specky-sdd 3.5.0 → 3.7.0

package/.apm/hooks/scripts/ears-validator.sh

@@ -3,36 +3,75 @@
 # Target: Claude Code (.claude/hooks/)
 # Type: Advisory | Trigger: PostToolUse | Phase: 2,3
 # Paper: arXiv:2601.03878 — EARS quality
+#
+# Advisory hook: missing EARS pattern types WARN but exit 0 — exit 1 is
+# reserved for real failures (SPECIFICATION.md missing or unreadable).
+# Body is POSIX-sh compatible (runs under dash/sh as well as bash), so
+# plain `set -eu` instead of bash-only `set -o pipefail`.
 
-set -euo pipefail
+set -eu
 
 LATEST=$(ls -td .specs/*/ 2>/dev/null | head -1 || true)
 [ -z "$LATEST" ] && exit 0
 SPEC="$LATEST/SPECIFICATION.md"
-[ -f "$SPEC" ] || exit 0
+
+if [ ! -f "$SPEC" ] || [ ! -r "$SPEC" ]; then
+  echo "❌ EARS Validation: $SPEC is missing or unreadable."
+  echo "   sdd_write_spec should have produced it — re-run the Specify phase."
+  exit 1
+fi
 
 echo "🔍 EARS Validation: $SPEC"
 
-# Count each EARS pattern (POSIX ERE for macOS/Linux portability)
-UBIQ=$(grep -cE 'The system shall' "$SPEC" 2>/dev/null || echo "0")
-EVENT=$(grep -cE 'When .*, the system shall' "$SPEC" 2>/dev/null || echo "0")
-STATE=$(grep -cE 'While .*, the system shall' "$SPEC" 2>/dev/null || echo "0")
-OPTION=$(grep -cE 'Where .*, the system shall' "$SPEC" 2>/dev/null || echo "0")
-UNWANTED=$(grep -cE 'If .*, then the system shall' "$SPEC" 2>/dev/null || echo "0")
-COMPLEX=$(grep -cE 'While .*, when .*, the system shall' "$SPEC" 2>/dev/null || echo "0")
+# Count one EARS pattern (POSIX ERE for macOS/Linux portability).
+# grep -c prints the count but exits 1 when the count is 0; the old
+# `|| echo "0"` appended a SECOND "0" line to the captured value, which
+# broke the arithmetic below (and the whole hook, under set -e) for any
+# spec missing even one pattern type. Capture the count and swallow the
+# exit status instead.
+count_pattern() {
+  _count=$(grep -cE "$1" "$SPEC" 2>/dev/null) || _count="${_count:-0}"
+  printf '%s' "${_count:-0}"
+}
+
+UBIQ=$(count_pattern 'The system shall')
+EVENT=$(count_pattern 'When .*, the system shall')
+STATE=$(count_pattern 'While .*, the system shall')
+OPTION=$(count_pattern 'Where .*, the system shall')
+UNWANTED=$(count_pattern 'If .*, then the system shall')
+COMPLEX=$(count_pattern 'While .*, when .*, the system shall')
 
 TOTAL=$((UBIQ + EVENT + STATE + OPTION + UNWANTED + COMPLEX))
-REQS=$(grep -cE 'REQ-[A-Z]+-[0-9]+' "$SPEC" 2>/dev/null || echo "0")
-
-echo "  Ubiquitous:  $UBIQ"
-echo "  Event-driven: $EVENT"
-echo "  State-driven: $STATE"
-echo "  Optional:     $OPTION"
-echo "  Unwanted:     $UNWANTED"
-echo "  Complex:      $COMPLEX"
+REQS=$(count_pattern 'REQ-[A-Z]+-[0-9]+')
+
+# Per-pattern coverage report
+PRESENT=0
+MISSING=""
+report_pattern() {
+  # $1 = padded label, $2 = count, $3 = pattern name for the warning line
+  echo "  $1 $2"
+  if [ "$2" -gt 0 ]; then
+    PRESENT=$((PRESENT + 1))
+  else
+    MISSING="$MISSING $3"
+  fi
+}
+
+report_pattern "Ubiquitous:  " "$UBIQ" "ubiquitous"
+report_pattern "Event-driven:" "$EVENT" "event-driven"
+report_pattern "State-driven:" "$STATE" "state-driven"
+report_pattern "Optional:    " "$OPTION" "optional"
+report_pattern "Unwanted:    " "$UNWANTED" "unwanted-behavior"
+report_pattern "Complex:     " "$COMPLEX" "complex"
 echo "  ─────────────"
+echo "  Pattern coverage: $PRESENT/6 EARS pattern types present"
 echo "  EARS total:   $TOTAL / $REQS requirements"
 
+if [ -n "$MISSING" ]; then
+  echo "⚠️  Pattern types with zero requirements:$MISSING"
+  echo "   Not every spec needs all 6 EARS patterns — advisory only."
+fi
+
 if [ "$TOTAL" -lt "$REQS" ]; then
   echo "⚠️  $((REQS - TOTAL)) requirements may not follow EARS notation."
   echo "   Run sdd_validate_ears for detailed analysis."

package/.apm/prompts/specky-api.prompt.md

@@ -12,4 +12,4 @@ Design an API using the Specky SDD pipeline.
 Please:
 1. Call @requirements-engineer to produce FRD + NFRD for the API
 2. Call @sdd-init with project_type=api
-3. Proceed through research → specify → design phases
+3. Proceed through discover → specify → design phases

package/.apm/prompts/specky-research.prompt.md

@@ -1,6 +1,6 @@
 ---
-description: Run SDD research phase
+description: Run SDD Discover phase (research)
 ---
-Run the SDD research phase for feature [FEATURE NUMBER].
+Run the SDD Discover phase (research) for feature [FEATURE NUMBER].
 
 @research-analyst — scan the codebase, import relevant documents, run discovery questions, and produce RESEARCH.md.

package/.apm/skills/research-analyst/SKILL.md

@@ -214,10 +214,10 @@ Generate dependency graph and assess risk of each integration.
 Structure the research artifact as:
 
 ```markdown
-# Research Phase Report
+# Discovery Phase Report
 **Project:** [name]
 **Date:** [YYYY-MM-DD]
-**Phase:** 1 - Research
+**Phase:** 1 - Discover
 **Status:** Complete
 
 ## Executive Summary

package/.apm/skills/specky-onboarding/SKILL.md

@@ -130,9 +130,9 @@ Check for:
 
 **Utility (8):** sdd_get_status, sdd_get_template, sdd_write_bugfix, sdd_scan_codebase, sdd_amend, sdd_check_ecosystem, sdd_check_sync, sdd_metrics
 
-**Governance (3):** sdd_model_routing, sdd_context_status, sdd_check_access
+**Governance (4):** sdd_model_routing, sdd_context_status, sdd_check_access, sdd_verify_audit
 
-## 14 Hook Scripts
+## 16 Hook Scripts
 
 **Blocking (exit 2 = halt):**
 - artifact-validator.sh — Prerequisite .md files exist
@@ -142,9 +142,11 @@ Check for:
 
 **Advisory (exit 0 = warn):**
 - branch-validator.sh — Branch matches phase expectations
-- lgtm-gate.sh — Human review reminder at Phases 3/4/5
-- auto-checkpoint.sh — Suggest checkpoint after writes
+- pipeline-guard.sh — Pipeline ordering / phase-skip guard
+- lgtm-gate.sh — Human review reminder at Phases 2/4/5
+- session-banner.sh — Session start pipeline-status banner
 - spec-sync.sh — Detect spec-code drift
+- auto-checkpoint.sh — Suggest checkpoint after writes
 - spec-quality.sh — Specification quality metrics
 - ears-validator.sh — EARS pattern compliance
 - task-tracer.sh — Task dependency graph

package/CHANGELOG.md

@@ -7,6 +7,58 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.7.0] - 2026-07-03
+
+Update awareness: users of old versions now find out — without the server ever
+phoning home.
+
+### Added
+
+- **Version-drift advisory (always on, zero network).** `specky doctor`, `specky status`, and the MCP server at startup compare the workspace's installed assets version (`.specky/install.json`) against the running CLI/server version and suggest `specky upgrade` when they differ — the common "updated the global CLI but the project still runs the old pinned server" case. Local file comparison only; stderr only; never blocks startup.
+- **Once-daily update banner (CLI only, opt-out).** After `install`/`init`, `doctor`, `status`, `upgrade`, and `--version`, the CLI checks `https://registry.npmjs.org/specky-sdd/latest` (24h cache in `~/.specky/update-check.json`, 2s timeout, fail-silent offline) and prints `Update available: specky-sdd vX → vY → npm install -g specky-sdd@latest && specky upgrade`. **Never runs in `specky serve`** — the MCP server keeps making zero outbound calls. Disabled automatically in CI (`CI=true`); opt out with `SPECKY_NO_UPDATE_CHECK=1` or `update_check: false` in `.specky/config.yml` (not flipped by the enterprise profile). No telemetry — nothing is sent beyond the GET itself.
+- `compareSemver`/`checkForUpdate` utilities with 37 dependency-injected tests (semver matrix incl. prereleases, cache TTL, opt-outs, offline/timeout, unwritable cache).
+- Docs: README "Staying up to date" (banner, one-command upgrade, Renovate/Dependabot for per-project pins, GitHub Watch → Releases), CLI.md update-notifications section + `SPECKY_NO_UPDATE_CHECK`, INSTALL.md upgrading guidance, SECURITY.md precise network disclosure (server: zero outbound; CLI: the single optional registry GET).
+
+### Changed
+
+- `specky status` no longer crashes on a corrupt `.specky/install.json` (reports "metadata unreadable" instead).
+
+## [3.6.0] - 2026-07-03
+
+Delivery-honesty release. A black-box audit executed all 65 public product
+promises against the real 3.5.0 server (`docs/AUDIT-DELIVERY-3.5.md` is the
+full record: 30 delivered / 29 partial / 6 not delivered). This release fixes
+every finding.
+
+### Fixed
+
+- **`sdd_auto_pipeline` fabricated its quality gate** (hard-coded `APPROVE`/100% — the same defect fixed for other paths in 3.4.0 had survived here). It now runs the shared `AnalysisEngine`: real decision, real coverage, requirement-level traceability matrix in `ANALYSIS.md`. Auto-generated packages honestly report `CHANGES_NEEDED` until traceability is complete.
+- **`sdd_get_status` reported a stale phase** (it preferred a per-feature state file no pipeline tool writes and fell back to a fresh default). Headline fields (current phase, progress, gate decision, next action) now reflect the state the pipeline actually persists.
+- **Phase-skip loophole**: with no registered feature, `sdd_advance_phase` skipped every artifact check and could walk six phases with zero artifacts. Advancing past init now requires a registered feature.
+- **Generated tests now compile/run**: pytest output was a Python syntax error (JS-style header); junit class names didn't match filenames and had duplicate methods; xunit had duplicate members; vitest/jest/playwright emitted markdown ToC noise as tests, traced to a nonexistent `REQ-000`, and truncated the `REQ-` prefix. All fixed, with structural (and where possible compile) tests.
+- **PBT generators produce runnable property tests**: valid `fast-check` import, self-contained bodies (no undefined helpers), meaningful assertions, and real REQ IDs (never fabricated `REQ-GEN-00N` — untraceable items are skipped or explicitly labeled `UNTRACED-`).
+- **`sdd_verify_tests` coverage scanned the wrong directories** (always 0%): it now scans where `sdd_generate_tests` writes (via a generated-tests manifest), so the REQ→test mapping and `next_steps` use real numbers.
+- **Doc generators derive real content**: the "first 15 lines" summarizer (which captured only frontmatter + ToC) was replaced with requirement-aware extraction — generated docs now contain the actual EARS requirements; the runbook is derived from `DESIGN.md` (was 100% static template); onboarding explains the feature; API docs extract request/response examples from the design contracts (were always `{}`) and no longer duplicate endpoints from mermaid blocks; the journey doc joined the parallel batch and failures surface in the response.
+- **Diagrams**: `er`/`dfd` emitted invalid Mermaid (unsanitized ids) — fixed; `class`/`state`/`c4_code` were byte-identical stubs regardless of input — now derived from the artifacts; `pie` fabricated numbers — now computed; `gantt` was header-only from spec/design and used a date syntax real Mermaid rejects — fixed; `sequence` derivation is readable (`Client->>System` per requirement). `sdd_generate_all_diagrams` now **writes `DIAGRAMS.md`** (it returned diagrams but wrote nothing) and covers c4_context + state (18 diagrams). ToC headings are no longer treated as architecture components; `sdd_figma_diagram` types differ structurally with meaningful edge labels.
+- **Binary document imports fail honestly**: real (compressed) PDF/DOCX/PPTX used to import as gibberish flagged "success". Unsupported binaries now return a clear error pointing to md/txt conversion or the MarkItDown MCP; `sdd_batch_import` counts them as failed.
+- **`sdd_export_work_items` payloads are target-specific** (GitHub `{title, body, labels}` / Jira `{fields: {project.key, issuetype…}}` / Azure Boards `System.*` fields + `area_path`/`iteration_path`) and honor the documented inputs that were silently discarded (`project_key`, `include_subtasks`, …).
+- **Persisted `[TODO:]` placeholders**: `CHECKLIST.md` and `CROSS_ANALYSIS.md` now render the real items/alignment tables and recommendation (the data existed only in the JSON response).
+- **Terraform generation emits real resources** parsed from the `DESIGN.md` tech stack (was a provider-only skeleton with four generic modules); devcontainer/local-env/codespaces honor the documented DESIGN.md fallback detection (`additional_services` is no longer always empty); the Codespaces payload no longer references a nonexistent `create_codespace` MCP tool.
+- **`ears-validator.sh` hook** no longer fails (exit 1) whenever a spec lacks one of the 6 EARS pattern types — it reports per-pattern coverage as an advisory.
+- **`sdd_figma_to_spec`** payload referenced nonexistent tool names (`sdd_gen_spec` → `sdd_write_spec` etc.).
+- Cognitive-debt gate instrumentation resolved artifact paths against the process cwd instead of the workspace root, silently degrading in hosted (HTTP) mode.
+
+### Added
+
+- **Opt-in server-side LGTM**: `pipeline.require_lgtm: true` in `.specky/config.yml` makes `sdd_advance_phase` refuse to pass the Specify/Design/Tasks gates without an explicit `lgtm: true` input. Default off; not flipped by the enterprise profile (human-review gating is a workflow choice, not a security control). Gate history records LGTM presence.
+- **`docs/AUDIT-DELIVERY-3.5.md`** — the full promise-delivery audit as a public record.
+- 6 new test suites (~112 new tests, 299 total) locking generated-content quality: compilable test output, valid Mermaid structure, target-specific export payloads, honest import failures, requirement-bearing docs, pipeline-state truthfulness.
+
+### Container publishing docs
+
+- Expanded GHCR/container documentation across README, install, enterprise deployment, and publishing guidance.
+- Updated GHCR publish automation to preserve multi-arch `linux/amd64` + `linux/arm64` images.
+
 ## [3.5.0] - 2026-07-02
 
 Enterprise mode — an **opt-in configuration profile** of the same 100%

package/README.md

@@ -51,13 +51,14 @@
 | | [Where Specifications Live](#where-specifications-live) | File structure and naming conventions |
 | | [Input Methods](#input-methods-6-ways-to-start) | 6 ways to feed Specky |
 | | [Three Project Types](#three-project-types-one-pipeline) | Greenfield, Brownfield, Modernization |
+| | [Staying up to date](#staying-up-to-date) | Update notifications and one-command upgrade |
 | **Pipeline** | [Pipeline and LGTM Gates](#pipeline-and-lgtm-gates) | 10 phases with human review gates |
 | | [All 58 Tools](#all-58-tools) | Complete tool reference by category |
 | | [EARS Notation](#ears-notation) | The 6 requirement patterns |
 | **Enterprise** | [Compliance Frameworks](#compliance-frameworks) | HIPAA, SOC2, GDPR, PCI-DSS, ISO 27001 |
 | | [Enterprise Ready](#enterprise-ready) | Security, audit trail, quality gates |
 | **Platform** | [The SDD Platform](#the-spec-driven-development-platform) | Built on Spec-Kit, everything included |
-| | [Roadmap](#roadmap) | v3.5 current, v3.6+ planned |
+| | [Roadmap](#roadmap) | v3.7 current, v3.8+ planned |
 
 
 ## What is Specky?
@@ -173,7 +174,7 @@ Specky adds a **deterministic engine** between your intent and your code:
 | Gitflow-SDD branching | spec/NNN → develop → stage → main |
 | Unified CLI distribution | `npm install -g specky-sdd && specky install --ide=copilot` — one binary, multi-OS (macOS/Linux/Windows/WSL) |
 | Works in any MCP host | VS Code + Copilot, Claude Code, Cursor, Windsurf, or any MCP client |
-| Zero outbound network calls | Fully air-gapped, code never leaves your machine |
+| Zero outbound calls from the MCP server | Air-gap friendly; code never leaves your machine. The CLI's once-daily update check is [opt-out](#staying-up-to-date) |
 | MIT open source | Fork it, extend it, audit it. No vendor lock, no seat pricing |
 
 
@@ -352,7 +353,7 @@ The AI calls `sdd_import_document` → converts to Markdown, extracts sections,
 
 The AI calls `sdd_batch_import` → processes every supported file in the directory.
 
-> **Tip:** For best results with PDF/DOCX, install the optional `mammoth` and `pdfjs-dist` packages for enhanced formatting, table extraction, and image handling.
+> **Honest note on binary formats:** the built-in extractor fully handles `md`/`txt` and simple uncompressed files. Real-world (compressed) PDF/DOCX/PPTX need one of: the optional `mammoth`/`pdfjs-dist` packages, or the recommended **MarkItDown MCP** integration. Since 3.6, unsupported binaries **fail with clear guidance** instead of silently importing garbage.
 
 ### 4. Figma Design (design-to-spec)
 
@@ -892,14 +893,38 @@ templates_path: ./my-templates       # Override built-in templates
 default_framework: vitest            # Default test framework
 compliance_frameworks: [hipaa, soc2] # Frameworks to check
 audit_enabled: true                  # Enable audit trail
+update_check: true                   # Once-daily CLI update check (set false to disable)
 rbac:
   enabled: false                     # Role checks (viewer/contributor/admin)
   default_role: contributor
 rate_limit:
   enabled: false                     # HTTP token bucket (60 rpm, burst 10)
+pipeline:
+  require_lgtm: false                # Server-side LGTM: sdd_advance_phase refuses to pass
+                                     # the Specify/Design/Tasks gates unless lgtm: true
 ```
 
-When `templates_path` is set, Specky uses your custom templates instead of the built-in ones. When `audit_enabled` is true, tool invocations are logged locally. `profile: enterprise` turns audit, RBAC, rate limiting, and fail-closed auditing on by default (explicit values win) — see [docs/ENTERPRISE-DEPLOYMENT.md](docs/ENTERPRISE-DEPLOYMENT.md).
+When `templates_path` is set, Specky uses your custom templates instead of the built-in ones. When `audit_enabled` is true, tool invocations are logged locally. `profile: enterprise` turns audit, RBAC, rate limiting, and fail-closed auditing on by default (explicit values win) — see [docs/ENTERPRISE-DEPLOYMENT.md](docs/ENTERPRISE-DEPLOYMENT.md). With `pipeline.require_lgtm: true`, the LGTM quality gates become server-enforced instead of an agent convention: advancing past Specify/Design/Tasks requires the explicit `lgtm: true` input on `sdd_advance_phase`.
+
+
+## Staying up to date
+
+Specky tells you about new versions in two ways:
+
+- **Version drift warning (always on, zero network):** `specky doctor` and `specky status` warn when the assets installed in your project differ from the version of the CLI running them, and suggest `specky upgrade`. The MCP server prints the same warning at startup. This is a local file comparison — no network involved.
+- **Update banner (once daily):** after `install`, `doctor`, `status`, `upgrade`, or `--version`, the CLI checks the npm registry at most once per day and prints `Update available: vX → vY` when a newer release exists. This is a single GET to `registry.npmjs.org` — no telemetry, nothing sent beyond the request itself. It fails silently offline, is disabled in CI (`CI=true`), and **never runs in `specky serve`** — the MCP server itself never phones home.
+
+Upgrading is one command:
+
+```bash
+npm install -g specky-sdd@latest && specky upgrade
+```
+
+`specky upgrade` matters: it refreshes the installed agents, prompts, skills, and hooks **and re-pins `.mcp.json` / `.vscode/mcp.json` to the new version** — updating the npm package alone leaves the MCP registration pointing at the old pinned server.
+
+Teams pinning per-project (`npm install --save-dev specky-sdd`) should let [Renovate](https://docs.renovatebot.com/) or [Dependabot](https://docs.github.com/en/code-security/dependabot) propose the `package.json` bump. For release emails, use **Watch → Custom → Releases** on the [GitHub repo](https://github.com/paulasilvatech/specky).
+
+**Opt out** of the registry check with `SPECKY_NO_UPDATE_CHECK=1` in the environment or `update_check: false` in `.specky/config.yml`. The drift warning stays on — it never touches the network.
 
 
 ## MCP Integration Architecture
@@ -997,7 +1022,7 @@ Specky is 100% open source (MIT) — enterprise mode is just an opt-in configura
 ### Security Posture
 
 - **3 runtime dependencies** — minimal attack surface (`@modelcontextprotocol/sdk`, `zod`, `yaml`)
-- **Zero outbound network requests** — all data stays local
+- **Zero outbound network requests from the MCP server** — all data stays local; the CLI's optional once-daily update check is the only network touch ([opt-out](#staying-up-to-date))
 - **No `eval()` or dynamic code execution** — template rendering is string replacement only
 - **Path traversal prevention**: FileManager sanitizes all paths, blocks `..` sequences
 - **Zod `.strict()` validation** — every tool input is schema-validated; unknown fields rejected
@@ -1090,16 +1115,26 @@ npm run dev
 # Verify MCP handshake (quick smoke test)
 echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}' | node dist/index.js 2>/dev/null
 
-# Build and run with Docker locally
+# Run the published image from GHCR (multi-arch: linux/amd64 + linux/arm64)
+docker pull ghcr.io/paulasilvatech/specky:latest        # or pin a release: :3.6.0
+docker run --rm -p 3200:3200 ghcr.io/paulasilvatech/specky:latest
+curl http://localhost:3200/health                       # -> {"status":"ok","version":"3.6.0"}
+
+# Or build and run locally from source
 docker build -t specky-sdd:dev .
 docker run -p 3200:3200 -v $(pwd):/workspace specky-sdd:dev
 curl http://localhost:3200/health
 ```
 
+The published image binds `0.0.0.0:3200` inside the container (so `-p` works)
+and serves an unauthenticated `GET /health`. For hardened/authenticated
+deployments (enterprise profile, token auth, TLS proxy, private packages) see
+[docs/ENTERPRISE-DEPLOYMENT.md](docs/ENTERPRISE-DEPLOYMENT.md).
+
 
 ## Roadmap
 
-### v3.5 (current)
+### v3.7 (current)
 
 | Capability | Status |
 |------------|--------|
@@ -1134,8 +1169,9 @@ curl http://localhost:3200/health
 | Enterprise profile (`profile: enterprise` — audit/RBAC/rate-limit defaults ON, opt-in) | Stable |
 | Identity-based RBAC over HTTP (`SDD_HTTP_TOKENS_FILE`: token → principal + role) | Stable |
 | Tamper-evident audit trail (HMAC-signed entries, fail-closed mode, `sdd_verify_audit`) | Stable |
+| Server-enforced LGTM gates (opt-in `pipeline.require_lgtm`) | Stable |
 
-### v3.6+ (planned)
+### v3.8+ (planned)
 
 | Feature | Description |
 |---------|-------------|

package/SECURITY.md

@@ -4,9 +4,9 @@
 
 | Version | Supported |
 | --- | --- |
-| 3.5.x | ✅ Active |
-| 3.4.x | ✅ Security fixes only |
-| 3.0.x–3.3.x | ❌ End of life |
+| 3.7.x | ✅ Active |
+| 3.6.x | ✅ Security fixes only |
+| 3.0.x–3.5.x | ❌ End of life |
 | 2.x | ❌ End of life |
 | 1.0.x | ❌ End of life |
 
@@ -46,9 +46,18 @@ AI Client → JSON-RPC → Zod .strict() validation → Service layer
 
 Specky does **not** use `eval()`, `Function()`, `vm.runInNewContext()`, or any dynamic code execution. Template rendering uses string replacement only — no template engines that execute code.
 
-### No Network Calls
+### Network Calls
 
-Specky operates entirely locally. It makes zero outbound network requests. All data stays on the user's machine. The MCP server communicates only via stdio (JSON-RPC over stdin/stdout) or optional HTTP transport on localhost.
+The **MCP server makes zero outbound network calls**. All data stays on the user's machine. It communicates only via stdio (JSON-RPC over stdin/stdout) or optional HTTP transport on localhost, and this holds unconditionally — `specky serve` never performs the update check described below.
+
+The **CLI performs exactly one optional outbound call**: a once-daily `GET https://registry.npmjs.org/specky-sdd/latest` to detect new releases, run after `install`/`doctor`/`status`/`upgrade`/`--version` and shown as an `Update available: vX → vY` banner. This is not telemetry — nothing is sent beyond the HTTP request itself: no identifiers, no usage data, no payload. The check fails silently when offline and is disabled automatically in CI (`CI=true`).
+
+Opt out with either:
+
+- `SPECKY_NO_UPDATE_CHECK=1` in the environment, or
+- `update_check: false` in `.specky/config.yml`
+
+The local version-drift warning printed by `specky doctor`/`specky status` and at MCP server startup compares installed assets against the running version on disk — it involves no network at all.
 
 ### Dependency Minimalism
 
@@ -81,7 +90,7 @@ Runtime dependencies are kept intentionally small and are audited in CI.
 | A07 Authentication Failures | stdio mode is process-isolated (no network). HTTP mode binds to `127.0.0.1` by default and supports optional bearer-token auth — a shared token (`SDD_HTTP_TOKEN`) or a named token table (`SDD_HTTP_TOKENS_FILE`, principal + RBAC role per token, sha256 storage supported) — all constant-time compared, plus DNS-rebinding protection |
 | A08 Data Integrity Failures | Atomic file writes via FileManager; Zod schema enforcement |
 | A09 Logging Failures | Structured stderr logging; no stdout pollution |
-| A10 SSRF | Zero outbound network requests |
+| A10 SSRF | Zero outbound requests from the MCP server; the CLI's once-daily update check fetches a fixed registry URL only — no user-controlled URLs |
 
 ## Dependency Auditing
 
@@ -106,6 +115,7 @@ We run `npm audit` in CI on every pull request. Any `high` or `critical` vulnera
 | `SDD_HTTP_TOKENS_FILE` | Named token table → principal + RBAC role (identity-based auth) | unset |
 | `SDD_AUDIT_HMAC_KEY` / `SDD_AUDIT_HMAC_KEY_FILE` | Sign audit entries (tamper evidence); keep the key outside the workspace | unset (chain only) |
 | `SDD_ROLE` | Local RBAC role for stdio use — ignored on authenticated HTTP requests | `rbac.default_role` |
+| `SPECKY_NO_UPDATE_CHECK` | Set to `1` to disable the CLI's once-daily update check — the package's only outbound call (see [Network Calls](#network-calls)) | unset (check enabled) |
 
 HTTP transport (`--http`) binds to `127.0.0.1` by default. Binding to a non-loopback address requires an explicit `--host` and prints a warning. Set `SDD_HTTP_TOKEN` (shared token) or `SDD_HTTP_TOKENS_FILE` (named tokens mapping to principal + role) to require an `Authorization: Bearer <token>` header on every `/mcp` request (the `/health` probe stays open). Even so, do not expose Specky to public networks without a TLS-terminating reverse proxy. Hosted, air-gapped, and container deployment patterns: [docs/ENTERPRISE-DEPLOYMENT.md](docs/ENTERPRISE-DEPLOYMENT.md).
 
@@ -185,7 +195,7 @@ server {
 
 These guarantees describe the intended product boundary. Known implementation gaps are tracked in [docs/DETERMINISM.md](docs/DETERMINISM.md) and [docs/ENTERPRISE-CONTROLS.md](docs/ENTERPRISE-CONTROLS.md).
 
-- **No outbound network calls from core MCP tools** — optional external MCP integrations are returned as routing payloads for the AI client to execute.
+- **No outbound network calls from core MCP tools** — optional external MCP integrations are returned as routing payloads for the AI client to execute. The CLI's once-daily update check (see [Network Calls](#network-calls)) is the package's only outbound call; it is opt-out and never runs in `specky serve`.
 - **No dynamic code execution** — no `eval()`, `Function()`, or `vm.runInNewContext()` in the Specky core.
 - **No credential storage by design** — no API keys, tokens, or passwords are intentionally stored by Specky.
 - **Workspace-scoped I/O is the target boundary** — `FileManager.sanitizePath()` enforces this for core file operations; document import hardening is tracked as an enterprise remediation item.
@@ -212,7 +222,7 @@ Running `npx -y specky-sdd@latest` without a pinned version downloads the latest
 
 ```bash
 # Install into a local vendor directory — no global write permissions needed
-npm install specky-sdd@3.5.0 --prefix ./vendor --ignore-scripts
+npm install specky-sdd@3.6.0 --prefix ./vendor --ignore-scripts
 ./vendor/node_modules/.bin/specky install
 ./vendor/node_modules/.bin/specky doctor     # integrity check
 ```
@@ -255,7 +265,7 @@ Specky addresses the 12 threat categories from the CoSAI MCP Security White Pape
 | --- | --- | --- |
 | M1 | Prompt Injection | No dynamic content in tool descriptions; outputs are structured JSON |
 | M2 | Insecure Tool Design | Thin Tools / Fat Services — tools are pure input/output wrappers |
-| M3 | Excessive Agency | No shell execution, no outbound network, no code eval |
+| M3 | Excessive Agency | No shell execution, no outbound network from the MCP server, no code eval |
 | M4 | Insufficient Authentication | HTTP mode delegates to reverse proxy; stdio is process-isolated |
 | M5 | Broken Object-Level Authorization | RBAC engine enforces per-tool access by role (opt-in) |
 | M6 | Sensitive Data Exposure | FileManager path boundary; no credential logging; workspace-scoped I/O |

package/apm.yml

@@ -1,5 +1,5 @@
 name: specky-sdd
-version: 3.5.0
+version: 3.7.0
 description: "Agentic Spec-Driven Development — 10-phase pipeline with 58 MCP tools, 13 agents, 22 prompts, 8 skills, 16 hooks, EARS notation, model routing, and enterprise security"
 author: Paula Silva
 license: MIT

package/config.yml

@@ -1,5 +1,5 @@
 audit_enabled: true
-version: "3.5.0"
+version: "3.7.0"
 pipeline:
   phases: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]
   phase_names:

package/dist/cli/commands/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/doctor.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAoND,wBAAsB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA2DpE"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/doctor.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAoND,wBAAsB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAkEpE"}

package/dist/cli/commands/doctor.js

@@ -9,6 +9,7 @@
  */
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { resolve } from "node:path";
+import { VERSION } from "../../constants.js";
 import { hashFile } from "../lib/asset-copier.js";
 import { detectIde } from "../lib/ide-detect.js";
 import { targetPaths } from "../lib/paths.js";
@@ -181,6 +182,10 @@ export async function runDoctor(opts) {
     console.log(`[specky doctor] Lock version: ${lock.version} (generated ${lock.generated_at})`);
     console.log(`[specky doctor] Files tracked: ${Object.keys(lock.files).length}`);
     console.log(`[specky doctor] IDE scope: ${resolvedIde.ide} (${resolvedIde.detail})`);
+    // Version-drift advisory (zero network): installed assets vs running CLI.
+    if (installMeta?.version && installMeta.version !== VERSION) {
+        console.log(`[specky doctor] ⚠️  Version drift: installed assets are v${installMeta.version} but this CLI is v${VERSION} — run \`specky upgrade\` to refresh.`);
+    }
     const integrity = verifyIntegrity(lock, targets.shared.specky);
     printIntegrity(integrity, opts.verbose);
     const checks = runConfigChecks(targets, workspace, resolvedIde.ide);

package/dist/cli/commands/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/cli/commands/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAgB,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAwC1E,SAAS,eAAe,CACtB,IAAiB,EACjB,UAAkB;IAElB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,EAAE,GAAa,EAAE,CAAC;IAExB,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE;gBAAE,SAAS;YACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,MAAM,KAAK,QAAQ;gBAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;gBACjC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,YAAY,CAAI,IAAY;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAgB;IAC9C,MAAM,QAAQ,GAAG,YAAY,CAC3B,OAAO,CAAC,MAAM,CAAC,YAAY,CAC5B,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,qCAAqC;SAC9C,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM,EACJ,OAAO,CAAC,MAAM,KAAK,CAAC;YAClB,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,oCAAoC;YACnD,CAAC,CAAC,WAAW,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,YAAY,CAA0B,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,iEAAiE;SAC1E,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,MAAM,CACxD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CACxB,CAAC;IACF,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM,EACJ,OAAO,CAAC,MAAM,KAAK,CAAC;YAClB,CAAC,CAAC,mCAAmC;YACrC,CAAC,CAAC,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,KAAa;IACvD,MAAM,GAAG,GAAG,YAAY,CAGrB,IAAI,CAAC,CAAC;IACT,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACtE,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,OAAO;QACL,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,sBAAsB;KACxE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,YAAY,CAAc,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,mBAAmB,CAC1B,WAA+B,EAC/B,SAAiB;IAEjB,IAAI,WAAW,EAAE,GAAG,EAAE,CAAC;QACrB,OAAO;YACL,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,kCAAkC;SAC3C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,GAAG,EAAE,QAAQ,CAAC,cAAc;YAC5B,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,oCAAoC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC1E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,EAAE,MAAM;QACX,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,2EAA2E;KACpF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,OAAgB,EAChB,SAAiB,EACjB,GAAiB;IAEjB,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,MAAuB,EAAE,OAAgB;IAC/D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEtD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACzE,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YACtD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAe;IAClC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAmB;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAClD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAChE,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAEvE,OAAO,CAAC,GAAG,CAAC,8BAA8B,SAAS,EAAE,CAAC,CAAC;IAEvD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,wCAAwC,QAAQ,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC1E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAgB,CAAC;IACvE,MAAM,WAAW,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CACT,iCAAiC,IAAI,CAAC,OAAO,eAAe,IAAI,CAAC,YAAY,GAAG,CACjF,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,kCAAkC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CACT,8BAA8B,WAAW,CAAC,GAAG,KAAK,WAAW,CAAC,MAAM,GAAG,CACxE,CAAC;IAEF,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/D,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;IACpE,WAAW,CAAC,MAAM,CAAC,CAAC;IAEpB,MAAM,WAAW,GACf,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAE7C,IAAI,WAAW,IAAI,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CACT,4EAA4E,CAC7E,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,CACT,oFAAoF,CACrF,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/cli/commands/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAgB,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAwC1E,SAAS,eAAe,CACtB,IAAiB,EACjB,UAAkB;IAElB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,EAAE,GAAa,EAAE,CAAC;IAExB,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE;gBAAE,SAAS;YACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,MAAM,KAAK,QAAQ;gBAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;gBACjC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,YAAY,CAAI,IAAY;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAgB;IAC9C,MAAM,QAAQ,GAAG,YAAY,CAC3B,OAAO,CAAC,MAAM,CAAC,YAAY,CAC5B,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,qCAAqC;SAC9C,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM,EACJ,OAAO,CAAC,MAAM,KAAK,CAAC;YAClB,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,oCAAoC;YACnD,CAAC,CAAC,WAAW,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,YAAY,CAA0B,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,iEAAiE;SAC1E,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,MAAM,CACxD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CACxB,CAAC;IACF,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM,EACJ,OAAO,CAAC,MAAM,KAAK,CAAC;YAClB,CAAC,CAAC,mCAAmC;YACrC,CAAC,CAAC,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,KAAa;IACvD,MAAM,GAAG,GAAG,YAAY,CAGrB,IAAI,CAAC,CAAC;IACT,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACtE,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,OAAO;QACL,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,sBAAsB;KACxE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,YAAY,CAAc,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,mBAAmB,CAC1B,WAA+B,EAC/B,SAAiB;IAEjB,IAAI,WAAW,EAAE,GAAG,EAAE,CAAC;QACrB,OAAO;YACL,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,kCAAkC;SAC3C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,GAAG,EAAE,QAAQ,CAAC,cAAc;YAC5B,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,oCAAoC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC1E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,EAAE,MAAM;QACX,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,2EAA2E;KACpF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,OAAgB,EAChB,SAAiB,EACjB,GAAiB;IAEjB,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,MAAuB,EAAE,OAAgB;IAC/D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEtD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACzE,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YACtD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAe;IAClC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAmB;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAClD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAChE,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAEvE,OAAO,CAAC,GAAG,CAAC,8BAA8B,SAAS,EAAE,CAAC,CAAC;IAEvD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,wCAAwC,QAAQ,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC1E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAgB,CAAC;IACvE,MAAM,WAAW,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CACT,iCAAiC,IAAI,CAAC,OAAO,eAAe,IAAI,CAAC,YAAY,GAAG,CACjF,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,kCAAkC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CACT,8BAA8B,WAAW,CAAC,GAAG,KAAK,WAAW,CAAC,MAAM,GAAG,CACxE,CAAC;IAEF,0EAA0E;IAC1E,IAAI,WAAW,EAAE,OAAO,IAAI,WAAW,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CACT,4DAA4D,WAAW,CAAC,OAAO,qBAAqB,OAAO,uCAAuC,CACnJ,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/D,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;IACpE,WAAW,CAAC,MAAM,CAAC,CAAC;IAEpB,MAAM,WAAW,GACf,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAE7C,IAAI,WAAW,IAAI,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CACT,4EAA4E,CAC7E,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,CACT,oFAAoF,CACrF,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/cli/commands/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/status.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAkFpE"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/status.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAiGpE"}

package/dist/cli/commands/status.js

@@ -11,11 +11,26 @@ export async function runStatus(opts) {
     console.log(`Specky v${VERSION}`);
     console.log(`Workspace: ${workspace}`);
     console.log("");
-    // Install info
+    // Install info (read defensively — a corrupt install.json must not crash status)
     const installJson = resolve(t.shared.specky, "install.json");
+    let meta = null;
     if (existsSync(installJson)) {
-        const meta = JSON.parse(readFileSync(installJson, "utf8"));
+        try {
+            meta = JSON.parse(readFileSync(installJson, "utf8"));
+        }
+        catch {
+            meta = null;
+        }
+    }
+    if (meta) {
         console.log(`Install: v${meta.version}, ide=${meta.ide}, at=${meta.installed_at}`);
+        // Version-drift advisory (zero network): installed assets vs running CLI.
+        if (meta.version && meta.version !== VERSION) {
+            console.log(`⚠️  Installed assets are v${meta.version} but this CLI is v${VERSION} — run \`specky upgrade\` to refresh.`);
+        }
+    }
+    else if (existsSync(installJson)) {
+        console.log("Install: metadata unreadable — run `npx specky doctor`");
     }
     else {
         console.log("Install: NOT DETECTED — run `npx specky init`");

package/dist/cli/commands/status.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/cli/commands/status.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAM9C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAmB;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAClD,MAAM,CAAC,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAEjC,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,cAAc,SAAS,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,eAAe;IACf,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC7D,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAIxD,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,OAAO,SAAS,IAAI,CAAC,GAAG,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IACrF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAC/D,CAAC;IAED,eAAe;IACf,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5B,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,0BAA0B,MAAM,cAAc,QAAQ,YAAY,MAAM,WAAW,KAAK,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC;QAC1G,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,0BAA0B,MAAM,aAAa,OAAO,YAAY,MAAM,WAAW,KAAK,EAAE,CAAC,CAAC;IACxG,CAAC;IAED,iBAAiB;IACjB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;QAC3F,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACxD,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrC,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAMvD,CAAC;YACF,2EAA2E;YAC3E,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,KAAK,IAAI,SAAS,CAAC;YAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM;gBAC5B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM;gBAC7E,CAAC,CAAC,CAAC,CAAC;YACN,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,WAAW,KAAK,KAAK,SAAS,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,sBAAsB,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/cli/commands/status.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAM9C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAmB;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAClD,MAAM,CAAC,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAEjC,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,cAAc,SAAS,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,iFAAiF;IACjF,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC7D,IAAI,IAAI,GAAqE,IAAI,CAAC;IAClF,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAIlD,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,OAAO,SAAS,IAAI,CAAC,GAAG,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACnF,0EAA0E;QAC1E,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CACT,6BAA6B,IAAI,CAAC,OAAO,qBAAqB,OAAO,uCAAuC,CAC7G,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAC/D,CAAC;IAED,eAAe;IACf,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5B,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,0BAA0B,MAAM,cAAc,QAAQ,YAAY,MAAM,WAAW,KAAK,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC;QAC1G,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,0BAA0B,MAAM,aAAa,OAAO,YAAY,MAAM,WAAW,KAAK,EAAE,CAAC,CAAC;IACxG,CAAC;IAED,iBAAiB;IACjB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;QAC3F,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACxD,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrC,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAMvD,CAAC;YACF,2EAA2E;YAC3E,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,KAAK,IAAI,SAAS,CAAC;YAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM;gBAC5B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM;gBAC7E,CAAC,CAAC,CAAC,CAAC;YACN,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,WAAW,KAAK,KAAK,SAAS,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,sBAAsB,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/cli/index.js

@@ -139,6 +139,37 @@ async function dispatch(command, rest) {
         }
     }
 }
+/**
+ * Commands after which the once-daily update banner may print. `serve` (and
+ * the legacy serve routing) is deliberately absent — the MCP server makes
+ * zero outbound calls, ever.
+ */
+const UPDATE_BANNER_COMMANDS = new Set([
+    "install", "init", "doctor", "status", "upgrade", "--version", "-v",
+]);
+/**
+ * Best-effort update banner (Layer 2 of update awareness). Runs AFTER the
+ * command so it can never delay or corrupt command output, prints to stderr
+ * only, and swallows every failure — the command's exit code is untouched.
+ */
+async function maybePrintUpdateBanner(command) {
+    if (!UPDATE_BANNER_COMMANDS.has(command))
+        return;
+    try {
+        const { loadConfig } = await import("../config.js");
+        // Workspace-level hard disable (.specky/config.yml). Absent file → default true.
+        if (!loadConfig(process.cwd()).update_check)
+            return;
+        const { checkForUpdate } = await import("./lib/update-check.js");
+        const latest = await checkForUpdate({});
+        if (latest) {
+            console.error(`Update available: specky-sdd v${VERSION} → v${latest}  →  npm install -g specky-sdd@latest && specky upgrade`);
+        }
+    }
+    catch {
+        // Never let the update check affect the command outcome.
+    }
+}
 async function main() {
     const binName = basename(process.argv[1] ?? "specky");
     const args = process.argv.slice(2);
@@ -172,6 +203,7 @@ async function main() {
     try {
         const code = await dispatch(command, rest);
         if (typeof code === "number" && command !== "serve") {
+            await maybePrintUpdateBanner(command);
             process.exit(code);
         }
     }