crewbus 10.0.4 → 10.0.6

package/CHANGELOG.md

@@ -4,6 +4,25 @@
 
 - Package is now published as unscoped `crewbus` (v10.0.2): `npm i -g crewbus`.
 
+## 10.0.6 (2026-10-13)
+
+PATCH RELEASE: Dashboard client hotfix. No board-schema change (`board.json` stays v2).
+
+- **Fixed a `SyntaxError` that killed the entire dashboard script block at load**:
+  - The command-palette entry `label:'Install 'crewbus' CLI in PATH'` used `\'` escapes inside the server's template literal, which Node evaluates before serving — browsers received unescaped quotes and refused to parse anything.
+  - Present since the palette landed; first shipped in v10.0.5, so every web/desktop user on 10.0.5 was affected.
+  - Regression test: the suite now fetches `/` and `node --check`s the rendered client script.
+
+## 10.0.5 (2026-10-12)
+
+PATCH RELEASE: Self-update command. No board-schema change (`board.json` stays v2); additive CLI surface only.
+
+- **`crewbus update [--check] [--yes] [--version x.y.z]`**:
+  - Version check via `npm view <own-name>@latest version`, install via `npm install -g` — registry, auth, and proxy come from the user's npm config, never hardcoded.
+  - Package name always read from our own `package.json` (never argv); `--version` accepts strict `x.y.z` only.
+  - `--check` reports only; bare `update` refuses off-TTY without `--yes` (install scripts execute from the network); source checkouts are refused with `git pull` guidance.
+  - Already-latest and newer-than-registry are no-ops; explicit pins allow downgrades; post-install note covers the old-code process restart + `init --force` for wiring.
+
 ## 10.0.4 (2026-10-12)
 
 PATCH RELEASE: Briefs view + gather endpoint, task-scoped spawn rosters, and mobile brief/thread/watcher screens. No board-schema change (`board.json` stays v2); all additions backward-compatible.

package/README.md

@@ -1,4 +1,4 @@
-# crewbus v10.0.4 — DM bus
+# crewbus v10.0.6 — DM bus
 
 [![CI](https://github.com/eamonpluto/crewbus/actions/workflows/ci.yml/badge.svg)](https://github.com/eamonpluto/crewbus/actions/workflows/ci.yml)
 
@@ -55,7 +55,7 @@ env overrides below.)
 Layout: `board.json`, `agents/<name>.json`, `dm/<recipient>/<id>.json`,
 `delivered/<recipient>/<id>.json` (push markers, written by the plugin).
 
-Versions: `package.json` (currently 10.0.4) is the source of truth for the
+Versions: `package.json` (currently 10.0.6) is the source of truth for the
 release version. `board.json`'s `version: 2` is the **board schema version**
 (a different number on purpose — do not "align" them). New to the project?
 Start with `docs/QUICKSTART.md` (5 minutes).

package/bin/crewbus.js

@@ -6326,6 +6326,10 @@ Setup:
     project-local surface (claude/opencode/cursor); codex/grok/antigravity
     are skipped (TOML or global-only surfaces — see docs/COMPATIBILITY.md).
     Nothing else is widened.
+  crewbus update [--check] [--yes] [--version x.y.z]
+    self-update the global npm install to the registry latest
+    (--check reports only; needs --yes off-TTY; runs the published
+    install scripts — same trust as npm i -g crewbus)
 
 Identity (first claim wins, token after that):
   crewbus register --from <you> [--session <opencode-session-id>] [--token <t>] [--expires-in <dur>] [--service]
@@ -7337,6 +7341,107 @@ function cmdInstallCli() {
   }
 }
 
+// Self-update support: which package did this process install as? Read
+// from our own package.json next to bin/crewbus.js — the name is never
+// taken from argv, so there is no `update <other-pkg>` confusion/abuse.
+function ownPackage() {
+  try {
+    const here = path.dirname(path.resolve(process.argv[1] || ""));
+    const pkg = JSON.parse(fs.readFileSync(path.join(here, "..", "package.json"), "utf8"));
+    if (pkg && typeof pkg.name === "string" && typeof pkg.version === "string") {
+      return { name: pkg.name, version: pkg.version, dir: path.resolve(path.join(here, "..")) };
+    }
+  } catch {}
+  return null;
+}
+
+// Zero-dep semver compare (release parts only; prerelease suffixes compare
+// equal — `npm view` reports the latest stable tag, so suffixes never meet
+// in the check path; --version pins accept them verbatim).
+function cmpSemver(a, b) {
+  const parts = (s) => String(s || "").trim().replace(/^[=v]/, "").split(".").map((x) => {
+    const n = Number(String(x).split("-")[0]);
+    return Number.isInteger(n) && n >= 0 ? n : 0;
+  });
+  const pa = parts(a);
+  const pb = parts(b);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] || 0) - (pb[i] || 0);
+    if (d !== 0) return d > 0 ? 1 : -1;
+  }
+  return 0;
+}
+
+function cmdUpdate(args) {
+  const checkOnly = args.includes("--check");
+  const yes = args.includes("--yes");
+  const wantRaw = getFlag(args, "--version");
+  if (wantRaw !== undefined && !/^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/.test(String(wantRaw).trim())) {
+    fail(`--version must be a plain x.y.z version (got "${wantRaw}") — no tags, URLs, or ranges`);
+  }
+  const own = ownPackage();
+  if (!own) fail("cannot determine the installed package (no package.json next to the CLI) — reinstall with: npm i -g crewbus");
+  try {
+    if (fs.existsSync(path.join(own.dir, ".git"))) {
+      fail(`running from a source checkout at ${own.dir} — update it with: git pull (npm would install the registry copy elsewhere; the global CLI is a separate install)`);
+    }
+  } catch (e) {
+    if (e && e.message && e.message.startsWith("running from a source checkout")) throw e;
+  }
+  // The user's own npm: registry, auth, proxy and cache all come from
+  // their npm config — never hardcoded here. shell:true on Windows so the
+  // npm.cmd shim resolves (same convention as probeBinary in lib/launch.js).
+  const npmShell = process.platform === "win32";
+  try {
+    execFileSync("npm", ["--version"], { stdio: ["ignore", "pipe", "pipe"], timeout: 15000, shell: npmShell });
+  } catch {
+    fail("npm was not found on PATH — install Node.js/npm first, or update manually: npm i -g crewbus@latest");
+  }
+  let latest = "";
+  try {
+    latest = String(execFileSync("npm", ["view", `${own.name}@latest`, "version"], { stdio: ["ignore", "pipe", "pipe"], timeout: 30000, shell: npmShell }) || "").trim();
+  } catch {
+    latest = "";
+  }
+  if (!latest) fail(`could not reach the npm registry (offline?) — latest ${own.name} version unknown; retry with network, or install explicitly: npm i -g ${own.name}@<x.y.z>`);
+  const want = wantRaw !== undefined ? String(wantRaw).trim() : latest;
+  const cmp = cmpSemver(own.version, want);
+  if (cmp === 0) {
+    console.log(`crewbus ${own.version} installed${wantRaw !== undefined ? ` (requested ${want})` : `, ${latest} latest`} — already up to date [board n/a]`);
+    return;
+  }
+  if (cmp > 0 && wantRaw === undefined) {
+    console.log(`crewbus ${own.version} installed is newer than registry latest ${latest} (dev install?) — nothing to do [board n/a]`);
+    return;
+  }
+  if (checkOnly) {
+    console.log(`crewbus ${own.version} installed, ${want} available — re-run without --check to update [board n/a]`);
+    return;
+  }
+  const direction = cmp < 0 ? "upgrade" : "downgrade";
+  if (!yes) {
+    if (process.stdin && process.stdin.isTTY) {
+      process.stderr.write(`This ${direction}s ${own.name} ${own.version} → ${want} via "npm install -g" (runs the published package's install scripts). Type "yes" to continue: `);
+      let answer = "";
+      try {
+        answer = String(fs.readFileSync(0, "utf8") || "").trim().toLowerCase();
+      } catch {}
+      if (answer !== "yes" && answer !== "y") fail("update refused (confirmation not given) — re-run with --yes to confirm");
+    } else {
+      fail(`refusing to self-update non-interactively without --yes (npm install -g executes the published package's install scripts) — re-run with --yes to confirm`);
+    }
+  }
+  console.log(`${direction === "upgrade" ? "Updating" : "Downgrading"} ${own.name} ${own.version} → ${want} (npm install -g ${own.name}@${want})…`);
+  try {
+    execFileSync("npm", ["install", "-g", `${own.name}@${want}`], { stdio: "inherit", timeout: 300000, shell: npmShell });
+  } catch (e) {
+    const detail = String((e && e.message) || e);
+    const busy = /EBUSY|EPERM/i.test(detail);
+    fail(`npm install failed: ${detail.slice(0, 300)}${busy ? " — close running crewbus processes (web/serve/listen/watchers holding the install open) and retry" : ""}`);
+  }
+  console.log(`updated to ${want} — this process is still the old code: restart your terminal (and any crewbus web/serve/listen processes), then re-run init --force in your projects to refresh harness wiring [board n/a]`);
+}
+
 async function main() {
   const [, , cmd, ...rest] = process.argv;
   if (REMOVED.has(cmd)) {
@@ -7345,6 +7450,7 @@ async function main() {
   switch (cmd) {
     case "init": return cmdInit(rest);
     case "install-cli": return cmdInstallCli();
+    case "update": return cmdUpdate(rest);
     case "register": return cmdRegister(rest);
     case "acl": return cmdAcl(rest);
     case "agents": return cmdAgents(rest);

package/bin/lib/web.js

@@ -636,7 +636,7 @@ details.tech-details summary{cursor:pointer;font-weight:500;user-select:none}
         <button data-nav="sec-launch" class="active">Launch</button>
         <button data-nav="sec-boards">Boards</button>
         <button data-nav="sec-briefs">Briefs</button>
-        <button data-nav="sec-crews">Crews</button>
+        <button data-nav="sec-crews">Crews</button>
       <button data-nav="sec-fleet">Fleet</button>
       <button data-nav="sec-channels">Channels</button>
       <button data-nav="sec-triage">Triage</button>
@@ -1425,7 +1425,7 @@ function paletteSections(){
     {kind:'action',label:'Copy board path',action:'copyboard'},
     {kind:'action',label:'Open project folder…',action:'openfolder'},
     {kind:'action',label:'Pair mobile client (QR)…',action:'pairmobile'},
-    {kind:'action',label:'Install \'crewbus\' CLI in PATH',action:'installcli'},
+    {kind:'action',label:"Install 'crewbus' CLI in PATH",action:'installcli'},
     {kind:'action',label:'Refresh board state',action:'refresh'},
     {kind:'section',label:'Launch',id:'sec-launch'},
     {kind:'section',label:'Boards',id:'sec-boards'},

package/docs/VERSION_SKEW.md

@@ -1,6 +1,6 @@
 # Version skew (mixed-relay operation)
 
-How crewbus versions interoperate. Evidence: `package.json:2` (`10.0.4`),
+How crewbus versions interoperate. Evidence: `package.json:2` (`10.0.6`),
 `CHANGELOG.md` (10.0.0 2026-10-08; 7.0.0 2026-10-05; 6.4.0–6.0.0; 4.1.0/4.0.0 baseline).
 Capabilities: `RELAY_CAPS` + `launch` per `packages/contracts/board-caps.json:6-8`.
 Cell behavior is the NEW side's verified behavior (`bin/lib/sync.js` refs);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crewbus",
-  "version": "10.0.4",
+  "version": "10.0.6",
   "description": "Zero-dependency message bus for AI coding-agent crews: message another agent, inserted into context, just a tool call.",
   "type": "module",
   "bin": {