litura-app 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,19 @@
+# Changelog
+
+Litura follows [semantic versioning](https://semver.org). Until 1.0 the minor
+number carries breaking changes.
+
+## Unreleased
+
+## 0.2.0 — 2026-09-06
+
+- Settings can ask npm about new versions once a day, off by default. When a newer version is published the header shows a badge linking to this file; the badge links rather than installs, so updating stays a command you run. Left off, Litura opens no connection of its own.
+- Releases are cut by tag, with GitHub Actions running the checks and publishing over OIDC.
+
+## 0.1.0 — 2026-09-06
+
+First npm release, published as `litura-app`; the command it installs is `litura`.
+
+- Run from any folder with `npx litura-app`. The draft and the style guide are read from the folder Litura starts in, not from its install directory.
+- The browser opens on start, and a taken port falls through to the next free one.
+- `litura --version` and `litura --check-update` report the running and published versions. Litura opens no connection of its own.

package/README.md

@@ -21,7 +21,7 @@ Right-click a selection to attach it to the composer, or press `Cmd/Ctrl+K` to a
 
 The draft, findings, conversation, and selected model are stored in browser local storage and survive a reload.
 
-The draft is also mirrored to `draft.md` in the folder Litura was started from, so it survives cleared browser storage and opens in any editor. The browser copy stays authoritative while the app runs; if the file changes underneath it, Litura says so and offers to load it rather than merging or overwriting silently. Nothing leaves the machine except what a model request sends to the selected provider.
+The draft is also mirrored to `draft.md` in the folder Litura was started from, so it survives cleared browser storage and opens in any editor. The browser copy stays authoritative while the app runs; if the file changes underneath it, Litura says so and offers to load it rather than merging or overwriting silently. Nothing leaves the machine except what a model request sends to the selected provider — and, if you switch it on in settings, a once-a-day question to the npm registry about new versions.
 
 
 ## Run
@@ -53,7 +53,11 @@ Running `npx litura-app` is the update: for a bare package name npm re-resolves
 npx litura-app --check-update
 ```
 
-prints the published version next to the running one. Litura opens no connection on its own — the check happens only when you run it, and nothing else phones home.
+prints the published version next to the running one.
+
+Settings has an `Ask npm about new versions` switch, off by default. Turn it on and Litura asks once a day and shows a badge in the header when a newer version is published; the badge links to the changelog rather than installing anything. Left off, Litura opens no connection of its own.
+
+Releases are cut by tag: `npm version <patch|minor|major>`, then `git push` and `git push --tags`. GitHub Actions runs the checks, verifies the tag matches `package.json`, and publishes.
 
 An update leaves your draft, your `style.md`, and your model settings alone. Stored findings and chat history are dropped only when a release changes their format.
 

package/SPEC.md

@@ -205,6 +205,8 @@ When no model is selected, the review, rewrite, and chat actions re-check Pi sta
 | Chat history | `localStorage["wa-chat"]`, last 20 turns | Until `Clear` or browser storage is cleared |
 | Findings | `localStorage["wa-findings"]` | Until a new review, `Clear`, or browser storage is cleared |
 | Automatic review setting | `localStorage["wa-autoreview"]` | Until browser storage is cleared |
+| Update-check setting | `localStorage["wa-updatecheck"]`, off unless set to `on` | Until browser storage is cleared |
+| Last seen published version | `localStorage["wa-update"]` as `{ latest, at }`, reused for 24 hours | Until browser storage is cleared |
 | Checked sentences | Browser memory | Until reload or a full review reset |
 | API credentials | Pi credential storage or environment | Managed by Pi |
 
@@ -265,6 +267,7 @@ All bodies and non-streaming responses are JSON unless noted.
 | `GET` | `/style.css`, `/app.js`, `/fonts/*` | Static assets |
 | `GET` | `/draft` | Current contents of the draft file as `{ text, path }` |
 | `PUT` | `/draft` | Overwrite the draft file with `{ text }` |
+| `GET` | `/api/version` | `{ name, current }`; with `?check=1` also `latest` from the npm registry, or `error` if it is unreachable |
 | `GET` | `/api/agent/status` | Providers, models, auth status, and default selection |
 | `POST` | `/api/agent/credentials` | Save a provider API key through Pi |
 | `DELETE` | `/api/agent/credentials` | Remove a stored provider credential |
@@ -338,9 +341,17 @@ Each review pass validates diagnostic codes against its assigned levels and chec
 
 ## 9. Distribution and updates
 
-Litura is published to npm and run as `npx litura` from the folder holding the draft. For a bare package name npm re-resolves the registry manifest on every run, so starting Litura is the update; a global install (`npm i -g`) shadows that check and has to be updated by hand.
+Litura is published to npm as `litura-app`; the command it installs is `litura`. It runs as `npx litura-app` from the folder holding the draft. For a bare package name npm re-resolves the registry manifest on every run, so starting Litura is the update; a global install (`npm i -g`) shadows that check and has to be updated by hand.
 
-`litura --version` prints the running version. `litura --check-update` prints the published version next to it. Neither the server nor the browser contacts the registry on its own: the check runs only when the command asks for it.
+`litura --version` prints the running version. `litura --check-update` prints the published version next to it, and reports an unpublished package rather than comparing against nothing. Neither flag ranks the two versions: a local build legitimately runs ahead of the registry, and ordering semver correctly would be a dependency.
+
+In the browser, `Ask npm about new versions` in settings is off by default and stored in `wa-updatecheck`. Off, the browser calls `/api/version` without `?check=1` and the server contacts nothing. On, it asks at most once every 24 hours, caches the answer in `wa-update`, and shows a header badge linking to the changelog when the published version differs from the running one. Switching it off hides the badge rather than leaving a stale one.
+
+### Releasing
+
+A release is a tag. `npm version <patch|minor|major>` refuses a dirty tree, bumps `package.json`, commits, and tags. Push the branch and the tag as two pushes — `git push && git push --tags` — rather than `--follow-tags`: pushing v0.1.0 together with its branch produced a run for the branch only. The tag push triggers `.github/workflows/release.yml`, which runs `npm run check`, verifies the tag matches `package.json`, and publishes with npm trusted publishing (OIDC, no stored token). Every other push runs the checks without publishing. `npm run check` passes without provider credentials: the Pi section asserts the shape of the model list, not its contents.
+
+### What survives
 
 | Survives an update | Mechanism |
 |---|---|

package/index.js

@@ -25,6 +25,15 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const MANIFEST = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf8'));
 const VERSION = MANIFEST.version;
 
+// Ask npm what it publishes. `null` means the package is not published at all
+// — a local build asking about itself — which is not the same as a failure.
+async function latestPublished(name = MANIFEST.name) {
+  const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(name)}/latest`);
+  if (response.status === 404) return null;
+  if (!response.ok) throw new Error(`registry returned ${response.status}`);
+  return (await response.json()).version;
+}
+
 // ─── CLI ───────────────────────────────────────────────────────────────────
 // Both flags run before the bundler and the server: they answer and exit.
 if (process.argv.includes('--version') || process.argv.includes('-v')) {
@@ -37,18 +46,10 @@ if (process.argv.includes('--version') || process.argv.includes('-v')) {
 // not something that happens quietly at startup.
 if (process.argv.includes('--check-update')) {
   const name = MANIFEST.name;
-  // A 404 is the registry answering, not failing: an unpublished build asking
-  // about itself. Say so instead of reporting version "undefined".
-  const latest = await fetch(`https://registry.npmjs.org/${encodeURIComponent(name)}/latest`)
-    .then(async response => {
-      if (response.status === 404) return null;
-      if (!response.ok) throw new Error(`registry returned ${response.status}`);
-      return (await response.json()).version;
-    })
-    .catch(error => {
-      console.error(`[update] npm registry unreachable — ${error.message}`);
-      process.exit(1);
-    });
+  const latest = await latestPublished(name).catch(error => {
+    console.error(`[update] npm registry unreachable — ${error.message}`);
+    process.exit(1);
+  });
   if (latest === null) {
     console.log(`Litura ${VERSION} — ${name} is not published; nothing to compare against.`);
     process.exit(0);
@@ -208,6 +209,19 @@ function readBody(req) {
 const server = http.createServer(async (req, res) => {
   const url = new URL(req.url, `http://localhost`);
 
+  // Which version is running, and — only when the browser asks with ?check=1,
+  // which it does only if the writer turned the check on — which is published.
+  // A registry that is down is reported, not retried: this is a nicety.
+  if (req.method === 'GET' && url.pathname === '/api/version') {
+    const payload = { name: MANIFEST.name, current: VERSION };
+    if (url.searchParams.get('check') === '1') {
+      try { payload.latest = await latestPublished(); }
+      catch (error) { payload.error = error.message; }
+    }
+    sendJson(res, 200, payload);
+    return;
+  }
+
   if (req.method === 'GET' && url.pathname === '/api/agent/status') {
     sendJson(res, 200, await getAgentStatus());
     return;

package/package.json

@@ -1,8 +1,15 @@
 {
   "name": "litura-app",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "A local AI-assisted editor for sharper, more human writing",
-  "keywords": ["writing", "editor", "ai", "prose", "markdown", "local"],
+  "keywords": [
+    "writing",
+    "editor",
+    "ai",
+    "prose",
+    "markdown",
+    "local"
+  ],
   "license": "MIT",
   "author": "Vadim Chirkov",
   "homepage": "https://github.com/vadimchirkov/litura#readme",
@@ -28,7 +35,8 @@
     "review-prompt.js",
     "public",
     "style.md",
-    "SPEC.md"
+    "SPEC.md",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "start": "node index.js",

package/public/app.js

@@ -16592,6 +16592,9 @@
   var scoreEl = document.getElementById("style-score");
   var chatPanel = document.getElementById("chat");
   var autoReviewEl = document.getElementById("auto-review");
+  var updateCheckEl = document.getElementById("update-check");
+  var updateBadge = document.getElementById("update-badge");
+  var updateStatus = document.getElementById("update-status");
   var chatHeight = 140;
   var STORAGE_SCHEMA = "1";
   if (localStorage.getItem("wa-schema") !== STORAGE_SCHEMA) {
@@ -17001,6 +17004,38 @@
     autoReviewOn = autoReviewEl.checked;
     localStorage.setItem("wa-autoreview", autoReviewOn ? "on" : "off");
   });
+  var UPDATE_INTERVAL = 24 * 60 * 60 * 1e3;
+  var updateCheckOn = localStorage.getItem("wa-updatecheck") === "on";
+  updateCheckEl.checked = updateCheckOn;
+  function renderUpdate({ current, latest, error }) {
+    const stale = Boolean(latest) && latest !== current;
+    updateBadge.hidden = !stale;
+    if (stale) {
+      updateBadge.textContent = `${latest} available`;
+      updateBadge.title = `Running ${current}. Restart with npx to pick it up; a global install needs npm i -g.`;
+    }
+    updateStatus.textContent = error ? `Running ${current} \u2014 npm could not be reached.` : stale ? `Running ${current}; npm publishes ${latest}.` : latest ? `Running ${current} \u2014 the published version.` : `Running ${current}.`;
+  }
+  async function refreshUpdate({ force = false } = {}) {
+    let cached = null;
+    try {
+      cached = JSON.parse(localStorage.getItem("wa-update") || "null");
+    } catch {
+    }
+    const check = updateCheckOn && (force || !(cached && Date.now() - cached.at < UPDATE_INTERVAL));
+    try {
+      const info = await api(`/api/version${check ? "?check=1" : ""}`);
+      if (info.latest) localStorage.setItem("wa-update", JSON.stringify({ latest: info.latest, at: Date.now() }));
+      renderUpdate({ ...info, latest: info.latest ?? (updateCheckOn ? cached?.latest : void 0) });
+    } catch {
+    }
+  }
+  updateCheckEl.addEventListener("change", () => {
+    updateCheckOn = updateCheckEl.checked;
+    localStorage.setItem("wa-updatecheck", updateCheckOn ? "on" : "off");
+    refreshUpdate({ force: updateCheckOn });
+  });
+  refreshUpdate();
   function syncStyleScore() {
     const text = workView.state.doc.toString();
     const { score, structural } = styleScore(text);

package/public/index.html

@@ -20,6 +20,12 @@
         <span class="wordmark">Litura</span>
         <span class="style-score" id="style-score" title="Local AI-tell score (0 = clean). Computed in the browser, no model call."></span>
         <button class="review-button" id="review-button" title="Review writing and structure">Review</button>
+        <!-- Only ever shown when the writer opted into the check and a newer
+             version exists. It links to the changelog, not to an installer:
+             updating is a command the writer runs. -->
+        <a class="update-badge" id="update-badge" hidden
+           href="https://github.com/vadimchirkov/litura/blob/main/CHANGELOG.md"
+           target="_blank" rel="noreferrer"></a>
         <span class="agent-status" id="agent-status">Pi</span>
         <button class="settings-open" id="settings-open" title="Model and access" aria-label="Model and access">⚙</button>
       </div>
@@ -81,6 +87,15 @@
         </label>
       </section>
 
+      <section>
+        <h3>Updates</h3>
+        <label class="settings-check">
+          <input type="checkbox" id="update-check">
+          <span>Ask npm about new versions<small>Off by default, once a day when on. It is the only request Litura makes that no writing of yours asked for.</small></span>
+        </label>
+        <p class="settings-hint" id="update-status"></p>
+      </section>
+
       <section>
         <h3>API keys</h3>
         <div class="key-entry">

package/public/style.css

@@ -251,6 +251,21 @@ html, body {
 .style-score:empty { margin-left: auto; }
 .style-score.warn { color: var(--accent); }
 
+/* Available update — quiet on purpose. Nothing is broken, and the writer is
+   mid-sentence; this must not compete with the draft. */
+.update-badge {
+  padding: 2px 8px;
+  border-radius: var(--r-pill);
+  background: var(--fill);
+  color: var(--text-2);
+  font-size: 12px;
+  text-decoration: none;
+  white-space: nowrap;
+}
+
+.update-badge:hover { background: var(--fill-hover); color: var(--text); }
+.update-badge[hidden] { display: none; }
+
 /* Secondary pill button — ChatGPT's action/secondary style */
 .review-button {
   display: inline-flex;