feat(cli): confirm major-version jumps in mops self update

[Kamirus]

When 3.0.0 reaches the release canister, /tags/latest flips and every 2.x user running mops self update absorbs a major with breaking changes — the only signal is the version number scrolling by. This is the last 2.x window to change that: the guard has to be in the installed CLI before the flip.

A major jump now stops and asks:

Current version: 2.20.0
Version 3.0.0 is a new major release with breaking changes:
https://github.com/caffeinelabs/mops/releases/tag/cli-v3.0.0
? Update to 3.0.0? › (y/N)

Non-interactively (CI, scripts) it skips the update with a notice and exits 0:

Skipping the major update. Run mops self update --major to update.

Exit 0 is the load-bearing choice: erroring would itself have been the breaking change — a script running mops self update succeeds today and would turn permanently red the day 3.0.0 ships. With the skip, the script keeps working and simply stays on its major. Same-major updates (minor/patch) never prompt and are byte-identical to today.

Also fixed in passing: an unparseable /tags/latest body (an error page, an empty response) was previously handed straight to npm add -g as an install spec; it is now an error naming the URL.

Coverage is honest-but-partial

Only users who self-update to a release carrying this guard get it — someone sitting on 2.20.0 still jumps straight to 3.0.0. That is unavoidable (the check runs client-side), which is why it should ship in a 2.x release soon rather than ride along with something else. The GA release notes remain the safety net for everyone else.

The same guard lands on v3 in a sibling PR, which covers the 3.x→4.x jump permanently.

Scope

Deliberately no releases.json diffing or npm consultation — /tags/latest plus a major comparison is the whole check. The decision table is a pure helper (helpers/self-update-kind.ts) with unit tests covering the prerelease edges (2.20.0 → 3.0.0-beta.1 prompts; 3.0.0-beta.1 → 3.0.0 does not). The jest moduleNameMapper addition is the standard ESM .js→.ts mapping; the full suite (25 suites, 200 tests, 73 snapshots) passes with it.

🤖 Generated with Claude Code

[github-actions]

Cursor AI review

👍 APPROVE — looks safe to merge

Category	Assessment	Details
Summary	✅	Adds a major-crossing guard to mops self update: confirm in a TTY, soft-skip non-interactively, opt in with --major; also rejects unparseable /tags/latest bodies before npm add -g.
Code Quality	✅	Pure decision helper (classifySelfUpdate) reused by the command; confirmation path matches existing prompts/onCancel pattern in owner.ts.
Consistency	✅	--major naming matches mops update --major; --help option, docs/docs/cli/6-self/01-mops-self-update.md, and cli/CHANGELOG.md ## Next stay aligned. Skill file never covered self (pre-existing scope).
Security	✅	Traced update() → getLatestVersion() → install URL: invalid tags now process.exit(1) instead of being interpolated into ${url}/versions/${latest}.tgz (new vs Base). No auth/registry/lockfile paths touched.
Tests	✅	Unit coverage of the decision table in cli/tests/self-update.test.ts (same-major, major, prerelease edges, invalid); network/npm sides intentionally untested, matching prior lack of self.ts tests. Snapshot strategy N/A (corner-case assertions).
Maintainability	✅	Small focused helper + clear comments; jest moduleNameMapper is the standard ESM .js→.ts remap needed for this first relative .js import in tests.

Verdict

Decision: APPROVE
Risk: Low
Reason: Contained, intentional CLI UX guard with docs/changelog/help in sync; same-major path is unchanged and non-interactive major skips exit 0 by design rather than silently installing 3.x.

---

Generated for commit 917c11f

[automation-sa-sre]

Automated approval: the AI review verdict for 4b0d777 is APPROVE. See the "Cursor AI review" comment for details.

[automation-sa-sre]

Automated approval: the AI review verdict for 917c11f is APPROVE. See the "Cursor AI review" comment for details.