feat(doctor): nudge when a newer starloghq is published - #54
Merged
Conversation
A stale install of a security tool is a liability, but nothing told users they were behind. `starlog doctor` now checks the npm registry for a newer version and nudges to upgrade. - src/update-check.ts: compareVersions (pure, x.y.z, tolerates v-prefix and pre-release suffixes) + fetchLatestVersion (short timeout, injectable fetch, STARLOG_REGISTRY_URL override, returns null on any failure). - doctor gains a "Version" check: `warn` with an upgrade command when behind, `ok` when current. Best-effort — skipped on STARLOG_NO_UPDATE_CHECK, and any network failure returns no line rather than a red mark, so a diagnostic never hangs or fails because npm was unreachable. Staleness is advisory (exit 0). Tests: update-check unit tests (compare + fetch success/failure/timeout); a doctor e2e that serves a newer version from a local registry stand-in and asserts the nudge (async spawn so the in-process server can answer the child). The gate and existing doctor e2e set STARLOG_NO_UPDATE_CHECK to stay hermetic. Full suite 564/564; release gate 20/20. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem (maintenance automation #3)
A stale install of a security tool is a liability, but nothing surfaced that a user was behind.
starlog doctornow checks the npm registry and nudges to upgrade.Change
src/update-check.ts—compareVersions(purex.y.z, tolerates a leadingvand pre-release suffixes, never throws) +fetchLatestVersion(short timeout, injectablefetchImpl,STARLOG_REGISTRY_URLoverride, returnsnullon any failure).doctorgains a "Version" check —warnwithnpm install -g starloghq@latestwhen behind,okwhen current.Best-effort by design
Skipped on
STARLOG_NO_UPDATE_CHECK; any network failure returns no line rather than a red mark; staleness is awarn(exit 0). A diagnostic must never hang or fail because npm was unreachable.Tests
compareVersionsordering/edge cases;fetchLatestVersionsuccess / non-ok / missing-field / throws-→-null.spawn(notspawnSync) so the in-process HTTP server can answer the child — a synchronous spawn deadlocks the event loop and the child's fetch times out.STARLOG_NO_UPDATE_CHECKto stay hermetic/offline.main(co-exists with doctor: warn when the installed hook is the legacy self-contained form #52's legacy-hook doctor test).Batch: #1 hook shim ✅ (#51) → #3 this PR → next: #2 (server.json bump + CI version gate + OIDC registry publish).
🤖 Generated with Claude Code