nothumanallowed 15.1.6 → 15.1.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "15.1.6",
+  "version": "15.1.7",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -52,12 +52,15 @@ export async function main(argv) {
       }
     }).catch(() => {});
 
-    // npm version check (non-blocking)
+    // npm version check (non-blocking). The one-liner uses --prefer-online to
+    // bypass npm's metadata cache, which is the #1 reason `npm install -g`
+    // appears to "do nothing" — it had stale "latest" in the local cache.
     checkNpmVersion().then(result => {
       if (result?.updateAvailable) {
         console.log('');
         warn(`New NHA version available: ${result.current} → ${result.latest}`);
-        info(`Run "nha update" to upgrade, or: npm cache clean --force && npm install -g nothumanallowed@${result.latest}`);
+        info(`Run "nha update" (recommended — auto-installs npm + agents)`);
+        info(`Or manually: npm cache clean --force && npm install -g nothumanallowed@${result.latest} --prefer-online`);
       }
     }).catch(() => {});
   }

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '15.1.6';
+export const VERSION = '15.1.7';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';
 

package/src/updater.mjs

@@ -87,17 +87,95 @@ function compareSemver(a, b) {
 }
 
 /**
- * Full update: re-download core files + agents.
+ * Detect whether the current `nha` binary is reachable from multiple PATH
+ * locations. This is the classic "I ran npm install -g but nothing changed"
+ * trap on macOS where a system-wide /usr/local/bin/nha shadows a user-space
+ * ~/.npm-global/bin/nha (or vice versa).
+ */
+async function detectDuplicateInstall() {
+  try {
+    const { execSync } = await import('child_process');
+    const out = execSync('which -a nha 2>/dev/null', { encoding: 'utf-8' });
+    const paths = out.split('\n').map(s => s.trim()).filter(Boolean);
+    return paths.length > 1 ? paths : null;
+  } catch { return null; }
+}
+
+/**
+ * Run `npm install -g nothumanallowed@latest` from inside the CLI itself.
+ * Uses --prefer-online to defeat npm's metadata cache, which is the usual
+ * culprit when the user already ran "npm install -g nothumanallowed" but got
+ * an older version because the manifest in cache was stale.
+ */
+async function npmSelfInstall(targetVersion) {
+  const { spawn } = await import('child_process');
+  return new Promise((resolve) => {
+    info(`Installing nothumanallowed@${targetVersion} via npm (this may take 10-30s)...`);
+    const args = [
+      'install', '-g', `nothumanallowed@${targetVersion}`,
+      '--registry=https://registry.npmjs.org/',
+      '--prefer-online',
+      '--no-fund',
+      '--no-audit',
+    ];
+    const child = spawn('npm', args, { stdio: 'inherit' });
+    child.on('exit', (code) => resolve(code === 0));
+    child.on('error', (err) => {
+      warn(`npm spawn failed: ${err.message}`);
+      resolve(false);
+    });
+  });
+}
+
+/**
+ * Full update: re-download core files + agents + self-upgrade the npm package.
  */
 export async function runUpdate() {
   info('Checking for updates...');
 
+  // ── npm package self-update ────────────────────────────────────────────
+  // Done FIRST so the freshly installed version applies on the next invocation.
+  // We bypass npm's metadata cache (--prefer-online) because that's the
+  // single most common reason "I just installed and it's still old".
+  let npmUpdated = false;
+  const npmCheck = await checkNpmVersion();
+  if (npmCheck?.updateAvailable) {
+    info(`npm package: ${npmCheck.current} → ${npmCheck.latest}`);
+    // Clean the local manifest cache first — defeats the stale-cache trap.
+    try {
+      const { execSync } = await import('child_process');
+      execSync('npm cache clean --force', { stdio: 'pipe' });
+    } catch { /* non-fatal */ }
+
+    const ok2 = await npmSelfInstall(npmCheck.latest);
+    if (ok2) {
+      ok(`npm package upgraded to ${npmCheck.latest}`);
+      npmUpdated = true;
+
+      // Detect duplicate global installs — common on macOS.
+      const dups = await detectDuplicateInstall();
+      if (dups && dups.length > 1) {
+        warn('Multiple nha installations detected on PATH:');
+        for (const p of dups) console.log(`    ${p}`);
+        warn('Only the FIRST in PATH is what your shell will run. If the version still');
+        warn('appears unchanged, remove the older one (e.g. `sudo rm /usr/local/bin/nha`)');
+        warn('or reorder your PATH so the newer install is found first.');
+      }
+    } else {
+      warn('npm install failed. Run manually:');
+      console.log(`    npm cache clean --force && npm install -g nothumanallowed@${npmCheck.latest} --prefer-online`);
+    }
+  } else if (npmCheck) {
+    ok(`npm package nothumanallowed@${npmCheck.current} (up to date)`);
+  }
+
+  // ── Agents + Legion + PIF (downloaded from website, not npm) ───────────
   const res = await fetch(`${BASE_URL}/versions.json`, {
     signal: AbortSignal.timeout(15000),
     headers: { 'User-Agent': 'nha-cli/1.0.0' },
   });
   if (!res.ok) {
-    warn('Could not reach nothumanallowed.com');
+    warn('Could not reach nothumanallowed.com for agent updates.');
     return;
   }
 
@@ -112,7 +190,7 @@ export async function runUpdate() {
   const pifCurrent = local['pif']?.latest ?? '?';
   const pifLatest = remote['pif']?.latest ?? '?';
 
-  let updated = false;
+  let updated = npmUpdated;
 
   // Update Legion
   if (legionCurrent !== legionLatest) {