jaitus 0.3.0 → 0.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jaitus",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Jaitus — a coding agent in your terminal.",
   "type": "module",
   "bin": {
@@ -16,7 +16,7 @@
     "node": ">=20"
   },
   "scripts": {
-    "test": "node tests/source-sanity.js && node tests/rules.js && node tests/run.js && node tests/commands.js && node tests/login.js && node tests/session.js && node tests/openUrl.js && node tests/ink-tui.js && node tests/tui-render.js",
+    "test": "node tests/source-sanity.js && node tests/rules.js && node tests/run.js && node tests/commands.js && node tests/login.js && node tests/session.js && node tests/openUrl.js && node tests/ink-tui.js && node tests/tui-render.js && node tests/mouse-e2e.js && node tests/environment.js && node tests/update.js && node tests/continuation.js",
     "preview": "node scripts/tui-preview.js",
     "prepublishOnly": "npm test"
   },

package/src/agent/loop.js

@@ -21,7 +21,9 @@
 import { byName, toolSchemas, ToolError, readImageForModel } from './tools.js';
 import { PermissionDenied } from './permissions.js';
 import path from 'node:path';
-import { loadContext, CONTEXT_FILE } from '../project.js';
+import fs from 'node:fs';
+import os from 'node:os';
+import { loadContext, loadIgnore, CONTEXT_FILE } from '../project.js';
 import { c, out, write, spinner, glyph } from '../ui.js';
 import { discoverMcpTools } from '../mcp.js';
 import { unifiedDiff } from '../diff.js';
@@ -29,6 +31,23 @@ import { fromResponse, fromGatewayBody } from '../errors.js';
 
 const MAX_ITERATIONS = 40;
 
+// Room for a long answer or a large file in one reply. The models behind Jaitus reason
+// before they answer, and that reasoning is spent from the same budget — at 8192 a long
+// answer, or any file of a few hundred lines, was cut off partway.
+export const MAX_OUTPUT_TOKENS = 32000;
+
+// A reply that stopped before it finished — the output limit, or a connection dropped
+// somewhere between the provider and here — is continued, not presented as the answer.
+// Bounded, so a model that never finishes cannot loop on the user's allowance.
+export const MAX_CONTINUATIONS = 4;
+export const CONTINUE_NOTE = 'Your previous reply was cut off before it finished (an output limit or a dropped connection). '
+  + 'Continue from exactly where it stopped: do not repeat or summarise what you already wrote, and do not mention this note. '
+  + 'If you were in the middle of a tool call, make that call again in full.';
+
+// A request that failed before anything arrived (a network blip) is tried again this
+// many times before it is reported.
+const NETWORK_RETRIES = 2;
+
 /** opencode tool icon per tool, muted when done. ASCII twins included. */
 const TOOL_MARKS = {
   run_command: ['$', '$'], read_file: ['→', '>'], read_image: ['→', '>'],
@@ -43,6 +62,11 @@ const toolMark = (name) => {
 
 export const SYSTEM_PROMPT = `You are Jaitus, a coding agent running in a developer's terminal, inside their project directory.
 
+You work directly on this computer. Your tools read, search, create and edit the files in
+the project and run shell commands in it, and you can fetch web pages. When the user asks
+about their files, their code or their machine, use the tools and answer from what you
+find — never say you cannot access local files, because you can.
+
 How to work:
 - Investigate before you change anything. Read the files you are about to edit; do not guess at their contents.
 - Prefer edit_file over write_file for existing files. Keep changes minimal and in the style of the surrounding code.
@@ -65,10 +89,66 @@ How to talk:
  * Fenced and labelled rather than concatenated, so instructions written by whoever owns
  * the repo are visibly the repo's and cannot be mistaken for part of Jaitus's own rules.
  */
+/**
+ * Where the agent is: the facts it would otherwise guess at, and guess wrong.
+ *
+ * Without these, the model did not know which folder it was in, which OS its commands
+ * would run on (cmd.exe and /bin/sh disagree about almost everything), or today's date —
+ * and a model that does not know where it is tends to say it cannot see your files. The
+ * listing is the top level only, names not contents, and respects .jaitusignore.
+ */
+export function environmentBlock(cwd, { now = new Date(), platform = process.platform } = {}) {
+  if (!cwd) return '';
+  const osName = { win32: 'Windows', darwin: 'macOS', linux: 'Linux' }[platform] || platform;
+  const shell = platform === 'win32' ? 'cmd.exe (run_command uses it)' : '/bin/sh (run_command uses it)';
+  // The repository may start above the working directory, and .git may be a file that
+  // points elsewhere (a worktree or submodule).
+  let branch = null;
+  for (let dir = cwd, i = 0; i < 40; i++) {
+    const dotGit = path.join(dir, '.git');
+    try {
+      let gitDir = dotGit;
+      if (fs.statSync(dotGit).isFile()) {
+        const m = /^gitdir:\s*(.+)$/m.exec(fs.readFileSync(dotGit, 'utf8'));
+        if (m) gitDir = path.resolve(dir, m[1].trim());
+      }
+      const head = fs.readFileSync(path.join(gitDir, 'HEAD'), 'utf8').trim();
+      branch = head.startsWith('ref: refs/heads/') ? head.slice(16) : `detached at ${head.slice(0, 7)}`;
+      break;
+    } catch { /* not here; look one level up */ }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  let listing = '';
+  try {
+    const ignore = loadIgnore(cwd);
+    const SKIP = new Set(['.git', 'node_modules']);
+    const names = fs.readdirSync(cwd, { withFileTypes: true })
+      .filter((d) => !SKIP.has(d.name) && !ignore.matches(d.isDirectory() ? `${d.name}/` : d.name) && !ignore.matches(d.name))
+      .map((d) => (d.isDirectory() ? `${d.name}/` : d.name))
+      .sort((a, b) => (b.endsWith('/') - a.endsWith('/')) || a.localeCompare(b));
+    const MAX = 60;
+    listing = names.slice(0, MAX).join('\n') + (names.length > MAX ? `\n… and ${names.length - MAX} more` : '');
+  } catch { /* unreadable: the tools will say why */ }
+  return `
+
+<environment>
+Working directory: ${cwd}
+Platform: ${osName} (${os.release()})
+Shell: ${shell}
+Today: ${now.toISOString().slice(0, 10)}
+Git: ${branch ? `yes, branch ${branch}` : 'no repository at this folder'}
+Top level of the working directory:
+${listing || '(empty)'}
+</environment>`;
+}
+
 export function systemPrompt(cwd) {
   const project = cwd ? loadContext(cwd) : null;
-  if (!project) return SYSTEM_PROMPT;
-  return `${SYSTEM_PROMPT}
+  const base = `${SYSTEM_PROMPT}${environmentBlock(cwd)}`;
+  if (!project) return base;
+  return `${base}
 
 The project you are working in ships a ${CONTEXT_FILE} with notes for you. Follow it where
 it applies, and prefer what it says over your own assumptions about this codebase.
@@ -82,7 +162,7 @@ ${project}
 async function streamTurn({ client, messages, model, system, tools, onText, onToolStart, signal }) {
   const res = await client.messages({
     model,
-    max_tokens: 8192,
+    max_tokens: MAX_OUTPUT_TOKENS,
     system: system || SYSTEM_PROMPT,
     tools,
     messages,
@@ -95,6 +175,10 @@ async function streamTurn({ client, messages, model, system, tools, onText, onTo
   // Blocks are keyed by the index the stream gives them, because they interleave.
   const blocks = new Map();
   let stopReason = null;
+  // Whether the stream ended the way a finished message ends. A stream that just stops
+  // — no message_stop, no stop reason — was cut, and used to be taken as a complete,
+  // silent answer: the "it stops midway for no reason" bug.
+  let sawStop = false;
   const usage = { input_tokens: 0, output_tokens: 0, cache_read_input_tokens: 0, cache_creation_input_tokens: 0 };
   // Usage can arrive at the START of a stream (Anthropic-format providers) or only at
   // the END, in message_delta (OpenAI-format providers, translated by the gateway —
@@ -145,6 +229,9 @@ async function streamTurn({ client, messages, model, system, tools, onText, onTo
         if (event.delta?.stop_reason) stopReason = event.delta.stop_reason;
         takeUsage(event.usage);
         break;
+      case 'message_stop':
+        sawStop = true;
+        break;
       default:
         break;
     }
@@ -159,21 +246,31 @@ async function streamTurn({ client, messages, model, system, tools, onText, onTo
   // independently would corrupt it. The decoder holds the partial bytes until complete.
   const decoder = new TextDecoder();
 
-  for await (const chunk of res.body) {
-    buffer += decoder.decode(chunk, { stream: true });
-    const frames = buffer.split('\n\n');
-    buffer = frames.pop() || '';
-    for (const frame of frames) {
-      for (const line of frame.split('\n')) {
-        if (!line.startsWith('data:')) continue;
-        const raw = line.slice(5).trim();
-        if (!raw || raw === '[DONE]') continue;
-        try { handle(JSON.parse(raw)); } catch { /* keepalive or partial */ }
+  let cut = false;
+  try {
+    for await (const chunk of res.body) {
+      buffer += decoder.decode(chunk, { stream: true });
+      const frames = buffer.split('\n\n');
+      buffer = frames.pop() || '';
+      for (const frame of frames) {
+        for (const line of frame.split('\n')) {
+          if (!line.startsWith('data:')) continue;
+          const raw = line.slice(5).trim();
+          if (!raw || raw === '[DONE]') continue;
+          try { handle(JSON.parse(raw)); } catch { /* keepalive or partial */ }
+        }
       }
+      if (streamError) break;
     }
-    if (streamError) break;
+  } catch (e) {
+    if (signal?.aborted || e?.name === 'AbortError') throw e;
+    // The connection dropped mid-answer. What arrived is kept and continued from; with
+    // nothing received yet, the caller retries the request instead.
+    if (!blocks.size) throw e;
+    cut = true;
   }
   if (streamError) throw streamError;
+  if (cut || (!sawStop && !stopReason)) stopReason = 'cut';
 
   const content = [...blocks.entries()]
     .sort((a, b) => a[0] - b[0])
@@ -222,6 +319,12 @@ export async function runAgent({
     ...Object.fromEntries(mcp.map((tool) => [tool.name, tool])),
   };
 
+  let continuations = 0;
+  let networkRetries = 0;
+  // True while the previous reply is being continued: its text is still on screen as
+  // one live message, and the continuation must extend it rather than start another.
+  let continuing = false;
+
   for (let iteration = 0; iteration < maxIterations; iteration++) {
     let streamed = false;
     const spin = tui ? { stop: () => {}, update: () => {} } : (silent ? { stop: () => {}, update: () => {} } : spinner(glyph('Working…', 'Working...')));
@@ -260,6 +363,15 @@ export async function runAgent({
       spin.stop();
       // Esc during streaming: stop mid-sentence, keep what landed, don't treat it
       // as an error. The partial text is already on screen.
+      // A network failure before anything arrived: try again, briefly, before reporting.
+      // Anything the gateway itself refused (a limit, a sign-in problem) has a status and
+      // is reported at once — retrying it would only repeat the refusal.
+      if (!(signal?.aborted || e?.name === 'AbortError') && !e?.status && networkRetries < NETWORK_RETRIES) {
+        networkRetries += 1;
+        await new Promise((r) => setTimeout(r, 800 * networkRetries));
+        iteration -= 1;
+        continue;
+      }
       if (signal?.aborted || e?.name === 'AbortError') {
         if (tui) tui.flushStream();
         if (streamed && !silent) out('');
@@ -271,8 +383,16 @@ export async function runAgent({
       throw e;
     }
     spin.stop();
-    if (tui) tui.flushStream();
-    if (streamed) { if (tui) tui.printStream('\n'); else if (!silent && !onText) out(''); }
+    networkRetries = 0;
+    const incomplete = turn.stopReason === 'max_tokens' || turn.stopReason === 'cut';
+    // A tool call cut off halfway has JSON that is not whole; it is dropped and the model
+    // is asked to make it again.
+    if (incomplete) turn.content = turn.content.filter((b) => b.type !== 'tool_use' || b.input?.__parse_error === undefined);
+    const willContinue = incomplete && continuations < MAX_CONTINUATIONS && !turn.content.some((b) => b.type === 'tool_use');
+    if (!willContinue) {
+      if (tui) tui.flushStream();
+      if (streamed || continuing) { if (tui) tui.printStream('\n'); else if (!silent && !onText) out(''); }
+    }
 
     totals.input += turn.usage.input_tokens || 0;
     totals.cached += (turn.usage.cache_read_input_tokens || 0) + (turn.usage.cache_creation_input_tokens || 0);
@@ -283,6 +403,24 @@ export async function runAgent({
     // appeared; now it moves after every step of the turn.
     tui?.setTurnTokens?.(totals.input + totals.cached + totals.output);
 
+    if (willContinue) {
+      continuations += 1;
+      continuing = true;
+      const text = turn.content.filter((b) => b.type === 'text');
+      if (text.length) messages.push({ role: 'assistant', content: text });
+      messages.push({ role: 'user', content: [{ type: 'text', text: CONTINUE_NOTE }] });
+      onEvent?.({ type: 'continued', reason: turn.stopReason, count: continuations });
+      continue;
+    }
+    continuing = false;
+    if (incomplete && !turn.content.some((b) => b.type === 'tool_use')) {
+      // Still unfinished after every continuation: say so, rather than let a partial
+      // answer pass as a whole one.
+      const why = 'The reply was still unfinished after several continuations. Ask for the rest, or narrow the request.';
+      if (tui?.notice) tui.notice(why, 'warn');
+      else if (!silent) out(c.yellow(`  ${why}`));
+    }
+
     // Append the assistant turn verbatim — tool_use blocks and all.
     messages.push({ role: 'assistant', content: turn.content });
     onEvent?.({ type: 'assistant_turn', content: turn.content, usage: turn.usage, iteration });

package/src/commands/login.js

@@ -104,16 +104,15 @@ function awaitCallback(server, expectedState) {
   });
 }
 
-export default async function login(argv) {
+/**
+ * The browser sign-in, with no output of its own.
+ *
+ * The command below prints it to the terminal; the app view shows the same steps in its
+ * transcript. Reports progress through `onUrl` (the link to open, shown in case the
+ * browser does not) and `onStatus`. Resolves to { ok: true, user } or { ok: false, message }.
+ */
+export async function signIn({ onUrl = () => {}, onStatus = () => {} } = {}) {
   const { baseUrl, siteUrl } = endpoints();
-
-  const existing = loadCredentials();
-  if (existing?.refreshToken && !argv.includes('--force')) {
-    out(`Already signed in as ${c.bold(existing.user?.email || 'your account')}.`);
-    const again = await ask(`${c.dim('Sign in again? [y/N] ')}`);
-    if (again.toLowerCase() !== 'y') return 0;
-  }
-
   const state = crypto.randomBytes(24).toString('base64url');
   // PKCE (S256): the challenge goes out through the browser, the verifier stays here and
   // is only ever sent in the final exchange.
@@ -140,27 +139,18 @@ export default async function login(argv) {
   url.searchParams.set('device', device);
   url.searchParams.set('platform', process.platform);
 
-  out('');
-  out(`  ${c.brand('Jaitus')} — sign in`);
-  out('');
-  out(`  Opening ${c.cyan(siteUrl + '/cli-auth')} in your browser.`);
-  out(`  ${c.dim('If it does not open, paste this link:')}`);
-  out(`  ${c.dim(url.toString())}`);
-  out('');
-
+  onUrl(url.toString(), `${siteUrl}/cli-auth`);
   openBrowser(url.toString());
-  const spin = spinner(glyph('Waiting for you to authorise in the browser…', 'Waiting for you to authorise in the browser...'));
+  onStatus('waiting');
 
   let code;
   try {
     ({ code } = await awaitCallback(server, state));
   } catch (e) {
-    spin.stop();
     server.close();
-    fail(e.message);
-    return 1;
+    return { ok: false, message: e.message };
   }
-  spin.update(glyph('Finishing sign-in…', 'Finishing sign-in...'));
+  onStatus('finishing');
 
   try {
     const res = await fetch(`${baseUrl}/api/auth/cli/exchange`, {
@@ -169,13 +159,11 @@ export default async function login(argv) {
       body: JSON.stringify({ code, verifier }),
     });
     const body = await res.json().catch(() => ({}));
-    spin.stop();
     server.close();
 
     if (!res.ok || !body?.data?.accessToken || !body?.data?.refreshToken) {
       // Our own sign-in endpoint's wording, or a plain fallback — never a raw body.
-      fail(typeof body?.message === 'string' && body.message ? body.message : 'Sign-in did not complete. Run `jaitus login` again.');
-      return 1;
+      return { ok: false, message: typeof body?.message === 'string' && body.message ? body.message : 'Sign-in did not complete. Try again.' };
     }
 
     saveCredentials({
@@ -188,14 +176,44 @@ export default async function login(argv) {
       createdAt: new Date().toISOString(),
     });
 
-    const who = body.data.user;
-    ok(`Signed in as ${c.bold(who?.email || 'your account')}${who?.isPaid ? '' : c.dim(' (free plan)')}`);
-    info(`Run ${c.bold('jaitus')} in a project to start, or ${c.bold('jaitus --help')} to see everything.`);
-    return 0;
-  } catch (e) {
-    spin.stop();
+    return { ok: true, user: body.data.user || null };
+  } catch {
     server.close();
-    fail('Could not reach Jaitus. Check your connection and run `jaitus login` again.');
+    return { ok: false, message: 'Could not reach Jaitus. Check your connection and try again.' };
+  }
+}
+
+export default async function login(argv, { then = 'hint' } = {}) {
+  const existing = loadCredentials();
+  if (existing?.refreshToken && !argv.includes('--force')) {
+    out(`Already signed in as ${c.bold(existing.user?.email || 'your account')}.`);
+    const again = await ask(`${c.dim('Sign in again? [y/N] ')}`);
+    if (again.toLowerCase() !== 'y') return 0;
+  }
+
+  let spin = null;
+  const result = await signIn({
+    onUrl: (url, shown) => {
+      out('');
+      out(`  ${c.brand('Jaitus')} — sign in`);
+      out('');
+      out(`  Opening ${c.cyan(shown)} in your browser.`);
+      out(`  ${c.dim('If it does not open, paste this link:')}`);
+      out(`  ${c.dim(url)}`);
+      out('');
+    },
+    onStatus: (s) => {
+      if (s === 'waiting') spin = spinner(glyph('Waiting for you to authorise in the browser…', 'Waiting for you to authorise in the browser...'));
+      else spin?.update(glyph('Finishing sign-in…', 'Finishing sign-in...'));
+    },
+  });
+  spin?.stop();
+  if (!result.ok) {
+    fail(`${result.message}${/login/.test(result.message) ? '' : ` Run ${c.bold('jaitus login')} to try again.`}`);
     return 1;
   }
+  const who = result.user;
+  ok(`Signed in as ${c.bold(who?.email || 'your account')}${who?.isPaid ? '' : c.dim(' (free plan)')}`);
+  if (then === 'hint') info(`Run ${c.bold('jaitus')} in a project to start, or ${c.bold('jaitus --help')} to see everything.`);
+  return 0;
 }

package/src/commands/update.js

@@ -1,12 +1,21 @@
 // ─── jaitus update ──────────────────────────────────────────────────────────────
 //
-// Checks the registry and tells you. It deliberately does NOT run the install itself:
-// the CLI may have been installed globally, with npx, through a version manager, or
-// vendored into a repo, and a tool that guesses wrong there either fails confusingly or
-// modifies something it was never asked to modify.
+// Checks the registry, and installs the new version when it can tell HOW this copy was
+// installed: a global npm install is upgraded with the same npm, after asking. Anything
+// else — npx, a version manager, a copy vendored into a repo — gets the command to run
+// instead, because a tool that guesses wrong there either fails confusingly or modifies
+// something it was never asked to modify.
+//
+// A global install never updates itself, so the app also checks once a day, in the
+// background, and says when a newer version is out (the update-notifier pattern npm and
+// gh use). JAITUS_NO_UPDATE_CHECK=1, NO_UPDATE_NOTIFIER or CI turns that off.
 
-import { c, out, ok, info, warn, present } from '../ui.js';
-import { version } from '../config.js';
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { c, out, ok, info, warn, fail, present, askKey } from '../ui.js';
+import { version, HOME } from '../config.js';
 
 const REGISTRY = process.env.JAITUS_REGISTRY || 'https://registry.npmjs.org';
 const TIMEOUT_MS = 5000;
@@ -46,6 +55,74 @@ export async function latestVersion() {
   return (await checkRegistry()).version;
 }
 
+const CHECK_FILE = path.join(HOME, 'update-check.json');
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+/** Whether the background check is allowed to run at all. */
+export function updateCheckEnabled(env = process.env) {
+  return !(env.JAITUS_NO_UPDATE_CHECK || env.NO_UPDATE_NOTIFIER || env.CI);
+}
+
+/**
+ * The newest published version, asked of the registry at most once a day.
+ *
+ * Cached so opening the app is never slowed by, or dependent on, the network: a failed
+ * check is remembered too, and simply tried again tomorrow.
+ */
+export async function cachedLatest({ now = Date.now(), file = CHECK_FILE, check = checkRegistry } = {}) {
+  try {
+    const cached = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (cached && now - Number(cached.checkedAt) < DAY_MS) return cached.latest || null;
+  } catch { /* first run, or unreadable: ask */ }
+  const { version: latest } = await check();
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify({ checkedAt: now, latest: latest || null }));
+  } catch { /* read-only home: check again next time */ }
+  return latest || null;
+}
+
+/** One line for the app to show when a newer version is out, or null. */
+export async function updateNotice(opts = {}) {
+  if (!updateCheckEnabled(opts.env)) return null;
+  const current = opts.current || version();
+  const latest = await cachedLatest(opts).catch(() => null);
+  if (!latest || !isNewer(latest, current)) return null;
+  return `Jaitus v${latest} is out — you have v${current}. Quit and run \`jaitus update\` to install it.`;
+}
+
+function run(cmd, args, { capture = false } = {}) {
+  return new Promise((resolve) => {
+    // npm is npm.cmd on Windows, which spawn cannot start without a shell. The arguments
+    // here are fixed strings (a version number from the registry at most), so they are
+    // joined into one command line rather than passed alongside shell: true, which Node
+    // deprecates because it does not escape them.
+    const stdio = capture ? ['ignore', 'pipe', 'ignore'] : 'inherit';
+    const child = process.platform === 'win32'
+      ? spawn([cmd, ...args].join(' '), { shell: true, stdio })
+      : spawn(cmd, args, { stdio });
+    let stdout = '';
+    child.stdout?.on('data', (d) => { stdout += d; });
+    child.on('error', () => resolve({ code: -1, stdout }));
+    child.on('close', (code) => resolve({ code, stdout }));
+  });
+}
+
+/**
+ * How this copy was installed: 'npm-global', 'npx', or 'other'.
+ *
+ * Decided by where this file actually lives, compared with npm's own global folder —
+ * not by guessing from environment variables.
+ */
+export async function installMethod({ here = fileURLToPath(import.meta.url), npmRoot = null } = {}) {
+  const real = (() => { try { return fs.realpathSync(here); } catch { return here; } })();
+  const norm = (p) => path.resolve(p).toLowerCase();
+  if (/[\\/]_npx[\\/]/.test(real)) return 'npx';
+  const root = npmRoot ?? (await run('npm', ['root', '-g'], { capture: true })).stdout.trim();
+  if (root && norm(real).startsWith(norm(path.join(root, 'jaitus')) + path.sep.toLowerCase())) return 'npm-global';
+  return 'other';
+}
+
 /**
  * Plain semver comparison — is `a` newer than `b`?
  * Prerelease tags are treated as older than the release they lead to, which is what
@@ -67,7 +144,61 @@ export function isNewer(a, b) {
   return false;
 }
 
-export default async function update(argv = [], { json = false } = {}) {
+/**
+ * Update on launch, then reopen: every time `jaitus` starts, the registry is asked
+ * (with a short timeout, so a slow network costs at most that); when a newer version is
+ * out and this copy is a global npm install, it is installed and the same command is
+ * started again on the new version.
+ *
+ * It never blocks the session on a failure. A failed install (commonly: a system-wide
+ * Node on macOS or Linux, where npm -g needs sudo) says so once and is not retried for a
+ * day, so a machine that cannot update does not pay for trying on every start.
+ *
+ * Off with `jaitus config autoUpdate off`, JAITUS_NO_AUTOUPDATE=1, NO_UPDATE_NOTIFIER or CI.
+ * Returns the child's exit code when it relaunched, or null to carry on in this process.
+ */
+export async function autoUpdate({ argv = [], settings = {}, env = process.env, current = version(), log = out,
+  check = () => checkRegistry(), method = () => installMethod(), install = (v) => run('npm', ['install', '-g', `jaitus@${v}`], { capture: true }),
+  relaunch = defaultRelaunch, now = Date.now(), failFile = path.join(HOME, 'update-failed.json') } = {}) {
+  if (env.JAITUS_UPDATED_FROM) return null;                // just relaunched: never loop
+  if (!updateCheckEnabled(env) || env.JAITUS_NO_AUTOUPDATE || settings.autoUpdate === false) return null;
+  if (!process.stdout.isTTY || !process.stdin.isTTY) return null;   // scripts and pipes get a stable version
+  const first = argv.find((a) => !a.startsWith('-'));
+  if (['update', 'completion', 'help', 'logout'].includes(first) || argv.some((a) => ['--version', '-v', '--help', '-h', '--print', '-p'].includes(a))) return null;
+  try {
+    const failed = JSON.parse(fs.readFileSync(failFile, 'utf8'));
+    if (now - Number(failed.at) < DAY_MS) return null;
+  } catch { /* no recent failure */ }
+
+  const { version: latest } = await Promise.race([
+    check(),
+    // unref: a quick command must not sit waiting for this timer after the answer came.
+    new Promise((resolve) => setTimeout(() => resolve({ version: null }), 1500).unref()),
+  ]);
+  if (!latest || !isNewer(latest, current)) return null;
+  if ((await method()) !== 'npm-global') return null;       // the in-app notice covers these
+
+  log(`  ${c.brand('Jaitus')} ${c.dim(`v${current} →`)} ${c.bold(`v${latest}`)} ${c.dim('— updating…')}`);
+  const { code } = await install(latest);
+  if (code !== 0) {
+    try { fs.mkdirSync(path.dirname(failFile), { recursive: true }); fs.writeFileSync(failFile, JSON.stringify({ at: now, version: latest })); } catch { /* best effort */ }
+    log(`  ${c.yellow('!')} ${c.dim('Could not update automatically — continuing on')} v${current}${c.dim('. To update:')} ${c.bold(process.platform === 'win32' ? 'npm install -g jaitus@latest' : 'sudo npm install -g jaitus@latest')}`);
+    return null;
+  }
+  log(`  ${c.accent('✓')} ${c.dim('Updated — reopening')}`);
+  return relaunch({ ...env, JAITUS_UPDATED_FROM: current });
+}
+
+/** Start the same command again on the freshly installed version, in this terminal. */
+function defaultRelaunch(env) {
+  return new Promise((resolve) => {
+    const child = spawn(process.execPath, [...process.execArgv, process.argv[1], ...process.argv.slice(2)], { stdio: 'inherit', env });
+    child.on('error', () => resolve(null));
+    child.on('exit', (code, signal) => resolve(signal ? 1 : (code ?? 0)));
+  });
+}
+
+export default async function update(argv = [], { json = false, interactive = true } = {}) {
   const current = version();
   const { version: latest, status } = await checkRegistry();
 
@@ -89,9 +220,36 @@ export default async function update(argv = [], { json = false } = {}) {
     out('');
     out(`  ${c.bold(`v${latest}`)} is available ${c.dim(`— you have v${current}`)}`);
     out('');
-    out(`  ${c.dim('global install')}   ${c.bold('npm install -g jaitus')}`);
+  });
+  if (!available || json) return 0;
+
+  const manual = () => {
+    out(`  ${c.dim('global install')}   ${c.bold('npm install -g jaitus@latest')}`);
     out(`  ${c.dim('no install')}       ${c.bold('npx jaitus@latest')}`);
     out('');
-  });
+  };
+  // Inside the app the running copy cannot be swapped out from under itself.
+  if (!interactive) { info('Quit Jaitus, then run it from your shell:'); manual(); return 0; }
+
+  const method = await installMethod();
+  if (method !== 'npm-global') {
+    info(method === 'npx' ? 'You are running it through npx — use @latest to get the new version:' : 'This copy was not installed with npm -g, so update it the way you installed it, or:');
+    manual();
+    return 0;
+  }
+  const yes = argv.includes('--yes') || argv.includes('-y');
+  if (!yes) {
+    if (!process.stdin.isTTY) { manual(); return 0; }
+    const answer = await askKey(`  Install v${latest} now? ${c.dim('[Y/n]')} `, ['y', 'n', '\r', '\n']);
+    if (answer === 'n') { manual(); return 0; }
+  }
+  out(`  ${c.dim('running')} npm install -g jaitus@${latest}`);
+  const { code } = await run('npm', ['install', '-g', `jaitus@${latest}`]);
+  if (code !== 0) {
+    fail(`npm could not install it (exit ${code}). Try it yourself — on macOS or Linux it may need sudo, or a Node version manager:`);
+    manual();
+    return 1;
+  }
+  ok(`Updated to v${latest}. Start ${c.bold('jaitus')} again to use it.`);
   return 0;
 }

package/src/errors.js

@@ -8,8 +8,8 @@
 // recognise, because the only text that is safe to show is text we wrote.
 
 const CATALOG = {
-  auth_required: { title: 'Not signed in', hint: 'Run `jaitus login` to sign in.' },
-  session_expired: { title: 'Signed out', hint: 'Run `jaitus login` to sign in again.' },
+  auth_required: { title: 'Not signed in', hint: 'Type /login to sign in (or run `jaitus login`).' },
+  session_expired: { title: 'Signed out', hint: 'Type /login to sign in again (or run `jaitus login`).' },
   account_suspended: { title: 'Account suspended', hint: 'Contact support if you think this is a mistake.' },
   email_unverified: { title: 'Email not verified', hint: 'Open the verification link in your inbox, then retry.' },
   free_limit_reached: { title: 'Free prompts used up', hint: 'Subscribe on the website, then retry this turn.' },