codex-copilot-dx 0.9.18 → 0.9.19

package/README.md

@@ -68,6 +68,8 @@ The dashboard does not poll in the background; refresh when needed.
   expose it to the public internet. The dashboard is not an authentication wall
   for the API. Diagnostic errors may contain sensitive upstream text.
 
+Startup checks GitHub Releases, not npm, and suggests `ccdx update github` when a newer stable version is available. GitHub updates install the exact release tag; dependency downloads still use npm's configured registry.
+
 See the [complete command/configuration reference](https://github.com/DaleXiao/codex-copilot-dx/blob/main/docs/REFERENCE.md)
 for authentication recovery, configuration-write boundaries, advanced limits,
 logging, image setup and client compatibility details.

package/bin/cli.mjs

@@ -307,7 +307,7 @@ async function printUpdateNotice() {
     const { latestVersion, updateAvailable } = await checkForUpdate({ currentVersion: LOCAL_VERSION });
     if (!updateAvailable) return;
     console.log(`\n  ${status("warn", `Update available: ${LOCAL_VERSION} -> ${latestVersion}`)}`);
-    console.log("  npm install -g codex-copilot-dx@latest\n");
+    console.log(`  Run ${CLI_NAME} update github to update, then restart ${CLI_NAME}.\n`);
   } catch {
     // Never block startup on the update check.
   }
@@ -315,8 +315,10 @@ async function printUpdateNotice() {
 
 try {
   assertSafeAdapterHost(ADAPTER_HOST, process.env);
-  void runInBackground(printUpdateNotice);
+  const updateNotice = runInBackground(printUpdateNotice);
   if (await reuseRunningAdapterIfAvailable()) {
+    // Ready is already displayed; finish the bounded check before this short-lived CLI exits.
+    await updateNotice;
     await LOGGING.cleanup();
     process.exit(0);
   }

package/docs/README.md

@@ -15,6 +15,7 @@ These reports record a specific release and test environment. Their version,
 test counts, timings, live-provider observations, and limitations remain
 historical facts rather than current guarantees.
 
+- [0.9.19: GitHub startup checks and stable-release updates](RELEASE_0.9.19.md)
 - [0.9.13: model-bound Auto-review reasoning selection](RELEASE_0.9.13.md)
 - [0.9.12: GPT-6.1 Sol / low Auto-review default](RELEASE_0.9.12.md)
 - [0.9.11: bounded usage-summary cache and diagnostic redaction](RELEASE_0.9.11.md)

package/docs/REFERENCE.md

@@ -230,7 +230,11 @@ ccdx update npm
 ccdx update github
 ```
 
-`ccdx update gh` is accepted as shorthand for the GitHub source. The npm source installs `codex-copilot-dx@latest` through the registry already configured for npm, including a company mirror. The GitHub source installs the latest commit from `DaleXiao/codex-copilot-dx` `main` and opts in to Git fetching only for that command. It does not change npm's persistent `allow-git` setting.
+Normal startup checks the latest stable GitHub Release once in the background, without accessing the npm registry. The anonymous check requires no PAT or Copilot credentials, has a two-second deadline and a bounded response body, and silently skips network errors, rate limits and invalid metadata. It never falls back to npm, retries, polls, installs an update or restarts the service. When a newer release is found, it prints the versions and `ccdx update github`. On adapter reuse, Ready is displayed before waiting for any remaining check budget so the short-lived command does not lose its notification.
+
+`ccdx update gh` is accepted as shorthand for the GitHub source. The npm source installs `codex-copilot-dx@latest` through the registry already configured for npm, including a company mirror. The GitHub source queries the latest stable published Release (ten-second deadline), validates its version tag, and installs that exact tag from `DaleXiao/codex-copilot-dx`, not `main`. Lookup failure stops before installation, without an npm fallback. It opts in to Git fetching only for that command and does not change npm's persistent `allow-git` setting.
+
+GitHub is the package source, not a replacement for the npm installer. Dependencies such as `sharp` may still need the configured npm registry during an explicit update; use a company-approved mirror/cache where required. GitHub updates do not promise an entirely registry-free installation.
 
 If a configured npm mirror has not synchronized the current release yet, use the GitHub source. A running adapter keeps its loaded version until it is stopped and restarted.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-copilot-dx",
-  "version": "0.9.18",
+  "version": "0.9.19",
   "description": "Use Codex App with GitHub Copilot",
   "author": "Dale Xiao",
   "type": "module",

package/src/cli-options.mjs

@@ -356,7 +356,7 @@ function topicHelp(name, topic) {
     "disable-image": `Usage:\n  ${name} disable-image\n\nDisables the local CCDX image tool and removes its stored API credential and unmodified CCDX image guidance.`,
     "image-status": `Usage:\n  ${name} image-status\n\nShows provider configuration and probes local image-tool readiness without generating an image or exposing its API key.`,
     "auto-review-model": `Usage:\n  ${name} auto-review-model\n\nSelect a Responses model, then an advertised reasoning effort. Enter keeps the default/current choice; q cancels both steps without saving. Effort 0 follows the client (low when omitted). Settings apply only to Auto-review on the next request; no client patch or restart is required for adapters running 0.9.13 or newer.`,
-    update: `Usage:\n  ${name} update [npm|github]\n\nUpdates the global package from the configured npm registry or GitHub main. With no source, an interactive terminal prompts for one.`,
+    update: `Usage:\n  ${name} update [npm|github]\n\nUpdates the global package from the configured npm registry or the latest stable GitHub release. With no source, an interactive terminal prompts for one.`,
     version: `Usage:\n  ${name} --version`,
   };
   return sections[topic];

package/src/package-update.mjs

@@ -1,10 +1,11 @@
 import { spawn } from "node:child_process";
 import { createInterface } from "node:readline/promises";
+import { fetchLatestRelease, githubReleaseVersion } from "./version.mjs";
 
 const PACKAGE_NAME = "codex-copilot-dx";
 const UPDATE_SPECS = {
   npm: `${PACKAGE_NAME}@latest`,
-  github: "github:DaleXiao/codex-copilot-dx#main",
+  github: "github:DaleXiao/codex-copilot-dx",
 };
 
 export function normalizeUpdateSource(value) {
@@ -13,12 +14,16 @@ export function normalizeUpdateSource(value) {
   return Object.hasOwn(UPDATE_SPECS, source) ? source : "";
 }
 
-export function globalUpdateCommand(source, { platform = process.platform } = {}) {
+export function globalUpdateCommand(source, { platform = process.platform, releaseTag } = {}) {
   const normalized = normalizeUpdateSource(source);
   if (!normalized) throw new Error(`Update source must be npm or github: ${source}`);
   const args = ["install", "--global"];
-  if (normalized === "github") args.push("--allow-git=all");
-  args.push(UPDATE_SPECS[normalized]);
+  if (normalized === "github") {
+    if (!githubReleaseVersion(releaseTag)) throw new Error("A valid stable GitHub release tag is required");
+    args.push("--allow-git=all", `${UPDATE_SPECS.github}#${releaseTag}`);
+  } else {
+    args.push(UPDATE_SPECS[normalized]);
+  }
   return {
     command: platform === "win32" ? "npm.cmd" : "npm",
     args,
@@ -52,6 +57,7 @@ export async function runPackageUpdateCommand({
   prompt,
   source,
   spawnImpl = spawn,
+  fetchImpl = fetch,
 } = {}) {
   let selectedSource = normalizeUpdateSource(source);
   if (source && !selectedSource) throw new Error(`Update source must be npm or github: ${source}`);
@@ -63,7 +69,7 @@ export async function runPackageUpdateCommand({
 
     output.write(`${commandName} update\n`);
     output.write("  1. npm registry [default]\n");
-    output.write("  2. GitHub main\n");
+    output.write("  2. GitHub release\n");
 
     let readline;
     const ask = prompt || (async (question) => {
@@ -86,8 +92,14 @@ export async function runPackageUpdateCommand({
     }
   }
 
-  const update = globalUpdateCommand(selectedSource, { platform });
-  const sourceLabel = selectedSource === "npm" ? "npm registry" : "GitHub main";
+  let release;
+  if (selectedSource === "github") {
+    output.write("Checking the latest stable GitHub release...\n");
+    release = await fetchLatestRelease({ fetchImpl, timeoutMs: 10000 });
+    if (!release) throw new Error("Could not read the latest stable GitHub release. No update was installed.");
+  }
+  const update = globalUpdateCommand(selectedSource, { platform, releaseTag: release?.tagName });
+  const sourceLabel = selectedSource === "npm" ? "npm registry" : `GitHub release ${release.tagName}`;
   output.write(`Updating ${PACKAGE_NAME} from ${sourceLabel}...\n`);
   const child = spawnImpl(update.command, update.args, {
     env,

package/src/version.mjs

@@ -2,7 +2,8 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
-const REGISTRY_LATEST_URL = "https://registry.npmjs.org/codex-copilot-dx/latest";
+const GITHUB_LATEST_RELEASE_URL = "https://api.github.com/repos/DaleXiao/codex-copilot-dx/releases/latest";
+const MAX_RELEASE_BYTES = 256 * 1024;
 
 export function localPackageVersion() {
   const here = path.dirname(fileURLToPath(import.meta.url));
@@ -29,17 +30,62 @@ export function isVersionGreater(a, b) {
   return false;
 }
 
-export async function fetchLatestVersion({ fetchImpl = fetch, timeoutMs = 2000 } = {}) {
+export function githubReleaseVersion(tag) {
+  if (typeof tag !== "string" || tag.length > 64) return null;
+  const match = /^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(tag);
+  if (!match || !match.slice(1).every((part) => Number.isSafeInteger(Number(part)))) return null;
+  return match.slice(1).join(".");
+}
+
+async function readReleaseJson(response, signal) {
+  const reader = response.body?.getReader?.();
+  if (!reader) throw new Error("GitHub release response has no readable body");
+  const cancel = () => { void reader.cancel().catch(() => {}); };
+  signal.addEventListener("abort", cancel, { once: true });
+  const chunks = [];
+  let bytes = 0;
+  let complete = false;
+  try {
+    if (Number(response.headers?.get?.("content-length")) > MAX_RELEASE_BYTES) {
+      throw new Error("GitHub release response is too large");
+    }
+    while (!signal.aborted) {
+      const { done, value } = await reader.read();
+      if (done) {
+        complete = true;
+        break;
+      }
+      bytes += value.byteLength;
+      if (bytes > MAX_RELEASE_BYTES) throw new Error("GitHub release response is too large");
+      chunks.push(Buffer.from(value));
+    }
+    if (signal.aborted) throw new Error("GitHub release request timed out");
+    return JSON.parse(Buffer.concat(chunks, bytes).toString("utf8"));
+  } finally {
+    signal.removeEventListener("abort", cancel);
+    if (!complete) cancel();
+    reader.releaseLock();
+  }
+}
+
+export async function fetchLatestRelease({ fetchImpl = fetch, timeoutMs = 2000 } = {}) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    const resp = await fetchImpl(REGISTRY_LATEST_URL, {
-      headers: { Accept: "application/json" },
+    const resp = await fetchImpl(GITHUB_LATEST_RELEASE_URL, {
+      headers: { Accept: "application/vnd.github+json", "User-Agent": "codex-copilot-dx" },
+      redirect: "error",
       signal: controller.signal,
     });
-    if (!resp.ok) return null;
-    const data = await resp.json();
-    return typeof data.version === "string" ? data.version : null;
+    if (!resp.ok) {
+      void resp.body?.cancel?.().catch(() => {});
+      return null;
+    }
+    const data = await readReleaseJson(resp, controller.signal);
+    const version = githubReleaseVersion(data?.tag_name);
+    return version && data.draft === false && data.prerelease === false
+      ? { version, tagName: data.tag_name }
+      : null;
   } catch {
     return null;
   } finally {
@@ -47,6 +93,10 @@ export async function fetchLatestVersion({ fetchImpl = fetch, timeoutMs = 2000 }
   }
 }
 
+export async function fetchLatestVersion(options) {
+  return (await fetchLatestRelease(options))?.version || null;
+}
+
 export async function checkForUpdate({ currentVersion = localPackageVersion(), fetchImpl, timeoutMs } = {}) {
   const latestVersion = await fetchLatestVersion({ fetchImpl, timeoutMs });
   return {