virlow-mcp 3.81.1 → 3.82.0

package/README.md

@@ -185,6 +185,11 @@ existing config to fix that. Pin an exact version (`virlow-mcp@3.81.0`) only if
 updates to wait for you. The desktop app updates itself and its built-in server, and the
 hosted connector is updated on Virlow's side.
 
+The server checks npm once at startup, and the `status` tool and the unlock page say when a
+newer version exists. The request tells npm only that someone at your IP checked
+virlow-mcp's version; it carries no account data. Turn it off with
+`VIRLOW_MCP_NO_UPDATE_CHECK=1`.
+
 ## First use
 
 1. Ask your AI client to run the **`unlock`** tool. This opens a browser window pointed

package/dist/cli.js

@@ -3859,7 +3859,8 @@ function buildServer(opts) {
   server.registerTool("status", {
     description: "Report whether the vault is currently locked or unlocked, and which account it's unlocked as. Call this after unlock to confirm the user finished the browser form, and before any memory/notes tool if you are unsure of the current lock state."
   }, wrap(async () => {
-    return textResult(JSON.stringify(vault.status()));
+    const notice = opts.updateNotice?.() ?? null;
+    return textResult(JSON.stringify(notice === null ? vault.status() : { ...vault.status(), update: notice }));
   }));
   const requireMemories = async () => {
     if (!vault.isUnlocked())
@@ -4518,8 +4519,9 @@ async function performUnlock(api, vault, creds) {
     vault.touch();
   };
 }
-function renderForm(nonce, error) {
+function renderForm(nonce, error, updateNotice) {
   const errorHtml = error ? `<p class="error">${escapeHtml(error)}</p>` : "";
+  const updateHtml = updateNotice ? `<p class="update">${escapeHtml(updateNotice)}</p>` : "";
   return `<!doctype html>
 <html lang="en">
 <head>
@@ -4528,6 +4530,7 @@ function renderForm(nonce, error) {
 <style>
   body { font-family: system-ui, sans-serif; max-width: 420px; margin: 48px auto; padding: 0 16px; color: #1a1a1a; }
   h1 { font-size: 1.4rem; }
+  p.update { color: #555; font-size: 0.9rem; }
   label { display: block; margin-top: 12px; font-weight: 600; }
   input { width: 100%; padding: 8px; margin-top: 4px; box-sizing: border-box; font-size: 1rem; }
   button { margin-top: 20px; padding: 10px 16px; font-size: 1rem; cursor: pointer; }
@@ -4542,6 +4545,7 @@ function renderForm(nonce, error) {
   Virlow API. They are never seen by any AI model or logged.
 </p>
 ${errorHtml}
+${updateHtml}
 <form method="POST" action="/unlock?nonce=${encodeURIComponent(nonce)}" autocomplete="off">
   <label for="email">Email</label>
   <input type="email" id="email" name="email" autocomplete="off" required />
@@ -4686,7 +4690,7 @@ function startUnlockServer(api, vault, opts = {}) {
         harden(res);
         res.statusCode = 200;
         res.setHeader("content-type", "text/html; charset=utf-8");
-        res.end(renderForm(nonce));
+        res.end(renderForm(nonce, void 0, opts.updateNotice?.() ?? null));
         return;
       }
       if (req.method === "POST") {
@@ -4710,7 +4714,7 @@ function startUnlockServer(api, vault, opts = {}) {
           harden(res);
           res.statusCode = 200;
           res.setHeader("content-type", "text/html; charset=utf-8");
-          res.end(renderForm(nonce, message));
+          res.end(renderForm(nonce, message, opts.updateNotice?.() ?? null));
         }
         return;
       }
@@ -4742,25 +4746,30 @@ function startUnlockServer(api, vault, opts = {}) {
 }
 
 // src/version.ts
-var VERSION = true ? "3.81.1" : "dev";
+var VERSION = true ? "3.82.0" : "dev";
 
 // src/server.ts
 function defaultEmbeddingCacheDir() {
   return path3.join(os.homedir(), ".virlow-mcp", "cache");
 }
-var localBrowserUnlock = {
-  description: "Open a local browser window where the USER signs in and enters their Virlow master password. This tool returns immediately once the browser is opened \u2014 it does NOT wait for the user to finish. Call the status tool afterward to confirm the vault unlocked. Never ask the user for their password or account credentials yourself, and never relay a password through this tool or any other \u2014 credentials are entered only in the browser form and never seen by any AI model.",
-  async begin({ api, vault }) {
-    const { url } = await startUnlockServer(api, vault, { openBrowser: true });
-    return `Browser opened at ${url}. Complete the unlock form there, then run status to confirm.`;
-  }
-};
+function localBrowserUnlock(updateNotice) {
+  return {
+    description: "Open a local browser window where the USER signs in and enters their Virlow master password. This tool returns immediately once the browser is opened \u2014 it does NOT wait for the user to finish. Call the status tool afterward to confirm the vault unlocked. Never ask the user for their password or account credentials yourself, and never relay a password through this tool or any other \u2014 credentials are entered only in the browser form and never seen by any AI model.",
+    async begin({ api, vault }) {
+      const { url } = await startUnlockServer(api, vault, {
+        openBrowser: true,
+        ...updateNotice ? { updateNotice } : {}
+      });
+      return `Browser opened at ${url}. Complete the unlock form there, then run status to confirm.`;
+    }
+  };
+}
 function withLocalDefaults(opts) {
   const { embeddingCacheDir, ...rest } = opts;
   return {
     ...rest,
     serverInfo: { name: "virlow-mcp", version: VERSION },
-    unlock: localBrowserUnlock,
+    unlock: localBrowserUnlock(opts.updateNotice),
     createEmbeddingCache: (userId) => new EmbeddingCache({
       dir: embeddingCacheDir ?? defaultEmbeddingCacheDir(),
       userId,
@@ -4828,6 +4837,63 @@ async function runConnectBridge(opts) {
   };
 }
 
+// src/update-check.ts
+var REGISTRY_URL = "https://registry.npmjs.org/virlow-mcp/latest";
+var TIMEOUT_MS = 3e3;
+var OPT_OUT_ENV = "VIRLOW_MCP_NO_UPDATE_CHECK";
+function parseVersion(v) {
+  const m = /^(\d+)\.(\d+)\.(\d+)$/.exec(v);
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+function isNewer(candidate, current) {
+  const a = parseVersion(candidate);
+  const b = parseVersion(current);
+  if (!a || !b) return false;
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] > b[i];
+  }
+  return false;
+}
+function optedOut(env) {
+  const v = env[OPT_OUT_ENV];
+  return v === "1" || v === "true";
+}
+function updateCheckApplies(argv, env) {
+  if (optedOut(env)) return false;
+  if (argv.includes("--version") || argv.includes("-v")) return false;
+  if (argv.some((a) => a === "--connect" || a.startsWith("--connect="))) return false;
+  return true;
+}
+function startUpdateCheck(opts) {
+  const env = opts.env ?? process.env;
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const log = opts.log ?? ((line) => process.stderr.write(`${line}
+`));
+  let text = null;
+  if (optedOut(env)) return { notice: () => null, done: Promise.resolve() };
+  const done = (async () => {
+    try {
+      const res = await fetchImpl(REGISTRY_URL, {
+        signal: AbortSignal.timeout(TIMEOUT_MS),
+        headers: { accept: "application/json" }
+      });
+      if (!res.ok) return;
+      const body = await res.json();
+      const latest = body.version;
+      if (typeof latest === "string" && isNewer(latest, opts.current)) {
+        text = `virlow-mcp ${latest} is available (you are running ${opts.current}). Restart your AI client to update. If your MCP config runs plain virlow-mcp, change it to virlow-mcp@latest.`;
+      }
+    } catch (err) {
+      const why = err instanceof Error ? err.message : String(err);
+      try {
+        log(`virlow-mcp: update check skipped: ${why.replace(/\s+/g, " ")}`);
+      } catch {
+      }
+    }
+  })();
+  return { notice: () => text, done };
+}
+
 // src/cli.ts
 function flagValue(name) {
   const prefix = `--${name}=`;
@@ -4860,7 +4926,15 @@ async function main() {
   const http2 = process.argv.includes("--http");
   const host = flagValue("host") ?? "127.0.0.1";
   const fileAccess = localFileAccess({ http: http2, host });
-  const serverOpts = { apiUrl, modelCacheDir, embeddingCacheDir, memoriesEnabled, fileAccess };
+  const updates = updateCheckApplies(process.argv, process.env) ? startUpdateCheck({ current: VERSION }) : null;
+  const serverOpts = {
+    apiUrl,
+    modelCacheDir,
+    embeddingCacheDir,
+    memoriesEnabled,
+    fileAccess,
+    ...updates ? { updateNotice: () => updates.notice() } : {}
+  };
   const services = createServices2(serverOpts);
   const { server } = buildServer2({ ...serverOpts, services });
   if (http2) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "virlow-mcp",
-  "version": "3.81.1",
+  "version": "3.82.0",
   "description": "Local MCP server for Virlow Secure Notes: end-to-end-encrypted AI memories and notes for Cursor, Claude, Codex, and any MCP client.",
   "license": "UNLICENSED",
   "type": "module",
@@ -34,9 +34,9 @@
     "esbuild": "^0.25.0",
     "typescript": "^5.8.0",
     "vitest": "^3.0.0",
-    "@batalabs/virlow-crypto": "3.81.1",
-    "@batalabs/virlow-mcp-core": "3.81.1",
-    "@batalabs/virlow-memory": "3.81.1"
+    "@batalabs/virlow-crypto": "3.82.0",
+    "@batalabs/virlow-memory": "3.82.0",
+    "@batalabs/virlow-mcp-core": "3.82.0"
   },
   "scripts": {
     "build": "node build.mjs",