ework-aio 0.3.7 → 0.3.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-aio",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "All-in-one installer for ework (issue tracker) + ework-daemon (AI bridge) + opencode-ework (plugin). One command: npm i -g ework-aio && ework-aio install.",
   "type": "module",
   "license": "MIT",
@@ -46,8 +46,8 @@
     "postinstall": "echo '\\n  ework-aio installed. Run \\033[1mework-aio install\\033[0m to set up services.\\n  Help: ework-aio --help\\n'"
   },
   "dependencies": {
-    "ework-web": "^0.4.0",
     "ework-daemon": "^0.2.0",
+    "ework-web": "^0.4.2",
     "opencode-ework": "^0.1.0",
     "zod": "^3.23.0"
   },

package/src/commands/install.ts

@@ -24,7 +24,7 @@ import { resolvePaths, type PathConfig } from "../paths.ts";
 import { type InstallContext } from "../config.ts";
 import { ensureEnvFile, parseEnvFile, patchEnvKey } from "../env.ts";
 import { startProcess, isProcessRunning, readPidFile } from "../pidfile.ts";
-import { checkPreflight, resolveCommand, resolveBundledBin, ensureSelfBinSymlink, REQUIRED_COMMANDS } from "../preflight.ts";
+import { checkPreflight, resolveCommand, resolveBundledBin, ensureSelfBinSymlink, isDevRepo, REQUIRED_COMMANDS } from "../preflight.ts";
 import {
   generateUnitFile,
   writeUnitFile,
@@ -107,6 +107,10 @@ export async function runInstall(
 
   ensureSelfBinSymlink(logger);
 
+  if (isDevRepo()) {
+    logger.warn("running from dev checkout — bundled deps may differ from published versions. For production use 'npm install -g ework-aio' instead.");
+  }
+
   // 2. Resolve ework-web / ework-daemon binaries.
   //
   // ework-daemon ships TWO bins: `ework-daemon` (client CLI: status/issues/...)

package/src/preflight.ts

@@ -70,11 +70,23 @@ export function checkPreflight(
 export const REQUIRED_COMMANDS: readonly string[] = ["bun", "npm", "opencode"];
 export const OPTIONAL_COMMANDS: readonly string[] = ["systemctl", "sudo"];
 
+export function isDevRepo(): boolean {
+  const pkgRoot = path.resolve(import.meta.dir, "..");
+  return fs.existsSync(path.join(pkgRoot, ".git"));
+}
+
 // Ensure `ework-aio` is reachable from PATH. npm puts the bin at its own
 // global prefix's bin dir, which may differ from every dir on PATH (e.g.
 // prefix changed after a node upgrade). Walk PATH in order and, at the
 // first writable dir, create/repair a symlink to our actual bin.
+//
+// Skip when running from a dev checkout (detected via .git dir in package
+// root). A dev-repo symlink would shadow the npm global install and pin the
+// user to stale bundled deps — exactly the bug where `upgrade` pulls latest
+// but `restart` still runs 0.1.0 from the dev repo's node_modules.
 export function ensureSelfBinSymlink(logger: Logger): void {
+  if (isDevRepo()) return;
+
   const ourBin = path.resolve(import.meta.dir, "..", "bin", "ework-aio");
   if (!fs.existsSync(ourBin)) return;
   const ourBinReal = fs.realpathSync(ourBin);