Ahmed Abushagur 655a909955 fix(update-check): auto-install patch bumps without SPAWN_AUTO_UPDATE (#3296) ... auto-install to same-major.minor bumps. The intent was "give users control over feature updates" but the effect was "nobody installs security patches" because the default became notice-only for everything. This decouples the two ideas and aligns the policy with semver intent: - PATCH bumps (1.0.5 -> 1.0.7, same major.minor): auto-install always, no opt-in needed. Patches are reserved for bug fixes and security hardening. Blast radius is bounded by semver: no behavior changes, no new features, no breaking changes. - MINOR / MAJOR bumps (1.0.x -> 1.1.0, 1.x.x -> 2.0.0): respect SPAWN_AUTO_UPDATE=1 as opt-in. These can contain behavior changes and users should decide when to move to them. - SPAWN_NO_AUTO_UPDATE=1: new explicit opt-out for CI environments or pinned installs that need a fully static CLI. Caveat — the one-time hurdle: users currently on 1.0.6 won't get 1.0.7 automatically, because they're still running 1.0.6's update-check.ts which honors the old opt-in gate. Once they reach 1.0.7 via spawn update (or by setting SPAWN_AUTO_UPDATE=1), every future patch will propagate automatically and the fleet becomes self-healing on security. Tests: - 5 new tests lock in the policy (patch auto without env, minor notice without env, minor auto with env, major notice without env, explicit opt-out suppresses patch) - All 21 update-check tests pass (16 existing + 5 new) - 2109/2109 total suite Bumps 1.0.6 -> 1.0.7.		2026-04-14 10:38:08 +00:00
..
cli	fix(update-check): auto-install patch bumps without SPAWN_AUTO_UPDATE (#3296)	2026-04-14 10:38:08 +00:00
shared	fix: rethrow normalized Error in tryCatchIf/asyncTryCatchIf (#2930)	2026-03-23 19:33:05 -07:00