quiver-cli 0.2.0 → 0.4.0

package/README.md

@@ -57,7 +57,7 @@ quiver-cli check              # detect drift (CI-friendly: --json, exit 1)
 | `quiver-cli login`         | Store a GitHub token for remote (`github:`) catalogs              |
 | `quiver-cli logout`        | Remove the stored GitHub token                                    |
 | `quiver-cli help`          | Show help                                                         |
-| `quiver-cli version`       | Show the version (`-v`, `--version`)                              |
+| `quiver-cli version`       | Show the version + any available update (`-v`, `--version`)       |
 
 Options: `-f/--force`, `--all/-y` (non-interactive), `--json`
 (status/check/upstream/list), `--providers=claude,opencode` (limit generated
@@ -183,6 +183,20 @@ exactly the variables the selected servers need (none needed → no file). For
 Codex, secret headers are mapped to `env_http_headers` so secrets never land in
 the committed `config.toml`.
 
+## Staying up to date
+
+quiver-cli checks npm for a newer release (at most once a day, cached under
+`~/.cache/quiver/`) and prints a one-line notice after a command when an update
+is available. `quiver-cli version` checks on demand. Update with:
+
+```bash
+pnpm add -g quiver-cli   # or: npm i -g quiver-cli / yarn global add quiver-cli
+```
+
+The check is best-effort and never blocks or fails a command. It is silenced
+automatically for `--json`, non-interactive shells and CI, and can be disabled
+entirely with `QUIVER_NO_UPDATE_NOTIFIER=1`.
+
 ## Development
 
 ```bash

package/dist/cli.js

@@ -766,13 +766,6 @@ var init_remote = __esm({
 });
 
 // src/catalog/resolve.ts
-var resolve_exports = {};
-__export(resolve_exports, {
-  DEFAULT_CATALOG_SOURCE: () => DEFAULT_CATALOG_SOURCE,
-  isCatalogWritable: () => isCatalogWritable,
-  packageRoot: () => packageRoot,
-  resolveCatalog: () => resolveCatalog
-});
 import { accessSync, constants, existsSync as existsSync6 } from "fs";
 import { dirname as dirname3, relative as relative3, resolve as resolve7, sep } from "path";
 import { fileURLToPath } from "url";
@@ -1400,7 +1393,7 @@ var init_select = __esm({
     "use strict";
     init_prompts();
     DEFAULT_SKILLS = ["find-skills", "skill-creator"];
-    DEFAULT_COMMANDS = ["cp"];
+    DEFAULT_COMMANDS = ["cp", "review"];
     skillHint = (fm) => {
       const parts = [];
       if (fm.version) parts.push(`v${fm.version}`);
@@ -2978,6 +2971,114 @@ var init_logout = __esm({
   }
 });
 
+// src/version/notifier.ts
+var notifier_exports = {};
+__export(notifier_exports, {
+  checkForUpdate: () => checkForUpdate,
+  compareSemver: () => compareSemver,
+  getCurrentVersion: () => getCurrentVersion,
+  installHint: () => installHint,
+  notifierSuppressed: () => notifierSuppressed
+});
+import { existsSync as existsSync14, mkdirSync as mkdirSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync9 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname6, resolve as resolve19 } from "path";
+var REGISTRY_URL, CHECK_TTL_MS, FETCH_TIMEOUT_MS, INSTALL_HINT, cacheFilePath, installHint, getCurrentVersion, compareSemver, readCache, writeCache, fetchLatestVersion, checkForUpdate, notifierSuppressed;
+var init_notifier = __esm({
+  "src/version/notifier.ts"() {
+    "use strict";
+    init_resolve();
+    REGISTRY_URL = "https://registry.npmjs.org/quiver-cli/latest";
+    CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
+    FETCH_TIMEOUT_MS = 2e3;
+    INSTALL_HINT = "pnpm add -g quiver-cli";
+    cacheFilePath = () => {
+      const base = process.env["XDG_CACHE_HOME"] || resolve19(homedir3(), ".cache");
+      return resolve19(base, "quiver", "update-check.json");
+    };
+    installHint = () => INSTALL_HINT;
+    getCurrentVersion = () => {
+      try {
+        const pkg = JSON.parse(
+          readFileSync11(resolve19(packageRoot, "package.json"), "utf8")
+        );
+        return pkg.version;
+      } catch {
+        return "0.0.0";
+      }
+    };
+    compareSemver = (a, b) => {
+      const parse2 = (v) => {
+        const [core = "", ...preParts] = v.replace(/^v/, "").split("-");
+        const nums = core.split(".").map((n) => Number.parseInt(n, 10) || 0);
+        while (nums.length < 3) nums.push(0);
+        return { nums, pre: preParts.length > 0 };
+      };
+      const pa = parse2(a);
+      const pb = parse2(b);
+      for (let i = 0; i < 3; i += 1) {
+        const da = pa.nums[i] ?? 0;
+        const db = pb.nums[i] ?? 0;
+        if (da !== db) return da > db ? 1 : -1;
+      }
+      if (pa.pre !== pb.pre) return pa.pre ? -1 : 1;
+      return 0;
+    };
+    readCache = () => {
+      const path = cacheFilePath();
+      if (!existsSync14(path)) return null;
+      try {
+        return JSON.parse(readFileSync11(path, "utf8"));
+      } catch {
+        return null;
+      }
+    };
+    writeCache = (cache) => {
+      try {
+        const path = cacheFilePath();
+        mkdirSync7(dirname6(path), { recursive: true });
+        writeFileSync9(path, JSON.stringify(cache, null, 2) + "\n");
+      } catch {
+      }
+    };
+    fetchLatestVersion = async () => {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+      try {
+        const res = await fetch(REGISTRY_URL, {
+          signal: controller.signal,
+          headers: { Accept: "application/json" }
+        });
+        if (!res.ok) return null;
+        const body = await res.json();
+        return typeof body.version === "string" ? body.version : null;
+      } catch {
+        return null;
+      } finally {
+        clearTimeout(timer);
+      }
+    };
+    checkForUpdate = async (options = {}) => {
+      const current = getCurrentVersion();
+      const cache = readCache();
+      let latest = cache?.latest ?? null;
+      const fresh = cache && Date.now() - new Date(cache.checkedAt).getTime() < CHECK_TTL_MS;
+      if (options.force || !fresh) {
+        const fetched = await fetchLatestVersion();
+        if (fetched) {
+          latest = fetched;
+          writeCache({ checkedAt: (/* @__PURE__ */ new Date()).toISOString(), latest: fetched });
+        } else if (!cache) {
+          writeCache({ checkedAt: (/* @__PURE__ */ new Date()).toISOString(), latest: null });
+        }
+      }
+      const updateAvailable = latest !== null && compareSemver(latest, current) > 0;
+      return { current, latest, updateAvailable };
+    };
+    notifierSuppressed = (json) => Boolean(process.env["QUIVER_NO_UPDATE_NOTIFIER"]) || Boolean(process.env["CI"]) || !process.stdout.isTTY || json;
+  }
+});
+
 // src/cli.ts
 init_prompts();
 import process4 from "process";
@@ -3102,13 +3203,14 @@ var run = async () => {
     case "version":
     case "--version":
     case "-v": {
-      const { readFileSync: readFileSync11 } = await import("fs");
-      const { resolve: resolve19 } = await import("path");
-      const { packageRoot: packageRoot2 } = await Promise.resolve().then(() => (init_resolve(), resolve_exports));
-      const pkg = JSON.parse(
-        readFileSync11(resolve19(packageRoot2, "package.json"), "utf8")
-      );
-      console.log(pkg.version);
+      const { checkForUpdate: checkForUpdate2, installHint: installHint2 } = await Promise.resolve().then(() => (init_notifier(), notifier_exports));
+      const info2 = await checkForUpdate2({ force: true });
+      console.log(info2.current);
+      if (info2.updateAvailable) {
+        console.log(
+          `update available: ${info2.latest}  (run: ${installHint2()})`
+        );
+      }
       break;
     }
     default:
@@ -3117,6 +3219,25 @@ var run = async () => {
       console.log(HELP);
       process4.exitCode = 1;
   }
+  if (!["version", "--version", "-v", "help", "--help", "-h"].includes(command)) {
+    await maybeNotifyUpdate(options.json);
+  }
+};
+var maybeNotifyUpdate = async (json) => {
+  try {
+    const { checkForUpdate: checkForUpdate2, notifierSuppressed: notifierSuppressed2, installHint: installHint2 } = await Promise.resolve().then(() => (init_notifier(), notifier_exports));
+    if (notifierSuppressed2(json)) return;
+    const info2 = await checkForUpdate2();
+    if (!info2.updateAvailable) return;
+    const c = palette();
+    console.log(
+      `
+${c.yellow("\u25B2")} ${c.bold("update available")} ${c.dim(
+        info2.current
+      )} \u2192 ${c.cyan(info2.latest)}   ${c.dim(`run: ${installHint2()}`)}`
+    );
+  } catch {
+  }
 };
 run().catch(async (err) => {
   await error(err instanceof Error ? err.message : String(err));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quiver-cli",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Compose a selected subset of skills, commands & MCP servers from a central catalog into any repo as native configs for opencode, Claude Code and Codex - with lockfile-based drift awareness.",
   "type": "module",
   "bin": {

package/template/.agents/commands/cp.md

@@ -1,40 +1,27 @@
 ---
 description: Commit and push all current changes using Conventional Commits
+subtask: true
 ---
 
-You are a git commit assistant. Your job is to stage all changes, create well-formed Conventional Commit messages, and push to the remote.
+You are a git commit assistant. Your job is to stage changes, create well-formed Conventional Commit messages, and push to the remote.
 
-## Steps
-
-### 1. Inspect Changes
-
-Run these commands to understand the current state:
-
-```bash
-git status
-git diff --stat
-```
-
-If there are no changes (nothing to commit), respond with "Nothing to commit." and stop.
+## Context
 
-### 2. Prisma Migration Check
+Status:
+!`git status`
 
-If `prisma/schema.prisma` appears in the changed files, verify that migration files also exist in the changeset:
+Summary:
+!`git diff --stat`
 
-```bash
-SCHEMA_CHANGED=$(git diff --name-only HEAD -- prisma/schema.prisma)
-MIGRATION_CHANGED=$(git diff --name-only HEAD -- prisma/migrations/)
-```
+## Steps
 
-If `SCHEMA_CHANGED` is non-empty but `MIGRATION_CHANGED` is empty, a migration is missing. Create one:
+### 1. Inspect Changes
 
-1. Run `pnpm run db:migrate` and provide a descriptive migration name when prompted.
-2. After the migration is created, verify it exists in `prisma/migrations/`.
-3. The new migration files will be included in the commit automatically (via `git add -A`).
+Review the status and summary above to understand the current state.
 
-If both are non-empty or schema is unchanged, proceed normally.
+If there are no changes (nothing to commit), respond with "Nothing to commit." and stop.
 
-### 3. Analyze Changes
+### 2. Analyze Changes
 
 Review the diff to understand what changed:
 
@@ -42,13 +29,13 @@ Review the diff to understand what changed:
 git diff HEAD
 ```
 
-### 4. Split Commits if Necessary
+### 3. Split Commits if Necessary
 
 If changes are **unrelated** (e.g., a bug fix and a new feature), split them into separate commits. Each commit must represent **one logical change**.
 
-To split: stage files selectively with `git add <file>`, commit, then repeat.
+To split: stage the relevant files selectively with `git add <file>`, commit, then repeat for the next logical change.
 
-### 5. Select Commit Type
+### 4. Select Commit Type
 
 Choose the most accurate type:
 
@@ -64,7 +51,7 @@ Choose the most accurate type:
 | `chore`    | Tooling, config, deps               |
 | `ci`       | CI/CD only                          |
 
-### 6. Compose Commit Message
+### 5. Compose Commit Message
 
 Format: `<type>(<scope>): <subject>`
 
@@ -88,17 +75,21 @@ Format: `<type>(<scope>): <subject>`
 
 **Forbidden subjects:** `update`, `wip`, `changes`, `fix stuff`, `misc`
 
-### 7. Execute
+### 6. Execute
+
+Stage only the files belonging to the current logical change — never use `git add -A`:
 
 ```bash
-git add -A
+git add <file1> <file2> ...
 git commit -m "<message>"
-git push -u origin HEAD
 ```
 
-If splitting commits, repeat the add/commit cycle per logical change, then push once at the end.
+If splitting commits, repeat the add/commit cycle per logical change. Push once at the end:
+
+- If the current branch has no upstream, set it: `git push -u origin HEAD`
+- Otherwise: `git push`
 
-### 8. Report
+### 7. Report
 
 After pushing, show a summary:
 
@@ -110,6 +101,7 @@ Pushed to <branch>:
 
 ## Rules
 
+- Stage selectively per logical change; NEVER use `git add -A`.
 - NEVER amend existing commits.
 - NEVER force push.
 - NEVER create empty commits.

package/template/.agents/commands/review.md

@@ -0,0 +1,68 @@
+---
+description: Review uncommitted changes for bugs, security and quality issues (read-only)
+subtask: true
+---
+
+You are a code reviewer. Review the changes below and report issues. You do NOT edit, stage, or commit — review only.
+
+## Context
+
+Status:
+!`git status`
+
+Staged diff:
+!`git diff --staged`
+
+Unstaged diff:
+!`git diff`
+
+## Steps
+
+### 1. Determine Scope
+
+If there are no changes in either diff above, respond with "Nothing to review." and stop.
+
+Otherwise, skim the changed files to understand what changed and why.
+
+### 2. Review
+
+Assess the changed lines against the criteria below. Judge only the lines that were actually added or modified, not the surrounding untouched code.
+
+**General**
+
+- Obvious bugs or incorrect logic.
+- Missing error handling or swallowed errors.
+- Security: secrets committed in code, injection, unvalidated input.
+- Dead or commented-out code, leftover debug logging (`console.log`).
+- Missing tests where they are clearly warranted.
+- Unclear names or overly broad visibility.
+
+**TypeScript / Next.js**
+
+- `any` or unsafe casts instead of `unknown` + narrowing.
+- Server/client boundary: server secrets or `server-only` logic leaking into client components; `"use client"` set correctly; no `NEXT_PUBLIC_` exposure of secrets.
+- `async`/`await` in Server Components with proper error and loading handling.
+- Input validation at API route / server action boundaries (e.g. Zod).
+- Re-render or dependency-array correctness (only when visible in the diff).
+
+### 3. Report
+
+Output the result in this format:
+
+```
+## Review
+
+Verdict: OK | Changes recommended | Blocking issues
+
+### Findings
+- [blocker|warning|nit] file.ts:42 — description + suggested fix
+```
+
+If there are no findings, write "No issues found." under the verdict.
+
+## Rules
+
+- Read-only: NEVER edit, stage, or commit files.
+- Judge only the changed lines, not unrelated surrounding code.
+- Always reference findings with `file:line`.
+- Skip formatting nits already covered by Prettier/ESLint.