hermes-git 0.3.1 → 0.3.5

package/README.md

@@ -42,6 +42,8 @@ hermes wip
 
 No magic. Every command shows exactly what git operations it runs.
 
+Run `hermes` with no arguments to see the full command reference and available workflows.
+
 ---
 
 ## Installation
@@ -78,7 +80,7 @@ hermes config set provider gemini
 hermes config set gemini-key AIza...
 ```
 
-Verify it worked:
+Verify:
 
 ```bash
 hermes config list
@@ -93,7 +95,7 @@ hermes config list
 npm install -g hermes-git
 hermes config setup
 
-# 2. Initialize your project (optional, enables team config sharing)
+# 2. Initialize your project (optional — enables team config sharing)
 cd your-project
 hermes init
 
@@ -105,13 +107,26 @@ hermes start "user authentication"
 
 ## Commands
 
+### `hermes update`
+
+Update hermes to the latest version.
+
+```bash
+hermes update           # check and install if a newer version exists
+hermes update --check   # check only, don't install
+```
+
+Auto-detects your package manager (npm, bun, or pnpm).
+
+---
+
 ### `hermes config`
 
 Manage API keys and provider settings.
 
 ```bash
-hermes config setup              # Interactive wizard
-hermes config list               # Show current config (keys masked)
+hermes config setup              # interactive wizard
+hermes config list               # show current config (keys masked, sources shown)
 hermes config set provider openai
 hermes config set openai-key sk-...
 hermes config get provider
@@ -122,6 +137,52 @@ Config is stored in `~/.config/hermes/config.json`. You can also use environment
 
 ---
 
+### `hermes guard`
+
+Scan staged files for secrets and sensitive content before committing.
+
+```bash
+hermes guard
+```
+
+Scans every staged file for:
+
+- **Sensitive filenames** — `.env`, `id_rsa`, `*.pem`, `credentials.json`, `google-services.json`, etc.
+- **API keys** — Anthropic, OpenAI, Google, AWS, GitHub, Stripe, SendGrid, Twilio
+- **Private key headers** — `-----BEGIN PRIVATE KEY-----` and variants
+- **Database URLs** with embedded credentials — `postgres://user:pass@host`
+- **Hardcoded passwords/tokens** — common assignment patterns
+
+Findings are categorised as `BLOCKED` (definite secret) or `WARN` (suspicious). The AI explains each finding and what to do about it, then you choose: abort, unstage the flagged files, or proceed anyway.
+
+```
+  BLOCKED  src/config.ts
+           ● Anthropic API key  line 12
+             apiKey: "sk-a...****",
+             Rotate at: https://console.anthropic.com/settings/keys
+
+  What this means:
+  This key gives anyone with repo access full billing access to your
+  Anthropic account. Rotate it immediately and load it from an
+  environment variable instead.
+
+  ? Blocked secrets found. What do you want to do?
+  ❯ Abort — I will fix these before committing
+    Unstage the flagged files and continue
+    Proceed anyway (I know what I'm doing)
+```
+
+**Install as a git pre-commit hook** so it runs automatically on every commit:
+
+```bash
+hermes guard install-hook    # installs to .git/hooks/pre-commit
+hermes guard uninstall-hook  # removes it
+```
+
+In hook mode the scan is non-interactive: prints findings to stderr and exits 1 on any blocker.
+
+---
+
 ### `hermes plan "<intent>"`
 
 Analyze repo state and propose a safe Git plan. **Makes no changes.**
@@ -154,7 +215,7 @@ hermes sync
 hermes sync --from develop
 ```
 
-Hermes evaluates whether rebase or merge is safer given your branch state and explains before executing.
+Evaluates whether rebase or merge is safer given your branch state and explains before executing.
 
 ---
 
@@ -171,55 +232,6 @@ Decides commit vs stash based on what's safest in your current state.
 
 ---
 
-### `hermes guard`
-
-Scan staged files for secrets and sensitive content before committing.
-
-```bash
-hermes guard
-```
-
-Hermes scans every staged file for:
-
-- **Sensitive filenames** — `.env`, `id_rsa`, `*.pem`, `credentials.json`, `google-services.json`, etc.
-- **API keys** — Anthropic, OpenAI, Google, AWS, GitHub, Stripe, SendGrid, Twilio
-- **Private key headers** — `-----BEGIN PRIVATE KEY-----` and variants
-- **Database URLs** with embedded credentials — `postgres://user:pass@host`
-- **Hardcoded passwords/tokens** — common assignment patterns
-
-Findings are categorized as `BLOCKED` (definite secret) or `WARN` (suspicious). The AI explains each finding and what to do about it. Then you choose: abort, unstage the flagged files, or proceed anyway.
-
-```
-  BLOCKED  src/config.ts
-           ● Anthropic API key  line 12
-             apiKey: "sk-a...****",
-             Rotate at: https://console.anthropic.com/settings/keys
-           ● Database URL with credentials  line 15
-             dbUrl: "post...****prod.db.internal/app"
-
-  What this means:
-  The Anthropic API key on line 12 would give anyone with repository
-  access full billing access to your Anthropic account. Rotate it
-  immediately and use process.env.ANTHROPIC_API_KEY instead.
-  ...
-
-  ? Blocked secrets found. What do you want to do?
-  ❯ Abort — I will fix these before committing
-    Unstage the flagged files and continue
-    Proceed anyway (I know what I'm doing)
-```
-
-**Install as a git pre-commit hook** so it runs automatically on every commit:
-
-```bash
-hermes guard install-hook    # installs to .git/hooks/pre-commit
-hermes guard uninstall-hook  # removes it
-```
-
-In hook mode (`--hook`), the scan is non-interactive: it prints findings to stderr and exits 1 on any blocker.
-
----
-
 ### `hermes conflict explain`
 
 Understand why a conflict exists.
@@ -246,15 +258,17 @@ For each file: shows a proposed resolution, lets you accept, edit manually, or s
 
 ### `hermes workflow <name>`
 
-One-command workflows for common patterns.
+One-command workflows for common patterns. Available workflows are shown when you run `hermes` with no arguments.
 
 ```bash
 hermes workflow pr-ready      # fetch → rebase → push --force-with-lease
 hermes workflow daily-sync    # fetch all → show status → suggest next action
 hermes workflow quick-commit  # generate commit message from staged diff
-hermes workflow list          # show available workflows
+hermes workflow list          # show all workflows including project-specific
 ```
 
+Define project-specific workflows in `.hermes/config.json` and they appear automatically in the help output.
+
 ---
 
 ### `hermes worktree new "<task>"`
@@ -273,8 +287,8 @@ hermes worktree new "fix memory leak"
 Initialize project-level config (`.hermes/config.json`). Commit this to share branch patterns and workflows with your team.
 
 ```bash
-hermes init         # Interactive
-hermes init --quick # Use defaults
+hermes init         # interactive
+hermes init --quick # use defaults
 ```
 
 ---
@@ -301,6 +315,8 @@ Hermes resolves config in this priority order:
 | `.env` file in current dir | `ANTHROPIC_API_KEY=sk-ant-...` |
 | `~/.config/hermes/config.json` | set via `hermes config set` |
 
+Environment variables always win — useful for CI and Docker environments where you don't want a config file.
+
 **Supported env vars:**
 
 | Variable | Description |
@@ -326,9 +342,9 @@ If `HERMES_PROVIDER` is not set, Hermes auto-detects by using whichever key it f
 
 1. **Reads your repo state** — branch, commits, dirty files, conflicts, remote tracking
 2. **Sends context + intent to an AI** — using your configured provider
-3. **Validates the response** — all returned commands must start with `git`, destructive flags are blocked
+3. **Validates the response** — all returned commands must start with `git`; destructive flags are blocked
 4. **Executes with display** — shows every command before running it
-5. **You always stay in control** — interactive prompts for anything irreversible
+5. **You stay in control** — interactive prompts for anything irreversible
 
 ---
 
@@ -350,30 +366,23 @@ If `HERMES_PROVIDER` is not set, Hermes auto-detects by using whichever key it f
 hermes config setup
 ```
 
-**Wrong provider selected**
+**Wrong provider being used**
 
 ```bash
 hermes config set provider anthropic
-hermes config list   # verify
+hermes config list   # check sources — env vars override saved config
 ```
 
-**Key saved but not working**
+**Key set but not working**
 
 ```bash
-# Check what Hermes sees
-hermes config list
-
-# Environment variables override saved config
-# Check for conflicting vars:
-echo $ANTHROPIC_API_KEY
+hermes config list   # shows value and where it came from (env / .env / config)
 ```
 
-**General debugging**
+**Update to latest**
 
 ```bash
-hermes --version
-hermes config list
-git status
+hermes update
 ```
 
 ---

package/dist/index.js

@@ -37589,9 +37589,11 @@ function initCommand(program2) {
       await mkdir3(".hermes", { recursive: true });
       await writeFile4(".hermes/config.json", JSON.stringify(config, null, 2));
       await mkdir3(".hermes/backups", { recursive: true });
-      await appendToGitignore(`.hermes/backups/
-.hermes/stats.json
-`);
+      const added = await updateGitignore();
+      if (added.length > 0) {
+        console.log(`
+\uD83D\uDCDD Added to .gitignore: ${added.join(", ")}`);
+      }
       displaySuccess("Hermes initialized successfully!");
       console.log(`
 \uD83D\uDCC4 Configuration saved to .hermes/config.json`);
@@ -37734,23 +37736,38 @@ async function interactiveConfig(repoInfo) {
     }
   };
 }
-async function appendToGitignore(content) {
-  try {
-    const { appendFile } = await import("fs/promises");
-    const gitignorePath = ".gitignore";
-    if (existsSync4(gitignorePath)) {
-      const { readFile: readFile5 } = await import("fs/promises");
-      const existing = await readFile5(gitignorePath, "utf-8");
-      if (!existing.includes(".hermes/backups")) {
-        await appendFile(gitignorePath, `
+var GITIGNORE_ENTRIES = [
+  { pattern: ".env", comment: null },
+  { pattern: ".env.*", comment: null },
+  { pattern: "!.env.example", comment: null },
+  { pattern: ".hermes/backups/", comment: null },
+  { pattern: ".hermes/stats.json", comment: null }
+];
+async function updateGitignore() {
+  const { appendFile, readFile: rf } = await import("fs/promises");
+  const gitignorePath = ".gitignore";
+  let existing = "";
+  if (existsSync4(gitignorePath)) {
+    try {
+      existing = await rf(gitignorePath, "utf-8");
+    } catch {}
+  }
+  const existingLines = existing.split(`
+`).map((l) => l.trim());
+  const toAdd = GITIGNORE_ENTRIES.filter((e) => !existingLines.includes(e.pattern));
+  if (toAdd.length === 0)
+    return [];
+  const block = `
 # Hermes
-` + content);
-      }
-    } else {
-      await writeFile4(gitignorePath, `# Hermes
-` + content);
-    }
-  } catch {}
+` + toAdd.map((e) => e.pattern).join(`
+`) + `
+`;
+  if (existsSync4(gitignorePath)) {
+    await appendFile(gitignorePath, block);
+  } else {
+    await writeFile4(gitignorePath, block.trimStart());
+  }
+  return toAdd.map((e) => e.pattern);
 }
 
 // src/commands/stats.ts
@@ -38737,32 +38754,348 @@ function buildInstallCommand(pm) {
   }
 }
 
+// src/commands/commit.ts
+import { exec as exec6 } from "child_process";
+import { promisify as promisify6 } from "util";
+var execAsync6 = promisify6(exec6);
+async function getStagedFiles2() {
+  try {
+    const { stdout } = await execAsync6("git diff --cached --name-status");
+    return stdout.trim().split(`
+`).filter(Boolean).map((line) => {
+      const [status, ...rest] = line.split("\t");
+      return { status: status.trim(), path: rest.join("\t").trim() };
+    });
+  } catch {
+    return [];
+  }
+}
+async function getUnstagedFiles() {
+  try {
+    const { stdout } = await execAsync6("git status --porcelain");
+    return stdout.trim().split(`
+`).filter(Boolean).map((line) => {
+      const status = line.slice(0, 2).trim();
+      const path5 = line.slice(3).trim();
+      return { status, path: path5 };
+    }).filter(({ status }) => status === "??" || status[0] === " " || status.length === 1);
+  } catch {
+    return [];
+  }
+}
+async function getRecentBranchCommits(n = 5) {
+  try {
+    const { stdout } = await execAsync6(`git log --oneline -${n} --no-merges 2>/dev/null`);
+    return stdout.trim();
+  } catch {
+    return "";
+  }
+}
+function statusLabel(s) {
+  const map = {
+    M: source_default.yellow("modified "),
+    A: source_default.green("new file "),
+    D: source_default.red("deleted  "),
+    R: source_default.blue("renamed  "),
+    C: source_default.blue("copied   "),
+    "??": source_default.dim("untracked"),
+    " M": source_default.yellow("modified "),
+    " D": source_default.red("deleted  ")
+  };
+  return map[s] ?? source_default.dim(s.padEnd(9));
+}
+function divider() {
+  console.log(source_default.dim("  " + "─".repeat(54)));
+}
+async function analyzeChanges(branch, stagedDiff, stagedStat, recentCommits) {
+  const prompt2 = `You are an expert Git historian. Analyze these staged changes and produce a structured commit analysis.
+
+Branch: ${branch}
+Recent commits on this branch:
+${recentCommits || "(none — first commit)"}
+
+Staged diff summary:
+${stagedStat}
+
+Full staged diff (truncated to 12000 chars):
+${stagedDiff.slice(0, 12000)}
+
+Return RAW JSON ONLY — no markdown, no code fences, just the JSON object:
+{
+  "summary": "2-3 sentences: what was changed and the likely intent behind it",
+  "concerns": ["array of concerns — mixed unrelated changes, debug/temp code, large binary, TODO left in, test missing, etc. Empty array if none."],
+  "message": "conventional commit: type(scope): subject (max 72 chars). Be specific.",
+  "body": "optional multi-line body explaining WHY (not WHAT). Empty string if the subject is self-explanatory.",
+  "alternatives": ["two alternative commit messages if the intent is ambiguous"]
+}
+
+Rules for message:
+- type: feat | fix | refactor | docs | test | chore | style | perf | build | ci
+- scope: the primary module/component affected (omit if changes are cross-cutting)
+- subject: imperative mood, no period, lowercase after colon
+- be specific — "add OAuth login" not "add feature"`;
+  const raw = await getAISuggestion(prompt2);
+  const cleaned = raw.replace(/^```(?:json)?\s*/i, "").replace(/\s*```\s*$/, "").trim();
+  try {
+    return JSON.parse(cleaned);
+  } catch {
+    return {
+      summary: "Could not parse analysis.",
+      concerns: [],
+      message: cleaned.split(`
+`)[0].slice(0, 72),
+      body: "",
+      alternatives: []
+    };
+  }
+}
+function commitCommand(program2) {
+  program2.command("commit").description("Analyze staged changes with AI and craft a commit message").option("-a, --all", "Stage all tracked changes before analysis").option("--no-body", "Omit the commit body even if one is suggested").action(async (options) => {
+    const start = Date.now();
+    try {
+      const repoState = await getRepoState();
+      if (options.all) {
+        displayStep("git add -u");
+        await execAsync6("git add -u");
+      }
+      const staged = await getStagedFiles2();
+      if (staged.length === 0) {
+        console.log(source_default.yellow(`
+  Nothing staged to commit.`));
+        console.log(source_default.dim("  Use `git add <file>` or run `hermes commit --all` to stage tracked changes.\n"));
+        process.exit(0);
+      }
+      const unstaged = await getUnstagedFiles();
+      const recentCommits = await getRecentBranchCommits(5);
+      console.log();
+      console.log(source_default.bold(`  Staged (${staged.length} file${staged.length === 1 ? "" : "s"}):`));
+      for (const f of staged) {
+        console.log(`    ${statusLabel(f.status)} ${source_default.white(f.path)}`);
+      }
+      const relevantUnstaged = unstaged.filter((u) => !staged.some((s) => s.path === u.path));
+      if (relevantUnstaged.length > 0) {
+        console.log();
+        console.log(source_default.dim(`  Not staged (${relevantUnstaged.length}):`));
+        for (const f of relevantUnstaged.slice(0, 8)) {
+          console.log(`    ${statusLabel(f.status)} ${source_default.dim(f.path)}`);
+        }
+        if (relevantUnstaged.length > 8) {
+          console.log(source_default.dim(`    ...and ${relevantUnstaged.length - 8} more`));
+        }
+      }
+      const { name, model } = await getActiveProvider();
+      console.log();
+      console.log(`  Analyzing... ${source_default.dim(`[${name} / ${model}]`)}`);
+      const [stagedDiff, stagedStat] = await Promise.all([
+        execAsync6("git diff --cached").then((r) => r.stdout),
+        execAsync6("git diff --cached --stat").then((r) => r.stdout)
+      ]);
+      const analysis = await analyzeChanges(repoState.currentBranch, stagedDiff, stagedStat, recentCommits);
+      console.log();
+      divider();
+      console.log();
+      console.log("  " + source_default.bold("Understanding"));
+      console.log();
+      const words = analysis.summary.split(" ");
+      let line = "  ";
+      for (const w of words) {
+        if (line.length + w.length > 62) {
+          console.log(source_default.white(line));
+          line = "  " + w + " ";
+        } else {
+          line += w + " ";
+        }
+      }
+      if (line.trim())
+        console.log(source_default.white(line));
+      if (analysis.concerns.length > 0) {
+        console.log();
+        for (const c of analysis.concerns) {
+          console.log(`  ${source_default.yellow("⚠")}  ${source_default.yellow(c)}`);
+        }
+      }
+      console.log();
+      divider();
+      console.log();
+      const hasBody = options.body !== false && analysis.body.trim().length > 0;
+      console.log("  " + source_default.bold("Proposed commit"));
+      console.log();
+      console.log("  " + source_default.cyan.bold(analysis.message));
+      if (hasBody) {
+        console.log();
+        analysis.body.split(`
+`).forEach((l) => {
+          console.log("  " + source_default.dim(l));
+        });
+      }
+      console.log();
+      let finalMessage = analysis.message;
+      let finalBody = hasBody ? analysis.body : "";
+      let committed = false;
+      while (!committed) {
+        const choices = [
+          { name: "Commit", value: "commit" },
+          { name: "Edit message", value: "edit" }
+        ];
+        if (analysis.alternatives?.length > 0) {
+          choices.push({ name: "See alternative messages", value: "alts" });
+        }
+        if (relevantUnstaged.length > 0) {
+          choices.push({ name: "Stage more files first", value: "stage" });
+        }
+        choices.push({ name: "Cancel", value: "cancel" });
+        const { action } = await esm_default12.prompt([
+          {
+            type: "list",
+            name: "action",
+            message: "What would you like to do?",
+            choices
+          }
+        ]);
+        if (action === "cancel") {
+          console.log(source_default.dim(`
+  Cancelled. Changes remain staged.
+`));
+          await recordCommand("commit", [], Date.now() - start, false);
+          return;
+        }
+        if (action === "alts") {
+          console.log();
+          analysis.alternatives.forEach((alt, i) => {
+            console.log(`  ${source_default.dim(`${i + 1}.`)} ${source_default.cyan(alt)}`);
+          });
+          console.log();
+          const { pick } = await esm_default12.prompt([
+            {
+              type: "list",
+              name: "pick",
+              message: "Use an alternative?",
+              choices: [
+                ...analysis.alternatives.map((a, i) => ({ name: a, value: `${i}` })),
+                { name: "Keep original", value: "keep" }
+              ]
+            }
+          ]);
+          if (pick !== "keep") {
+            finalMessage = analysis.alternatives[parseInt(pick, 10)];
+            finalBody = "";
+            console.log();
+            console.log("  " + source_default.cyan.bold(finalMessage));
+            console.log();
+          }
+          continue;
+        }
+        if (action === "edit") {
+          const { edited } = await esm_default12.prompt([
+            {
+              type: "input",
+              name: "edited",
+              message: "Commit message:",
+              default: finalMessage
+            }
+          ]);
+          finalMessage = edited.trim();
+          finalBody = "";
+          console.log();
+          continue;
+        }
+        if (action === "stage") {
+          const { files } = await esm_default12.prompt([
+            {
+              type: "checkbox",
+              name: "files",
+              message: "Select files to stage:",
+              choices: relevantUnstaged.map((f) => ({
+                name: `${statusLabel(f.status)} ${f.path}`,
+                value: f.path
+              }))
+            }
+          ]);
+          if (files.length > 0) {
+            for (const f of files) {
+              const cmd = `git add ${JSON.stringify(f)}`;
+              displayStep(cmd);
+              await execAsync6(cmd);
+            }
+            console.log(source_default.dim(`
+  Staged ${files.length} file(s). Re-running analysis...
+`));
+            const [newDiff, newStat] = await Promise.all([
+              execAsync6("git diff --cached").then((r) => r.stdout),
+              execAsync6("git diff --cached --stat").then((r) => r.stdout)
+            ]);
+            const newAnalysis = await analyzeChanges(repoState.currentBranch, newDiff, newStat, recentCommits);
+            analysis.summary = newAnalysis.summary;
+            analysis.concerns = newAnalysis.concerns;
+            analysis.message = newAnalysis.message;
+            analysis.body = newAnalysis.body;
+            analysis.alternatives = newAnalysis.alternatives;
+            finalMessage = newAnalysis.message;
+            finalBody = options.body !== false && newAnalysis.body.trim().length > 0 ? newAnalysis.body : "";
+            console.log("  " + source_default.bold("Updated proposal"));
+            console.log();
+            console.log("  " + source_default.cyan.bold(finalMessage));
+            if (finalBody) {
+              console.log();
+              finalBody.split(`
+`).forEach((l) => console.log("  " + source_default.dim(l)));
+            }
+            if (newAnalysis.concerns.length > 0) {
+              console.log();
+              newAnalysis.concerns.forEach((c) => {
+                console.log(`  ${source_default.yellow("⚠")}  ${source_default.yellow(c)}`);
+              });
+            }
+            console.log();
+          }
+          continue;
+        }
+        if (action === "commit") {
+          const fullMessage = finalBody ? `${finalMessage}
+
+${finalBody}` : finalMessage;
+          displayStep(`git commit -m "${finalMessage}"${finalBody ? " (with body)" : ""}`);
+          await execAsync6(`git commit -m ${JSON.stringify(fullMessage)}`);
+          displaySuccess("Committed!");
+          const { stdout: hash } = await execAsync6("git rev-parse --short HEAD");
+          console.log(source_default.dim(`  ${hash.trim()} ${finalMessage}
+`));
+          await recordCommand("commit", [], Date.now() - start, true);
+          committed = true;
+        }
+      }
+    } catch (error3) {
+      console.error("❌ Error:", error3 instanceof Error ? error3.message : error3);
+      await recordCommand("commit", [], Date.now() - start, false);
+      process.exit(1);
+    }
+  });
+}
+
 // src/lib/update-notifier.ts
 import { readFile as readFile6, writeFile as writeFile6, mkdir as mkdir5 } from "fs/promises";
 import { existsSync as existsSync6 } from "fs";
 import { homedir as homedir2 } from "os";
 import path5 from "path";
 var PACKAGE_NAME2 = "hermes-git";
-var CHECK_INTERVAL = 24 * 60 * 60 * 1000;
+var CHECK_INTERVAL = 12 * 60 * 60 * 1000;
 var CACHE_DIR = path5.join(homedir2(), ".hermes", "cache");
 var CACHE_FILE = path5.join(CACHE_DIR, "update-check.json");
-async function getLatestVersion() {
+async function fetchDistTags() {
   try {
-    const response = await fetch(`https://registry.npmjs.org/${PACKAGE_NAME2}/latest`);
-    if (!response.ok)
-      return null;
-    const data = await response.json();
-    return data.version || null;
+    const res = await fetch(`https://registry.npmjs.org/-/package/${PACKAGE_NAME2}/dist-tags`, { signal: AbortSignal.timeout(5000) });
+    if (!res.ok)
+      return {};
+    return await res.json();
   } catch {
-    return null;
+    return {};
   }
 }
 async function readCache() {
   try {
     if (!existsSync6(CACHE_FILE))
       return null;
-    const content = await readFile6(CACHE_FILE, "utf-8");
-    return JSON.parse(content);
+    return JSON.parse(await readFile6(CACHE_FILE, "utf-8"));
   } catch {
     return null;
   }
@@ -38773,36 +39106,66 @@ async function writeCache(cache) {
     await writeFile6(CACHE_FILE, JSON.stringify(cache, null, 2));
   } catch {}
 }
-function isNewerVersion(current, latest) {
-  const currentParts = current.split(".").map(Number);
-  const latestParts = latest.split(".").map(Number);
+function compareVersions2(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
   for (let i = 0;i < 3; i++) {
-    if (latestParts[i] > currentParts[i])
-      return true;
-    if (latestParts[i] < currentParts[i])
-      return false;
+    if (pa[i] > pb[i])
+      return 1;
+    if (pa[i] < pb[i])
+      return -1;
   }
-  return false;
+  return 0;
+}
+async function enforceMinimumVersion(currentVersion) {
+  try {
+    const cache = await readCache();
+    const now = Date.now();
+    const stale = !cache || now - cache.lastChecked > CHECK_INTERVAL;
+    let minimumVersion = cache?.minimumVersion ?? null;
+    let latestVersion = cache?.latestVersion ?? null;
+    if (stale) {
+      const tags = await fetchDistTags();
+      latestVersion = tags.latest ?? latestVersion;
+      minimumVersion = tags.minimum ?? null;
+      await writeCache({ lastChecked: now, latestVersion: latestVersion ?? undefined, minimumVersion: minimumVersion ?? undefined });
+    }
+    if (minimumVersion && compareVersions2(currentVersion, minimumVersion) < 0) {
+      console.error("");
+      console.error(source_default.red.bold("  ✖ This version of hermes is no longer supported."));
+      console.error("");
+      console.error(`  You have ${source_default.dim(currentVersion)}, minimum required is ${source_default.red.bold(minimumVersion)}.`);
+      console.error("");
+      console.error("  Update now:");
+      console.error(`    ${source_default.cyan("npm install -g hermes-git@latest")}`);
+      console.error(`    ${source_default.dim("or:  hermes update")}`);
+      console.error("");
+      process.exit(1);
+    }
+  } catch {}
 }
 async function checkForUpdates(currentVersion) {
   try {
     const cache = await readCache();
     const now = Date.now();
-    const shouldCheck = !cache || now - cache.lastChecked > CHECK_INTERVAL;
-    let latestVersion = cache?.latestVersion || null;
-    if (shouldCheck) {
-      latestVersion = await getLatestVersion();
+    const stale = !cache || now - cache.lastChecked > CHECK_INTERVAL;
+    let latestVersion = cache?.latestVersion ?? null;
+    if (stale) {
+      const tags = await fetchDistTags();
+      latestVersion = tags.latest ?? null;
       await writeCache({
         lastChecked: now,
-        latestVersion: latestVersion || undefined
+        latestVersion: latestVersion ?? undefined,
+        minimumVersion: cache?.minimumVersion
       });
     }
-    if (latestVersion && isNewerVersion(currentVersion, latestVersion)) {
+    if (latestVersion && compareVersions2(latestVersion, currentVersion) > 0) {
+      const gap = " ".repeat(Math.max(0, 17 - currentVersion.length - latestVersion.length));
       console.log(source_default.yellow(`
-┌─────────────────────────────────────────────────────┐`));
-      console.log(source_default.yellow("│") + "  " + source_default.bold("Update available!") + " " + source_default.dim(currentVersion) + " → " + source_default.green.bold(latestVersion) + "       " + source_default.yellow("│"));
-      console.log(source_default.yellow("│") + "  Run: " + source_default.cyan("npm install -g hermes-git@latest") + "  " + source_default.yellow("│"));
-      console.log(source_default.yellow(`└─────────────────────────────────────────────────────┘
+┌──────────────────────────────────────────────────────┐`));
+      console.log(source_default.yellow("│") + `  ${source_default.bold("Update available!")} ${source_default.dim(currentVersion)} → ${source_default.green.bold(latestVersion)}${gap}` + source_default.yellow("│"));
+      console.log(source_default.yellow("│") + `  Run: ${source_default.cyan("hermes update")}` + " ".repeat(36) + source_default.yellow("│"));
+      console.log(source_default.yellow(`└──────────────────────────────────────────────────────┘
 `));
     }
   } catch {}
@@ -38889,7 +39252,7 @@ function printWorkflows() {
 
 // src/index.ts
 var program2 = new Command;
-var CURRENT_VERSION = "0.3.1";
+var CURRENT_VERSION = "0.3.5";
 program2.name("hermes").description("Intent-driven Git, guided by AI").version(CURRENT_VERSION).action(() => {
   printBanner(CURRENT_VERSION);
   printWorkflows();
@@ -38907,5 +39270,5 @@ workflowCommand(program2);
 configCommand(program2);
 guardCommand(program2);
 updateCommand(program2, CURRENT_VERSION);
-checkForUpdates(CURRENT_VERSION).catch(() => {});
-program2.parse();
+commitCommand(program2);
+enforceMinimumVersion(CURRENT_VERSION).then(() => program2.parseAsync()).then(() => checkForUpdates(CURRENT_VERSION)).catch(() => {});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hermes-git",
-  "version": "0.3.1",
+  "version": "0.3.5",
   "description": "Intent-driven Git, guided by AI. Turn natural language into safe, explainable Git operations.",
   "type": "module",
   "main": "./dist/index.js",