fix(cli): tighten update check eligibility

Author: waleedlatif1

apps/docs/content/docs/cli/configuration.mdx

@@ -147,16 +147,18 @@ containing username/password userinfo, such as
 `https://user:password@registry.example`, is rejected and no update check is
 made.
 
-Malformed and non-HTTP(S) configured registry values also disable the update
-check rather than making an unexpected request to the public registry.
+An empty or whitespace-only `npm_config_registry` is treated as unset, so the
+public registry remains the default. Non-empty malformed and non-HTTP(S) values
+disable the update check rather than making an unexpected public request.
 
 The notice is skipped entirely when:
 
 - `SIM_NO_UPDATE_CHECK` is set to anything but `0` or `false`
 - stderr is not a terminal, so redirected and piped output is never affected
 - a CI environment variable is present (`CI`, `GITHUB_ACTIONS`, `JENKINS_URL`,
   `TEAMCITY_VERSION`, `BUILDKITE`)
-- the CLI is running under `npx`, which resolves the newest version every time
+- the CLI is running under `npm exec` or `npx`, which may use a project-local or
+  ephemeral package where global-install advice is inappropriate
 - the CLI is running from a checkout of the sim repository, whose version
   deliberately trails the published one
 - the installed version is a prerelease

apps/docs/content/docs/cli/troubleshooting.mdx

@@ -120,7 +120,7 @@ one installs a second copy instead of replacing the executable on your `PATH`:
 
 The CLI can also tell you this through a cached daily check on eligible
 invocations, and the command it prints already matches your installation. It
-stays quiet when stderr is redirected, in CI, and under `npx`.
+stays quiet when stderr is redirected, in CI, and under `npm exec` or `npx`.
 
 ## An update notice appears in output I am parsing
 

packages/sim-cli/README.md

@@ -272,9 +272,10 @@ Apart from the configured registry URL, it sends only its own version and never
 your Sim API key. If `npm_config_registry` points at a private mirror, its query
 string is preserved, including any query-string credentials. Registry URLs
 containing username/password userinfo are rejected. Set
-`SIM_NO_UPDATE_CHECK=1` to turn it off; malformed or non-HTTP(S) configured
-registry values also fail closed. The full list of cases where it stays quiet
-is in the [configuration guide](https://docs.sim.ai/cli/configuration).
+`SIM_NO_UPDATE_CHECK=1` to turn it off. Empty or whitespace-only registry values
+use the public default; non-empty malformed or non-HTTP(S) values fail closed.
+The full list of cases where it stays quiet is in the
+[configuration guide](https://docs.sim.ai/cli/configuration).
 
 ## Documentation
 

packages/sim-cli/src/update/check.process.test.ts

@@ -87,6 +87,7 @@ function runChild(
         JENKINS_URL: '0',
         NODE_USE_ENV_PROXY: '0',
         NO_PROXY: '127.0.0.1,localhost',
+        npm_command: '',
         TEAMCITY_VERSION: '0',
         ...options.env,
         SIM_CONFIG_DIR: configDir,
@@ -364,11 +365,12 @@ it.skipIf(!SUPPORTS_PROXY_FLAG)(
   10_000
 )
 
-it('keeps a configured registry credential out of probe argv and environment', async () => {
+it('keeps CLI credentials out of probe argv and environment', async () => {
   const inspectionPath = join(temporaryDir, 'probe-inspection.json')
   const preloadDir = join(temporaryDir, 'probe preload')
   const preloadPath = join(preloadDir, 'inspect-probe.cjs')
-  const sentinel = 'registry-secret-sentinel'
+  const registrySentinel = 'registry-secret-sentinel'
+  const apiKeySentinel = 'api-key-secret-sentinel'
   let requestPath: string | undefined
   mkdirSync(preloadDir)
   writeFileSync(
@@ -395,24 +397,27 @@ it('keeps a configured registry credential out of probe argv and environment', a
       response.end(JSON.stringify({ latest: '2.1.5' }))
     },
     async (origin) => {
-      const registry = `${origin}?token=${sentinel}`
+      const registry = `${origin}?token=${registrySentinel}`
       const result = await runChild(entrypoint, registry, join(temporaryDir, 'config-credential'), {
         env: {
           NODE_OPTIONS: `--require="${preloadPath}"`,
           NPM_CONFIG_REGISTRY: registry,
           PROBE_INSPECTION_PATH: inspectionPath,
+          SIM_API_KEY: apiKeySentinel,
         },
         useProcessEnv: true,
       })
 
       expect(result).toMatchObject({ code: 0, signal: null, stderr: '' })
-      expect(requestPath).toBe(`/-/package/sim/dist-tags?token=${sentinel}`)
+      expect(requestPath).toBe(`/-/package/sim/dist-tags?token=${registrySentinel}`)
       const inspection = JSON.parse(readFileSync(inspectionPath, 'utf8')) as {
         argv: string[]
         environmentValues: string[]
         execArgv: string[]
       }
-      expect(JSON.stringify(inspection)).not.toContain(sentinel)
+      const serializedInspection = JSON.stringify(inspection)
+      expect(serializedInspection).not.toContain(registrySentinel)
+      expect(serializedInspection).not.toContain(apiKeySentinel)
     }
   )
 }, 10_000)

packages/sim-cli/src/update/check.test.ts

@@ -177,8 +177,34 @@ describe('when the notice is suppressed', () => {
   it.each([
     '/Users/x/.npm/_npx/a1b2/node_modules/sim/dist/index.js',
     'C:\\Users\\x\\AppData\\Local\\npm-cache\\_npx\\a1b2\\node_modules\\sim\\dist\\index.js',
-  ])('says nothing under npx, which resolves the tag on every run (%s)', async (modulePath) => {
+  ])('says nothing for an npx cache installation (%s)', async (modulePath) => {
     await run({ modulePath })
+    expect(fetched).toEqual([])
+    expect(notices).toEqual([])
+  })
+
+  it.each([
+    '/Users/x/project/node_modules/sim/dist/index.js',
+    'C:\\Users\\x\\project\\node_modules\\sim\\dist\\index.js',
+  ])('says nothing when npm exec resolves a project-local dependency (%s)', async (modulePath) => {
+    await run({ env: { npm_command: 'exec' }, modulePath })
+    expect(fetched).toEqual([])
+    expect(notices).toEqual([])
+  })
+
+  it.each([
+    {
+      cwd: '/Users/x/project/packages/app',
+      modulePath: '/Users/x/project/node_modules/sim/dist/index.js',
+    },
+    {
+      cwd: 'C:\\Users\\x\\project\\packages\\app',
+      modulePath:
+        'C:\\Users\\x\\project\\node_modules\\.pnpm\\sim@2.1.2\\node_modules\\sim\\dist\\index.js',
+    },
+  ])('says nothing from a project-local install at $modulePath', async ({ cwd, modulePath }) => {
+    await run({ cwd, modulePath })
+    expect(fetched).toEqual([])
     expect(notices).toEqual([])
   })
 

packages/sim-cli/src/update/check.ts

@@ -87,6 +87,8 @@ interface UpdateCacheEntry {
 const CACHE_VERSION = 1
 
 export interface UpdateCheckOptions {
+  /** Current working directory. Injected so project-local installation detection is testable. */
+  cwd?: string
   currentVersion?: string
   env?: NodeJS.ProcessEnv
   /** Whether stderr is a terminal. Injected so the suppression rule is testable. */
@@ -117,10 +119,26 @@ function isEnabled(value: string | undefined): boolean {
   return normalized !== '' && normalized !== '0' && normalized !== 'false'
 }
 
-/** Skips npx, which resolves latest, and checkouts, whose manifest trails npm. */
-function isUnadvisableInstall(modulePath: string): boolean {
+/** Whether the package is installed in a node_modules tree above the working directory. */
+function isProjectLocalInstall(modulePath: string, cwd: string): boolean {
+  const normalizedModulePath = normalizeModulePath(modulePath)
+  const nodeModulesIndex = normalizedModulePath.indexOf('/node_modules/')
+  if (nodeModulesIndex < 0) return false
+
+  const installRoot = normalizedModulePath.slice(0, nodeModulesIndex)
+  const workingDirectory = normalizeModulePath(cwd).replace(/\/+$/, '')
+  return workingDirectory === installRoot || workingDirectory.startsWith(`${installRoot}/`)
+}
+
+/** Skips ephemeral, project-local, and checkout installs that global advice cannot update. */
+function isUnadvisableInstall(modulePath: string, env: NodeJS.ProcessEnv, cwd: string): boolean {
   const normalized = normalizeModulePath(modulePath)
-  return normalized.includes('/_npx/') || normalized.includes('/packages/sim-cli/')
+  return (
+    env.npm_command === 'exec' ||
+    normalized.includes('/_npx/') ||
+    normalized.includes('/packages/sim-cli/') ||
+    isProjectLocalInstall(modulePath, cwd)
+  )
 }
 
 /** Normalizes separators and case before installation-path comparisons. */
@@ -185,11 +203,12 @@ try {
 }
 `
 
-/** Preserves proxy/TLS settings without copying the registry credential into the probe. */
+/** Preserves proxy/TLS settings without copying CLI credentials into the probe. */
 function registryProcessEnv(): NodeJS.ProcessEnv {
   const env = { ...process.env }
   for (const key of Object.keys(env)) {
-    if (key.toLowerCase() === 'npm_config_registry') delete env[key]
+    const normalized = key.toLowerCase()
+    if (normalized === 'npm_config_registry' || normalized === 'sim_api_key') delete env[key]
   }
   return env
 }
@@ -421,12 +440,13 @@ export async function announceUpdateIfAvailable(options: UpdateCheckOptions = {}
     const env = options.env ?? process.env
     const isTty = options.isTty ?? process.stderr.isTTY === true
     const modulePath = options.modulePath ?? fileURLToPath(import.meta.url)
+    const cwd = options.cwd ?? process.cwd()
     const now = options.now ?? new Date()
 
     if (isEnabled(env.SIM_NO_UPDATE_CHECK)) return
     if (!isTty) return
     if (CI_VARIABLES.some((variable) => isEnabled(env[variable]))) return
-    if (isUnadvisableInstall(modulePath)) return
+    if (isUnadvisableInstall(modulePath, env, cwd)) return
 
     const currentVersion = options.currentVersion ?? CLI_VERSION
     const current = parseStableVersion(currentVersion)