flameox - npm Package Compare versions

Comparing version 0.1.10 to 0.1.11

bin/flameox.cjs

@@ -31,23 +31,31 @@ #!/usr/bin/env node
 const pythonArgs = command === "upgrade" ? ["setup", "--refresh", "--yes", ...args.slice(1)] : args;
+const resolveLatest = command === "upgrade" && process.env.FLAMEOX_NPM_UPGRADE_HANDOFF !== "1";
+const executable = resolveLatest
+  ? process.env.FLAMEOX_NPX_EXECUTABLE || "npx"
+  : process.env.FLAMEOX_UV_EXECUTABLE || "uvx";
+const childArgs = resolveLatest
+  ? ["--yes", "--prefer-online", "flameox@latest", "upgrade", ...args.slice(1)]
+  : [
+      "--no-config",
+      "--no-sources",
+      "--refresh-package",
+      "flameox",
+      "--prerelease",
+      "allow",
+      "--python",
+      "3.12",
+      "--from",
+      pythonPackage,
+      "flameox",
+      ...pythonArgs,
+    ];
+const childEnvironment = resolveLatest
+  ? { ...environment, FLAMEOX_NPM_UPGRADE_HANDOFF: "1" }
+  : environment;
 process.stderr.write(
-  "Preparing flameox's cached managed Python runtime; this does not add packages to your project.\n",
+  resolveLatest
+    ? "Resolving the latest flameox bootstrap before upgrading the managed runtime.\n"
+    : "Preparing flameox's cached managed Python runtime; this does not add packages to your project.\n",
 );
-const child = spawn(
-  process.env.FLAMEOX_UV_EXECUTABLE || "uvx",
-  [
-    "--no-config",
-    "--no-sources",
-    "--refresh-package",
-    "flameox",
-    "--prerelease",
-    "allow",
-    "--python",
-    "3.12",
-    "--from",
-    pythonPackage,
-    "flameox",
-    ...pythonArgs,
-  ],
-  { env: environment, stdio: "inherit" },
-);
+const child = spawn(executable, childArgs, { env: childEnvironment, stdio: "inherit" });
 
@@ -54,0 +62,0 @@ const signals = ["SIGINT", "SIGTERM", "SIGHUP"];

package.json

 {
   "name": "flameox",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "Bootstrap the local flameox MCP setup wizard",
@@ -5,0 +5,0 @@ "homepage": "https://github.com/morluto/flameox#readme",

README.md

@@ -13,11 +13,11 @@ # flameox
 ```console
-npx flameox@latest upgrade
+npx flameox upgrade
 ```
 
-It launches the matching `flameox` Python package with `uvx`. The
-wizard installs a persistent, versioned local runtime and writes only the MCP
-client configurations you approve. Keep `@latest` in the command: an
-unqualified `npx flameox` invocation may reuse an older cached bootstrap. The
-bootstrap refreshes uv metadata for the pinned Python package before resolving
-it, so a newly published runtime is visible even when uv has cached an older
-package index.
+`upgrade` first resolves `flameox@latest`, then launches its matching Python
+package with `uvx`. The wizard installs a persistent, versioned local runtime
+and writes only the MCP client configurations you approve. For the interactive
+setup flow, keep `@latest` in the command: an unqualified `npx flameox setup`
+invocation may reuse an older cached bootstrap. The bootstrap refreshes uv
+metadata for the pinned Python package before resolving it, so a newly
+published runtime is visible even when uv has cached an older package index.

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances

Improved metrics

Total package byte prevSize

5933

11.84%

Lines of code

131

6.5%

Worsened metrics

Number of low supply chain risk alerts

5

66.67%

No dependency changes