premanmcp 1.0.4 → 1.0.5

package/bin/hook.js

@@ -139,6 +139,57 @@ function isGeneratedInvocation(invocation) {
   return invocation === "preman" || /^npm exec -y premanmcp@\S+ --$/.test(invocation);
 }
 
+/**
+ * The release a generated invocation pins, or "" when it does not pin one.
+ *
+ * The bare `preman` form resolves at push time, and `@latest` is whatever we
+ * ship next, so neither can be out of date. Only an explicit version can be.
+ */
+export function pinnedRelease(invocation) {
+  const match = /^npm exec -y premanmcp@(\S+) --$/.exec(String(invocation || "").trim());
+  const version = match ? match[1] : "";
+  return version === "latest" ? "" : version;
+}
+
+/**
+ * Is `left` an earlier release than `right`?
+ *
+ * Anything this cannot read as three numbers compares as not-older, so a
+ * prerelease tag or a mirror's own numbering is left alone rather than being
+ * rewritten on a guess.
+ */
+export function isOlderRelease(left, right) {
+  const parse = (value) => String(value).split(".").map((part) => Number.parseInt(part, 10));
+  const a = parse(left);
+  const b = parse(right);
+  if (a.length !== 3 || b.length !== 3) return false;
+  if ([...a, ...b].some((part) => !Number.isFinite(part))) return false;
+  for (let index = 0; index < 3; index += 1) {
+    if (a[index] !== b[index]) return a[index] < b[index];
+  }
+  return false;
+}
+
+/**
+ * Does this hook run a PreMan older than the one asking?
+ *
+ * A pinned hook keeps working long after it stops being current -- it answers
+ * `help`, it runs `verify`, it just does all of it as the version that wrote
+ * it. Found in the wild: a hook still on 0.13.0 while 1.0.4 was installed,
+ * printing an error message whose formatting had been fixed several releases
+ * earlier, with nothing anywhere to say why.
+ *
+ * Only ever true when we would be moving forward. An older CLI run for some
+ * other reason must not drag a newer hook back with it.
+ */
+export function hookIsBehind(invocation) {
+  if (declaredInvocation()) return false;
+  const pinned = pinnedRelease(invocation);
+  const running = packageVersion();
+  if (!pinned || !running) return false;
+  return isOlderRelease(pinned, running);
+}
+
 function hookBody(invocation) {
   // `exec` is deliberately absent: we want the wrapper to survive the CLI exiting
   // non-zero and still exit 0 itself.
@@ -319,9 +370,11 @@ function rememberHookCheck(cwd, now, fields) {
  * PreMan is running here -- any command, the MCP server starting -- is taken as
  * the moment to check.
  *
- * Deliberately narrow. It only ever rewrites a hook we wrote that no longer
- * answers: an absent hook is not installed behind the user, a foreign hook is
- * not touched, and a hook that works is left on whatever version it pins.
+ * Deliberately narrow. It only ever rewrites a hook we wrote: an absent hook is
+ * not installed behind the user, and a foreign hook is not touched. A working
+ * hook is rewritten only when it pins a release older than the one running --
+ * see `hookIsBehind` -- because "it answers" and "it is the CLI we ship" stopped
+ * being the same question once a pin could outlive several releases.
  */
 export function repairDeadHook({ cwd = process.cwd(), now = Date.now(), force = false } = {}) {
   const remember = (fields) => rememberHookCheck(cwd, now, fields);
@@ -337,11 +390,14 @@ export function repairDeadHook({ cwd = process.cwd(), now = Date.now(), force =
     return remember({ action: "not-a-repository" });
   }
   if (status.state !== "installed") return remember({ action: status.state });
-  if (status.works) return remember({ action: "healthy", invocation: status.invocation });
+  const behind = hookIsBehind(status.invocation);
+  if (status.works && !behind) {
+    return remember({ action: "healthy", invocation: status.invocation });
+  }
 
   const result = installHook(makeArgs([]));
   return remember({
-    action: result.action === "updated" ? "repaired" : result.action,
+    action: result.action === "updated" ? (behind ? "upgraded" : "repaired") : result.action,
     invocation: result.invocation || "",
     replaced: status.invocation,
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "premanmcp",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "PreMan CLI and stdio proxy for PreMan's hosted MCP server",
   "type": "module",
   "bin": {