unoverse 0.1.161 → 0.1.162

package/bin/unoverse.mjs

@@ -116,10 +116,27 @@ switch (cmd) {
     // Those two steps run via `_postupdate` in the NEWLY installed binary, not this
     // process: this file is being replaced mid-command, and copying the skill from the
     // old install would pin it one release behind forever.
-    const r = spawnSync("npm", ["install", "-g", "unoverse@latest"], { stdio: "inherit" });
+    // THE REGISTRY IS THE TRUTH, asked directly. `npm install unoverse@latest` resolves
+    // `latest` from npm's CACHED metadata, and that cache lags real releases by minutes:
+    // three updates in a row can install the same stale version while the registry has
+    // long moved on (observed live 2026-08-21, 0.1.160 served repeatedly with 0.1.161
+    // published). So update asks the registry itself which version is latest and installs
+    // THAT version by exact number with --prefer-online, which is immune to every layer
+    // of metadata cache. The registry being unreachable falls back to npm's own idea of
+    // latest, which is never worse than before.
+    let want = "";
+    try {
+      const doc = await (await fetch("https://registry.npmjs.org/unoverse", { headers: { accept: "application/vnd.npm.install-v1+json" } })).json();
+      want = doc?.["dist-tags"]?.latest ?? "";
+    } catch { /* registry unreachable: npm's latest is the best available answer */ }
+    const spec = want ? `unoverse@${want}` : "unoverse@latest";
+    const r = spawnSync("npm", ["install", "-g", spec, "--prefer-online"], { stdio: "inherit" });
     if (r.status === 0) {
       const v = spawnSync("unoverse", ["-v"], { encoding: "utf8" }).stdout?.trim();
       console.log(`\n  ✓ unoverse is now ${v || "up to date"}`);
+      if (want && v && v !== want) {
+        console.log(`  ⚠ the registry's latest is ${want}; npm delivered ${v}. Re-run in a minute, or: npm install -g unoverse@${want}`);
+      }
       spawnSync("unoverse", ["_postupdate"], { stdio: "inherit" });
     } else {
       // DO NOT GUESS THE CAUSE. This used to say "(permissions?)" whatever happened, so a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.161",
+  "version": "0.1.162",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",