sim 2.1.6-preview.84.1 → 2.1.6-preview.90.1

package/README.md

@@ -256,9 +256,26 @@ The main environment variables are:
 | `SIM_API_KEY` | API key, usually for CI |
 | `SIM_WORKSPACE` | Workspace to target |
 | `SIM_OUTPUT` | `table`, `json`, `yaml`, or `text` |
-| `SIM_CONFIG_DIR` | Directory containing CLI config and credentials |
+| `SIM_CONFIG_DIR` | Base directory for CLI config, credentials, and the update cache |
 | `SIM_TIMEOUT_SECONDS` | Per-request timeout; `0` waits indefinitely |
 | `SIM_DEBUG` | Print request diagnostics to stderr |
+| `SIM_NO_UPDATE_CHECK` | Turn off the update notice |
+
+On eligible interactive invocations, `sim` uses a daily cache before asking
+`registry.npmjs.org` what is published under the `latest` tag and prints one
+line on stderr when a newer version exists. Prerelease installs are skipped
+entirely. The cache lives in `~/.sim` by default and follows `SIM_CONFIG_DIR`;
+without a writable cache, each eligible invocation checks again. Concurrent
+invocations can also perform duplicate checks. The registry request has a
+one-second deadline; the short-lived request process is terminated on expiry.
+Apart from the configured registry URL, it sends only its own version and never
+your Sim API key. If `npm_config_registry` points at a private mirror, its query
+string is preserved, including any query-string credentials. Registry URLs
+containing username/password userinfo are rejected. Set
+`SIM_NO_UPDATE_CHECK=1` to turn it off. Empty or whitespace-only registry values
+use the public default; non-empty malformed or non-HTTP(S) values fail closed.
+The full list of cases where it stays quiet is in the
+[configuration guide](https://docs.sim.ai/cli/configuration).
 
 ## Documentation
 

package/dist/index.js

@@ -2310,6 +2310,9 @@ function configPath() {
 function credentialsPath() {
   return process.env.SIM_CREDENTIALS_FILE || join(configDir(), "credentials");
 }
+function updateCachePath() {
+  return join(configDir(), "update-check.json");
+}
 // src/config/profile.ts
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
@@ -7465,6 +7468,47 @@ var V2_OPERATIONS = {
       }
     }
   },
+  createSandbox: {
+    method: "POST",
+    path: "/api/v2/sandboxes",
+    pathParams: [],
+    responseMode: "json",
+    summary: "Create Sandbox",
+    personalKeyOnly: true,
+    body: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace in which to create the sandbox."
+      },
+      name: {
+        kind: "string",
+        required: true,
+        describe: "Display name, unique within the workspace; 1 to 64 characters."
+      },
+      language: {
+        kind: "enum",
+        required: true,
+        values: ["javascript", "python"],
+        describe: "Dependency ecosystem: `javascript` installs from npm, `python` from PyPI."
+      },
+      dependencies: {
+        kind: "array",
+        default: [],
+        describe: "Package specifiers installed into the sandbox, one per entry."
+      },
+      cliTools: {
+        kind: "array",
+        default: [],
+        describe: "Pinned managed CLI ids installed into the sandbox, at most 10, no duplicates."
+      },
+      systemPackages: {
+        kind: "array",
+        default: [],
+        describe: "Debian packages installed into the sandbox, one per entry."
+      }
+    }
+  },
   createServiceAccountCredential: {
     method: "POST",
     path: "/api/v2/credentials",
@@ -7982,6 +8026,18 @@ var V2_OPERATIONS = {
       }
     }
   },
+  deleteSandbox: {
+    method: "DELETE",
+    path: "/api/v2/sandboxes/[sandboxId]",
+    pathParams: ["sandboxId"],
+    pathParamDocs: { sandboxId: "Unique sandbox identifier." },
+    responseMode: "json",
+    summary: "Delete Sandbox",
+    personalKeyOnly: true,
+    query: {
+      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the sandbox." }
+    }
+  },
   deleteSecret: {
     method: "DELETE",
     path: "/api/v2/secrets/[name]",
@@ -8675,6 +8731,17 @@ var V2_OPERATIONS = {
       workspaceId: { kind: "string", required: true, describe: "Workspace that owns the table." }
     }
   },
+  getSandbox: {
+    method: "GET",
+    path: "/api/v2/sandboxes/[sandboxId]",
+    pathParams: ["sandboxId"],
+    pathParamDocs: { sandboxId: "Unique sandbox identifier." },
+    responseMode: "json",
+    summary: "Get Sandbox",
+    query: {
+      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the sandbox." }
+    }
+  },
   getSkill: {
     method: "GET",
     path: "/api/v2/skills/[skillId]",
@@ -9825,6 +9892,41 @@ var V2_OPERATIONS = {
       }
     }
   },
+  listSandboxes: {
+    method: "GET",
+    path: "/api/v2/sandboxes",
+    pathParams: [],
+    responseMode: "json",
+    summary: "List Sandboxes",
+    query: {
+      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the sandbox." },
+      search: {
+        kind: "string",
+        describe: "Case-insensitive substring match against the sandbox name."
+      },
+      sortBy: {
+        kind: "enum",
+        values: ["name", "createdAt", "updatedAt"],
+        default: "name",
+        describe: "Field used to sort the result. Sorting by `name` is case-sensitive and follows the storage collation, so do not rely on a case-insensitive order."
+      },
+      sortOrder: {
+        kind: "enum",
+        values: ["asc", "desc"],
+        default: "asc",
+        describe: "Sort direction."
+      },
+      limit: {
+        kind: "integer",
+        default: 50,
+        describe: "Maximum sandboxes to return per page. Must be a whole number from 1 to 100. Defaults to 50."
+      },
+      cursor: {
+        kind: "string",
+        describe: "Opaque cursor from the previous page. Send it back with the same sort and filters; only `limit` may change. Change anything else and pagination must restart without a cursor."
+      }
+    }
+  },
   listSecrets: {
     method: "GET",
     path: "/api/v2/secrets",
@@ -11374,6 +11476,39 @@ var V2_OPERATIONS = {
       limit: { kind: "integer", describe: "Maximum matching rows to update." }
     }
   },
+  updateSandbox: {
+    method: "PATCH",
+    path: "/api/v2/sandboxes/[sandboxId]",
+    pathParams: ["sandboxId"],
+    pathParamDocs: { sandboxId: "Unique sandbox identifier." },
+    responseMode: "json",
+    summary: "Update Sandbox",
+    personalKeyOnly: true,
+    body: {
+      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the sandbox." },
+      name: {
+        kind: "string",
+        describe: "New display name, unique within the workspace; 1 to 64 characters."
+      },
+      language: {
+        kind: "enum",
+        values: ["javascript", "python"],
+        describe: "Replacement dependency ecosystem. The whole spec is revalidated against it, so a Python dependency list does not survive a switch to JavaScript."
+      },
+      dependencies: {
+        kind: "array",
+        describe: "Replacement package list; replaces the whole list."
+      },
+      cliTools: {
+        kind: "array",
+        describe: "Replacement managed CLI list; replaces the whole list."
+      },
+      systemPackages: {
+        kind: "array",
+        describe: "Replacement Debian package list; replaces the whole list."
+      }
+    }
+  },
   updateSkill: {
     method: "PATCH",
     path: "/api/v2/skills/[skillId]",
@@ -12307,6 +12442,9 @@ var CLI_CONTRACT = {
     confirm: "This revokes the explicit skill editor grant for the selected email."
   },
   deleteCustomTool: { confirm: "This deletes the custom tool." },
+  deleteSandbox: {
+    confirm: "This deletes the sandbox; Function blocks that select it fail until re-pointed."
+  },
   deleteMcpServer: {
     confirm: "This removes the MCP server and the tools it provides."
   },
@@ -12593,6 +12731,20 @@ var CLI_CONTRACT = {
   importWorkflow: { flags: { folderPath: FOLDER_PATH_FLAG } },
   createCustomTool: { flags: { schema: { json: true, describe: CUSTOM_TOOL_SCHEMA_HELP } } },
   updateCustomTool: { flags: { schema: { json: true, describe: CUSTOM_TOOL_SCHEMA_HELP } } },
+  createSandbox: {
+    flags: {
+      dependencies: { list: true, manifest: true },
+      cliTools: { list: true },
+      systemPackages: { list: true, manifest: true }
+    }
+  },
+  updateSandbox: {
+    flags: {
+      dependencies: { list: true, manifest: true },
+      cliTools: { list: true },
+      systemPackages: { list: true, manifest: true }
+    }
+  },
   listTables: {
     flags: { folderPath: FOLDER_PATH_FLAG },
     columns: [
@@ -12734,6 +12886,15 @@ var CLI_CONTRACT = {
       { header: "updated", path: "updatedAt", format: "timestamp" }
     ]
   },
+  listSandboxes: {
+    columns: [
+      { header: "id" },
+      { header: "name" },
+      { header: "language" },
+      { header: "status", path: "buildStatus" },
+      { header: "updated", path: "updatedAt", format: "timestamp" }
+    ]
+  },
   listCredentials: {
     columns: [
       { header: "id" },
@@ -13439,7 +13600,11 @@ function readArgumentSource(raw, flagName) {
     throw new SimApiError(`--${flagName} cannot read ${path}: ${error.message}${literalAtHint(error, path)}`, 0);
   }
 }
-function readListValues(raw, flagName) {
+function isManifestNoise(line) {
+  const trimmed = line.trim();
+  return trimmed === "" || trimmed.startsWith("#");
+}
+function readListValues(raw, flagName, manifest = false) {
   const arguments_ = Array.isArray(raw) ? raw : [raw];
   const values = arguments_.flatMap((argument) => {
     if (typeof argument !== "string") {
@@ -13451,10 +13616,11 @@ function readListValues(raw, flagName) {
     const lines = source.text.split(/\r?\n/);
     if (lines.at(-1) === "")
       lines.pop();
-    if (lines.length === 0) {
+    const kept = manifest ? lines.filter((line) => !isManifestNoise(line)) : lines;
+    if (kept.length === 0) {
       throw new SimApiError(`--${flagName}${source.from} contains no values`, 0);
     }
-    return lines.map((line, index) => {
+    return kept.map((line, index) => {
       const value = line.trim();
       if (!value) {
         throw new SimApiError(`--${flagName}${source.from} has an empty value on line ${index + 1}`, 0);
@@ -13499,7 +13665,7 @@ function coerce(raw, field, flag, flagName) {
   if (raw === undefined)
     return;
   if (flag.list) {
-    const values = readListValues(raw, flagName).map((value) => flag.folderPath ? encodeFolderPath(value) : value);
+    const values = readListValues(raw, flagName, flag.manifest === true).map((value) => flag.folderPath ? encodeFolderPath(value) : value);
     return field.kind === "string" ? values.join(",") : values;
   }
   if (flag.rowCap)
@@ -13678,7 +13844,7 @@ function addFieldOption(command, operation, field, descriptor, slot, paginates,
   const placeholder = takesList ? "<value...>" : flag.rowCap ? "<n>" : wantsJson ? "<json|@file>" : "<value>";
   const choices = flag.choices ?? descriptor.values;
   const literalNull = slot === "body" && !takesList && !wantsJson;
-  const describe = `${documented}${takesList ? " (space-separated, or @path / @- with one value per line; @@value for a literal leading @)" : wantsJson ? " (JSON, or @path / @- to read a file or stdin)" : ""}${descriptor.required ? " (required)" : ""}${literalNull ? literalNullHint(documented, name) : ""}`;
+  const describe = `${documented}${takesList ? flag.manifest ? " (space-separated, or @path / @- with one value per line; in a file, blank lines and # comments are ignored, while inline values are sent as typed and may not be empty; @@value for a literal leading @)" : " (space-separated, or @path / @- with one value per line; @@value for a literal leading @)" : wantsJson ? " (JSON, or @path / @- to read a file or stdin)" : ""}${descriptor.required ? " (required)" : ""}${literalNull ? literalNullHint(documented, name) : ""}`;
   const renamedFrom = flag.renamedFrom ?? [];
   const option = new Option(`${short}--${name} ${placeholder}`, describe);
   if (flag.hidden)
@@ -14421,6 +14587,7 @@ var GROUP_ALIASES = {
   knowledge: "kb",
   logs: "log",
   "mcp-servers": "mcp-server",
+  sandboxes: "sandbox",
   secrets: "secret",
   skills: "skill",
   tables: "table",
@@ -16454,6 +16621,328 @@ function attachSecretCommands(program2) {
   secrets.command("set").argument("<name>", "Secret name, as referenced in workflows").description(describeOperation(V2_OPERATIONS.setSecret, "Create or replace a named secret")).addOption(new Option("--scope <scope>", "Secret ownership scope (required)").choices([...SECRET_SCOPES]).makeOptionMandatory()).option("--value <value|@file>", "Secret value. Passing it inline exposes it to shell history and process listings; @path reads it from a file and @- from stdin, verbatim — a trailing newline is part of the value, so write the file with printf rather than echo. Prefix a literal leading @ with a second one").option("--description <description>", "What the secret is for, shown to teammates; workspace scope only. Omit to leave an existing description unchanged").option("--unredacted", `${V2_OPERATIONS.setSecret.body.unredacted.describe} Pass --no-unredacted to restore redaction`).option("--no-unredacted", "Send --unredacted as false").on("option:unredacted", () => redactionSpellings.add("--unredacted")).on("option:no-unredacted", () => redactionSpellings.add("--no-unredacted")).action((name, options, command) => setSecret(name, options, command, redactionSpellings));
 }
 
+// src/update/check.ts
+import { spawn as spawn2 } from "node:child_process";
+import {
+  closeSync,
+  constants as constants2,
+  fstatSync,
+  lstatSync,
+  mkdirSync as mkdirSync2,
+  openSync,
+  readSync as readSync2,
+  renameSync,
+  unlinkSync,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { dirname as dirname3 } from "node:path";
+import { fileURLToPath } from "node:url";
+var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+var REGISTRY_TIMEOUT_MS = 1000;
+var DEFAULT_REGISTRY = "https://registry.npmjs.org";
+var PACKAGE_NAME = "sim";
+var DIST_TAGS_PATH = `-/package/${PACKAGE_NAME}/dist-tags`;
+var MAX_RESPONSE_BYTES = 64 * 1024;
+var MAX_CACHE_BYTES = 4 * 1024;
+var STABLE_VERSION_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+function parseStableVersion(version) {
+  const match = STABLE_VERSION_PATTERN.exec(version);
+  if (!match)
+    return null;
+  const parsed = [Number(match[1]), Number(match[2]), Number(match[3])];
+  return parsed.every(Number.isSafeInteger) ? parsed : null;
+}
+function isNewerVersion(candidate, current) {
+  if (candidate[0] !== current[0])
+    return candidate[0] > current[0];
+  if (candidate[1] !== current[1])
+    return candidate[1] > current[1];
+  return candidate[2] > current[2];
+}
+var CI_VARIABLES = [
+  "CI",
+  "GITHUB_ACTIONS",
+  "JENKINS_URL",
+  "TEAMCITY_VERSION",
+  "BUILDKITE"
+];
+var CACHE_VERSION = 1;
+var cacheWriteSequence = 0;
+function isEnabled(value) {
+  if (value === undefined)
+    return false;
+  const normalized = value.trim().toLowerCase();
+  return normalized !== "" && normalized !== "0" && normalized !== "false";
+}
+function isProjectLocalInstall(modulePath, cwd) {
+  const normalizedModulePath = normalizeModulePath(modulePath);
+  const nodeModulesIndex = normalizedModulePath.indexOf("/node_modules/");
+  if (nodeModulesIndex < 0)
+    return false;
+  const installRoot = normalizedModulePath.slice(0, nodeModulesIndex);
+  const workingDirectory = normalizeModulePath(cwd).replace(/\/+$/, "");
+  return workingDirectory === installRoot || workingDirectory.startsWith(`${installRoot}/`);
+}
+function isUnadvisableInstall(modulePath, env2, cwd) {
+  const normalized = normalizeModulePath(modulePath);
+  return env2.npm_command === "exec" || normalized.includes("/_npx/") || normalized.includes("/packages/sim-cli/") || isProjectLocalInstall(modulePath, cwd);
+}
+function normalizeModulePath(modulePath) {
+  return modulePath.replace(/\\/g, "/").toLowerCase();
+}
+function registryUrl(env2) {
+  const fallback = new URL(DIST_TAGS_PATH, DEFAULT_REGISTRY);
+  const configured = env2.npm_config_registry?.trim();
+  if (!configured)
+    return fallback;
+  try {
+    const base = new URL(configured);
+    if (base.protocol !== "http:" && base.protocol !== "https:")
+      return null;
+    if (base.username || base.password)
+      return null;
+    base.pathname = `${base.pathname.replace(/\/$/, "")}/${DIST_TAGS_PATH}`;
+    return base;
+  } catch {
+    return null;
+  }
+}
+var REGISTRY_REQUEST_SCRIPT = `
+let input = ''
+process.stdin.setEncoding('utf8')
+for await (const chunk of process.stdin) input += chunk
+
+try {
+  const { url, headers, maxResponseBytes, timeoutMs } = JSON.parse(input)
+  const deadline = setTimeout(() => process.exit(1), timeoutMs)
+  const response = await fetch(url, { headers, redirect: 'error' })
+  const declared = Number(response.headers.get('content-length'))
+
+  if (!response.ok || !response.body || (Number.isFinite(declared) && declared > maxResponseBytes)) {
+    process.exit(1)
+  }
+
+  const reader = response.body.getReader()
+  const chunks = []
+  let seen = 0
+
+  while (true) {
+    const { done, value } = await reader.read()
+    if (done) break
+    seen += value.byteLength
+    if (seen > maxResponseBytes) {
+      process.exit(1)
+    }
+    chunks.push(Buffer.from(value))
+  }
+
+  clearTimeout(deadline)
+  process.stdout.write(Buffer.concat(chunks), () => process.exit(0))
+} catch {
+  process.exit(1)
+}
+`;
+function registryProcessEnv() {
+  const env2 = { ...process.env };
+  for (const key of Object.keys(env2)) {
+    const normalized = key.toLowerCase();
+    if (normalized === "npm_config_registry" || normalized === "sim_api_key")
+      delete env2[key];
+  }
+  return env2;
+}
+function requestRegistry(url, { headers, maxResponseBytes, timeoutMs }) {
+  return new Promise((resolve3, reject) => {
+    const proxyArguments = process.execArgv.filter((argument) => argument === "--use-env-proxy" || argument === "--no-use-env-proxy");
+    const child = spawn2(process.execPath, [...proxyArguments, "--input-type=module", "--eval", REGISTRY_REQUEST_SCRIPT], {
+      env: registryProcessEnv(),
+      killSignal: "SIGKILL",
+      stdio: ["pipe", "pipe", "ignore"],
+      timeout: timeoutMs,
+      windowsHide: true
+    });
+    const chunks = [];
+    let failed = false;
+    let seen = 0;
+    child.stdout.on("data", (chunk) => {
+      seen += chunk.byteLength;
+      if (seen > maxResponseBytes) {
+        failed = true;
+        child.kill("SIGKILL");
+        return;
+      }
+      chunks.push(chunk);
+    });
+    child.stdout.on("error", () => {
+      failed = true;
+      child.kill("SIGKILL");
+    });
+    child.stdin.on("error", () => {});
+    child.once("error", reject);
+    child.once("close", (code) => {
+      resolve3(code === 0 && !failed ? Buffer.concat(chunks).toString("utf8") : null);
+    });
+    child.stdin.end(JSON.stringify({ headers, maxResponseBytes, timeoutMs, url: url.href }));
+  });
+}
+async function fetchDistTags(env2, request) {
+  try {
+    const url = registryUrl(env2);
+    if (!url)
+      return null;
+    const text2 = await request(url, {
+      headers: { accept: "application/json", "user-agent": `${PACKAGE_NAME}-cli/${CLI_VERSION}` },
+      maxResponseBytes: MAX_RESPONSE_BYTES,
+      timeoutMs: REGISTRY_TIMEOUT_MS
+    });
+    if (text2 === null || Buffer.byteLength(text2) > MAX_RESPONSE_BYTES)
+      return null;
+    const body = JSON.parse(text2);
+    if (typeof body !== "object" || body === null || Array.isArray(body))
+      return null;
+    const tags = {};
+    for (const [tag, version] of Object.entries(body)) {
+      if (typeof version === "string")
+        tags[tag] = version;
+    }
+    return tags;
+  } catch {
+    return null;
+  }
+}
+function readCache(path) {
+  let descriptor = null;
+  try {
+    if (!lstatSync(path).isFile())
+      return null;
+    descriptor = openSync(path, constants2.O_RDONLY | constants2.O_NONBLOCK | constants2.O_NOFOLLOW);
+    const descriptorStats = fstatSync(descriptor);
+    if (!descriptorStats.isFile() || descriptorStats.size > MAX_CACHE_BYTES) {
+      return null;
+    }
+    const buffer = Buffer.allocUnsafe(MAX_CACHE_BYTES + 1);
+    let bytesRead = 0;
+    while (bytesRead < buffer.byteLength) {
+      const count = readSync2(descriptor, buffer, bytesRead, buffer.byteLength - bytesRead, bytesRead);
+      if (count === 0)
+        break;
+      bytesRead += count;
+    }
+    if (bytesRead > MAX_CACHE_BYTES)
+      return null;
+    const parsed = JSON.parse(buffer.subarray(0, bytesRead).toString("utf8"));
+    if (typeof parsed !== "object" || parsed === null)
+      return null;
+    const entry = parsed;
+    if (entry.version !== CACHE_VERSION)
+      return null;
+    if (typeof entry.checkedAt !== "string" || Number.isNaN(Date.parse(entry.checkedAt)))
+      return null;
+    return {
+      version: CACHE_VERSION,
+      checkedAt: entry.checkedAt
+    };
+  } catch {
+    return null;
+  } finally {
+    if (descriptor !== null) {
+      try {
+        closeSync(descriptor);
+      } catch {}
+    }
+  }
+}
+function writeCache(path, entry) {
+  let descriptor = null;
+  let temporaryCreated = false;
+  const temporaryPath = `${path}.${process.pid}.${Date.now()}.${cacheWriteSequence++}.tmp`;
+  try {
+    mkdirSync2(dirname3(path), { recursive: true, mode: 448 });
+    descriptor = openSync(temporaryPath, "wx", 420);
+    temporaryCreated = true;
+    writeFileSync2(descriptor, `${JSON.stringify(entry, null, 2)}
+`);
+    closeSync(descriptor);
+    descriptor = null;
+    renameSync(temporaryPath, path);
+    temporaryCreated = false;
+  } catch {} finally {
+    if (descriptor !== null) {
+      try {
+        closeSync(descriptor);
+      } catch {}
+    }
+    if (temporaryCreated) {
+      try {
+        unlinkSync(temporaryPath);
+      } catch {}
+    }
+  }
+}
+function isFresh(entry, now) {
+  const age = now.getTime() - Date.parse(entry.checkedAt);
+  return age >= 0 && age < CHECK_INTERVAL_MS;
+}
+function upgradeCommand(modulePath = fileURLToPath(import.meta.url), env2 = process.env) {
+  const target = `${PACKAGE_NAME}@latest`;
+  const normalized = normalizeModulePath(modulePath);
+  if (normalized.includes(".bun/install/global"))
+    return `bun add -g ${target}`;
+  if (normalized.includes("/pnpm/") || normalized.includes("/.pnpm/")) {
+    return `pnpm add -g ${target}`;
+  }
+  if (normalized.includes("/.yarn/") || normalized.includes("/yarn/")) {
+    return `yarn global add ${target}`;
+  }
+  const agent = env2.npm_config_user_agent ?? "";
+  if (agent.startsWith("pnpm/"))
+    return `pnpm add -g ${target}`;
+  if (agent.startsWith("yarn/"))
+    return `yarn global add ${target}`;
+  if (agent.startsWith("bun/"))
+    return `bun add -g ${target}`;
+  return `npm install -g ${target}`;
+}
+async function announceUpdateIfAvailable(options = {}) {
+  try {
+    const env2 = options.env ?? process.env;
+    const isTty = options.isTty ?? process.stderr.isTTY === true;
+    const modulePath = options.modulePath ?? fileURLToPath(import.meta.url);
+    const cwd = options.cwd ?? process.cwd();
+    const now = options.now ?? new Date;
+    if (isEnabled(env2.SIM_NO_UPDATE_CHECK))
+      return;
+    if (!isTty)
+      return;
+    if (CI_VARIABLES.some((variable) => isEnabled(env2[variable])))
+      return;
+    if (isUnadvisableInstall(modulePath, env2, cwd))
+      return;
+    const currentVersion = options.currentVersion ?? CLI_VERSION;
+    const current = parseStableVersion(currentVersion);
+    if (!current)
+      return;
+    const cachePath = updateCachePath();
+    const cached = readCache(cachePath);
+    if (cached && isFresh(cached, now))
+      return;
+    const tags = await fetchDistTags(env2, options.registryRequest ?? requestRegistry);
+    const latest = tags?.latest ?? null;
+    const available = latest ? parseStableVersion(latest) : null;
+    writeCache(cachePath, {
+      version: CACHE_VERSION,
+      checkedAt: now.toISOString()
+    });
+    if (!latest || !available)
+      return;
+    if (!isNewerVersion(available, current))
+      return;
+    const write = options.write ?? ((message) => void process.stderr.write(message));
+    write(`Update available: sim ${currentVersion} → ${latest}. Run: ${upgradeCommand(modulePath, env2)}
+`);
+  } catch {}
+}
+
 // src/program.ts
 var PROGRAM_DESCRIPTION = "Talk to the Sim API from your terminal";
 var HELP_EPILOGUE = `
@@ -16533,6 +17022,7 @@ function buildProgram(options = {}) {
   attachProtocolCommands(program2);
   attachSecretCommands(program2);
   program2.addHelpText("after", HELP_EPILOGUE);
+  program2.hook("preAction", () => announceUpdateIfAvailable());
   refuseHelpAfterUnknownCommand(program2);
   assertNoReservedProgramFlags(program2);
   return program2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sim",
-  "version": "2.1.6-preview.84.1",
+  "version": "2.1.6-preview.90.1",
   "description": "Sim CLI - talk to the Sim API from your terminal",
   "type": "module",
   "bin": {