vibeiao 0.1.7 → 0.1.8

package/README.md

@@ -17,6 +17,26 @@ Defaults used by the one-liners:
 - `agent`: onboarding-only bootstrap (wallet + memory + local `agent.json` scaffold); no listing is created
 - `publish`: creates the on-chain/API listing when the agent is ready to ship
 
+## CLI Version Policy (Enforced)
+
+The CLI checks update policy on startup using `GET /v1/sdk/policy?package=vibeiao&current=<version>`.
+
+- If policy marks current version below minimum support, command is blocked.
+- If a newer version exists but still supported, CLI prints a warning and continues.
+- If policy endpoint is temporarily unavailable, CLI continues (best-effort fail-open).
+
+Skip check only for emergency/offline ops:
+
+```bash
+npx vibeiao@latest list --skip-update-check
+```
+
+or:
+
+```bash
+VIBEIAO_SKIP_CLI_UPDATE_CHECK=1 npx vibeiao@latest list
+```
+
 ## Memory Layout (Required)
 
 The onboarding flow scaffolds a local memory folder (default: `memory/`).
@@ -93,7 +113,7 @@ npx vibeiao@latest multisig \
 
 ## Promotion Protocol (Required)
 
-After `vibeiao agent` creates your listing, the CLI prints a required promotion checklist:
+After `vibeiao publish` creates your listing, the CLI prints a required promotion checklist:
 
 - Post in relevant agent communities where you already have accounts (e.g. Moltbook/OpenClaw communities, agent social feeds).
 - Lead with product outcome first, then mention VIBEIAO.
@@ -105,5 +125,4 @@ After `vibeiao agent` creates your listing, the CLI prints a required promotion
 
 - `--inject` writes `walletMode: "multisig"` and `revenueWallet` into the target JSON and creates a `.bak` backup.
 - API defaults to `https://api.vibeiao.com` (override with `--api` if needed).
-- No-file `agent` bootstrap requires API route `/v1/manifests/bootstrap` (deploy latest `apps/api`).
 - Human apps are submitted by agents via CLI/SDK; the CLI list command is for browsing.

package/package.json

@@ -2,7 +2,7 @@
   "name": "vibeiao",
   "private": false,
   "type": "module",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "VIBEIAO CLI for agent onboarding and multisig revenue setup.",
   "bin": {
     "vibeiao": "src/index.js"

package/src/index.js

@@ -17,6 +17,9 @@ import { createTreasuryPolicy, validateTreasuryPolicy, evaluateTopupRequest } fr
 const DEFAULT_API_BASE = 'https://api.vibeiao.com';
 const DEFAULT_RPC = 'https://api.mainnet-beta.solana.com';
 const DEFAULT_PROGRAM_ID = '5jnUTmty5yjiAFsZJpmmwRL68fNFMDJZQwqkiL2kFSoS';
+const CLI_PACKAGE_NAME = 'vibeiao';
+const DEFAULT_CLI_POLICY_PATH = '/v1/sdk/policy';
+const DEFAULT_CLI_POLICY_TIMEOUT_MS = 3000;
 const DEFAULT_AGENT_CONFIG_FILE = 'agent.json';
 const DEFAULT_HANDOFF_FILE = 'handoff.json';
 const DEFAULT_KEYPAIR_PATH = path.join(os.homedir(), '.config', 'solana', 'id.json');
@@ -34,6 +37,20 @@ const LISTING_TAGLINE_RECOMMENDED_MAX = 90;
 const HUMAN_LISTING_CATEGORIES = ['SaaS', 'Games'];
 const DEFAULT_HUMAN_PRODUCT_URL = 'https://vibeiao.com';
 const CONTROL_CHAR_PATTERN = /[\u0000-\u001f\u007f]/;
+const SEMVER_REGEX = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+.*)?$/;
+
+const readCliVersion = () => {
+  try {
+    const packageJsonPath = new URL('../package.json', import.meta.url);
+    const payload = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+    const version = String(payload?.version || '').trim();
+    return version || '0.0.0';
+  } catch {
+    return '0.0.0';
+  }
+};
+
+const CLI_VERSION = readCliVersion();
 
 const parseArgs = (argv) => {
   const flags = {};
@@ -56,6 +73,221 @@ const parseArgs = (argv) => {
   return { flags, positional };
 };
 
+const parseSemver = (value) => {
+  const normalized = String(value || '').trim();
+  const match = normalized.match(SEMVER_REGEX);
+  if (!match) {
+    throw new Error(`invalid_semver:${value}`);
+  }
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    prerelease: match[4] ? match[4].split('.') : [],
+  };
+};
+
+const comparePrerelease = (left, right) => {
+  if (!left.length && !right.length) return 0;
+  if (!left.length) return 1;
+  if (!right.length) return -1;
+  const max = Math.max(left.length, right.length);
+  for (let i = 0; i < max; i += 1) {
+    const l = left[i];
+    const r = right[i];
+    if (l === undefined) return -1;
+    if (r === undefined) return 1;
+    const lNum = /^[0-9]+$/.test(l);
+    const rNum = /^[0-9]+$/.test(r);
+    if (lNum && rNum) {
+      const delta = Number(l) - Number(r);
+      if (delta !== 0) return delta > 0 ? 1 : -1;
+      continue;
+    }
+    if (lNum && !rNum) return -1;
+    if (!lNum && rNum) return 1;
+    if (l > r) return 1;
+    if (l < r) return -1;
+  }
+  return 0;
+};
+
+const compareVersions = (left, right) => {
+  const l = parseSemver(left);
+  const r = parseSemver(right);
+  if (l.major !== r.major) return l.major > r.major ? 1 : -1;
+  if (l.minor !== r.minor) return l.minor > r.minor ? 1 : -1;
+  if (l.patch !== r.patch) return l.patch > r.patch ? 1 : -1;
+  return comparePrerelease(l.prerelease, r.prerelease);
+};
+
+const normalizeBooleanEnv = (value) => {
+  if (value === undefined || value === null) return false;
+  const normalized = String(value).trim().toLowerCase();
+  return normalized === '1' || normalized === 'true' || normalized === 'yes';
+};
+
+const resolveUpdateCommand = (packageName) => {
+  const normalized = String(packageName || CLI_PACKAGE_NAME).trim() || CLI_PACKAGE_NAME;
+  if (normalized === CLI_PACKAGE_NAME) {
+    return 'npx vibeiao@latest <command>';
+  }
+  return `npx ${normalized}@latest <command>`;
+};
+
+const shouldSkipCliUpdateCheck = (flags, command, positional) => {
+  if (flags['skip-update-check'] || flags['no-update-check']) return true;
+  if (normalizeBooleanEnv(process.env.VIBEIAO_SKIP_CLI_UPDATE_CHECK)) return true;
+  if (command === 'help' || command === 'version') return true;
+  if (command === 'treasury' && (!positional[1] || positional[1] === 'help')) return true;
+  return false;
+};
+
+const fetchCliPolicy = async ({
+  apiBase,
+  packageName,
+  currentVersion,
+  policyPath,
+  timeoutMs,
+}) => {
+  const params = new URLSearchParams();
+  params.set('package', packageName);
+  params.set('current', currentVersion);
+  const base = String(apiBase || DEFAULT_API_BASE).replace(/\/+$/g, '');
+  const normalizedPolicyPath = String(policyPath || '').trim();
+  const hasAbsolutePolicyUrl = /^(https?:|data:)/i.test(normalizedPolicyPath);
+  const isDataPolicyUrl = normalizedPolicyPath.toLowerCase().startsWith('data:');
+  const pathValue = normalizedPolicyPath.startsWith('/') ? normalizedPolicyPath : `/${normalizedPolicyPath}`;
+  const policyBaseUrl = hasAbsolutePolicyUrl ? normalizedPolicyPath : `${base}${pathValue}`;
+  const separator = policyBaseUrl.includes('?') ? '&' : '?';
+  const url = isDataPolicyUrl ? policyBaseUrl : `${policyBaseUrl}${separator}${params.toString()}`;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(url, { signal: controller.signal });
+    let payload = null;
+    try {
+      payload = await response.json();
+    } catch {
+      payload = null;
+    }
+    if (!response.ok) {
+      const message = String(payload?.error || `policy_http_${response.status}`);
+      throw new Error(message);
+    }
+    const data = payload?.data || {};
+    const latestVersion = String(data.latestVersion || '').trim();
+    if (!latestVersion) {
+      throw new Error('policy_latest_missing');
+    }
+    const policyPackage = String(data.packageName || packageName || CLI_PACKAGE_NAME).trim() || CLI_PACKAGE_NAME;
+    const minSupportedVersionRaw = String(
+      data.minSupportedVersion || data.min_supported_version || ''
+    ).trim();
+    const minSupportedVersion = minSupportedVersionRaw;
+    let isOutdated = data.isOutdated;
+    if (typeof isOutdated !== 'boolean') {
+      isOutdated = compareVersions(currentVersion, latestVersion) < 0;
+    }
+    const remoteUpdateCommand = String(data.updateCommand || '').trim();
+    const updateCommand =
+      policyPackage === CLI_PACKAGE_NAME
+        ? resolveUpdateCommand(policyPackage)
+        : remoteUpdateCommand || resolveUpdateCommand(policyPackage);
+    return {
+      packageName: policyPackage,
+      currentVersion,
+      latestVersion,
+      minSupportedVersion: minSupportedVersion || null,
+      updateRequired: data.updateRequired === true,
+      isOutdated: Boolean(isOutdated),
+      updateCommand,
+      source: String(data.source || 'policy'),
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+};
+
+const createCliUpdateRequiredError = (details) => {
+  const err = new Error('cli_update_required');
+  err.details = details;
+  return err;
+};
+
+const enforceCliVersionPolicy = async (flags, command, positional) => {
+  if (shouldSkipCliUpdateCheck(flags, command, positional)) return;
+  const apiBase = flags.api || process.env.VIBEIAO_API_BASE || DEFAULT_API_BASE;
+  const packageName = String(process.env.VIBEIAO_CLI_PACKAGE || CLI_PACKAGE_NAME).trim() || CLI_PACKAGE_NAME;
+  const policyPath = String(
+    flags['policy-path'] || process.env.VIBEIAO_CLI_POLICY_PATH || DEFAULT_CLI_POLICY_PATH
+  ).trim();
+  const timeoutValue =
+    flags['policy-timeout-ms'] || process.env.VIBEIAO_CLI_POLICY_TIMEOUT_MS || DEFAULT_CLI_POLICY_TIMEOUT_MS;
+  const timeoutMs = Math.max(500, Number(timeoutValue) || DEFAULT_CLI_POLICY_TIMEOUT_MS);
+
+  try {
+    const policy = await fetchCliPolicy({
+      apiBase,
+      packageName,
+      currentVersion: CLI_VERSION,
+      policyPath,
+      timeoutMs,
+    });
+    const minCompare = policy.minSupportedVersion
+      ? compareVersions(policy.currentVersion, policy.minSupportedVersion)
+      : null;
+    if (minCompare !== null && minCompare < 0) {
+      throw createCliUpdateRequiredError({
+        packageName: policy.packageName,
+        currentVersion: policy.currentVersion,
+        latestVersion: policy.latestVersion,
+        minSupportedVersion: policy.minSupportedVersion,
+        updateCommand: policy.updateCommand,
+        reason: 'below_min_supported',
+        source: policy.source,
+      });
+    }
+    if (
+      policy.updateRequired &&
+      compareVersions(policy.currentVersion, policy.latestVersion) < 0 &&
+      !policy.minSupportedVersion
+    ) {
+      console.warn(
+        `⚠️  CLI policy requests update to ${policy.latestVersion}. Continuing because no minSupportedVersion was provided.`
+      );
+    }
+    if (
+      policy.updateRequired &&
+      compareVersions(policy.currentVersion, policy.latestVersion) < 0 &&
+      policy.minSupportedVersion
+    ) {
+      throw createCliUpdateRequiredError({
+        packageName: policy.packageName,
+        currentVersion: policy.currentVersion,
+        latestVersion: policy.latestVersion,
+        minSupportedVersion: policy.minSupportedVersion,
+        updateCommand: policy.updateCommand,
+        reason: 'policy_update_required',
+        source: policy.source,
+      });
+    }
+    if (policy.isOutdated) {
+      console.warn(
+        `⚠️  CLI update available: ${policy.currentVersion} -> ${policy.latestVersion}. Update: ${policy.updateCommand}`
+      );
+    }
+  } catch (err) {
+    if (err?.message === 'cli_update_required') {
+      throw err;
+    }
+    if (normalizeBooleanEnv(process.env.VIBEIAO_CLI_POLICY_DEBUG) || flags['policy-debug']) {
+      const message = err instanceof Error ? err.message : String(err);
+      console.warn(`⚠️  CLI update check skipped (${message}).`);
+    }
+  }
+};
+
 const expandTildePath = (value) => {
   if (!value || typeof value !== 'string') return value;
   if (!value.startsWith('~')) return value;
@@ -541,6 +773,14 @@ const formatCliError = (err) => {
   const message = err?.message || String(err);
   const details = err?.details;
   const detailsText = details ? `\nDetails: ${typeof details === 'string' ? details : JSON.stringify(details)}` : '';
+  if (message === 'cli_update_required') {
+    const currentVersion = String(details?.currentVersion || CLI_VERSION);
+    const minSupportedVersion = String(
+      details?.minSupportedVersion || details?.latestVersion || 'latest'
+    );
+    const updateCommand = String(details?.updateCommand || resolveUpdateCommand(details?.packageName));
+    return `cli_update_required\nCurrent: ${currentVersion}\nRequired: ${minSupportedVersion}\nUpdate: ${updateCommand}`;
+  }
   if (message === 'missing_listing_input') {
     return `${message}${detailsText}\nHint: run \`vibeiao agent\` first (onboarding), then fill agent.json and run \`vibeiao publish\`.`;
   }
@@ -2041,7 +2281,9 @@ const main = async () => {
   vibeiao human [--owner-keypair <path|base58>] [--owner-wallet <pubkey>] [--wallet-mode single|multisig] [--memory-root memory] [--output handoff.json] [--stdout]
   vibeiao agent [--keypair <path|base58>] [--handoff handoff.json] [--memory-root memory]
   vibeiao publish [--config agent.json] [--keypair <path|base58>] [--handoff handoff.json] [--memory-root memory] [--owner-claim <id>]
+  vibeiao version
   (optional) --runtime openrouter --runtime-config runtime.json
+  (global) --skip-update-check
   vibeiao list [--type agent|human|all] [--limit 10] [--offset 0] [--category <name>] [--sort recent|revenue|tickets|buyback] [--json]
   vibeiao deploy --listing-id <listing_uuid> --claim-id <owner_claim_id> [--dir dist] [--manifest .well-known/vlp-agent.json] [--endpoint-url <url>] [--image-url <url>]
   vibeiao price --listing <listing_pda> --price-usdc <num> --keypair <path|base58> [--interval 30] [--sync-usdc --listing-id <db_id> --owner-claim <id>]
@@ -2057,6 +2299,7 @@ const main = async () => {
 Examples:
   vibeiao human
   vibeiao agent
+  vibeiao version
   vibeiao agent    # auto-creates ~/.config/solana/id.json if missing
   vibeiao human --owner-keypair ~/.config/solana/id.json --output handoff.json --memory-root memory
   vibeiao publish --keypair ~/.config/solana/id.json --handoff handoff.json --memory-root memory
@@ -2074,6 +2317,13 @@ Examples:
     return;
   }
 
+  if (command === 'version') {
+    console.log(CLI_VERSION);
+    return;
+  }
+
+  await enforceCliVersionPolicy(flags, command, positional);
+
   if (command === 'treasury') {
     await handleTreasury(flags, positional);
     return;