fix(cli): print the installed version in the banner, not a hardcoded v0.1.0

apps/cli/src/core/__tests__/version.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, it, vi } from "vitest";
+import { banner } from "../logger.js";
+import { PKG_VERSION } from "../version.js";
+
+describe("banner", () => {
+  // The bug this file exists for: the banner printed a hardcoded
+  // "v0.1.0" on every command, so a box running 0.11.6 reported a version
+  // ten minors stale and looked like a failed upgrade.
+  it("reports the resolved package version, not a literal", () => {
+    const lines: string[] = [];
+    const spy = vi.spyOn(console, "log").mockImplementation((...args) => {
+      lines.push(args.join(" "));
+    });
+
+    try {
+      banner();
+    } finally {
+      spy.mockRestore();
+    }
+
+    const versionLine = lines.find((l) => l.includes("All-in-one security agent daemon"));
+    expect(versionLine).toBeDefined();
+    expect(versionLine).toContain(`v${PKG_VERSION}`);
+    expect(versionLine).not.toContain("v0.1.0");
+  });
+});

apps/cli/src/core/logger.ts

@@ -1,5 +1,6 @@
 import chalk from 'chalk';
 import type { EventSeverity } from '../types/events.js';
+import { PKG_VERSION } from './version.js';
 
 const SEVERITY_COLORS: Record<EventSeverity, (s: string) => string> = {
   info: chalk.green,
@@ -58,5 +59,5 @@ export function banner(): void {
      ██║   ██║  ██║██║  ██║███████╗██║  ██║   ██║   ╚██████╗██║  ██║╚██████╔╝███████║██║  ██║
      ╚═╝   ╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝   ╚═╝    ╚═════╝╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚═╝  ╚═╝
   `));
-  console.log(chalk.gray('  All-in-one security agent daemon — v0.1.0\n'));
+  console.log(chalk.gray(`  All-in-one security agent daemon — v${PKG_VERSION}\n`));
 }

apps/cli/src/core/version.ts

@@ -0,0 +1,21 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+// The bundles live in `dist/`, which sits at the package root once published,
+// so the manifest is always one level up from `__dirname`. Reading it keeps the
+// version in one place: a hardcoded literal reports whatever it was written at,
+// no matter which release is actually installed.
+const FALLBACK_VERSION = '0.0.0';
+
+function readPackageVersion(): string {
+  try {
+    const pkg = JSON.parse(
+      readFileSync(join(__dirname, '..', 'package.json'), 'utf-8'),
+    ) as { version?: string };
+    return pkg.version || FALLBACK_VERSION;
+  } catch {
+    return FALLBACK_VERSION;
+  }
+}
+
+export const PKG_VERSION = readPackageVersion();

apps/cli/src/index.ts

@@ -42,12 +42,7 @@ import {
   shadowedUpdateWarning,
   type PackageManager,
 } from "./upgrade.js";
-
-let PKG_VERSION = "0.1.8";
-try {
-  const pkg = JSON.parse(readFileSync(join(__dirname, "..", "package.json"), "utf-8"));
-  PKG_VERSION = pkg.version;
-} catch {}
+import { PKG_VERSION } from "./core/version.js";
 
 const LOGO = `
 ${chalk.green("  ████████╗██╗  ██╗██████╗ ███████╗ █████╗ ████████╗")}