neon 8.12.0 → 8.12.2

package/README.md

@@ -1578,7 +1578,7 @@ Global options are supported with any Neon CLI command.
 
 - <a id="analytics"></a>`--analytics`
 
-  Analytics are enabled by default to gather information about the CLI commands and options that are used by our customers. This data collection assists in offering support, and allows for a better understanding of typical usage patterns so that we can improve user experience. Neon does not collect user-defined data, such as project IDs or command payloads, except the question passed to `neon ask --prompt` and the query passed to `neon docs search`. The Neon search service records each `neon docs search` query with the CLI version and the detected coding agent; with `--no-analytics` it records nothing. When the CLI fails on an internal bug (a JavaScript `TypeError`, `ReferenceError`, `RangeError`, or `SyntaxError`), it also sends that error to Neon's Sentry: the error type, the message only when it is a standard JavaScript message that names nothing but code (any other message is replaced), the stack trace with file paths cut to the package (`neon/dist/...`), the CLI and Node.js versions, and whether it ran in CI or a coding agent. To opt-out of analytics data collection and error reports, specify `--no-analytics` or `--analytics false`.
+  Analytics are enabled by default to gather information about the CLI commands and options that are used by our customers. This data collection assists in offering support, and allows for a better understanding of typical usage patterns so that we can improve user experience. Neon does not collect user-defined data, such as project IDs or command payloads, except the question passed to `neon ask --prompt` and the query passed to `neon docs search`. Each successful command also reports the Neon agent skills recorded in the user-level skills lock and in the current directory's `skills-lock.json`: the skill names, their lock hashes, and whether each is behind its source, read from local files without a network request. The Neon search service records each `neon docs search` query with the CLI version and the detected coding agent; with `--no-analytics` it records nothing. When the CLI fails on an internal bug (a JavaScript `TypeError`, `ReferenceError`, `RangeError`, or `SyntaxError`), it also sends that error to Neon's Sentry: the error type, the message only when it is a standard JavaScript message that names nothing but code (any other message is replaced), the stack trace with file paths cut to the package (`neon/dist/...`), the CLI and Node.js versions, and whether it ran in CI or a coding agent. To opt-out of analytics data collection and error reports, specify `--no-analytics` or `--analytics false`.
 
 - <a id="version"></a>`-v, --version`
 

package/dist/analytics.js

@@ -296,6 +296,8 @@ const trackEvent = (event, properties) => {
 	});
 	log.debug("Sent CLI event: %s", event);
 };
+/** Whether this process sends telemetry: analytics is on and the client was created. */
+const isAnalyticsActive = () => client !== void 0;
 /**
 * Tracks cli_command_success. The account fields come from the lookup, which may still be in
 * flight when the command finishes, so they are read when the event is sent.
@@ -354,4 +356,4 @@ const getAnalyticsEventProperties = (args) => ({
 	githubEnvVars: getGithubEnvVars(process.env)
 });
 //#endregion
-export { analyticsIdentity, analyticsMiddleware, closeAnalytics, commandSuccessProperties, getAnalyticsEventProperties, getErrorAnalyticsEventProperties, initAnalyticsClientMiddleware, recordCommandSuccessExtras, recordScaffoldedTemplate, sendError, storedCredentialAttribution, takeCommandSuccessExtras, telemetryCredential, trackCommandSuccess, trackEvent, useAnalyticsClientForTests };
+export { analyticsIdentity, analyticsMiddleware, closeAnalytics, commandSuccessProperties, getAnalyticsEventProperties, getErrorAnalyticsEventProperties, initAnalyticsClientMiddleware, isAnalyticsActive, recordCommandSuccessExtras, recordScaffoldedTemplate, sendError, storedCredentialAttribution, takeCommandSuccessExtras, telemetryCredential, trackCommandSuccess, trackEvent, useAnalyticsClientForTests };

package/dist/index.js

@@ -6,7 +6,7 @@ import { r as defaultDir } from "./_chunks/paths-DMq0Lt7a.js";
 import { ensureConfigDir } from "./config.js";
 import { currentContextFile, enrichFromContext } from "./context.js";
 import { NETWORK_ERROR_MESSAGE, isNetworkError, matchErrorCode } from "./errors.js";
-import { analyticsMiddleware, closeAnalytics, initAnalyticsClientMiddleware, sendError, takeCommandSuccessExtras, trackCommandSuccess } from "./analytics.js";
+import { analyticsMiddleware, closeAnalytics, initAnalyticsClientMiddleware, isAnalyticsActive, recordCommandSuccessExtras, sendError, takeCommandSuccessExtras, trackCommandSuccess } from "./analytics.js";
 import { AuthRefreshError, defaultClientID } from "./auth.js";
 import { getCliName } from "./utils/cli_name.js";
 import { c as ensureAuth } from "./_chunks/auth-CIUtXByB.js";
@@ -208,6 +208,15 @@ async function handleError(msg, err, canRetry) {
 	await preloadCommand(builder, hideBin(process.argv));
 	while (attempts < MAX_ATTEMPTS) try {
 		const args = await builder.argv;
+		const configDir = typeof args.configDir === "string" ? args.configDir : defaultDir;
+		if (isAnalyticsActive()) {
+			const { readSkillsTelemetry } = await import("./skills/freshness.js");
+			const skills = readSkillsTelemetry({
+				configDir,
+				cwd: process.cwd()
+			});
+			if (skills !== void 0) recordCommandSuccessExtras({ skills });
+		}
 		trackCommandSuccess(args);
 		if (args._.length === 0 || args.help) {
 			await showHelp(builder);
@@ -216,7 +225,7 @@ async function handleError(msg, err, canRetry) {
 		await closeAnalytics();
 		const notifier = {
 			commandPath: args._.map(String),
-			configDir: typeof args.configDir === "string" ? args.configDir : defaultDir,
+			configDir,
 			currentBranch: Boolean(args.currentBranch),
 			output: typeof args.output === "string" ? args.output : "table"
 		};

package/dist/skills/freshness.js

@@ -24,9 +24,6 @@ const isRecord = (value) => typeof value === "object" && value !== null && !Arra
 const SKILL_NAME = /^[a-z0-9][a-z0-9-]{0,63}$/;
 const skillFolder = (skillPath) => skillPath.replace(/\\/g, "/").replace(/\/?SKILL\.md$/i, "");
 /**
-* Entries pinned to a `ref` are left out: `neon skills` never pins one, and a pinned skill
-* tracks that ref rather than the repository's default branch.
-*
 * The global lock's `skillFolderHash` is usually a tree SHA, but the skills CLI stores a
 * content SHA-256 there when it installed from a Git clone; it tells them apart by length.
 */
@@ -39,7 +36,7 @@ const parseSkillsLock = (raw, scope) => {
 		if (!isRecord(entry)) continue;
 		const { source, skillPath, ref } = entry;
 		const hash = entry[field];
-		if (!SKILL_NAME.test(skill) || typeof source !== "string" || !NEON_SOURCES.has(source) || ref !== void 0 || typeof skillPath !== "string" || typeof hash !== "string" || hash === "") continue;
+		if (!SKILL_NAME.test(skill) || typeof source !== "string" || !NEON_SOURCES.has(source) || typeof skillPath !== "string" || typeof hash !== "string" || hash === "") continue;
 		const folder = skillFolder(skillPath);
 		if (folder === "") continue;
 		const hashKind = scope === "global" && /^[0-9a-f]{40}$/i.test(hash) ? "tree" : "content";
@@ -49,12 +46,13 @@ const parseSkillsLock = (raw, scope) => {
 			source,
 			folder,
 			hash,
-			hashKind
+			hashKind,
+			pinned: ref !== void 0
 		});
 	}
 	return skills;
 };
-const readLockedSkills = (path, scope) => {
+const readAllLockedSkills = (path, scope) => {
 	if (!existsSync(path)) return [];
 	const raw = readLockFile(path);
 	try {
@@ -63,6 +61,8 @@ const readLockedSkills = (path, scope) => {
 		throw new Error(`${path} is not valid JSON.`);
 	}
 };
+/** The skills the update check covers: every Neon skill in the lock except pinned ones. */
+const readLockedSkills = (path, scope) => readAllLockedSkills(path, scope).filter((skill) => !skill.pinned);
 const MAX_LOCK_BYTES = 1048576;
 /**
 * A project lock is repository content: a FIFO would block the open and `/dev/zero` the read,
@@ -303,26 +303,74 @@ const spawnSkillsCheckWorker = (cachePath, cwd) => {
 		log.debug("Could not start the skills check: %s", error instanceof Error ? error.message : String(error));
 	}
 };
+/** Every Neon skill in the lock, pinned ones included. */
+const readLock = (path, scope) => ({
+	skills: readAllLockedSkills(path, scope),
+	modifiedAt: statSync(path, { throwIfNoEntry: false })?.mtimeMs ?? 0
+});
+const readLocks = (cwd) => ({
+	global: readLock(globalLockPath(), "global"),
+	project: readLock(projectLockPath(cwd), "project")
+});
+/**
+* `outdated` is `null` when the cache cannot answer: no successful check yet, a check still
+* pending for the folder, a lock written after the last check, a folder gone upstream, or a
+* pinned skill.
+*/
+const skillsTelemetry = (locks, cache) => {
+	const scope = ({ skills, modifiedAt }) => {
+		if (skills.length === 0) return { installed: false };
+		const known = cache !== void 0 && cache.checkedAt > 0 && modifiedAt <= cache.checkedAt;
+		return {
+			installed: true,
+			skills: Object.fromEntries(skills.map((skill) => {
+				const remote = cache?.folders[folderKey(skill)];
+				const status = known && !skill.pinned && remote?.pending !== true ? skillStatus(skill, remote) : void 0;
+				return [skill.skill, {
+					hash: skill.hash,
+					outdated: status === "outdated" ? true : status === "up to date" ? false : null
+				}];
+			}))
+		};
+	};
+	return {
+		checkedAt: cache !== void 0 && cache.checkedAt > 0 ? cache.checkedAt : null,
+		global: scope(locks.global),
+		project: scope(locks.project)
+	};
+};
+/**
+* Reads only local files. `undefined` when a lock can't be read, which leaves the property
+* off the event rather than reporting skills as not installed.
+*/
+const readSkillsTelemetry = ({ configDir, cwd }) => {
+	try {
+		return skillsTelemetry(readLocks(cwd), readSkillsCheckCache(skillsCheckCachePath(configDir)));
+	} catch (error) {
+		log.debug("Leaving skills out of telemetry: %s", error instanceof Error ? error.message : String(error));
+		return;
+	}
+};
 /**
 * Warns at most once a day when a Neon skill in the user-level lock or this directory's
 * `skills-lock.json` is behind its source, from a cache a background worker refreshes daily.
 */
 const notifyIfSkillsOutdated = ({ configDir, cwd, now = Date.now() }) => {
-	const lockPaths = [globalLockPath(), projectLockPath(cwd)];
-	let skills;
+	let locks;
 	try {
-		skills = [...readLockedSkills(lockPaths[0], "global"), ...readLockedSkills(lockPaths[1], "project")];
+		locks = readLocks(cwd);
 	} catch (error) {
 		log.debug("Skipping the skills check: %s", error instanceof Error ? error.message : String(error));
 		return;
 	}
+	const skills = [...locks.global.skills, ...locks.project.skills].filter((skill) => !skill.pinned);
 	if (skills.length === 0) return;
 	const cachePath = skillsCheckCachePath(configDir);
 	const cache = readSkillsCheckCache(cachePath);
 	const plan = planSkillsCheck({
 		skills,
 		cache,
-		lockModifiedAt: Math.max(...lockPaths.map((path) => statSync(path, { throwIfNoEntry: false })?.mtimeMs ?? 0)),
+		lockModifiedAt: Math.max(locks.global.modifiedAt, locks.project.modifiedAt),
 		now
 	});
 	const notice = formatSkillsNotice(plan.outdated);
@@ -346,4 +394,4 @@ const notifyIfSkillsOutdated = ({ configDir, cwd, now = Date.now() }) => {
 	}, "skills check cache")) spawnSkillsCheckWorker(cachePath, cwd);
 };
 //#endregion
-export { formatSkillsNotice, globalLockPath, lockPath, neonSkillsUpdateCommand, notifyIfSkillsOutdated, parseSkillsCheckCache, parseSkillsLock, planSkillsCheck, projectLockPath, readLockedSkills, refreshSkillsCheckCache, scopeLabel, skillContentHash, skillStatus, skillsCheckCachePath, skillsStatusRows };
+export { formatSkillsNotice, globalLockPath, lockPath, neonSkillsUpdateCommand, notifyIfSkillsOutdated, parseSkillsCheckCache, parseSkillsLock, planSkillsCheck, projectLockPath, readLockedSkills, readSkillsTelemetry, refreshSkillsCheckCache, scopeLabel, skillContentHash, skillStatus, skillsCheckCachePath, skillsStatusRows, skillsTelemetry };

package/dist/skills/run.js

@@ -63,8 +63,8 @@ const quoteNpxArg = (part) => /[\s"'\\*]/.test(part) ? `'${part.replace(/'/g, `'
 const npxCommand = (args) => `npx ${args.map(quoteNpxArg).join(" ")}`;
 const ANSI = /\u001b\[[0-9;]*[A-Za-z]/g;
 const UPDATE_BANNER = /^Checking for skill updates/i;
-const UPDATE_NOTHING = /No (?:project|global) skills (?:to update|to check|tracked in lock file|can be updated in place)|All global skills are up to date/i;
-const UPDATE_RESULT = /No (?:project|global) skills (?:to update|to check|tracked in lock file|can be updated in place)\.?|All global skills are up to date|(?:✓\s*)?Updated \d+ skills?(?:\(s\))?|(?:✗\s*)?Failed to update \d+ skills?(?:\(s\))?/i;
+const UPDATE_NOTHING = /No (?:project|global) skills (?:to update|to check|tracked in lock file|can be updated in place)|All (?:project|global) skills are up to date/i;
+const UPDATE_RESULT = /No (?:project|global) skills (?:to update|to check|tracked in lock file|can be updated in place)\.?|All (?:project|global) skills are up to date|(?:✓\s*)?Updated \d+ skills?(?:\(s\))?|(?:✗\s*)?Failed to update \d+ skills?(?:\(s\))?/i;
 const stripAnsi = (text) => text.replace(ANSI, "").replace(/\r/g, "");
 const skillsUpdateHadNothing = (output) => UPDATE_NOTHING.test(stripAnsi(output));
 const skillsUpdateDetail = (output) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "8.12.0",
+  "version": "8.12.2",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -111,11 +111,11 @@
     "tsx": "4.22.3",
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
+    "@neon-internals/cli-core": "0.0.0",
     "@neon-internals/env-core": "0.0.35",
-    "@neon/e2e-harness": "0.0.0",
     "@neon/env": "1.6.5",
-    "@neon-internals/cli-core": "0.0.0",
-    "@neon/functions": "0.11.0"
+    "@neon/functions": "0.11.0",
+    "@neon/e2e-harness": "0.0.0"
   },
   "publishConfig": {
     "access": "public",