fix(cli): require user confirmation before CLI update

- Show update notification on startup (non-blocking via update-notifier)
- Ask for user confirmation (y/N) before running update
- Skip confirmation in CI mode or JSON output mode
- Update tests to match new flow

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: mylukin

.claude-plugin/marketplace.json

@@ -1,15 +1,15 @@
 {
   "$schema": "https://anthropic.com/claude-code/marketplace.schema.json",
   "name": "ralph-dev",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "description": "Autonomous end-to-end development system that transforms requirements into production-ready code",
   "owner": {
     "name": "Lukin",
     "email": "[email protected]"
   },
   "metadata": {
     "description": "Autonomous end-to-end development system that transforms requirements into production-ready code with zero manual intervention",
-    "version": "0.4.6",
+    "version": "0.4.7",
     "homepage": "https://github.com/mylukin/ralph-dev",
     "repository": "https://github.com/mylukin/ralph-dev"
   },
@@ -18,7 +18,7 @@
       "name": "ralph-dev",
       "source": "./",
       "description": "Autonomous end-to-end development system - from requirement to production-ready code with zero manual intervention",
-      "version": "0.4.6",
+      "version": "0.4.7",
       "author": {
         "name": "Lukin",
         "email": "[email protected]"

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ralph-dev",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "description": "Autonomous end-to-end development system - from requirement to production-ready code with zero manual intervention",
   "author": {
     "name": "Lukin",

cli/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "ralph-dev",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "description": "CLI tool for Ralph-dev - efficient operations for AI agents",
   "main": "dist/index.js",
   "bin": {

cli/package.json

@@ -9,6 +9,7 @@ import { execSync } from 'child_process';
 import { existsSync, mkdirSync, rmSync, readdirSync } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
+import { createInterface } from 'readline';
 import chalk from 'chalk';
 import { ExitCode } from '../core/exit-codes';
 import { handleError, Errors } from '../core/error-handler';
@@ -33,6 +34,24 @@ interface UpdateResult {
 const GITHUB_REPO = 'mylukin/ralph-dev';
 const PACKAGE_NAME = 'ralph-dev';
 
+/**
+ * Prompt user for confirmation
+ */
+function askConfirmation(question: string): Promise<boolean> {
+  return new Promise((resolve) => {
+    const rl = createInterface({
+      input: process.stdin,
+      output: process.stdout,
+    });
+
+    rl.question(question, (answer) => {
+      rl.close();
+      const normalized = answer.toLowerCase().trim();
+      resolve(normalized === 'y' || normalized === 'yes');
+    });
+  });
+}
+
 /**
  * Get the latest version from npm registry
  */
@@ -285,8 +304,31 @@ export function registerUpdateCommand(program: Command): void {
           process.exit(ExitCode.SUCCESS);
         }
 
+        // Check for updates first
+        const latestVersion = getLatestVersion();
+        const hasUpdate = latestVersion ? latestVersion !== currentVersion : true; // Assume update if can't check
+        const versionKnown = latestVersion !== null;
+
+        if (!hasUpdate && !options.pluginOnly) {
+          console.log(chalk.green(`\n✓ CLI is already at the latest version (${currentVersion})\n`));
+        }
+
+        // Ask for confirmation if there's an update (skip in JSON mode or CI)
+        if (hasUpdate && !options.pluginOnly && !options.json && !process.env.CI) {
+          if (versionKnown) {
+            console.log(chalk.yellow(`\n📦 Update available: ${currentVersion} → ${latestVersion}\n`));
+          } else {
+            console.log(chalk.yellow(`\n📦 Checking for updates...\n`));
+          }
+          const confirmed = await askConfirmation('Do you want to update? (y/N): ');
+          if (!confirmed) {
+            console.log(chalk.dim('\nUpdate cancelled.\n'));
+            process.exit(ExitCode.SUCCESS);
+          }
+        }
+
         // Update CLI
-        if (!options.pluginOnly) {
+        if (!options.pluginOnly && hasUpdate) {
           const cliResult = updateCLI();
           result.cli.updated = cliResult.success;
           result.cli.newVersion = cliResult.newVersion;

cli/src/commands/update.ts

@@ -38,13 +38,11 @@ const shouldCheckUpdate = !process.env.NO_UPDATE_NOTIFIER && !process.env.CI;
 
 if (shouldCheckUpdate) {
   const updateService = createAutoUpdateService(name, version, {
-    autoUpdate: true,
+    autoUpdate: false, // Don't auto-update, just show notification
   });
 
-  // Run update check in background (don't await to not block CLI)
-  updateService.checkAndUpdate().catch(() => {
-    // Silently ignore update check errors
-  });
+  // Show update notification (non-blocking)
+  updateService.notify();
 }
 
 // Parse command line arguments

cli/src/index.ts

@@ -218,9 +218,14 @@ describe('Update Command Integration', () => {
 
       let callCount = 0;
       vi.mocked(execSync).mockImplementation((cmd: any) => {
+        const cmdStr = String(cmd);
         callCount++;
-        if (callCount === 1) throw new Error('npm failed');
-        return '0.5.0\n';
+        // First call is npm view (version check) - return higher version to trigger update
+        if (cmdStr.includes('npm view')) return '99.0.0\n';
+        // Second call is npm install - fail it
+        if (callCount === 2) throw new Error('npm failed');
+        // Third call is npx npm install - succeed
+        return '99.0.0\n';
       });
 
       await program.parseAsync(['node', 'test', 'update', '--cli-only']);
@@ -236,7 +241,11 @@ describe('Update Command Integration', () => {
       const fs = await import('fs');
 
       vi.mocked(fs.existsSync).mockReturnValue(false);
-      vi.mocked(execSync).mockImplementation(() => {
+      vi.mocked(execSync).mockImplementation((cmd: any) => {
+        const cmdStr = String(cmd);
+        // Version check returns higher version to trigger update
+        if (cmdStr.includes('npm view')) return '99.0.0\n';
+        // All install attempts fail
         throw new Error('update failed');
       });