codebase-snapshot 0.9.5 → 0.9.7

package/CHANGELOG.md

@@ -21,6 +21,86 @@ Two versions exist on the registry that are not releases, and both are deprecate
 Deleting them requires account-level rights that the release pipeline does not have, so they are
 deprecated with an explanatory message instead. `latest` has pointed at 0.9.0 since it existed.
 
+## 0.9.7
+
+### The setup menu stops eating its own screen
+
+Reported with a screenshot from a terminal about 70 columns wide: every keypress on `snapshot`'s
+first question added another `◆ How should I set this up?` line, until 28 of them were piled above
+the live menu.
+
+The wizard repaints a prompt in place by moving the cursor up by the height of the last frame it
+drew — and it counted that height in *lines*, while a terminal lays out *rows*. The recommended
+answer carries the hint `node-lib · config · npm scripts · install · generate`, which makes that
+line 83 cells wide. In a narrow terminal the terminal wrapped it into two rows itself, so the frame
+was one row taller than the erase believed, and moving up one row short left the top of the old
+frame behind. Every keypress. Notice that the leftover was always exactly one line: the question.
+
+Frames are now wrapped to the visible width before they are drawn, so the height that is counted is
+the height that is shown. Continuation lines keep their indent, a token longer than the line breaks
+rather than overflowing it, and the width is re-read on every draw so a window that changed size is
+measured as it is now rather than as it was. Two cells of slack are left for `◆ ❯ ◻ ←`, which some
+fonts draw double-width.
+
+No existing test could have caught this: every one of them pinned `columns` to 120, where nothing
+wraps and the two counts agree. `tests/wizard-frame.test.js` drives the real wizard at 70, 60 and 50
+columns, replays the escape sequences through a small terminal simulator, and asserts that the
+screen shows one question rather than one per keypress. Putting the old arithmetic back turns three
+of its seven tests red.
+
+### Install pins in the docs are now maintained, not remembered
+
+`docs/mcp.md` told clients to run `codebase-snapshot@0.9.6` in four places that have to change at
+every release, and a comment marker cannot live inside a JSON fence. `sync-docs` now rewrites any
+`codebase-snapshot@x.y.z` pin and the `Added devDependency:` examples by shape, so the next release
+cannot leave a copy-pasteable snippet pointing at an old version. `@latest` is untouched.
+
+## 0.9.6
+
+### It tells you when it is out of date
+
+The tool's claim is that you can prove a thing is current, so it now asks that about itself. After
+a command finishes, if a newer release is published, it says so on stderr:
+
+```
+↑ codebase-snapshot 0.9.6 is available — you have 0.9.5.
+  npm install -g codebase-snapshot
+```
+
+The constraints matter more than the feature, because this is a network call in a tool people run
+in CI and behind firewalls:
+
+- **One GET, no identifier.** `registry.npmjs.org/codebase-snapshot/latest` and nothing else. The
+  registry learns that some machine ran this version; there is no telemetry, query string or install
+  id.
+- **It never runs where it costs something.** Not when stdout is not a terminal, not in CI, not in
+  any `--format json` invocation, and never in `mcp` — the server still makes no outbound
+  connections at all, which `docs/mcp.md` promises.
+- **It cannot break a command.** A 1.2 s cap, every failure returns null, and a cold cache is a miss
+  rather than an error. The request starts before the command and is awaited after it, so on real
+  work it overlaps entirely and adds no wall time.
+- **One request per machine per day.** A 24 h cache holds the answer; a *failed* check is remembered
+  for one hour, so a single blip neither hides a release for a day nor retries on every run.
+- **Off if you want.** `--no-update-check` or `CODEBASE_SNAPSHOT_NO_UPDATE_CHECK=1`.
+
+### A tool argument that arrived as a string is no longer rejected
+
+Reported from a real client session: the same `snapshot_read` call worked through one code path and
+failed through another because the client serialised `fromLine` as `"1"`. A digit string is the same
+value in a different spelling, and the caller cannot fix what their client did — so numeric fields
+now accept it.
+
+This is not a loosening of validation: only fields the schema declares as numbers are converted, only
+strings that parse to a finite number are converted, and `"ten"` still fails with the type message.
+`"1.5"` for an integer field still fails too.
+
+### Also
+
+- `--no-update-check` is scoped to the commands that can show the notice; it is not accepted by
+  `describe`, `skill` or `mcp`, whose scope would make it a flag that does nothing.
+- The `describe` contract gained the option, and the contract-diff test keeps it in step with the
+  parser.
+
 ## 0.9.5
 
 ### Every question in the wizard is reversible

package/README.md

@@ -188,6 +188,9 @@ to trust it.
 Exit codes: `0` success · `1` drift, refused generation, or nothing to snapshot · `2` usage error,
 or a first run with no terminal and no `--autopilot`.
 
+Once a day it checks the npm registry for a newer release and mentions it on stderr — skipped in CI,
+in any `--format json` run, and in `mcp`. Turn it off with `--no-update-check`.
+
 → [Full CLI reference](https://github.com/ankurhalder/codebase-snapshot/blob/main/docs/cli.md)
 
 ## For AI agents
@@ -197,7 +200,7 @@ Everything an agent needs is available as data, and the tool can install its own
 ```bash
 npx codebase-snapshot describe --format json   # contract: workflow, options, exit codes
 npx codebase-snapshot skill --install          # into .claude/skills + .cursor/rules
-npx -y codebase-snapshot@0.9.5 mcp             # or serve it over MCP
+npx -y codebase-snapshot@0.9.7 mcp             # or serve it over MCP
 ```
 
 An agent told only "use `npx codebase-snapshot`" can read the contract, follow its ordered