flowcollab 0.3.17 → 0.3.18

package/bin/_client.mjs

@@ -9,6 +9,7 @@ import 'dotenv/config';
 import { homedir } from 'os';
 import { readFileSync, writeFileSync, mkdirSync, chmodSync, renameSync } from 'fs';
 import { join } from 'path';
+import { get as httpsGet } from 'https';
 
 // On Windows, Node's bundled CA store doesn't include certs added by corporate/AV
 // TLS inspection software, causing fetch() to throw "fetch failed". Re-spawn with
@@ -44,21 +45,31 @@ process.on('exit', () => {
 });
 
 if (!_uc.checkedAt || (Date.now() - _uc.checkedAt) > 86_400_000) {
-  // B21 (audit): AbortSignal.timeout keeps a 4s timer alive that pins the event loop open AFTER the
-  // command is done (up to 4s of dead time on exit). Use a manual controller with an UNREF'd timer so
-  // the process can exit as soon as the real work finishes — the check is fire-and-forget either way.
-  const _uctrl = new AbortController();
-  const _utimer = setTimeout(() => _uctrl.abort(), 4000);
-  _utimer.unref?.();
-  fetch('https://registry.npmjs.org/flowcollab/latest', { signal: _uctrl.signal })
-    .then(r => r.json())
-    .then(({ version: latest }) => {
-      mkdirSync(join(homedir(), '.flow'), { recursive: true });
-      writeFileSync(_updateCache, JSON.stringify({ checkedAt: Date.now(), latest }));
-      _uc = { checkedAt: Date.now(), latest };
-    })
-    .catch(() => {})
-    .finally(() => clearTimeout(_utimer));
+  // B21/CLI-6 (audit): a pending network request pins the event loop open AFTER the command is done.
+  // fetch()'s undici socket can't be unref'd per-request, so use https.get + UNREF the socket — the
+  // request never delays the CLI's exit. Stamp checkedAt SYNCHRONOUSLY first so the 24h gate holds
+  // even for instant commands that exit before the request finishes (else unref'ing would re-check
+  // every run); the request just updates `latest` in the background when it completes.
+  try {
+    mkdirSync(join(homedir(), '.flow'), { recursive: true });
+    writeFileSync(_updateCache, JSON.stringify({ checkedAt: Date.now(), latest: _uc.latest ?? null }));
+  } catch {}
+  try {
+    const _ureq = httpsGet('https://registry.npmjs.org/flowcollab/latest', { headers: { accept: 'application/json' } }, (res) => {
+      if (res.statusCode !== 200) { res.resume(); return; }
+      let buf = '';
+      res.on('data', d => { buf += d; });
+      res.on('end', () => {
+        try {
+          const { version: latest } = JSON.parse(buf);
+          if (latest) { writeFileSync(_updateCache, JSON.stringify({ checkedAt: Date.now(), latest })); _uc = { checkedAt: Date.now(), latest }; }
+        } catch {}
+      });
+    });
+    _ureq.on('socket', s => s.unref?.()); // don't let the update check hold the CLI's exit
+    _ureq.on('error', () => {});
+    _ureq.setTimeout(4000, () => _ureq.destroy());
+  } catch {}
 }
 
 function loadGlobalConfig() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowcollab",
-  "version": "0.3.17",
+  "version": "0.3.18",
   "description": "Multi-Claude coordination layer — shared task board + CLI for teams running Claude Code",
   "type": "module",
   "files": [