improved

Author: SUSTAPLE117

cmd/root.go

@@ -95,15 +95,28 @@ By BoostSecurity.io - https://github.com/boostsecurityio/poutine `,
 	},
 }
 
+// versionCheckSkipCommands lists subcommands that must not trigger the
+// version check: "mcp-server" speaks JSON-RPC over stdio (no point delaying
+// its handshake), and "completion" is invoked by shells for tab-completion
+// lookups. Other subcommands (including "version" and "help") still pay the
+// once-per-day check, since the 24h cache means at most one network call.
+var versionCheckSkipCommands = map[string]struct{}{
+	"mcp-server": {},
+	"completion": {},
+}
+
 // runVersionCheck performs the once-per-day update check unless disabled by
-// flag, env var, or config. The "version" subcommand is excluded so users can
-// inspect the binary without triggering a network call.
+// flag, env var, or config. Commands listed in versionCheckSkipCommands and
+// any subcommand under them are excluded so users can inspect the binary or
+// run the MCP server without triggering a network call.
 func runVersionCheck(cmd *cobra.Command) {
-	if cmd != nil && cmd.Name() == "version" {
-		return
+	for c := cmd; c != nil; c = c.Parent() {
+		if _, skip := versionCheckSkipCommands[c.Name()]; skip {
+			return
+		}
 	}
 	disabled := disableVersionCheck || (config != nil && config.DisableVersionCheck)
-	result := versioncheck.Run(Version, disabled)
+	result := versioncheck.Run(cmd.Context(), Version, disabled)
 	if result == nil || !result.UpdateAvailable {
 		return
 	}

versioncheck/versioncheck.go

@@ -53,9 +53,9 @@ type options struct {
 
 // Run records a CLI start and, at most once every 24 hours, reports anonymous
 // telemetry to the configured endpoint and returns the latest release info.
-// The whole operation is bounded by checkTimeout so it never noticeably
-// slows down poutine startup.
-func Run(version string, disabled bool) *Result {
+// The HTTP call is bounded by checkTimeout (derived from ctx) so it never
+// noticeably slows down poutine startup.
+func Run(ctx context.Context, version string, disabled bool) *Result {
 	if disabled || isDisabledByEnv(os.Getenv(DisableEnv)) {
 		return nil
 	}
@@ -67,10 +67,10 @@ func Run(version string, disabled bool) *Result {
 	recordStart(cfg, uuid.NewString)
 	_ = SaveConfig(cfg)
 
-	ctx, cancel := context.WithTimeout(context.Background(), checkTimeout)
+	timeoutCtx, cancel := context.WithTimeout(ctx, checkTimeout)
 	defer cancel()
 
-	result, _ := run(ctx, options{
+	result, _ := run(timeoutCtx, options{
 		Config:     cfg,
 		Version:    version,
 		URL:        VersionCheckURL,

versioncheck/versioncheck_test.go

@@ -5,6 +5,8 @@ import (
 	"errors"
 	"io"
 	"net/http"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -306,6 +308,27 @@ func TestLoadConfig_RoundTrip(t *testing.T) {
 	assert.True(t, cfg.LastVersionCheckAt.Equal(loaded.LastVersionCheckAt))
 }
 
+func TestRun_DisabledShortCircuitsBeforeAnyDiskWrite(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("POUTINE_CONFIG_DIR", dir)
+	t.Setenv(DisableEnv, "")
+
+	// Disabled via the option (CLI flag / config path).
+	result := Run(context.Background(), "v0.18.0", true)
+	assert.Nil(t, result)
+
+	_, err := os.Stat(filepath.Join(dir, "config.yaml"))
+	assert.True(t, os.IsNotExist(err), "no state file should be written when disabled")
+
+	// Disabled via env var, even if the option is false.
+	t.Setenv(DisableEnv, "1")
+	result = Run(context.Background(), "v0.18.0", false)
+	assert.Nil(t, result)
+
+	_, err = os.Stat(filepath.Join(dir, "config.yaml"))
+	assert.True(t, os.IsNotExist(err), "no state file should be written when disabled by env")
+}
+
 func TestIsDisabledByEnv(t *testing.T) {
 	for _, value := range []string{"1", "true", "TRUE", "yes", "on"} {
 		assert.True(t, isDisabledByEnv(value), value)