, and the contract-diff test keeps it in step with the
+  parser.
+
+## 0.9.5
+
+### Every question in the wizard is reversible
+
+The first run asked five questions and accepted one answer each. Reaching the part-size question and
+changing your mind meant killing the process and starting again — and at the review screen,
+answering **No** to "Write this and continue?" threw the same cancellation Ctrl+C does, so "that is
+not what I meant" ended the run instead of correcting it.
+
+- **`←` goes back** on any list or text field, `b` on any list or confirmation. Each footer names
+  the keys that question actually accepts: `text` takes `←` alone (`b` there is a character you are
+  typing) and `confirm` takes `b` alone (`←`/`→` already mean yes/no).
+- **Back is a step, not a restart.** The five questions are now steps — scope → part size →
+  artifacts → credentials → review. Going back re-asks the previous one with your earlier answer
+  still selected, and back from the first step returns to *"How should I set this up?"* rather than
+  out of the wizard.
+- **`No` at the review steps back.** It used to abort. Ctrl+C is still how you say stop.
+- **Answers are rebuilt, not mutated.** Re-entering the scope step clears the globs it added, so
+  choosing "skip tests", going back, and choosing "everything" no longer leaves `**/*.test.*` in
+  the written config.
+
+Four new tests drive real keypress events through a fake TTY, alongside the four that already
+covered the forward path.
+
+### A clean first run
+
+Setup printed a Node `DEP0190` deprecation warning after installing dependencies: `spawnSync` was
+given an args array *and* `shell: true`, which Node deprecated because the arguments are
+concatenated rather than escaped. The Windows path now hands the shell one pre-formed command
+string — both halves are fixed literals from `detectPackageManager` — and every other platform
+spawns with no shell at all.
+
+### Still untested here
+
+The MCP server has not been run against a real client. Its protocol is exercised against the built
+binary, but a client's own configuration, timeouts and approval prompts are theirs. That is the next
+thing to check, not something this release proves.
+
 ## 0.9.4
 
 ### The snapshot is now something an agent can ask for

package/README.md

@@ -188,6 +188,9 @@ to trust it.
 Exit codes: `0` success · `1` drift, refused generation, or nothing to snapshot · `2` usage error,
 or a first run with no terminal and no `--autopilot`.
 
+Once a day it checks the npm registry for a newer release and mentions it on stderr — skipped in CI,
+in any `--format json` run, and in `mcp`. Turn it off with `--no-update-check`.
+
 → [Full CLI reference](https://github.com/ankurhalder/codebase-snapshot/blob/main/docs/cli.md)
 
 ## For AI agents
@@ -197,7 +200,7 @@ Everything an agent needs is available as data, and the tool can install its own
 ```bash
 npx codebase-snapshot describe --format json   # contract: workflow, options, exit codes
 npx codebase-snapshot skill --install          # into .claude/skills + .cursor/rules
-npx -y codebase-snapshot@0.9.4 mcp             # or serve it over MCP
+npx -y codebase-snapshot@0.9.6 mcp             # or serve it over MCP
 ```
 
 An agent told only "use `npx codebase-snapshot`" can read the contract, follow its ordered