fix: handle unknown update versions and flat interactive config

[suraj-markup]

Summary

• avoid showing the internal 0.0.0 fallback in startup update notices; unknown versions now say to update to latest
• resolve current AO version from ao-cli/ao-web fallbacks when wrapper metadata is unavailable or placeholder
• fix ao start --interactive for flat repo-local configs by writing role agent overrides without assuming a projects map

Tests

• pnpm --filter @aoagents/ao-cli exec vitest run tests/lib/update-check.test.ts tests/commands/start.test.ts
• pnpm --filter @aoagents/ao-cli typecheck
• pnpm --filter @aoagents/ao-core typecheck

[greptile-apps]

Greptile Summary

This PR fixes three related bugs: the 0.0.0 internal placeholder leaking into startup update notices, stale version resolution in getInstalledAoVersion, and two crash paths in ao start --interactive when the active config is a flat repo-local YAML rather than a nested projects-keyed config. All GitHub Actions workflow references are also pinned to specific commit SHAs.

• Update-check cleanup: getInstalledAoVersion now skips 0.0.0 placeholders across all candidate packages and adds @aoagents/ao-cli as an intermediate fallback; maybeShowUpdateNotice shows "update to latest version" instead of the meaningless 0.0.0 → X.Y.Z arrow when the installed version is still unknown.
• Flat-config startNewOrchestrator fix: when the active config file has no projects map, the code now transparently falls back to the global registry for the mutation, then reloads from there; a clear error is thrown if the project still cannot be located.
• Flat-config interactive agent-override fix: the else (non-global, non-projects) branch now calls readProjectBehaviorConfig/writeProjectBehaviorConfig directly on the project path and keeps config/project consistent in-memory, avoiding the previous rawConfig.projects[projectId] TypeError on flat files.

Confidence Score: 5/5

Safe to merge; the changes are targeted bug fixes with matching tests and no regressions identified.

Both previously flagged crash paths in startNewOrchestrator and the interactive agent-override block are now guarded with explicit null checks and graceful fallbacks. The update-check changes are purely additive (extra candidate, extra branch), and the workflow SHA pinning reduces supply-chain risk without touching runtime behaviour. New tests cover the flat-config paths end-to-end.

No files require special attention.

Important Files Changed

Filename	Overview
packages/cli/src/commands/start.ts	Fixes two flat-config crash paths: startNewOrchestrator now falls back to the global registry when the local config has no projects map, and the interactive agent-override path now writes directly to the project's behavior config when no projects key is found.
packages/cli/src/lib/update-check.ts	maybeShowUpdateNotice now emits 'update to latest version' instead of showing the placeholder 0.0.0 when the installed version cannot be resolved; getCurrentVersion delegates to getInstalledAoVersion first.
packages/core/src/update-cache.ts	getInstalledAoVersion adds @aoagents/ao-cli as a fallback candidate and now skips any candidate whose version string is the placeholder '0.0.0'.
packages/cli/tests/commands/start.test.ts	Adds two new integration tests covering flat-config behaviour: startNewOrchestrator writing to the global registry and interactive agent overrides writing to the project's local YAML without injecting a projects key.
packages/cli/tests/lib/update-check.test.ts	Adds tests for getCurrentVersion's fallback priority and for maybeShowUpdateNotice hiding the 0.0.0 placeholder on both stable and nightly channels.
.github/workflows/ci.yml	Pins all GitHub Actions references from floating version tags (v4) to specific commit SHAs, improving supply-chain security.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[startNewOrchestrator] --> B{rawConfig has projects?}
    B -- Yes --> E[Use local config projects map]
    B -- No --> C{isCanonicalGlobalConfigPath?}
    C -- No --> D[Load global config as fallback]
    D --> F{global config has projects?}
    F -- Yes --> E
    F -- No --> G[Throw: project not found in registry]
    C -- Yes --> G
    E --> H[Generate collision-free newId + prefix]
    H --> I[Write updated config to mutationConfigPath]
    I --> J[loadConfig from mutationConfigPath]

    K[agentOverride path] --> L{isCanonicalGlobalConfigPath?}
    L -- Yes --> M[Write to project.path behavior config]
    L -- No --> N{rawConfig has projects?}
    N -- Yes --> O[Mutate projects map, write to configPath]
    N -- No --> P[Read + write project behavior config - Set updatedProject in-memory]
    M --> Q[loadConfig to refresh]
    O --> Q
    P --> R[Update config in-memory from updatedProject]

    S[getCurrentVersion] --> T[getInstalledAoVersion]
    T --> U{ao version != 0.0.0?}
    U -- Yes --> V[Return ao version]
    U -- No --> W{ao-cli version != 0.0.0?}
    W -- Yes --> X[Return ao-cli version]
    W -- No --> Y{ao-web version != 0.0.0?}
    Y -- Yes --> Z[Return ao-web version]
    Y -- No --> AA[Return 0.0.0 then getCliVersion fallback]

    AB[maybeShowUpdateNotice] --> AC{installMethod == git?}
    AC -- Yes --> AD[Show latestVersion]
    AC -- No --> AE{currentVersion == 0.0.0?}
    AE -- Yes --> AF[Show update to latest version]
    AE -- No --> AG[Show currentVersion to latestVersion]

Loading

_{Reviews (5): Last reviewed commit: "revert: run dependency review on all PRs" | Re-trigger Greptile}

[suraj-markup]

CI update: the first run failed before checkout because the org now requires every GitHub Action to be pinned to a full commit SHA (for example, actions/checkout@v4 was blocked). I pushed commit 0c31563 to pin all workflow action refs. The new Actions runs are currently marked action_required because this is a fork PR and require maintainer/admin approval before they can execute; my account cannot approve them (GitHub API returns 403 admin required).

[suraj-markup]

Addressed the P1 review on startNewOrchestrator in commit 334c6cb. That path now detects flat repo-local configs and writes the cloned new-orchestrator entry into the global project registry instead of assuming rawConfig.projects exists. Added a regression for selecting "Start new orchestrator" from a flat-config repo.\n\nVerified locally:\n- pnpm --filter @aoagents/ao-cli exec vitest run tests/commands/start.test.ts tests/lib/update-check.test.ts\n- pnpm --filter @aoagents/ao-cli typecheck\n- pnpm --filter @aoagents/ao-core typecheck