orizu 0.5.28 → 0.5.29

package/README.md

@@ -156,6 +156,35 @@ This prints the skill location plus source metadata (`name`, `root`, `skillMd`,
 to reading `SKILL.md` in two commands and verify the guidance matches the CLI
 that supplied it.
 
+### Update the CLI
+
+An npm-global install can update itself to npm's `latest` release:
+
+```bash
+orizu update [--dry-run] [--json]
+```
+
+The command detects the npm prefix, checks and compares versions, installs only
+when `latest` is newer, and verifies the newly installed binary in a fresh
+process. A successful `orizu update` automatically runs `orizu skills update`
+with the installed CLI, including when Orizu is already the latest. `--dry-run`
+stops after the version comparison without installing or refreshing skills. Source checkouts,
+`npx` caches, and pnpm, Bun, or Yarn global layouts are refused without being
+modified.
+For now, Windows installs and custom npm prefixes without their own `bin/node`
+(for example `npm config set prefix ~/.npm-global`) are refused with
+`update_unsupported_install`; use the manual npm command in that error.
+
+On other human-readable commands, an npm-global install may print one stderr
+line when its cached release check finds a newer version. Cache refresh happens
+in a detached process at most once every 24 hours, so commands do not wait for
+the registry. Notices and refreshes are suppressed for `--json`, CI,
+`NO_UPDATE_NOTIFIER`, and `update` itself. Disable them explicitly with:
+
+```bash
+ORIZU_NO_UPDATE_CHECK=1 orizu --help
+```
+
 Agents are first-class users of this CLI: **every command supports `--json`**
 (as a prefix, `orizu --json teams list`, or a trailing flag) and emits a single
 machine-readable JSON document instead of formatted text. Discover the full
@@ -210,6 +239,10 @@ orizu logout
     <td>Locate the bundled skill (read-only)</td>
     <td><code>orizu skills path --json</code></td>
   </tr>
+  <tr>
+    <td>Update an npm-global CLI and its installed skills</td>
+    <td><code>orizu update</code></td>
+  </tr>
   <tr>
     <td>Inspect CLI capabilities as JSON</td>
     <td><code>orizu capabilities --json</code></td>

package/dist/cli-project-slug.d.ts

@@ -0,0 +1,17 @@
+export interface ParsedProjectSlug {
+    teamSlug: string;
+    projectSlug: string;
+}
+export interface SplitProjectArg {
+    /** null when the caller passed a bare project slug. */
+    teamSlug: string | null;
+    projectSlug: string;
+}
+export declare function normalizeSlugInput(slug: string): string;
+/**
+ * Accept a `--project` value in either documented form: `teamSlug/projectSlug`
+ * or a bare `projectSlug` (resolved within the caller's team).
+ */
+export declare function splitCliProjectArg(value: string): SplitProjectArg | null;
+export declare function parseCliProjectSlug(projectSlug: string): ParsedProjectSlug | null;
+//# sourceMappingURL=cli-project-slug.d.ts.map

package/dist/cli-project-slug.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-project-slug.d.ts","sourceRoot":"","sources":["../src/cli-project-slug.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAQxE;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAQjF"}

package/dist/cli-project-slug.js

@@ -0,0 +1,24 @@
+export function normalizeSlugInput(slug) {
+    return slug.trim().toLowerCase();
+}
+/**
+ * Accept a `--project` value in either documented form: `teamSlug/projectSlug`
+ * or a bare `projectSlug` (resolved within the caller's team).
+ */
+export function splitCliProjectArg(value) {
+    if (!value.includes('/')) {
+        const projectSlug = normalizeSlugInput(value);
+        return projectSlug ? { teamSlug: null, projectSlug } : null;
+    }
+    const parsed = parseCliProjectSlug(value);
+    return parsed ? { teamSlug: parsed.teamSlug, projectSlug: parsed.projectSlug } : null;
+}
+export function parseCliProjectSlug(projectSlug) {
+    const segments = projectSlug.split('/');
+    if (segments.length !== 2)
+        return null;
+    const [teamSlug, project] = segments.map(normalizeSlugInput);
+    if (!teamSlug || !project)
+        return null;
+    return { teamSlug, projectSlug: project };
+}

package/dist/credentials.d.ts

@@ -1,4 +1,5 @@
 import { ServerCredentials, StoredCredentialsV2, StoredCredentialsV3 } from './types.js';
+export declare function getConfigDir(): string;
 /**
  * Runs a synchronous credentials transaction under the one process-wide and
  * cross-process lock. Exported so real-process fixtures can hold the production
@@ -18,6 +19,9 @@ export declare function updateServerCredentials(baseUrl: string, credentials: Se
 export declare function credentialsEqual(left: ServerCredentials, right: ServerCredentials): boolean;
 export declare function updateServerCredentialsIfCurrent(baseUrl: string, expected: ServerCredentials, replacement: ServerCredentials): boolean;
 export declare function getActiveBaseUrl(): string | null;
+export declare function rememberProcessSecret(secret: string): string;
+export declare function rememberResolvedBearer(bearer: string): string;
+export declare function getSecretsSeenThisProcess(): readonly string[];
 /**
  * In-sandbox bearer resolution (ALI-1044). Resolves a bearer supplied out-of-band
  * to the hosted agent, WITHOUT consulting credentials.json:

package/dist/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAiBA,OAAO,EACL,iBAAiB,EAEjB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,YAAY,CAAA;AAqInB;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAgCvE;AAED;;;;GAIG;AACH,wBAAsB,mCAAmC,CAAC,CAAC,EACzD,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAiDZ;AAwGD,wBAAgB,qBAAqB,IAAI,mBAAmB,GAAG,mBAAmB,GAAG,IAAI,CA8BxF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAW9E;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAepF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAatF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAO3F;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAUT;AAED,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAGhD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CA0BrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAYlE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS1D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,QAMtD;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAWT;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAc/D;AAED,wBAAgB,oBAAoB,SAKnC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAiBA,OAAO,EACL,iBAAiB,EAEjB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,YAAY,CAAA;AAMnB,wBAAgB,YAAY,IAAI,MAAM,CAKrC;AA0HD;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAgCvE;AAED;;;;GAIG;AACH,wBAAsB,mCAAmC,CAAC,CAAC,EACzD,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAiDZ;AAwGD,wBAAgB,qBAAqB,IAAI,mBAAmB,GAAG,mBAAmB,GAAG,IAAI,CA8BxF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAW9E;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAepF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAatF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAO3F;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAUT;AAED,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAGhD;AAID,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,yBAAyB,IAAI,SAAS,MAAM,EAAE,CAE7D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CA0BrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAclE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS1D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,QAMtD;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAWT;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAc/D;AAED,wBAAgB,oBAAoB,SAKnC"}

package/dist/credentials.js

@@ -6,7 +6,7 @@ import { AsyncLocalStorage } from 'async_hooks';
 function isNodeError(error) {
     return error instanceof Error;
 }
-function getConfigDir() {
+export function getConfigDir() {
     if (process.env.ORIZU_CONFIG_DIR) {
         return process.env.ORIZU_CONFIG_DIR;
     }
@@ -364,6 +364,17 @@ export function getActiveBaseUrl() {
     const config = loadCredentialsConfig();
     return config?.activeBaseUrl || null;
 }
+const secretsSeenThisProcess = new Set();
+export function rememberProcessSecret(secret) {
+    secretsSeenThisProcess.add(secret);
+    return secret;
+}
+export function rememberResolvedBearer(bearer) {
+    return rememberProcessSecret(bearer);
+}
+export function getSecretsSeenThisProcess() {
+    return [...secretsSeenThisProcess];
+}
 /**
  * In-sandbox bearer resolution (ALI-1044). Resolves a bearer supplied out-of-band
  * to the hosted agent, WITHOUT consulting credentials.json:
@@ -385,7 +396,7 @@ export function getActiveBaseUrl() {
 export function resolveEnvBearerToken() {
     const explicit = process.env.ORIZU_TOKEN;
     if (explicit && explicit.trim()) {
-        return explicit.trim();
+        return rememberResolvedBearer(explicit.trim());
     }
     const tokenFile = process.env.ORIZU_TOKEN_FILE;
     if (tokenFile && tokenFile.length > 0) {
@@ -404,7 +415,7 @@ export function resolveEnvBearerToken() {
         if (!token) {
             throw new Error(`ORIZU_TOKEN_FILE (${tokenFile}) is empty.`);
         }
-        return token;
+        return rememberResolvedBearer(token);
     }
     return null;
 }
@@ -426,7 +437,7 @@ export function resolveAuthTokenForBaseUrl(baseUrl) {
     if (!credentials) {
         throw new Error(`Not logged in for ${baseUrl}. Run \`orizu login --server ${baseUrl}\` (or \`--local\`) first.`);
     }
-    return 'accessToken' in credentials ? credentials.accessToken : credentials.apiKey;
+    return rememberResolvedBearer('accessToken' in credentials ? credentials.accessToken : credentials.apiKey);
 }
 /**
  * Non-throwing "is any auth available?" check (login --no-prompt-if-logged-in,

package/dist/feedback-cli.d.ts

@@ -0,0 +1,14 @@
+export interface FeedbackCliIo {
+    json: boolean;
+    print: (message: string) => void;
+    printErr: (message: string) => void;
+    fetcher?: (path: string, init?: RequestInit) => Promise<Response>;
+    configDir?: string;
+    cwd?: string;
+    now?: () => number;
+    homeDir?: string;
+    hasAuth?: (baseUrl: string) => boolean;
+}
+export declare function resolveFeedbackTimeoutMs(baseUrl: string): number;
+export declare function feedbackCommand(args: string[], io: FeedbackCliIo): Promise<number>;
+//# sourceMappingURL=feedback-cli.d.ts.map

package/dist/feedback-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"feedback-cli.d.ts","sourceRoot":"","sources":["../src/feedback-cli.ts"],"names":[],"mappings":"AAyDA,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAChC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IACnC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACjE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAA;CACvC;AAwaD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAWhE;AAiCD,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAmOxF"}