[distroinfinity]

Follow-up to #98 (auto-update). Moves the update version signal from each daemon polling GitHub to asking our own API, so you control rollout centrally and the whole thing is actually testable. Tarballs still live on GitHub Releases.

Changes

• API: new public GET /cli/version-check?current=<v> → { latest, outdated, tarballUrl }, driven by a new LATEST_CLI_VERSION env. Unset ⇒ outdated:false (safe default + kill-switch). Set ⇒ advertises that version; tarballUrl = the version-specific GitHub asset. (routes/cli-version.ts, lib/semver.ts, config/env.ts.)
• CLI: daemon, distro upgrade, and distro status now call checkForUpdate(current) → our API instead of GitHub. The auto-update pipeline downloads the server-provided tarballUrl. Removed the GitHub poll + the version-check file cache entirely.
• Critical fix: tar was externalized but missing from the release tarball — a released auto-updater would have crashed with Cannot find package 'tar'. Now bundled (tsup noExternal). This was only catchable by running the real built artifact — see below.

Real, on-machine verification (not mocks)

Stood up a local server returning the real /cli/version-check contract + a real release tarball, ran the actual daemon on an old version:

• Happy path: daemon 0.2.9 → asked the server → downloaded the real tarball → real npm install compiled better-sqlite3 → verified (real node --version + daemon self-check) → atomically swapped current → restarted into a new daemon reporting 9.9.9. ~14.6s.
• Reject path: staged build whose --version ≠ server's claimed latest → verifyStaged rejected → current stayed on 0.2.9, bad-version backoff armed.

This real test is what surfaced the tar bug (unit tests run from source with full node_modules; the fixture e2e stubbed npm — both missed it).

Operational note (gating)

Merging deploys the endpoint, but it advertises nothing until LATEST_CLI_VERSION is set on the API (Railway). So this PR is safe to merge with zero auto-update impact. To actually roll out: cut cli-v<X>, then set LATEST_CLI_VERSION=<X> on Railway (and unset/lower it to halt a bad rollout).

Test plan

• 25 API tests (endpoint + semver), 151 CLI tests, typecheck/lint/build all green
• real daemon e2e: happy-path auto-update + verify-reject (evidence above)
• built bundle runs in isolation with only better-sqlite3 external (tar bundled)
• post-merge: confirm GET https://api.distrotv.xyz/cli/version-check?current=0.0.1 returns outdated:false (env unset) — i.e. safe default live

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
devdrip	Ready	Preview, Comment	May 27, 2026 2:35pm