inup 1.6.6 → 1.6.8

package/dist/{services/package-manager-detector.js → shared/package-manager.js}

@@ -4,8 +4,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PackageManagerDetector = void 0;
-const fs_1 = require("fs");
-const path_1 = require("path");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
 const chalk_1 = __importDefault(require("chalk"));
 const PACKAGE_MANAGERS = {
     npm: {
@@ -45,18 +45,19 @@ const PACKAGE_MANAGERS = {
         color: chalk_1.default.magenta,
     },
 };
+// biome-ignore lint/complexity/noStaticOnlyClass: intentional namespace-style API used throughout the codebase
 class PackageManagerDetector {
     /**
      * Detect package manager from packageManager field or lock files
      */
     static detect(cwd = process.cwd()) {
         // 1. Check packageManager field in package.json
-        const fromPackageJson = this.detectFromPackageJson(cwd);
+        const fromPackageJson = PackageManagerDetector.detectFromPackageJson(cwd);
         if (fromPackageJson) {
             return fromPackageJson;
         }
         // 2. Check for lock files
-        const fromLockFile = this.detectFromLockFiles(cwd);
+        const fromLockFile = PackageManagerDetector.detectFromLockFiles(cwd);
         if (fromLockFile) {
             return fromLockFile;
         }
@@ -68,12 +69,12 @@ class PackageManagerDetector {
      * Detect from package.json packageManager field
      */
     static detectFromPackageJson(cwd) {
-        const packageJsonPath = (0, path_1.join)(cwd, 'package.json');
-        if (!(0, fs_1.existsSync)(packageJsonPath)) {
+        const packageJsonPath = (0, node_path_1.join)(cwd, 'package.json');
+        if (!(0, node_fs_1.existsSync)(packageJsonPath)) {
             return null;
         }
         try {
-            const content = (0, fs_1.readFileSync)(packageJsonPath, 'utf-8');
+            const content = (0, node_fs_1.readFileSync)(packageJsonPath, 'utf-8');
             const packageJson = JSON.parse(content);
             if (packageJson.packageManager) {
                 // Parse format: "pnpm@10.28.1" or "npm@9.0.0+sha512.abc..."
@@ -84,7 +85,7 @@ class PackageManagerDetector {
                 }
             }
         }
-        catch (error) {
+        catch {
             // Invalid package.json, continue to lock file detection
         }
         return null;
@@ -94,19 +95,19 @@ class PackageManagerDetector {
      */
     static detectFromLockFiles(cwd) {
         const lockFileChecks = [
-            { pm: PACKAGE_MANAGERS.pnpm, path: (0, path_1.join)(cwd, 'pnpm-lock.yaml') },
-            { pm: PACKAGE_MANAGERS.bun, path: (0, path_1.join)(cwd, 'bun.lockb') },
+            { pm: PACKAGE_MANAGERS.pnpm, path: (0, node_path_1.join)(cwd, 'pnpm-lock.yaml') },
+            { pm: PACKAGE_MANAGERS.bun, path: (0, node_path_1.join)(cwd, 'bun.lockb') },
             // Bun >= 1.2 writes a text `bun.lock` instead of the binary `bun.lockb`.
-            { pm: PACKAGE_MANAGERS.bun, path: (0, path_1.join)(cwd, 'bun.lock') },
-            { pm: PACKAGE_MANAGERS.yarn, path: (0, path_1.join)(cwd, 'yarn.lock') },
-            { pm: PACKAGE_MANAGERS.npm, path: (0, path_1.join)(cwd, 'package-lock.json') },
+            { pm: PACKAGE_MANAGERS.bun, path: (0, node_path_1.join)(cwd, 'bun.lock') },
+            { pm: PACKAGE_MANAGERS.yarn, path: (0, node_path_1.join)(cwd, 'yarn.lock') },
+            { pm: PACKAGE_MANAGERS.npm, path: (0, node_path_1.join)(cwd, 'package-lock.json') },
         ];
         const existingLocks = lockFileChecks
-            .filter(({ path }) => (0, fs_1.existsSync)(path))
+            .filter(({ path }) => (0, node_fs_1.existsSync)(path))
             .map(({ pm, path }) => ({
             pm,
             path,
-            mtime: (0, fs_1.statSync)(path).mtime.getTime(),
+            mtime: (0, node_fs_1.statSync)(path).mtime.getTime(),
         }));
         if (existingLocks.length === 0) {
             return null;
@@ -131,20 +132,20 @@ class PackageManagerDetector {
     static findWorkspaceRoot(cwd = process.cwd(), packageManager) {
         const pmInfo = PACKAGE_MANAGERS[packageManager];
         let currentDir = cwd;
-        while (currentDir !== (0, path_1.join)(currentDir, '..')) {
+        while (currentDir !== (0, node_path_1.join)(currentDir, '..')) {
             // Check for package manager-specific workspace file
             if (pmInfo.workspaceFile) {
-                const workspaceFilePath = (0, path_1.join)(currentDir, pmInfo.workspaceFile);
-                if ((0, fs_1.existsSync)(workspaceFilePath)) {
+                const workspaceFilePath = (0, node_path_1.join)(currentDir, pmInfo.workspaceFile);
+                if ((0, node_fs_1.existsSync)(workspaceFilePath)) {
                     return currentDir;
                 }
             }
             else {
                 // Check for package.json with workspaces field
-                const packageJsonPath = (0, path_1.join)(currentDir, 'package.json');
-                if ((0, fs_1.existsSync)(packageJsonPath)) {
+                const packageJsonPath = (0, node_path_1.join)(currentDir, 'package.json');
+                if ((0, node_fs_1.existsSync)(packageJsonPath)) {
                     try {
-                        const content = (0, fs_1.readFileSync)(packageJsonPath, 'utf-8');
+                        const content = (0, node_fs_1.readFileSync)(packageJsonPath, 'utf-8');
                         const packageJson = JSON.parse(content);
                         // Check if workspaces field exists and is non-empty
                         if (packageJson.workspaces) {
@@ -159,12 +160,12 @@ class PackageManagerDetector {
                             }
                         }
                     }
-                    catch (error) {
+                    catch {
                         // Invalid package.json, continue searching
                     }
                 }
             }
-            currentDir = (0, path_1.join)(currentDir, '..');
+            currentDir = (0, node_path_1.join)(currentDir, '..');
         }
         return null;
     }
@@ -172,8 +173,8 @@ class PackageManagerDetector {
      * Check if directory is in a workspace
      */
     static isInWorkspace(cwd, packageManager) {
-        return this.findWorkspaceRoot(cwd, packageManager) !== null;
+        return PackageManagerDetector.findWorkspaceRoot(cwd, packageManager) !== null;
     }
 }
 exports.PackageManagerDetector = PackageManagerDetector;
-//# sourceMappingURL=package-manager-detector.js.map
+//# sourceMappingURL=package-manager.js.map

package/dist/shared/pnpm-catalogs.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PnpmCatalogs = exports.DEFAULT_CATALOG = exports.PNPM_WORKSPACE_FILE = void 0;
+exports.isCatalogReference = isCatalogReference;
+exports.writeCatalogUpdates = writeCatalogUpdates;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const yaml_1 = require("yaml");
+const debug_logger_1 = require("./debug-logger");
+exports.PNPM_WORKSPACE_FILE = 'pnpm-workspace.yaml';
+/** Name pnpm gives the top-level `catalog:` map (also addressable as `catalogs.default`). */
+exports.DEFAULT_CATALOG = 'default';
+/** `catalog:` (default) or `catalog:<name>` — the pnpm catalog protocol. */
+function isCatalogReference(version) {
+    return version.startsWith('catalog:');
+}
+/**
+ * The catalog definitions of the nearest `pnpm-workspace.yaml`.
+ *
+ * Catalogs (pnpm ≥ 9.5) hoist shared version ranges out of the member
+ * package.json files: a dependency declared as `"react": "catalog:"` gets its
+ * actual range from this file's `catalog:` map (or `catalogs.<name>` for
+ * `"catalog:<name>"` references). Upgrading such a dependency therefore means
+ * editing pnpm-workspace.yaml, not the referencing package.json.
+ */
+class PnpmCatalogs {
+    path;
+    catalogs;
+    constructor(
+    /** Absolute path of the pnpm-workspace.yaml the catalogs were read from. */
+    path, 
+    /** catalog name → (package name → range). */
+    catalogs) {
+        this.path = path;
+        this.catalogs = catalogs;
+    }
+    /**
+     * Load catalogs from the nearest pnpm-workspace.yaml at or above `startDir`.
+     * Returns null when there is no workspace file, it is unreadable, or it
+     * defines no catalogs — a broken file must never break a scan.
+     */
+    static load(startDir) {
+        const path = findPnpmWorkspaceFile(startDir);
+        if (!path)
+            return null;
+        try {
+            const raw = (0, yaml_1.parse)((0, node_fs_1.readFileSync)(path, 'utf8'));
+            if (!raw || typeof raw !== 'object')
+                return null;
+            const catalogs = new Map();
+            const addCatalog = (name, value) => {
+                if (!value || typeof value !== 'object' || Array.isArray(value))
+                    return;
+                const entries = new Map();
+                for (const [pkg, range] of Object.entries(value)) {
+                    if (typeof range === 'string')
+                        entries.set(pkg, range);
+                }
+                if (entries.size > 0)
+                    catalogs.set(name, entries);
+            };
+            addCatalog(exports.DEFAULT_CATALOG, raw.catalog);
+            if (raw.catalogs && typeof raw.catalogs === 'object' && !Array.isArray(raw.catalogs)) {
+                for (const [name, value] of Object.entries(raw.catalogs)) {
+                    addCatalog(name, value);
+                }
+            }
+            if (catalogs.size === 0)
+                return null;
+            return new PnpmCatalogs(path, catalogs);
+        }
+        catch (error) {
+            debug_logger_1.debugLog.warn('PnpmCatalogs', `failed to parse ${path}: ${error}`);
+            return null;
+        }
+    }
+    /**
+     * Resolve a `catalog:` / `catalog:<name>` version specifier for `packageName`
+     * to the range declared in the workspace file, or null when the reference
+     * points at a catalog (or entry) that does not exist.
+     */
+    resolve(packageName, versionSpecifier) {
+        if (!isCatalogReference(versionSpecifier))
+            return null;
+        const name = versionSpecifier.slice('catalog:'.length).trim() || exports.DEFAULT_CATALOG;
+        const range = this.catalogs.get(name)?.get(packageName);
+        return range === undefined ? null : { catalog: name, range };
+    }
+    /** Every entry declared in the given catalog (empty for unknown catalogs). */
+    entriesOf(catalogName) {
+        const entries = this.catalogs.get(catalogName);
+        if (!entries)
+            return [];
+        return Array.from(entries, ([name, range]) => ({ name, range }));
+    }
+}
+exports.PnpmCatalogs = PnpmCatalogs;
+/**
+ * Write new ranges for catalog entries back into pnpm-workspace.yaml.
+ *
+ * Edits go through the yaml Document API so comments, key order, and the
+ * formatting of untouched nodes survive the round-trip. Entries that no longer
+ * exist in the file (edited since the scan) are skipped, never invented.
+ */
+function writeCatalogUpdates(workspaceFilePath, updates) {
+    const raw = (0, node_fs_1.readFileSync)(workspaceFilePath, 'utf8');
+    const doc = (0, yaml_1.parseDocument)(raw);
+    for (const update of updates) {
+        // The default catalog may live under `catalog:` or `catalogs.default:`.
+        const candidatePaths = update.catalog === exports.DEFAULT_CATALOG
+            ? [
+                ['catalog', update.name],
+                ['catalogs', exports.DEFAULT_CATALOG, update.name],
+            ]
+            : [['catalogs', update.catalog, update.name]];
+        const keyPath = candidatePaths.find((path) => doc.hasIn(path));
+        if (!keyPath) {
+            debug_logger_1.debugLog.warn('PnpmCatalogs', `catalog entry ${update.catalog}:${update.name} no longer exists in ${workspaceFilePath} — skipping`);
+            continue;
+        }
+        doc.setIn(keyPath, update.range);
+    }
+    (0, node_fs_1.writeFileSync)(workspaceFilePath, doc.toString());
+}
+/** Nearest pnpm-workspace.yaml at or above `startDir`, or null. */
+function findPnpmWorkspaceFile(startDir) {
+    let dir = (0, node_path_1.resolve)(startDir);
+    for (;;) {
+        const candidate = (0, node_path_1.join)(dir, exports.PNPM_WORKSPACE_FILE);
+        if ((0, node_fs_1.existsSync)(candidate))
+            return candidate;
+        const parent = (0, node_path_1.dirname)(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+//# sourceMappingURL=pnpm-catalogs.js.map

package/dist/{services → shared/registry}/npm-registry.js

@@ -2,22 +2,25 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fetchPackageVersions = fetchPackageVersions;
 exports.clearPackageCache = clearPackageCache;
-const undici_1 = require("undici");
-const node_zlib_1 = require("node:zlib");
 const node_util_1 = require("node:util");
+const node_zlib_1 = require("node:zlib");
+const undici_1 = require("undici");
 const gunzipAsync = (0, node_util_1.promisify)(node_zlib_1.gunzip);
 const inflateAsync = (0, node_util_1.promisify)(node_zlib_1.inflate);
 const brotliDecompressAsync = (0, node_util_1.promisify)(node_zlib_1.brotliDecompress);
 const config_1 = require("../config");
-const version_1 = require("../utils/version");
-const retry_1 = require("./http/retry");
-const inflight_1 = require("./http/inflight");
-const resizable_semaphore_1 = require("./http/resizable-semaphore");
-const adaptive_controller_1 = require("./http/adaptive-controller");
-const etag_store_1 = require("./http/etag-store");
+const adaptive_controller_1 = require("../http/adaptive-controller");
+const etag_store_1 = require("../http/etag-store");
+const inflight_1 = require("../http/inflight");
+const resizable_semaphore_1 = require("../http/resizable-semaphore");
+const retry_1 = require("../http/retry");
+const versions_1 = require("../versions");
+const registry_config_1 = require("./registry-config");
 const inFlightLookups = new inflight_1.InflightMap();
-const registryOrigin = new URL(config_1.NPM_REGISTRY_URL).origin;
-const registryPathPrefix = new URL(config_1.NPM_REGISTRY_URL).pathname.replace(/\/$/, '');
+// One pool per registry origin: scoped packages may resolve to different
+// registries (`@scope:registry` in .npmrc), and each origin keeps its own
+// keep-alive connections. Most runs still touch a single origin.
+//
 // Connection count is kept == the adaptive controller's ceiling (POOL_CONNECTIONS)
 // so the controller is never silently throttled below its chosen limit. Idle
 // keep-alive connections are cheap.
@@ -28,16 +31,24 @@ const registryPathPrefix = new URL(config_1.NPM_REGISTRY_URL).pathname.replace(/
 // controller. With a headers timeout, a stall surfaces as a transient error the
 // controller can react to (and retry handles). `bodyTimeout` stays 0 — large
 // packuments legitimately stream slowly.
-const registryPool = new undici_1.Pool(registryOrigin, {
-    connections: config_1.POOL_CONNECTIONS,
-    pipelining: 1,
-    keepAliveTimeout: 30_000,
-    keepAliveMaxTimeout: 600_000,
-    headersTimeout: 30_000,
-    bodyTimeout: 0,
-    connectTimeout: 15_000,
-    allowH2: false,
-});
+const poolByOrigin = new Map();
+function poolFor(origin) {
+    let pool = poolByOrigin.get(origin);
+    if (!pool) {
+        pool = new undici_1.Pool(origin, {
+            connections: config_1.POOL_CONNECTIONS,
+            pipelining: 1,
+            keepAliveTimeout: 30_000,
+            keepAliveMaxTimeout: 600_000,
+            headersTimeout: 30_000,
+            bodyTimeout: 0,
+            connectTimeout: 15_000,
+            allowH2: false,
+        });
+        poolByOrigin.set(origin, pool);
+    }
+    return pool;
+}
 const MAX_REGISTRY_ATTEMPTS = 3;
 const RETRY_BACKOFF_MS = [500, 1500, 3000];
 // Fixed concurrency used when adaptive is disabled (INUP_ADAPTIVE=0, the A/B
@@ -48,27 +59,32 @@ async function getFreshPackageData(packageName, currentVersion, onAttempt) {
     const cacheKey = `${packageName}@${currentVersion ?? ''}`;
     return inFlightLookups.dedupe(cacheKey, () => fetchPackageFromRegistry(packageName, onAttempt));
 }
-const encodeRegistryPath = (packageName) => {
+const encodeRegistryPath = (packageName, pathPrefix) => {
     const encodedName = packageName.startsWith('@')
         ? `@${encodeURIComponent(packageName.slice(1).split('/')[0])}/${encodeURIComponent(packageName.slice(packageName.indexOf('/') + 1))}`
         : encodeURIComponent(packageName);
-    return `${registryPathPrefix}/${encodedName}`;
+    return `${pathPrefix}/${encodedName}`;
 };
-async function attemptRegistryFetch(path) {
+async function attemptRegistryFetch(target, path) {
     const startedAt = Date.now();
     // Conditional request: if we have a stored ETag for this packument, ask the
     // registry to validate it. Unchanged → 304 (no body) and we reuse stored data.
     // This still hits the registry every run, so data is never served stale.
-    const cached = (0, etag_store_1.readEtag)(path);
+    // Keys are origin-qualified so two registries can never collide on a path.
+    const cacheKey = `${target.origin}${path}`;
+    const cached = (0, etag_store_1.readEtag)(cacheKey);
     try {
         const requestHeaders = {
             accept: 'application/vnd.npm.install-v1+json',
             'accept-encoding': 'gzip, deflate, br',
         };
+        if (target.authHeader) {
+            requestHeaders.authorization = target.authHeader;
+        }
         if (cached) {
             requestHeaders['if-none-match'] = cached.etag;
         }
-        const { statusCode, headers, body } = await registryPool.request({
+        const { statusCode, headers, body } = await poolFor(target.origin).request({
             path,
             method: 'GET',
             headers: requestHeaders,
@@ -112,12 +128,12 @@ async function attemptRegistryFetch(path) {
         else {
             decoded = raw;
         }
-        const data = (0, version_1.parseVersions)(decoded.toString('utf8'));
+        const data = (0, versions_1.parseVersions)(decoded.toString('utf8'));
         // Persist the ETag for next run's conditional request.
-        const etagHeader = headers['etag'];
+        const etagHeader = headers.etag;
         const etag = Array.isArray(etagHeader) ? etagHeader[0] : etagHeader;
         if (etag) {
-            (0, etag_store_1.writeEtag)(path, etag.toString(), data);
+            (0, etag_store_1.writeEtag)(cacheKey, etag.toString(), data);
         }
         return {
             kind: 'success',
@@ -134,10 +150,10 @@ async function attemptRegistryFetch(path) {
         return { kind: 'transient' };
     }
 }
-async function fetchFromRegistryWithRetries(path, onAttempt) {
+async function fetchFromRegistryWithRetries(target, path, onAttempt) {
     let lastOutcome = { kind: 'transient' };
     for (let attempt = 0; attempt < MAX_REGISTRY_ATTEMPTS; attempt++) {
-        const outcome = await attemptRegistryFetch(path);
+        const outcome = await attemptRegistryFetch(target, path);
         onAttempt?.(outcome);
         if (outcome.kind === 'success' || outcome.kind === 'not-found') {
             return outcome;
@@ -154,8 +170,11 @@ async function fetchFromRegistryWithRetries(path, onAttempt) {
     return lastOutcome;
 }
 async function fetchPackageFromRegistry(packageName, onAttempt) {
-    const path = encodeRegistryPath(packageName);
-    const outcome = await fetchFromRegistryWithRetries(path, onAttempt);
+    // Scoped packages may live on a different registry (with credentials) than
+    // unscoped ones — resolved from the npm config chain, memoized per scope.
+    const target = (0, registry_config_1.registryTargetFor)(packageName);
+    const path = encodeRegistryPath(packageName, target.pathPrefix);
+    const outcome = await fetchFromRegistryWithRetries(target, path, onAttempt);
     if (outcome.kind === 'success') {
         return outcome.data;
     }
@@ -213,8 +232,10 @@ async function fetchPackageVersions(packageNames, options = {}) {
     const pendingEmissions = new Map();
     let nextEmitIndex = 0;
     const flushPending = () => {
-        while (pendingEmissions.has(nextEmitIndex)) {
+        while (true) {
             const ready = pendingEmissions.get(nextEmitIndex);
+            if (!ready)
+                break;
             pendingEmissions.delete(nextEmitIndex);
             options.onBatchReady?.(ready);
             nextEmitIndex++;

package/dist/shared/registry/registry-config.js

@@ -0,0 +1,76 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scopeOfPackage = scopeOfPackage;
+exports.registryTargetFor = registryTargetFor;
+exports.clearRegistryTargetCache = clearRegistryTargetCache;
+const registry_auth_token_1 = __importDefault(require("registry-auth-token"));
+const registry_url_1 = __importDefault(require("registry-auth-token/registry-url"));
+const config_1 = require("../config");
+// The submodule's .d.ts declares the second parameter as `{ npmrc?: … }`, but the
+// implementation consumes the plain npmrc key/value record directly.
+const getRegistryUrl = registry_url_1.default;
+/** Scope of a package name (`@scope/pkg` → `@scope`), or undefined when unscoped. */
+function scopeOfPackage(packageName) {
+    if (!packageName.startsWith('@'))
+        return undefined;
+    const slash = packageName.indexOf('/');
+    return slash > 0 ? packageName.slice(0, slash) : undefined;
+}
+// Config files are re-read on every resolution inside registry-auth-token, so
+// memoize per scope: one resolution per distinct scope per process.
+const targetByScope = new Map();
+function registryTargetFor(packageName, npmrc) {
+    const scope = scopeOfPackage(packageName) ?? '';
+    if (!npmrc) {
+        const cached = targetByScope.get(scope);
+        if (cached)
+            return cached;
+    }
+    const target = resolveTarget(scope || undefined, npmrc);
+    if (!npmrc) {
+        targetByScope.set(scope, target);
+    }
+    return target;
+}
+function resolveTarget(scope, npmrc) {
+    let registryHref = config_1.NPM_REGISTRY_URL;
+    try {
+        registryHref = getRegistryUrl(scope, npmrc);
+    }
+    catch {
+        // Unreadable npm config must never break a run — fall back to the public registry.
+    }
+    let parsed;
+    try {
+        parsed = new URL(registryHref);
+    }
+    catch {
+        parsed = new URL(config_1.NPM_REGISTRY_URL);
+    }
+    let authHeader;
+    try {
+        const auth = (0, registry_auth_token_1.default)(parsed.href, { recursive: true, ...(npmrc ? { npmrc } : {}) });
+        // registry-auth-token stringifies an unset ${ENV_VAR} reference into the
+        // literal "undefined". Sending `Bearer undefined` guarantees a 401 where an
+        // anonymous request might succeed, so treat it as no credentials.
+        if (auth?.token && auth.token !== 'undefined') {
+            authHeader = `${auth.type} ${auth.token}`;
+        }
+    }
+    catch {
+        // No credentials (or unreadable config) → anonymous requests, matching npm.
+    }
+    return {
+        origin: parsed.origin,
+        pathPrefix: parsed.pathname.replace(/\/$/, ''),
+        authHeader,
+    };
+}
+/** Test helper: forget memoized resolutions so npmrc overrides take effect. */
+function clearRegistryTargetCache() {
+    targetByScope.clear();
+}
+//# sourceMappingURL=registry-config.js.map

package/dist/{services → shared/registry}/version-checker.js

@@ -35,21 +35,32 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkForUpdate = checkForUpdate;
 exports.checkForUpdateAsync = checkForUpdateAsync;
-const child_process_1 = require("child_process");
 const semver = __importStar(require("semver"));
 const config_1 = require("../config");
+/** Cap for the self-update check; it must never hold up an interactive session. */
+const UPDATE_CHECK_TIMEOUT_MS = 5000;
 /**
- * Check if the current package version is outdated compared to npm registry
+ * Check if the current package version is outdated compared to npm registry.
+ *
+ * One small registry request (`{registry}/{name}/latest`) instead of spawning
+ * the npm CLI — `npm view` paid a few hundred ms of process startup for the
+ * same answer.
  */
 async function checkForUpdate(packageName, currentVersion) {
     try {
-        // Use npm view to get the latest version from registry
-        const result = (0, child_process_1.execSync)(`npm view ${packageName} version`, {
-            encoding: 'utf-8',
-            timeout: config_1.REQUEST_TIMEOUT,
-            stdio: ['pipe', 'pipe', 'pipe'],
+        const response = await fetch(`${config_1.NPM_REGISTRY_URL}/${encodeURIComponent(packageName)}/latest`, {
+            method: 'GET',
+            headers: { accept: 'application/json' },
+            signal: AbortSignal.timeout(UPDATE_CHECK_TIMEOUT_MS),
         });
-        const latestVersion = result.trim();
+        if (!response.ok) {
+            return null;
+        }
+        const manifest = (await response.json());
+        const latestVersion = typeof manifest.version === 'string' ? manifest.version.trim() : '';
+        if (!semver.valid(latestVersion)) {
+            return null;
+        }
         // Compare versions
         const isOutdated = semver.lt(currentVersion, latestVersion);
         // Determine update command based on how the tool was likely invoked
@@ -63,30 +74,18 @@ async function checkForUpdate(packageName, currentVersion) {
             updateCommand,
         };
     }
-    catch (error) {
+    catch {
         // Silently fail - don't interrupt the user experience
         return null;
     }
 }
 /**
- * Check for updates in the background without blocking
- * Resolves immediately, result available via promise
+ * Check for updates in the background without blocking.
+ *
+ * `checkForUpdate` self-caps at UPDATE_CHECK_TIMEOUT_MS and never rejects
+ * (every failure resolves to null), so no extra timeout race is needed here.
  */
 function checkForUpdateAsync(packageName, currentVersion) {
-    return new Promise((resolve) => {
-        // Set a timeout to prevent hanging
-        const timeout = setTimeout(() => {
-            resolve(null);
-        }, 5000);
-        checkForUpdate(packageName, currentVersion)
-            .then((result) => {
-            clearTimeout(timeout);
-            resolve(result);
-        })
-            .catch(() => {
-            clearTimeout(timeout);
-            resolve(null);
-        });
-    });
+    return checkForUpdate(packageName, currentVersion);
 }
 //# sourceMappingURL=version-checker.js.map

package/dist/{ui/utils → shared/terminal}/cursor.js

@@ -82,7 +82,7 @@ exports.ConsoleUtils = {
     clearProgress() {
         if (!process.stderr.isTTY)
             return;
-        process.stderr.write('\r' + ' '.repeat(exports.ConsoleUtils.LINE_WIDTH) + '\r');
+        process.stderr.write(`\r${' '.repeat(exports.ConsoleUtils.LINE_WIDTH)}\r`);
     },
 };
 //# sourceMappingURL=cursor.js.map

package/dist/{ui/utils → shared/terminal}/index.js

@@ -1,14 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.wrapPlainText = exports.truncatePlainText = exports.stripAnsi = exports.getVisualLength = exports.TerminalInput = exports.RAW_SHOW_CURSOR = exports.RAW_EXIT_ALT_SCREEN = exports.ConsoleUtils = exports.CursorUtils = exports.formatVersionDiff = exports.truncateMiddle = exports.applyVersionPrefix = exports.VersionUtils = void 0;
-var version_1 = require("./version");
-Object.defineProperty(exports, "VersionUtils", { enumerable: true, get: function () { return version_1.VersionUtils; } });
-Object.defineProperty(exports, "applyVersionPrefix", { enumerable: true, get: function () { return version_1.applyVersionPrefix; } });
-Object.defineProperty(exports, "truncateMiddle", { enumerable: true, get: function () { return version_1.truncateMiddle; } });
-Object.defineProperty(exports, "formatVersionDiff", { enumerable: true, get: function () { return version_1.formatVersionDiff; } });
+exports.wrapPlainText = exports.truncatePlainText = exports.stripAnsi = exports.getVisualLength = exports.TerminalInput = exports.RAW_SHOW_CURSOR = exports.RAW_EXIT_ALT_SCREEN = exports.CursorUtils = exports.ConsoleUtils = exports.shouldDisableColor = exports.applyColorSetting = void 0;
+var color_1 = require("./color");
+Object.defineProperty(exports, "applyColorSetting", { enumerable: true, get: function () { return color_1.applyColorSetting; } });
+Object.defineProperty(exports, "shouldDisableColor", { enumerable: true, get: function () { return color_1.shouldDisableColor; } });
 var cursor_1 = require("./cursor");
-Object.defineProperty(exports, "CursorUtils", { enumerable: true, get: function () { return cursor_1.CursorUtils; } });
 Object.defineProperty(exports, "ConsoleUtils", { enumerable: true, get: function () { return cursor_1.ConsoleUtils; } });
+Object.defineProperty(exports, "CursorUtils", { enumerable: true, get: function () { return cursor_1.CursorUtils; } });
 Object.defineProperty(exports, "RAW_EXIT_ALT_SCREEN", { enumerable: true, get: function () { return cursor_1.RAW_EXIT_ALT_SCREEN; } });
 Object.defineProperty(exports, "RAW_SHOW_CURSOR", { enumerable: true, get: function () { return cursor_1.RAW_SHOW_CURSOR; } });
 var terminal_input_1 = require("./terminal-input");

package/dist/{ui/utils → shared/terminal}/terminal-input.js

@@ -85,7 +85,12 @@ exports.TerminalInput = {
     promptForImmediateConfirmation(prompt, defaultValue = true) {
         return new Promise((resolve) => {
             process.stdout.write(prompt);
+            // Replaced synchronously below before any keypress can call finish(),
+            // so the placeholder body is unreachable. (The `v8 ignore next` form
+            // is not honored by coverage-v8 here; the block form is.)
+            /* v8 ignore start */
             let cleanup = () => { };
+            /* v8 ignore stop */
             const finish = (value) => {
                 cleanup();
                 process.stdout.write('\n');