Function run

packages/cli/src/commands/upgrade.ts:22–107

({ args })

    json: { type: "boolean", description: "Output as JSON", default: false },
  },
  async run({ args }) {
    const useJson = args.json === true;
    const checkOnly = args.check === true;

    // JSON mode: always force-check and output structured data
    if (useJson) {
      const result = await checkForUpdate(true);
      console.log(JSON.stringify(withMeta(result), null, 2));
      return;
    }

    const autoYes = args.yes === true;
    clack.intro(c.bold("hyperframes upgrade"));

    const s = clack.spinner();
    s.start("Checking for updates...");

    const result = await checkForUpdate(true);

    if (result.latest === result.current) {
      s.stop(c.success("Already up to date"));
      clack.outro(`${c.success("\u25C7")}  ${c.bold("v" + VERSION)}`);
      return;
    }

    s.stop("Update available");

    console.log();
    console.log(`   ${c.dim("Current:")}  ${c.bold("v" + result.current)}`);
    console.log(`   ${c.dim("Latest:")}   ${c.bold(c.accent("v" + result.latest))}`);
    console.log();

    if (checkOnly) {
      clack.outro(c.accent("Update available: v" + result.latest));
      return;
    }

    if (!autoYes) {
      const shouldUpgrade = await clack.confirm({
        message: "Upgrade now?",
      });

      if (clack.isCancel(shouldUpgrade) || !shouldUpgrade) {
        clack.outro(c.dim("Skipped."));
        return;
      }
    }

    // Reject anything that isn't a strict semver-shaped string before it reaches
    // the install command. A poisoned npm registry response could otherwise put
    // shell metacharacters into `result.latest`; rejecting up front means the
    // version flows through execFile (and the displayed command) as an opaque
    // token, not something the shell might re-parse.
    const SAFE_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
    if (!SAFE_VERSION.test(result.latest)) {
      clack.outro(c.dim("Refusing to install: unexpected version string from npm registry."));
      process.exitCode = 1;
      return;