pinsay-cli 0.7.0 → 0.7.2

package/dist/cli.js

@@ -15,7 +15,7 @@ var init_build_constants = __esm({
   "src/build-constants.ts"() {
     "use strict";
     BUILD_DEFAULT_SERVER = true ? "https://app.pinsay.dev" : "https://app.pinsay.dev";
-    BUILD_CLI_VERSION = true ? "0.7.0" : "0.0.0-dev";
+    BUILD_CLI_VERSION = true ? "0.7.2" : "0.0.0-dev";
   }
 });
 
@@ -705,7 +705,7 @@ var init_map = __esm({
 });
 
 // src/auth.ts
-import { promises as fs17 } from "node:fs";
+import { promises as fs18 } from "node:fs";
 import { dirname as dirname8 } from "node:path";
 async function readApiKey(cwd2, server) {
   const { key } = await resolveApiKey(cwd2, server);
@@ -730,7 +730,7 @@ async function resolveToken(server, cwd2, explicitApiKey) {
     return void 0;
   const cacheFile = tokenCacheFile(server, apiKey);
   try {
-    const cached = JSON.parse(await fs17.readFile(cacheFile, "utf8"));
+    const cached = JSON.parse(await fs18.readFile(cacheFile, "utf8"));
     const token = typeof cached?.token === "string" ? cached.token.trim() : "";
     if (token && !isJwtExpired(token))
       return token;
@@ -747,8 +747,8 @@ async function resolveToken(server, cwd2, explicitApiKey) {
     );
     if (login?.token) {
       try {
-        await fs17.mkdir(dirname8(cacheFile), { recursive: true });
-        await fs17.writeFile(cacheFile, JSON.stringify({ token: login.token }), "utf8");
+        await fs18.mkdir(dirname8(cacheFile), { recursive: true });
+        await fs18.writeFile(cacheFile, JSON.stringify({ token: login.token }), "utf8");
       } catch {
       }
       return login.token;
@@ -770,7 +770,7 @@ var init_auth = __esm({
 
 // src/vite/resolve.ts
 import { existsSync as existsSync3, readFileSync } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 function entryOf(json, hash) {
   if (!json || typeof json !== "object")
     return void 0;
@@ -799,11 +799,11 @@ function resolveSource(cwd2, hash) {
   const miss = { kind: "unknown", path: null, component: null };
   if (!hash || !/^[0-9a-f]{8}$/.test(hash))
     return miss;
-  const manifestPath = join17(cwd2, ".pinsay", "manifest.json");
+  const manifestPath = join18(cwd2, ".pinsay", "manifest.json");
   const current = normalise(entryOf(readJson2(manifestPath), hash));
   if (current)
     return { kind: "manifest", path: current.path, component: current.component };
-  const prevPath = join17(cwd2, ".pinsay", "manifest.prev.json");
+  const prevPath = join18(cwd2, ".pinsay", "manifest.prev.json");
   const previous = normalise(entryOf(readJson2(prevPath), hash));
   if (previous) {
     return {
@@ -1103,6 +1103,12 @@ async function statusCommand(cwd2, parsed, positionals = []) {
     console.error(`Invalid status: ${newStatusStr}. Must be open, ready, applied, or archived.`);
     process.exit(2);
   }
+  if (statusNum === 3) {
+    console.error(
+      'Marking a comment as \'applied\' is not permitted via `pinsay status`.\nUse `pinsay apply --mark <id> --reply "<explanation>"` (or `pinsay reply <id> "<text>"`) to record a properly structured reply.'
+    );
+    process.exit(2);
+  }
   await api(server, `/api/comments/${id}`, {
     method: "PATCH",
     body: { status: statusNum },
@@ -4741,14 +4747,66 @@ async function updateCommand(cwd2, options) {
 // src/commands/apply.ts
 init_config();
 init_api();
+
+// src/lib/notify-update.ts
+import { promises as fs17 } from "node:fs";
+import { join as join17 } from "node:path";
+init_build_constants();
+async function checkAndNotifyUpdates(options) {
+  const result = {
+    cliUpdateAvailable: false,
+    skillsUpdateAvailable: false
+  };
+  if (options.silent || !options.meta)
+    return result;
+  const meta = options.meta;
+  if (meta.latestCliVersion && compareSemver(BUILD_CLI_VERSION, meta.latestCliVersion) < 0) {
+    result.cliUpdateAvailable = true;
+    console.error(
+      `\x1B[33m\u{1F4A1} Update available for pinsay-cli: ${BUILD_CLI_VERSION} \u2192 ${meta.latestCliVersion}\x1B[0m
+\x1B[33m   Run 'npx -y pinsay@latest' to update.\x1B[0m
+`
+    );
+  }
+  if (meta.skillVersion && options.config && options.cwd) {
+    try {
+      const files = skillFilesFor(options.config);
+      let hasStale = false;
+      for (const rel of files) {
+        const abs = join17(options.cwd, rel);
+        try {
+          await fs17.access(abs);
+          const installed = await readStamp(abs);
+          if (installed && installed !== meta.skillVersion) {
+            hasStale = true;
+            break;
+          }
+        } catch {
+        }
+      }
+      if (hasStale) {
+        result.skillsUpdateAvailable = true;
+        console.error(
+          `\x1B[33m\u{1F4A1} Local AI skills are out of date with the server.\x1B[0m
+\x1B[33m   Run 'npx pinsay-cli update' to refresh your prompt skills.\x1B[0m
+`
+        );
+      }
+    } catch {
+    }
+  }
+  return result;
+}
+
+// src/commands/apply.ts
 init_auth();
 init_build_constants();
 
 // src/apply/run.ts
 init_resolve();
 init_api();
-import { promises as fs19 } from "node:fs";
-import { join as join19, dirname as dirname9 } from "node:path";
+import { promises as fs20 } from "node:fs";
+import { join as join20, dirname as dirname9 } from "node:path";
 import { spawnSync } from "node:child_process";
 
 // src/apply/queue.ts
@@ -4906,8 +4964,8 @@ async function fetchQueue(ctx, filter) {
 
 // src/apply/context.ts
 init_api();
-import { promises as fs18 } from "node:fs";
-import { join as join18 } from "node:path";
+import { promises as fs19 } from "node:fs";
+import { join as join19 } from "node:path";
 init_config();
 async function loadProjectContext(ctx) {
   const branding = await getBranding(ctx.server);
@@ -4918,7 +4976,7 @@ async function loadProjectContext(ctx) {
     if (config.delegation === "off")
       delegation = "off";
     const relPath = isMultiProject(config) ? stackFileRelPath(ctx.project) : stackFileRelPath();
-    const stackRaw = await fs18.readFile(join18(ctx.cwd, relPath), "utf8");
+    const stackRaw = await fs19.readFile(join19(ctx.cwd, relPath), "utf8");
     stack = JSON.parse(stackRaw);
   } catch {
   }
@@ -5241,24 +5299,29 @@ function buildApplyPrompt(items, context, opts) {
     '(Separate style: after each item; Single style: run `npx pinsay-cli apply --mark all --reply "..." --models "..." --tool <your-tool-name>`'
   );
   lines.push(
-    "once at the end). Never run git push. `--models` MUST list EVERY model that touched the item and its role:"
+    "once at the end). Never run git push. `--models` is MANDATORY and MUST list EVERY model that touched the item and its role:"
   );
   lines.push(
-    "the planner/reviewer (your own model id) and each worker model you delegated to (`implementer`). Use exact"
+    "the planner/reviewer (your own model id) and each worker model you delegated to (`implementer`). NEVER guess or hardcode"
+  );
+  lines.push(
+    'outdated model names from memory (like "gemini-2.5-pro"). Always inspect your active runtime model name directly. Use exact'
   );
   lines.push(
     'model ids (e.g. `claude-opus-5-5`, `claude-sonnet-5-5`, `gpt-5.2`), never aliases like "haiku" or "sonnet". With one'
   );
   lines.push(
-    "model and no delegation, pass just yours as `<your-model-id>=implementer`. `--tool` (e.g. `claude-code`, `opencode`,"
+    "model and no delegation, pass just yours as `<your-model-id>=implementer`. Explicit role `=<role>` is required on each entry."
+  );
+  lines.push(
+    "`--tool` (e.g. `claude-code`, `opencode`, `cursor`, `windsurf`, `antigravity`) records which agent you are running as."
   );
   lines.push(
-    "`cursor`, `windsurf`, `antigravity`) records which agent you are running as. ALWAYS pass both explicitly, even on a"
+    "ALWAYS pass both explicitly, even on a project you ran `init` on \u2014 `--tool` silently falls back to whichever tool happened"
   );
   lines.push(
-    "project you ran `init` on \u2014 `--tool` silently falls back to whichever tool happened to run `init`, which is wrong"
+    "to run `init`, which is wrong the moment a different tool applies a comment later."
   );
-  lines.push("the moment a different tool applies a comment later.");
   return lines.join("\n") + "\n";
 }
 
@@ -5285,10 +5348,10 @@ function detectAiTool(override) {
 async function ensureToolRegistered(ctx, tool) {
   const config = await readConfig(ctx.cwd).catch(() => ({}));
   const relStackPath = isMultiProject(config) ? stackFileRelPath(ctx.project) : stackFileRelPath();
-  const stackPath = join19(ctx.cwd, relStackPath);
+  const stackPath = join20(ctx.cwd, relStackPath);
   let stackData = {};
   try {
-    const raw = await fs19.readFile(stackPath, "utf8");
+    const raw = await fs20.readFile(stackPath, "utf8");
     stackData = JSON.parse(raw);
   } catch {
   }
@@ -5307,8 +5370,8 @@ async function ensureToolRegistered(ctx, tool) {
         }
       );
       if (res) {
-        await fs19.mkdir(dirname9(stackPath), { recursive: true });
-        await fs19.writeFile(stackPath, JSON.stringify(res, null, 2) + "\n", "utf8");
+        await fs20.mkdir(dirname9(stackPath), { recursive: true });
+        await fs20.writeFile(stackPath, JSON.stringify(res, null, 2) + "\n", "utf8");
         return;
       }
     } catch {
@@ -5317,8 +5380,8 @@ async function ensureToolRegistered(ctx, tool) {
   aiTools.push(tool);
   stackData.aiTools = aiTools;
   try {
-    await fs19.mkdir(dirname9(stackPath), { recursive: true });
-    await fs19.writeFile(stackPath, JSON.stringify(stackData, null, 2) + "\n", "utf8");
+    await fs20.mkdir(dirname9(stackPath), { recursive: true });
+    await fs20.writeFile(stackPath, JSON.stringify(stackData, null, 2) + "\n", "utf8");
   } catch {
   }
 }
@@ -5392,9 +5455,9 @@ async function runApply(options, ctx) {
         console.error(`Failed to spawn opencode: ${res.error.message}`);
       }
     } else if (tool === "cursor") {
-      const promptFile = join19(ctx.cwd, ".pinsay/apply-prompt.md");
-      await fs19.mkdir(join19(ctx.cwd, ".pinsay"), { recursive: true });
-      await fs19.writeFile(promptFile, prompt, "utf8");
+      const promptFile = join20(ctx.cwd, ".pinsay/apply-prompt.md");
+      await fs20.mkdir(join20(ctx.cwd, ".pinsay"), { recursive: true });
+      await fs20.writeFile(promptFile, prompt, "utf8");
       console.log(`Saved apply prompt to ${promptFile}`);
     } else if (tool === "clipboard") {
       const copied = copyToClipboard(prompt);
@@ -5753,6 +5816,18 @@ async function exitIfWorkspaceFrozen(server, token) {
   } catch {
   }
 }
+async function checkMetaAndNotify(server, config, root, parsed) {
+  try {
+    const meta = await api(server, "/api/meta");
+    const minCli = meta?.minCliVersion || "0.0.0";
+    if (compareSemver(BUILD_CLI_VERSION, minCli) < 0) {
+      console.error(tooOldMessage(BUILD_CLI_VERSION, minCli));
+      process.exit(5);
+    }
+    await checkAndNotifyUpdates({ meta, config, cwd: root, silent: Boolean(parsed["json"]) });
+  } catch {
+  }
+}
 function parseModelFlags(parsed) {
   try {
     return resolveModels({
@@ -5796,17 +5871,7 @@ async function applyCommand(cwd2, parsed, positionals = []) {
     return;
   }
   const project = resolved.ok ? resolved.project.key : "";
-  try {
-    const meta = await api(server, "/api/meta");
-    const minCli = meta?.minCliVersion || "0.0.0";
-    if (compareSemver(BUILD_CLI_VERSION, minCli) < 0) {
-      console.error(tooOldMessage(BUILD_CLI_VERSION, minCli));
-      process.exit(5);
-    }
-  } catch (err) {
-    if (!(err instanceof ApiError && err.code === 404)) {
-    }
-  }
+  await checkMetaAndNotify(server, config, root, parsed);
   const explicitKey = typeof parsed["key"] === "string" ? parsed["key"] : void 0;
   const token = await resolveToken(server, root, explicitKey);
   const apiKey = explicitKey || await readApiKey(root, server);
@@ -5841,8 +5906,10 @@ async function applyCommand(cwd2, parsed, positionals = []) {
       markId = parsedNum;
     }
     const reply = typeof parsed["reply"] === "string" ? parsed["reply"] : "";
-    if (!reply) {
-      console.error('--reply "<text>" is required when using --mark');
+    if (!reply || reply.trim().length < 15 || /^(done|fixed|applied|ok|yes)$/i.test(reply.trim())) {
+      console.error(
+        '--reply "<text>" is required when using --mark and must provide a substantive explanation of the changes (at least 15 characters, e.g. "Applied \u2713 \u2014 updated logo source in header").'
+      );
       process.exit(2);
     }
     const noCommit = parsed["no-commit"] === true;
@@ -5855,6 +5922,19 @@ async function applyCommand(cwd2, parsed, positionals = []) {
       );
     }
     const models = parseModelFlags(parsed);
+    if (models.length === 0) {
+      console.error(
+        '--models "<model>=<role>" is mandatory when marking a comment as applied.\nSpecify your actual active runtime model and role (e.g. --models "<active-model>=implementer").\nIf multiple models or subagents participated (planner, implementer, reviewer), list all of them separated by commas.\nNever guess or hardcode model names from memory.'
+      );
+      process.exit(2);
+    }
+    const missingRole = models.find((m) => !m.role);
+    if (missingRole) {
+      console.error(
+        `Invalid --models entry "${missingRole.model}": explicit role is required. Expected "<model>=<role>" where role is one of: planner, implementer, reviewer (e.g. "${missingRole.model}=implementer").`
+      );
+      process.exit(2);
+    }
     const markStatus = typeof parsed["status"] === "string" ? parsed["status"] : void 0;
     const markEnv = typeof parsed["env"] === "string" ? parsed["env"] : void 0;
     const marked = await markApplied(
@@ -5930,17 +6010,7 @@ async function applyAllProjects(root, cwd2, config, server, parsed) {
     console.error("--tool needs a single project \u2014 pass --project <key> (several are configured).");
     process.exit(2);
   }
-  try {
-    const meta = await api(server, "/api/meta");
-    const minCli = meta?.minCliVersion || "0.0.0";
-    if (compareSemver(BUILD_CLI_VERSION, minCli) < 0) {
-      console.error(tooOldMessage(BUILD_CLI_VERSION, minCli));
-      process.exit(5);
-    }
-  } catch (err) {
-    if (!(err instanceof ApiError && err.code === 404)) {
-    }
-  }
+  await checkMetaAndNotify(server, config, root, parsed);
   const explicitKey = typeof parsed["key"] === "string" ? parsed["key"] : void 0;
   const token = await resolveToken(server, root, explicitKey);
   const apiKey = explicitKey || await readApiKey(root, server);
@@ -5988,7 +6058,7 @@ init_build_constants();
 
 // src/mcp/server.ts
 import { readFileSync as readFileSync3 } from "node:fs";
-import { join as join21 } from "node:path";
+import { join as join22 } from "node:path";
 
 // node_modules/zod/v3/external.js
 var external_exports = {};
@@ -11560,7 +11630,7 @@ var ALL_TOOLS = [
 // src/mcp/tools.ts
 init_api();
 import { existsSync as existsSync4, readFileSync as readFileSync2 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join20, relative as relative5, resolve as resolve4 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join21, relative as relative5, resolve as resolve4 } from "node:path";
 import { spawnSync as spawnSync3 } from "node:child_process";
 init_build_constants();
 init_projection();
@@ -12100,7 +12170,7 @@ async function handleResolveSource(args, ctx) {
   if (!hash || typeof hash !== "string") {
     throw mcpError("forbidden", "hash is required");
   }
-  const manifestPath = join20(ctx.cwd, ".pinsay/manifest.json");
+  const manifestPath = join21(ctx.cwd, ".pinsay/manifest.json");
   if (!existsSync4(manifestPath)) {
     return { path: null, reason: "no-manifest" };
   }
@@ -12280,12 +12350,12 @@ function createMcpServer(ctx) {
     let configObj = {};
     let stackObj = {};
     try {
-      const configPath = join21(ctx.cwd, ".pinsay/config.json");
+      const configPath = join22(ctx.cwd, ".pinsay/config.json");
       configObj = JSON.parse(readFileSync3(configPath, "utf8"));
     } catch {
     }
     try {
-      const stackPath = join21(ctx.cwd, ".pinsay/stack.json");
+      const stackPath = join22(ctx.cwd, ".pinsay/stack.json");
       stackObj = JSON.parse(readFileSync3(stackPath, "utf8"));
     } catch {
     }
@@ -12350,8 +12420,8 @@ function createMcpServer(ctx) {
 async function runMcpServer(ctx, logFile) {
   if (logFile) {
     try {
-      const fs20 = await import("node:fs");
-      const logStream = fs20.createWriteStream(logFile, { flags: "a" });
+      const fs21 = await import("node:fs");
+      const logStream = fs21.createWriteStream(logFile, { flags: "a" });
       const origWrite = process.stderr.write;
       process.stderr.write = function(chunk, encoding, cb) {
         logStream.write(chunk);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinsay-cli",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Click-to-comment feedback for your web app: install the widget, then turn pending comments into AI apply prompts.",
   "type": "module",
   "license": "MIT",