yaver-cli 1.99.167 → 1.99.171

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yaver-cli",
-  "version": "1.99.167",
+  "version": "1.99.171",
   "mcpName": "io.github.kivanccakmak/yaver",
   "description": "Unified npm bootstrap for the Yaver agent, SDK injection, and local-first developer runtime",
   "bin": {

package/src/agent-runtime.js

@@ -36,6 +36,25 @@ async function ensureAgentBinary({ quiet = false } = {}) {
     const asset = await resolveAsset();
     const localAgentPath = resolveLocalAgentBinary(asset);
     if (localAgentPath) return localAgentPath;
+    // Defense in depth: if the cache holds a HIGHER version than
+    // what GH resolved, prefer it. Two failure modes this catches:
+    //   1. Older wrappers with the namespaced-tag-strip bug resolve
+    //      to a stale legacy `v*` release even when newer `cli/v*`
+    //      tags exist. Cache snapshot wins until npm catches up.
+    //   2. A new release publishes its tag but skips the platform
+    //      asset (e.g. macOS notarize fails); falling back to a
+    //      previously-cached newer build is better than running
+    //      the older one.
+    const higherCached = findHigherCachedThan(asset.version);
+    if (higherCached) {
+      if (!quiet) {
+        console.error(
+          `[yaver] cache holds a newer agent (${higherCached.version}) than the resolved release ` +
+          `(${asset.version}); preferring cached binary.`,
+        );
+      }
+      return higherCached.path;
+    }
     const installDir = path.join(CACHE_ROOT, asset.version, asset.cacheKey);
     const binaryPath = path.join(installDir, asset.binaryName);
     if (fs.existsSync(binaryPath)) {
@@ -62,6 +81,33 @@ async function ensureAgentBinary({ quiet = false } = {}) {
   }
 }
 
+/** Walk CACHE_ROOT and return the path + version of any cached
+ *  binary newer than `version` that matches this platform. Returns
+ *  null when nothing higher is cached. Used as a "prefer-newer"
+ *  override on top of the GH-resolved version. */
+function findHigherCachedThan(version) {
+  if (!fs.existsSync(CACHE_ROOT)) return null;
+  if (!semver.valid(version)) return null;
+  const platform = process.platform;
+  const arch = process.arch;
+  const goArch = arch === 'x64' ? 'amd64' : arch === 'arm64' ? 'arm64' : arch;
+  const cacheKey = `${platform}-${goArch}`;
+  const binaryName = platform === 'win32' ? 'yaver.exe' : 'yaver';
+  const versions = fs.readdirSync(CACHE_ROOT).filter((v) => semver.valid(v));
+  versions.sort(semver.rcompare);
+  for (const v of versions) {
+    if (semver.lte(v, version)) break; // sorted desc; nothing higher remains
+    const p = path.join(CACHE_ROOT, v, cacheKey, binaryName);
+    if (fs.existsSync(p)) {
+      if (process.platform !== 'win32') {
+        try { fs.chmodSync(p, 0o755); } catch (_) {}
+      }
+      return { path: p, version: v };
+    }
+  }
+  return null;
+}
+
 /** Walk CACHE_ROOT and return the path to the newest yaver binary
  *  matching this platform — used as fallback when GH /releases is
  *  rate-limited and no specific version was resolvable. */
@@ -497,13 +543,13 @@ async function fetchRemoteAsset(platform, goArch) {
       downloadName: asset.name,
       archiveType: 'exe',
       url: asset.browser_download_url,
-      version: release.tag_name.replace(/^v/, ''),
+      version: stripCliTagPrefix(release.tag_name),
     };
   }
 
   if (platform === 'darwin' || platform === 'linux') {
     const release = await fetchLatestRelease(DEFAULT_REPO);
-    const version = release.tag_name.replace(/^v/, '');
+    const version = stripCliTagPrefix(release.tag_name);
     const asset = findReleaseAsset(release, [
       `yaver-v${version}-${platform}-${goArch}.tar.gz`,
       `yaver-${platform}-${goArch}.tar.gz`,
@@ -525,6 +571,19 @@ async function fetchRemoteAsset(platform, goArch) {
   throw new Error(`unsupported platform for npm bootstrap: ${platform}`);
 }
 
+// Strip the CLI release tag prefix and return the bare semver — or
+// null if this isn't a CLI release at all. Tags now live in per-surface
+// namespaces: `cli/v1.99.167`, `mobile/v1.18.91`, `web/v1.1.131`, etc.
+// Pre-1.99.124 releases were just `v1.99.149`. Only those two shapes
+// belong to the CLI; mobile/web/relay tags must NOT pass through, or
+// `findReleaseAsset` will look for a yaver-linux-arm64 tarball on a
+// mobile release and silently fail. Returning null here lets
+// `semver.valid(stripCliTagPrefix(...))` filter non-CLI tags out.
+function stripCliTagPrefix(tag) {
+  const match = String(tag || '').match(/^(?:cli\/)?v(.+)$/);
+  return match ? match[1] : null;
+}
+
 async function fetchLatestRelease(repo) {
   const response = await request(`https://api.github.com/repos/${repo}/releases?per_page=20`, {
     headers: {
@@ -545,7 +604,7 @@ async function fetchLatestRelease(repo) {
   }
 
   const latest = Array.isArray(releases)
-    ? releases.find((release) => !release.draft && !release.prerelease && semver.valid(String(release.tag_name || '').replace(/^v/, '')))
+    ? releases.find((release) => !release.draft && !release.prerelease && semver.valid(stripCliTagPrefix(String(release.tag_name || ''))))
     : null;
 
   if (!latest || !latest.tag_name) {