Wire shared getLatestVersionCached into CC and Codex session-start hooks

[kaghni]

Summary

Completes the version-check caching work started in PR #69 (which wired openclaw). The cached helper getLatestVersionCached has existed in src/hooks/version-check.ts for a while — written, exported, fully unit-tested — but was never wired into production. All three Claude Code and Codex session-start hooks were still calling the uncached getLatestVersion(), meaning each session fires a raw.githubusercontent.com request.

This PR switches them to the cached version. Same helper that PR #69 uses for openclaw.

What changes

• src/hooks/session-start.ts — CC session-start
• src/hooks/session-start-setup.ts — CC async setup
• src/hooks/codex/session-start-setup.ts — codex async setup

All three now call:

const latest = await getLatestVersionCached({
  url: GITHUB_RAW_PKG,
  timeoutMs: 3000,
  cachePath: process.env.HIVEMIND_VERSION_CACHE_PATH || undefined,
});

• Caches at ~/.deeplake/.version-check.json with a 1h TTL
• Falls back to the cached value on fetch failure (network hiccups don't blank out the check)
• Honors HIVEMIND_VERSION_CACHE_PATH env override for test isolation

GITHUB_RAW_PKG is now exported from src/utils/version-check.ts so callers reference the canonical URL.

Test isolation

Previously, the session-start tests mocked global fetch but let the cache helper write to the user's real ~/.deeplake/.version-check.json. Between tests, cached state would bleed into fetch-mock assertions. This PR:

• Gives each test a unique cache path via mkdtempSync + HIVEMIND_VERSION_CACHE_PATH
• Cleans up the tmp dir in afterEach

Test plan

• npm run typecheck clean
• npm run build — all bundles rebuilt
• npm test — 918/918 passing across 41 files

Follow-up

After merge, the full caching story lines up across all three hosts:

• Openclaw — cached (PR Re-apply PR #66: openclaw coexist with memory-core (after revert) #69)
• Claude Code — cached (this PR)
• Codex — cached (this PR)

Network-destinations disclosure (in the README and SKILL.md) can then honestly say "contacts raw.githubusercontent.com at most once per hour."

🤖 Generated with Claude Code

[claude]

Claude finished @kaghni's task in 2m 35s —— View job

---

Review

• Read PR diff and changed files
• Analyze for bugs, security issues, correctness, and test coverage

One issue found and posted as an inline comment: the catch block in getLatestVersionCached (and the !res.ok branch) write checkedAt: nowMs to cache on any fetch failure, resetting the full 1h TTL. A transient network error on first install caches null for an hour, silently suppressing update checks. Fix is in src/hooks/version-check.ts — skip the write on error and just return the stale value.

Everything else looks clean: test isolation with per-test tmp dirs is correct, HIVEMIND_VERSION_CACHE_PATH wiring is consistent, and the || undefined fallback pattern is correct.

[github-actions]

Coverage Report

Scope: files changed in this PR. Enforced threshold: 90% per metric (per file via vitest.config.ts).

Status	Category	Percentage	Covered / Total
🟢	Lines	95.33% (🎯 90%)	204 / 214
🟢	Statements	94.51% (🎯 90%)	224 / 237
🟢	Functions	94.12% (🎯 90%)	16 / 17
🔴	Branches	83.33% (🎯 90%)	100 / 120

File Coverage — 4 files changed

File	Stmts	Branches	Functions	Lines
src/hooks/codex/session-start-setup.ts	🟢 98.5%	🔴 84.4%	🟢 100.0%	🟢 98.3%
src/hooks/session-start-setup.ts	🟢 98.0%	🔴 86.4%	🟢 100.0%	🟢 97.8%
src/hooks/session-start.ts	🟢 98.9%	🟢 91.3%	🟢 100.0%	🟢 98.8%
src/utils/version-check.ts	🔴 67.7%	🔴 60.0%	🔴 75.0%	🔴 72.0%

_{Generated for commit 2e10e34.}

[claude]

Writing checkedAt: nowMs in the catch block resets the full 1h TTL on any transient fetch failure (timeout, DNS hiccup). A brand-new install with a brief network blip will cache null and skip version checks for an entire hour. The same issue exists in the !res.ok branch (line 503) — a non-200 response also silently extends the TTL.

Skip the cache write on error and just return the stale value; retrying next session is preferable to a guaranteed 1h blackout. Fix should be applied in src/hooks/version-check.ts (the bundle is generated):

Suggested change

	} catch {
	const latest = stale?.latest ?? null;
	writeVersionCache({
	checkedAt: nowMs,
	latest,
	url: opts.url
	}, cachePath);
	return latest;
	}
	} catch {
	return stale?.latest ?? null;
	}

[kaghni]

Closing without merge. The per-session fetch is the current and preferred behavior. Caching was the bot-suggested alternative to the disclosure fix; now that openclaw's docs (PR #69) accurately name both network destinations, the caching mitigation isn't needed.

Context: the getLatestVersionCached helper reached main via PR #64 (stacked on Davit's still-open PR #61) but was never wired into production call sites. PR #61 is the right venue for anyone revisiting that design choice.