fix(cli): use the public npm registry for the self-update check

[John-David Dalton (jdalton)]

The self-update check now always uses the public npm registry instead of resolving it from the local npm config, so it behaves the same regardless of the directory the CLI runs in.

• Extracted into runSelfUpdateCheck() with a unit test covering the pinned registry.
• Dropped the now-unused registry-url / registry-auth-token dependencies.

---

Note

Low Risk
Small startup-path refactor with a pinned public registry URL; behavior change is intentional and covered by a unit test.

Overview
The CLI self-update notice no longer derives the registry URL or auth from the user’s npm config (cwd-sensitive). It always queries https://registry.npmjs.org/ via a new runSelfUpdateCheck() helper, so update availability is consistent everywhere the binary runs.

src/cli.mts delegates startup to that helper instead of inlining registry-url, registry-auth-token, and tiny-updater setup. registry-url and registry-auth-token are removed from package.json / lockfile. A unit test asserts the pinned registry and that authInfo is not passed.

^{Reviewed by Cursor Bugbot for commit 44bec12. Configure here.}

[John-David Dalton (jdalton)]

CodeRabbit (@coderabbitai) review this PR
Copilot review this PR

[coderabbitai]

@jdalton I'll review this PR now.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Copilot]

CodeRabbit (@coderabbitai) review this PR
Copilot review this PR

The changes look good. Here's a summary of the review:

src/utils/self-update.mts

• Correctly hardcodes 'https://registry.npmjs.org/' so the update check is immune to local .npmrc overrides, private registry configs, or per-project npm settings.
• authInfo is intentionally omitted — the public registry requires no credentials, so dropping it is correct and removes a potential information-leakage vector.
• Logic and formatting are otherwise identical to what was inlined in cli.mts, so no behavioral regressions.

src/utils/self-update.test.mts

• Mocks tiny-updater cleanly and asserts both the pinned registry URL and the absence of authInfo. Covers exactly the security-relevant invariants.

src/cli.mts

• Unused imports (registry-auth-token, registry-url, colors, socketPackageLink) are properly cleaned up.

package.json / pnpm-lock.yaml

• registry-auth-token and registry-url are correctly removed as they are no longer referenced anywhere.

CI is green. LGTM ✅

[John-David Dalton (jdalton)]

Cursor (@cursor) review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 44bec12. Configure here.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0c615ba5-96bc-4e16-b1d2-c5c28681083a

📥 Commits

Reviewing files that changed from the base of the PR and between 77bce16 and 44bec12.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (4)

• package.json
• src/cli.mts
• src/utils/self-update.mts
• src/utils/self-update.test.mts

💤 Files with no reviewable changes (1)

• package.json

---

📝 Walkthrough

Walkthrough

The self-update check previously inlined in the CLI entry point was extracted into a new runSelfUpdateCheck function in src/utils/self-update.mts, with accompanying tests. src/cli.mts now imports and calls this function instead of directly using registry/update libraries. Two now-unused devDependencies were removed from package.json.

Changes

Self-update Extraction

Layer / File(s)	Summary
New self-update utility and tests src/utils/self-update.mts, src/utils/self-update.test.mts	Adds runSelfUpdateCheck() which checks the npm registry for newer CLI versions via tiny-updater with a 24-hour TTL, logs version info and a changelog link; test mocks tiny-updater and verifies invocation without authInfo.
CLI wiring to new utility src/cli.mts	Removes inlined update-check imports/logic and calls the new runSelfUpdateCheck() before meowWithSubcommands.
Dependency cleanup package.json	Removes unused registry-auth-token and registry-url devDependencies.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
    participant CLI as src/cli.mts
    participant SelfUpdate as runSelfUpdateCheck
    participant Updater as tiny-updater
    participant Registry as npm Registry

    CLI->>SelfUpdate: await runSelfUpdateCheck()
    SelfUpdate->>Updater: check(pkgName, options, registry URL)
    Updater->>Registry: query latest version
    Registry-->>Updater: version info
    Updater-->>SelfUpdate: update available?
    alt update found
        SelfUpdate->>SelfUpdate: log version + changelog link
    end
    SelfUpdate-->>CLI: return

Loading

Poem

A rabbit hopped through cli code so neat,
Pulled self-update out, made the flow complete. 🐇
New module born, with tests standing guard,
Two stale deps swept from the yard.
Hop, hop — cleaner burrows ahead!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: pinning the self-update check to the public npm registry.
Description check	✅ Passed	The description accurately describes the registry change, the refactor, and the dependency cleanup.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jdalton/sec-634-harden-self-update-registry

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}