hirify-cli 0.6.0 → 0.6.1

package/README.md

@@ -14,7 +14,8 @@ npx -y hirify-cli@latest init
 
 One command installs the CLI globally, installs the skill for the agents found on this computer
 (Claude Code, Codex, Cursor, OpenCode, Gemini CLI, Antigravity) and signs you in through the browser.
-Run it yourself or let your agent run it. `--no-install` and `--no-login` skip a step.
+Run it yourself or let your agent run it. It installs the newest release, whichever version
+started it; a pinned version (`HIRIFY_VERSION_PIN`, `HIRIFY_NO_AUTO_UPDATE=1`) is kept.
 
 The same steps one by one:
 

package/bin/lib/cli.js

@@ -1,11 +1,11 @@
 import { CliError, redact, safeText } from './errors.js'
 const ARGUMENTS = { auth: '[<key>]', update: '[<version>]', 'vacancy search': '[<query>]', 'vacancy read': '<slug>', 'vacancy reveal': '<slug>', 'vacancy apply': '<slug>', 'vacancy hide': '<slug>...', 'company hide': '[<name>...]', 'feed show': '<id>', 'feed create': '<name>', 'feed deliver': '<id>', 'webhook create': '<name> <url>', 'feedback send': '<bug|feature> <title>', 'api call': '<capability>', 'capabilities show': '<capability>' }
 const GLOBAL = ['json', 'fields', 'error-format', 'debug', 'timeout', 'help']
-export const BOOLEAN_FLAGS = new Set(['json', 'debug', 'help', 'force', 'no-browser', 'no-install', 'no-login', 'stdin', 'telegram', 'no-telegram', 'no-webhook', 'check', 'rollback', 'undo'])
+export const BOOLEAN_FLAGS = new Set(['json', 'debug', 'help', 'force', 'no-browser', 'stdin', 'telegram', 'no-telegram', 'no-webhook', 'check', 'rollback', 'undo'])
 export const COMMANDS = {
   intro: { args: [0, 0], description: 'what this can do, and in what order' },
   version: { args: [0, 0], description: 'installed version' },
-  init: { args: [0, 0], flags: ['no-install', 'no-login', 'no-browser', 'callback-port'], description: 'install the CLI and the skill, then sign in' },
+  init: { args: [0, 0], flags: ['no-browser', 'callback-port'], description: 'install the CLI and the skill, then sign in' },
   skill: { args: [0, 0], description: 'install the working rules for your agent' },
   login: { args: [0, 0], flags: ['force', 'no-browser', 'callback-port'], description: 'sign in through your browser' },
   logout: { args: [0, 0], description: 'sign out on this computer' },

package/bin/lib/main.js

@@ -73,30 +73,26 @@ export async function main(argv = process.argv.slice(2), { baseRoot = ownRoot, b
       const { installGlobally, installSkill, describeSkill } = await import('./setup.js')
       const result = {}
       let skillRoot = ownRoot
-      if (!command.values['no-install']) {
-        output.progress('Installing the Hirify CLI...')
-        // A newer CLI found on this computer stays, and the skill is taken from it.
-        const { root, ...cli } = await installGlobally({ version: pkg.version, signal, env: config.env })
-        result.cli = cli
-        if (root) skillRoot = root
-      }
+      output.progress('Installing the Hirify CLI...')
+      const { root, ...cli } = await installGlobally({ version: pkg.version, latest: updater.check, signal, env: config.env })
+      result.cli = cli
+      // The skill comes from the CLI that is installed, so the two match.
+      if (cli.installed && cli.version !== pkg.version) skillRoot = root
       try { result.skill = installSkill({ packageRoot: skillRoot, env: config.env }) }
       catch (error) { if (!(error instanceof CliError)) throw error; result.skill = { error: error.code, message: error.message, agents: [] } }
-      if (!command.values['no-login']) {
-        let source = 'none'
-        try { source = auth.status().source } catch {}
-        if (['environment', 'key'].includes(source)) result.sign_in = { signed_in: true, already_signed_in: true, source }
-        else try { result.sign_in = await auth.login({ noBrowser: Boolean(command.values['no-browser']), port: Number(command.values['callback-port'] || 0), consentMs: Math.min(command.timeout, 300000) }) }
-        catch (error) { if (!(error instanceof CliError) || signal.aborted) throw error; result.sign_in = { signed_in: false, error: error.code, message: error.message } }
-      }
+      try {
+        const { source } = auth.status()
+        // A configured key is a finished sign-in: no browser, no waiting.
+        result.sign_in = ['environment', 'key'].includes(source) ? { signed_in: true, already_signed_in: true, source } : await auth.login({ noBrowser: Boolean(command.values['no-browser']), port: Number(command.values['callback-port'] || 0), consentMs: Math.min(command.timeout, 300000) })
+      } catch (error) { if (!(error instanceof CliError) || signal.aborted) throw error; result.sign_in = { signed_in: false, error: error.code, message: error.message } }
       if (command.json) output.json(result)
       else {
-        if (result.cli) output.console.log(result.cli.installed ? `Hirify CLI ${result.cli.version} is installed. The command is: hirify` : `The CLI could not be installed globally (${result.cli.reason}). Every command still works as: npx -y hirify-cli <command>`)
+        output.console.log(result.cli.installed ? `Hirify CLI ${result.cli.version} is installed. The command is: hirify` : `The CLI could not be installed globally (${result.cli.reason}). Every command still works as: npx -y hirify-cli <command>`)
         if (result.skill.error) output.console.log(result.skill.message); else for (const line of describeSkill(result.skill)) output.console.log(line)
-        if (result.sign_in) output.console.log(result.sign_in.signed_in ? (result.sign_in.already_signed_in ? 'Already signed in.' : 'Signed in. Access saved on this computer.') : result.sign_in.message)
-        if (result.sign_in?.signed_in) output.console.log('Next: ask your agent to look at your Hirify profile and saved searches.')
+        output.console.log(result.sign_in.signed_in ? (result.sign_in.already_signed_in ? 'Already signed in.' : 'Signed in. Access saved on this computer.') : result.sign_in.message)
+        if (result.sign_in.signed_in) output.console.log('Next: ask your agent to look at your Hirify profile and saved searches.')
       }
-      if (result.cli?.installed === false || result.skill.error || result.skill.agents.some(item => !item.installed) || result.sign_in?.signed_in === false) exitCode = 1
+      if (!result.cli.installed || result.skill.error || result.skill.agents.some(item => !item.installed) || !result.sign_in.signed_in) exitCode = 1
     } else if (command.name === 'auth') {
       secrets.add(command.words[0])
       await store.commit({ kind: 'key', access_token: command.words[0] })

package/bin/lib/setup.js

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, cpSync, rmSync, symlinkSync, lstatSync, realpathSync, readFileSync } from 'node:fs'
+import { existsSync, mkdirSync, cpSync, rmSync, symlinkSync, realpathSync, readFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join, relative } from 'node:path'
 import semver from 'semver'
@@ -26,11 +26,8 @@ export function agentDirectories({ env = process.env, home = homedir() } = {}) {
   ]
 }
 
-const entry = path => { try { return lstatSync(path) } catch (error) { if (error.code === 'ENOENT') return null; throw error } }
-const real = path => { try { return realpathSync(path) } catch { return path } }
 // Removing a link removes the link, never the directory it points to.
-const remove = path => { if (entry(path)) rmSync(path, { recursive: true, force: true }) }
-const readJSON = file => { try { return JSON.parse(readFileSync(file, 'utf8')) } catch { return null } }
+const remove = path => rmSync(path, { recursive: true, force: true })
 // OS messages may carry private paths, so only the code is reported.
 const reason = error => ['EACCES', 'EPERM', 'EROFS', 'ENOSPC', 'EDQUOT', 'ENOTDIR', 'ENOENT', 'EEXIST', 'ELOOP'].includes(error?.code) ? error.code : 'unknown'
 
@@ -55,14 +52,14 @@ export function installSkill({ packageRoot, env = process.env, home = homedir(),
     try {
       mkdirSync(agent.skills, { recursive: true })
       // An agent whose skills directory already is the shared one needs no link of its own.
-      const parent = real(agent.skills)
-      if (parent === real(shared)) { agents.push({ agent: agent.name, installed: true }); continue }
+      const parent = realpathSync(agent.skills)
+      if (parent === realpathSync(shared)) { agents.push({ agent: agent.name, installed: true }); continue }
       const target = join(parent, SKILL_NAME)
       remove(target)
       try {
         // A junction needs no elevated rights on Windows; elsewhere the link stays relative.
-        if (platform === 'win32') symlinkSync(real(path), target, 'junction')
-        else symlinkSync(relative(parent, real(path)), target, 'dir')
+        if (platform === 'win32') symlinkSync(realpathSync(path), target, 'junction')
+        else symlinkSync(relative(parent, realpathSync(path)), target, 'dir')
       } catch { cpSync(source, target, { recursive: true }) }
       agents.push({ agent: agent.name, installed: true })
     } catch (error) { agents.push({ agent: agent.name, installed: false, reason: reason(error) }) }
@@ -71,25 +68,34 @@ export function installSkill({ packageRoot, env = process.env, home = homedir(),
 }
 
 /**
- * Put the CLI on PATH with the person's own npm and its settings: the environment goes to npm as
- * it is, because what npx adds to it is the same configuration, already resolved. A failure is a
- * result, not an error: without a global installation every command still runs as
- * `npx -y hirify-cli <command>`. A newer global installation is kept, never downgraded, and its
- * `root` says where the skill that matches it is.
+ * Put the newest release of the CLI on PATH, whichever package started the command, with the
+ * person's own npm and its settings: the environment goes to npm as it is, because what npx adds
+ * to it is the same configuration, already resolved. A pinned version and switched-off updates
+ * keep the running release, as they do for automatic updates. A failure is a result, not an
+ * error: without a global installation every command still runs as `npx -y hirify-cli <command>`.
+ * An installation that is already at that release or past it is kept. `root` is where the
+ * installed package is, and with it the skill that matches it.
  */
-export async function installGlobally({ version, signal, env = process.env, run = runProcess } = {}) {
+export async function installGlobally({ version, latest, signal, env = process.env, run = runProcess } = {}) {
   const options = { signal, env }
+  if (!env.HIRIFY_VERSION_PIN && env.HIRIFY_NO_AUTO_UPDATE !== '1') {
+    try { version = (await latest()).version }
+    catch (error) { if (signal?.aborted || !(error instanceof CliError)) throw error; return { installed: false, reason: error.code } }
+  }
   let root
   try { root = await run('npm', ['root', '--global'], { ...options, timeout: 10000 }) }
   catch (error) { if (signal?.aborted) throw error; return { installed: false, reason: 'npm_unavailable' } }
   if (root.code !== 0 || !root.stdout.trim()) return { installed: false, reason: 'npm_unavailable' }
   const location = join(root.stdout.trim(), PACKAGE_NAME)
-  const current = readJSON(join(location, 'package.json'))
-  if (current?.name === PACKAGE_NAME && semver.valid(current.version) && semver.gte(current.version, version)) return { installed: true, version: current.version, changed: false, ...(semver.gt(current.version, version) && { root: location }) }
+  let current
+  // Only a package that is not there counts as absent; one that cannot be read is reported.
+  try { current = JSON.parse(readFileSync(join(location, 'package.json'), 'utf8')) }
+  catch (error) { if (error.code !== 'ENOENT') return { installed: false, reason: 'global_package_unreadable' } }
+  if (current?.name === PACKAGE_NAME && semver.valid(current.version) && semver.gte(current.version, version)) return { installed: true, version: current.version, changed: false, root: location }
   let result
   try { result = await run('npm', ['install', '--global', '--ignore-scripts', '--no-audit', '--no-fund', `${PACKAGE_NAME}@${version}`], { ...options, timeout: 180000 }) }
   catch (error) { if (signal?.aborted) throw error; return { installed: false, reason: 'install_failed' } }
-  return result.code === 0 ? { installed: true, version, changed: true } : { installed: false, reason: 'install_failed' }
+  return result.code === 0 ? { installed: true, version, changed: true, root: location } : { installed: false, reason: 'install_failed' }
 }
 
 /** Lines a person reads after `hirify skill` or `hirify init`. */

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "hirify-cli",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hirify-cli",
-      "version": "0.6.0",
+      "version": "0.6.1",
       "license": "Apache-2.0",
       "dependencies": {
         "cross-spawn": "7.0.6",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hirify-cli",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Hirify CLI for AI agents: browser sign-in, job feeds, search, reading a vacancy in full, contacts to apply to, and applying on Hirify.",
   "bin": {
     "hirify": "bin/hirify.js"