prjct-cli 2.2.18 → 2.3.4

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## [2.3.4] - 2026-05-01
+
+### Bug Fixes
+
+- switch to OIDC trusted publishing for npm releases
+
+
+## [2.3.3] - 2026-05-01
+
+### Bug Fixes
+
+- bump to 2.3.3 to recover from npm publish outage
+
+
+## [2.3.2] - 2026-05-01
+
+### Features
+
+- .github/workflows: Migrate workflows to Blacksmith runners (#265)
+
+### Bug Fixes
+
+- drop dynamic node -e from update checker (scanner mitigation)
+
+
+## [2.3.1] - 2026-05-01
+
+### Bug Fixes
+
+- sync bun.lock with package.json (unblock --frozen-lockfile)
+
+
+## [2.3.0] - 2026-04-30
+
+### Features
+
+- opt-in multi-agent harness mode (#264)
+
+
 ## [2.2.18] - 2026-04-25
 
 ### Added

package/assets/scripts/refresh-update.mjs

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+
+/**
+ * Background update-cache refresher for prjct-cli.
+ *
+ * Spawned detached/unref'd by core/infrastructure/update-checker.ts so the
+ * main `prjct` invocation can exit immediately. The next invocation reads
+ * the cache and (if a newer version is on npm) shows the update banner.
+ *
+ * Why a separate file instead of `node -e <inline>`: the inline pattern
+ * trips supply-chain scanners as a "dynamic code execution" anti-pattern.
+ * Behaviour here is identical — only the delivery mechanism changed.
+ *
+ * Usage: node refresh-update.mjs <cache-file-path>
+ *
+ * Inputs come from argv (no env, no stdin). Output is the cache file
+ * write — the script never prints to stdout/stderr.
+ */
+
+import fs from 'node:fs'
+import https from 'node:https'
+import path from 'node:path'
+
+const cacheFile = process.argv[2]
+if (!cacheFile) process.exit(0)
+
+// Defensive: only allow writing inside the user's prjct cache dir.
+// Refuses paths that try to escape via .. or absolute symlinks elsewhere.
+const resolved = path.resolve(cacheFile)
+const expectedDir = path.resolve(process.env.HOME || '', '.prjct-cli')
+if (!resolved.startsWith(`${expectedDir}${path.sep}`)) process.exit(0)
+
+const opts = {
+  hostname: 'registry.npmjs.org',
+  path: '/prjct-cli/latest',
+  headers: {
+    'User-Agent': 'prjct-cli-update-checker',
+    Accept: 'application/json',
+  },
+}
+
+const req = https.request(opts, (res) => {
+  let data = ''
+  res.on('data', (chunk) => {
+    data += chunk
+  })
+  res.on('end', () => {
+    try {
+      if (res.statusCode === 200) {
+        const version = JSON.parse(data).version
+        if (typeof version === 'string') {
+          fs.mkdirSync(path.dirname(resolved), { recursive: true })
+          fs.writeFileSync(
+            resolved,
+            JSON.stringify({ lastCheck: Date.now(), latestVersion: version })
+          )
+        }
+      }
+    } catch {
+      // best-effort; never throw
+    }
+  })
+})
+req.on('error', () => {})
+req.setTimeout(5000, () => req.destroy())
+req.end()