maqcli 0.6.0 → 0.6.1

package/dist/core/command-catalog.js

@@ -42,6 +42,7 @@ export const maqCommands = [
     { name: "flow", category: "control", summary: "Scheduled agent sessions (run under the daemon).", usage: "maq flow [list|add|remove]", needsInput: "none", args: [] },
     { name: "audit", category: "control", summary: "Verify a run's hash-chained audit log.", usage: "maq audit verify <run-dir>", needsInput: "none", args: [] },
     { name: "security", category: "system", summary: "Enforced security rules (protected paths, egress allowlist, injection scanning) + recent findings.", usage: "maq security [report|rules|scan <path>]", needsInput: "none", args: [] },
+    { name: "update", category: "system", summary: "Check npm for a newer maqcli and self-update.", usage: "maq update [--check]", needsInput: "none", args: [{ name: "check", type: "boolean", description: "only check, don't install" }] },
 ];
 /** Catalog of AI worker CLIs' own commands/flags (verified 2026-07-01). */
 export const aiCliCatalog = [

package/dist/core/launcher.js

@@ -353,7 +353,7 @@ async function connectMobile(rl) {
 async function launchUi(authKey) {
     // Reuse the daemon; open its landing page. Import lazily to avoid a cycle.
     const { createDaemon } = await import("../server/daemon.js");
-    const daemon = createDaemon({ token: authKey, version: "0.6.0" });
+    const daemon = createDaemon({ token: authKey, version: "0.6.1" });
     try {
         const { host, port } = await daemon.listen();
         const url = `http://${host}:${port}/`;

package/dist/core/update.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Self-update — lets a user run `maq update` from inside the CLI instead of
+ * remembering the npm incantation. Checks the npm registry for the latest
+ * published version, compares it to the running version, and (unless
+ * --check-only) re-installs globally via npm.
+ *
+ * Network access here is a deliberate, user-initiated exception to the
+ * default-deny egress posture (core/security.ts) — it only ever talks to the
+ * npm registry, and only when the user explicitly runs this command.
+ */
+export interface VersionInfo {
+    current: string;
+    latest: string | null;
+    upToDate: boolean;
+    error?: string;
+}
+/** Returns true if `latest` is strictly newer than `current`. */
+export declare function isNewer(current: string, latest: string): boolean;
+/** Query the npm registry for the latest published version of `maqcli`. */
+export declare function fetchLatestVersion(registryUrl?: string, timeoutMs?: number): Promise<string>;
+/** Compare the running version against the registry; never throws. */
+export declare function checkForUpdate(currentVersion: string): Promise<VersionInfo>;
+export interface UpdateOutcome {
+    ok: boolean;
+    message: string;
+    version?: VersionInfo;
+}
+/**
+ * Perform the update: check the registry, and if a newer version exists,
+ * run `npm install -g maqcli@<latest>`. `runner` is injectable for tests —
+ * it defaults to execSafe (shell:false, argument array; never string-built).
+ */
+export declare function performUpdate(currentVersion: string, opts?: {
+    checkOnly?: boolean;
+    runner?: (cmd: string, args: string[]) => Promise<{
+        code: number | null;
+        stdout: string;
+        stderr: string;
+    }>;
+}): Promise<UpdateOutcome>;

package/dist/core/update.js

@@ -0,0 +1,75 @@
+/**
+ * Self-update — lets a user run `maq update` from inside the CLI instead of
+ * remembering the npm incantation. Checks the npm registry for the latest
+ * published version, compares it to the running version, and (unless
+ * --check-only) re-installs globally via npm.
+ *
+ * Network access here is a deliberate, user-initiated exception to the
+ * default-deny egress posture (core/security.ts) — it only ever talks to the
+ * npm registry, and only when the user explicitly runs this command.
+ */
+import { execSafe } from "./exec.js";
+/** Parse "x.y.z" into a comparable tuple; non-numeric parts sort as 0. */
+function parseSemver(v) {
+    const parts = v.replace(/^v/, "").split(".").map((p) => parseInt(p, 10));
+    return [parts[0] || 0, parts[1] || 0, parts[2] || 0];
+}
+/** Returns true if `latest` is strictly newer than `current`. */
+export function isNewer(current, latest) {
+    const a = parseSemver(current);
+    const b = parseSemver(latest);
+    for (let i = 0; i < 3; i++) {
+        if (b[i] > a[i])
+            return true;
+        if (b[i] < a[i])
+            return false;
+    }
+    return false;
+}
+/** Query the npm registry for the latest published version of `maqcli`. */
+export async function fetchLatestVersion(registryUrl = "https://registry.npmjs.org/maqcli/latest", timeoutMs = 8000) {
+    const res = await fetch(registryUrl, { signal: AbortSignal.timeout(timeoutMs) });
+    if (!res.ok)
+        throw new Error(`registry returned ${res.status}`);
+    const body = (await res.json());
+    if (!body.version)
+        throw new Error("registry response missing a version field");
+    return body.version;
+}
+/** Compare the running version against the registry; never throws. */
+export async function checkForUpdate(currentVersion) {
+    try {
+        const latest = await fetchLatestVersion();
+        return { current: currentVersion, latest, upToDate: !isNewer(currentVersion, latest) };
+    }
+    catch (e) {
+        return { current: currentVersion, latest: null, upToDate: true, error: e.message };
+    }
+}
+/**
+ * Perform the update: check the registry, and if a newer version exists,
+ * run `npm install -g maqcli@<latest>`. `runner` is injectable for tests —
+ * it defaults to execSafe (shell:false, argument array; never string-built).
+ */
+export async function performUpdate(currentVersion, opts = {}) {
+    const version = await checkForUpdate(currentVersion);
+    if (version.error) {
+        return { ok: false, message: `could not check for updates: ${version.error}`, version };
+    }
+    if (version.upToDate) {
+        return { ok: true, message: `already up to date (v${version.current})`, version };
+    }
+    if (opts.checkOnly) {
+        return { ok: true, message: `update available: v${version.current} -> v${version.latest}`, version };
+    }
+    const runner = opts.runner ?? (async (cmd, args) => execSafe(cmd, args, { timeoutMs: 120000 }));
+    const outcome = await runner("npm", ["install", "-g", `maqcli@${version.latest}`]);
+    if (outcome.code !== 0) {
+        return {
+            ok: false,
+            message: `update to v${version.latest} failed (exit ${outcome.code}): ${outcome.stderr.slice(0, 400) || outcome.stdout.slice(0, 400)}`,
+            version,
+        };
+    }
+    return { ok: true, message: `updated v${version.current} -> v${version.latest}`, version };
+}

package/dist/index.js

@@ -43,9 +43,10 @@ import { runInit } from "./core/init-wizard.js";
 import { CostTracker } from "./core/cost-tracker.js";
 import { runLauncher } from "./core/launcher.js";
 import { runOrchestration } from "./core/orchestrator.js";
+import { performUpdate } from "./core/update.js";
 import { checkProtectedPath, scanForInjection, securityLog, securityRules, } from "./core/security.js";
 import { readFileSync, statSync } from "node:fs";
-const VERSION = "0.6.0";
+const VERSION = "0.6.1";
 async function main(argv) {
     const [command, ...rest] = argv;
     switch (command) {
@@ -79,6 +80,8 @@ async function main(argv) {
             return cmdOrchestrate(rest);
         case "security":
             return cmdSecurity(rest);
+        case "update":
+            return cmdUpdate(rest);
         case "verify":
             return cmdVerify(rest);
         case "serve":
@@ -426,6 +429,28 @@ function cmdSecurity(args) {
     return 0;
 }
 /** Machine-readable rule set — shared shape with the daemon's GET /v1/security. */
+async function cmdUpdate(args) {
+    const { values } = parseArgs({
+        args,
+        options: { ...commonFlags(), check: { type: "boolean", default: false } },
+        allowPositionals: true,
+    });
+    logger.out(`current version: ${VERSION}`);
+    logger.out(values.check ? "checking npm for a newer version…" : "checking npm and updating if a newer version is available…");
+    const outcome = await performUpdate(VERSION, { checkOnly: values.check });
+    if (values.json) {
+        logger.out(JSON.stringify(outcome, null, 0));
+        return outcome.ok ? 0 : 1;
+    }
+    logger.out(outcome.message);
+    if (outcome.ok && outcome.version && !outcome.version.upToDate && !values.check) {
+        logger.out("restart your terminal (or open a new one) to pick up the updated binary.");
+    }
+    if (outcome.ok && outcome.version && !outcome.version.upToDate && values.check) {
+        logger.out("run 'maq update' (without --check) to install it.");
+    }
+    return outcome.ok ? 0 : 1;
+}
 async function cmdServe(args) {
     const { values } = parseArgs({
         args,
@@ -1177,6 +1202,7 @@ function printHelp() {
         '  completion <shell>           Shell completions (bash/zsh/fish/powershell)',
         "  audit verify <run-dir>       Verify a run's hash-chained audit log",
         "  security [report|rules|scan <path>|add|remove]  Enforced security rules + recent findings",
+        "  update [--check]             Check npm for a newer maqcli and self-update",
         "  config [get|set|path|reset]  Read or update ~/.maqcli/config.json",
         "  version | help [<topic>]",
         "",

package/dist/server/daemon.js

@@ -52,7 +52,7 @@ export function createDaemon(opts = {}) {
     const host = opts.host ?? process.env.MAQ_HOST ?? "127.0.0.1";
     const port = opts.port ?? Number(process.env.MAQ_PORT ?? 7717);
     const token = opts.token ?? process.env.MAQ_TOKEN ?? generateToken();
-    const version = opts.version ?? "0.6.0";
+    const version = opts.version ?? "0.6.1";
     const corsOrigin = opts.corsOrigin ?? process.env.MAQ_CORS_ORIGIN;
     const registry = opts.registry ?? new SessionRegistry();
     const interactive = new InteractiveRegistry();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maqcli",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "MAQ master orchestrator — a token-efficient, agent-agnostic supervisor CLI that sits on top of any worker CLI (AI or not) via a Scout -> Plan -> Execute -> Verify pipeline.",
   "type": "module",
   "bin": {