v0.29.0 — installs that verify themselves

crawlproof update now updates

crawlproof update and crawlproof upgrade mean "install the latest". Before this they were handed straight to the dashboard, which printed its usage and exited 2 — the wrapper spells its own flags --self-* so every plain word belongs upstream, and update was the one word worth claiming. Only in first position, so crawlproof ads budget update still reaches upstream untouched.

An install that exits 0 is not an install

pnpm 11 ships a minimumReleaseAge cooldown that refuses versions published in the last little while, and it does not fail when it refuses one: it resolves to the newest release old enough to pass, writes an exclude-list note, and exits 0.

Reproduced in an empty directory on pnpm 11.18.0, with the registry reporting 0.2.0:

pnpm add @profullstack/crawlproof@latest    -> 0.1.0, exit 0
npm install @profullstack/crawlproof@latest -> 0.2.0

The failure mode is the bad one: you run update, are told it worked, and keep hitting the bug it was supposed to fix.

Both crawlproof and hqtui now ask what landed instead of trusting the exit code, and move to the next package manager when the answer is the wrong version. The version installed is printed, because "installed" without a number is exactly the claim that turned out to be false:

crawlproof: installing @profullstack/crawlproof@latest
crawlproof: installed 0.2.0 with npm

An unreachable registry leaves the wanted version unknown, and unknown passes, so an offline box can still reinstall what it already has.

Deliberately not --config.minimumReleaseAge=0. The cooldown is a real supply-chain protection, and switching it off wholesale in a tool that installs on other people's machines is a bigger decision than fixing an update.

Full changelog: v0.28.0...v0.29.0