vibeaudio 0.6.3 → 0.7.0

package/README.md

@@ -1,6 +1,6 @@
 # 🎧 VibeAudio
 
-[![test](https://github.com/kiril6/vibeaudio/actions/workflows/test.yml/badge.svg)](https://github.com/kiril6/vibeaudio/actions/workflows/test.yml)
+[![test](https://github.com/kiril6/vibeaudio/actions/workflows/test.yml/badge.svg)](https://github.com/kiril6/vibeaudio/actions/workflows/test.yml) [![npm](https://img.shields.io/npm/v/vibeaudio)](https://www.npmjs.com/package/vibeaudio) [![downloads](https://img.shields.io/npm/d18m/vibeaudio?label=downloads)](https://npm-stat.com/charts.html?package=vibeaudio) [![downloads/month](https://img.shields.io/npm/dm/vibeaudio)](https://npm-stat.com/charts.html?package=vibeaudio)
 
 > **Procedural focus music while your AI coding tools think.**
 > Every project gets its own arrangement. Zero dependencies, zero audio files.
@@ -87,6 +87,15 @@ npm i -g vibeaudio
 
 That puts `vibe` and `vibeaudio` on your `PATH`. Re-run the same command to update, or see [Uninstall](#-uninstall) to remove it cleanly.
 
+**Staying up to date.** When a newer version is out, `vibe --status`, `vibe --help` and the menu say so in one line. They're the only places it's shown — never in your agent's hooks, and never over a command you wrapped. What changed is on the [releases page](https://github.com/kiril6/vibeaudio/releases).
+
+<details>
+<summary><b>What the update check sends, and how to turn it off</b></summary>
+
+Once a day at most, a background process asks the public npm registry for the latest version number — the same request `npm outdated` makes. It sends nothing about you: no ID, no settings, no usage. It's the only network request VibeAudio ever makes, and `vibe` never waits for it; the answer is shown the next time. It's skipped in CI, under `npx`, and whenever `VIBE_NO_UPDATE_CHECK=1` or `NO_UPDATE_NOTIFIER=1` is set.
+
+</details>
+
 ### Then pick how it runs
 
 **Using Claude Code, Codex, Cursor or Grok interactively?** Install the hooks — this is the mode that actually tracks thinking:
@@ -542,6 +551,7 @@ export VIBE_CHIME_VOLUME=70     # Crisp completion chime at 70%
 export VIBE_GRACE_MS=3000       # Wait 3s of thinking before any music
 export VIBE_SEED=7              # Same arrangement everywhere, ignoring the directory
 export VIBE_DISABLE=1           # Mute, without uninstalling anything
+export VIBE_NO_UPDATE_CHECK=1   # Never ask npm whether a newer version is out
 ```
 
 **`VIBE_DISABLE=1` is for a shell you always want quiet** — a CI job, a shared machine, a terminal profile you keep silent. It's read at playback time and covers hooks, wrapper and MCP alike.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibeaudio",
-  "version": "0.6.3",
+  "version": "0.7.0",
   "description": "Procedural focus music while your AI coding tools (Claude Code, Codex, Cursor, Grok, Gemini, Copilot) think \u2014 a different arrangement per project.",
   "bin": {
     "vibeaudio": "bin/vibeaudio.js",

package/src/cli.js

@@ -103,7 +103,17 @@ Procedural focus music while your AI coding tools think.
   VIBE_GRACE_MS=<ms>           Override the saved grace window, in ms
   VIBE_SEED=<n>                Pin the arrangement instead of deriving it from the directory
   VIBE_DISABLE=1               Mute automatic playback without uninstalling anything
+  VIBE_NO_UPDATE_CHECK=1       Never check npm for a newer version
 `);
+  printUpdateNotice();
+}
+
+// Only where a person is reading: help, status and the menu. See update.js.
+function printUpdateNotice() {
+  if (!process.stdout.isTTY) return;
+  const { ephemeralInstallReason } = require("./hooks");
+  const line = require("./update").updateNotice({ ephemeral: Boolean(ephemeralInstallReason()) });
+  if (line) console.log(`${line}\n`);
 }
 
 /**
@@ -709,6 +719,7 @@ function printStatus() {
     }
   }
   console.log();
+  printUpdateNotice();
 }
 
 /**
@@ -1226,6 +1237,8 @@ async function run() {
     // leave. Wrapping the launch too turned every real failure below into a
     // silent exit 0, which is the worst possible thing for a wrapper to do:
     // `vibe && deploy` would chain on a run that never happened.
+    printUpdateNotice();
+
     let selection;
     try {
       selection = await promptInteractive({

package/src/update.js

@@ -0,0 +1,106 @@
+/**
+ * "A newer version is out", said where a person is looking.
+ *
+ * A global CLI has no other way to reach its users: nothing tells them to
+ * re-run `npm i -g`, so fixes never arrive. This asks the registry at most once
+ * a day, in a detached process, and shows the answer the *next* time - a run
+ * never waits on the network, and an offline machine is simply never told.
+ *
+ * The request is the one `npm outdated` makes, to the public registry, and
+ * carries nothing about the user: no id, no settings, no usage. It is the only
+ * network call VibeAudio makes, which is why it can be switched off.
+ *
+ * Shown only by `--status`, `--help` and the menu. Never by hooks - their
+ * output goes to the agent, not the person - and never by the wrapper, whose
+ * terminal belongs to the command it runs.
+ */
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { spawn } = require("child_process");
+const pkg = require("../package.json");
+
+const CHECK_FILE = path.join(os.homedir(), ".vibeaudio", "update.json");
+const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+const REGISTRY_URL = `https://registry.npmjs.org/${pkg.name}/latest`;
+
+// CI and the de-facto standard opt-out (update-notifier's) as well as our own.
+function checkDisabled(env = process.env) {
+  return Boolean(env.VIBE_NO_UPDATE_CHECK || env.NO_UPDATE_NOTIFIER || env.CI);
+}
+
+/** Numeric x.y.z comparison; a prerelease or malformed version is never "newer". */
+function isNewer(latest, current) {
+  const parse = (v) => (/^\d+\.\d+\.\d+$/.test(v || "") ? v.split(".").map(Number) : null);
+  const a = parse(latest);
+  const b = parse(current);
+  if (!a || !b) return false;
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] > b[i];
+  }
+  return false;
+}
+
+function readCheck(file) {
+  try {
+    const data = JSON.parse(fs.readFileSync(file, "utf8"));
+    return data && typeof data === "object" ? data : {};
+  } catch (e) {
+    return {};
+  }
+}
+
+function writeCheck(file, data) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  // Per-process temp name: two runs refreshing at once must not share one.
+  const tmp = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, `${JSON.stringify(data)}\n`);
+  fs.renameSync(tmp, file);
+}
+
+function refreshInBackground(file) {
+  try {
+    // Stamp the attempt first, so a burst of runs starts one check, not many.
+    writeCheck(file, { ...readCheck(file), checked: Date.now() });
+    const child = spawn(process.execPath, [__filename, file], { detached: true, stdio: "ignore" });
+    child.unref();
+  } catch (e) {
+    // An update notice is never worth an error.
+  }
+}
+
+/**
+ * The line to print, or null. Synchronous and offline: it reads what the last
+ * check found, and starts the next check if that one is a day old.
+ * `ephemeral`: running from an npx cache, where "npm i -g" is the wrong advice
+ * and npx fetches the latest on its own anyway.
+ */
+function updateNotice({ file = CHECK_FILE, env = process.env, now = Date.now(), current = pkg.version, ephemeral = false, refresh = refreshInBackground } = {}) {
+  if (checkDisabled(env) || ephemeral) return null;
+
+  const state = readCheck(file);
+  if (!(now - (state.checked || 0) < CHECK_INTERVAL_MS)) refresh(file);
+
+  if (!isNewer(state.latest, current)) return null;
+  return `\x1b[33mUpdate available ${current} → ${state.latest}\x1b[0m  \x1b[1mnpm i -g ${pkg.name}\x1b[0m` +
+    `  \x1b[90m(what's new: https://github.com/kiril6/vibeaudio/releases)\x1b[0m`;
+}
+
+// The detached child: one request, bounded, and silent whatever happens.
+async function runCheck(file) {
+  try {
+    const res = await fetch(REGISTRY_URL, {
+      headers: { accept: "application/json" },
+      signal: AbortSignal.timeout(5000)
+    });
+    if (!res.ok) return;
+    const { version } = await res.json();
+    if (typeof version === "string") writeCheck(file, { ...readCheck(file), latest: version });
+  } catch (e) {
+    // Offline, blocked, or a registry hiccup: try again tomorrow.
+  }
+}
+
+if (require.main === module) runCheck(process.argv[2] || CHECK_FILE);
+
+module.exports = { updateNotice, isNewer, checkDisabled, CHECK_FILE };