feat: send X-OpenBoot-Version header, show upgrade hint from server

- All CLI→Server HTTP requests include X-OpenBoot-Version header
- CLI reads X-OpenBoot-Upgrade response header and prints one-time hint
- SetClientVersion() called at startup from root command

Author: fullstackjam

internal/cli/root.go

@@ -39,6 +39,7 @@ shell configuration, and macOS preferences.`,
   # Capture your current environment
   openboot snapshot --json > my-setup.json`,
 	PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
+		config.SetClientVersion(version)
 		updater.AutoUpgrade(version)
 		config.RefreshPackagesFromRemote()
 

internal/config/config.go

@@ -11,17 +11,49 @@ import (
 	"os"
 	"regexp"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/openbootdotdev/openboot/internal/system"
 	"gopkg.in/yaml.v3"
 )
 
+var upgradeHintOnce sync.Once
+
+// checkUpgradeHint reads the X-OpenBoot-Upgrade header from server responses.
+// If the server says the CLI is too old, print a one-time hint to stderr.
+func checkUpgradeHint(resp *http.Response) {
+	if resp.Header.Get("X-OpenBoot-Upgrade") == "true" {
+		upgradeHintOnce.Do(func() {
+			minVer := resp.Header.Get("X-OpenBoot-Min-Version")
+			if minVer == "" {
+				minVer = "latest"
+			}
+			fmt.Fprintf(os.Stderr, "Notice: your CLI is older than the server expects (min %s). Run: brew upgrade openboot\n", minVer)
+		})
+	}
+}
+
 // isAllowedAPIURL delegates to the shared implementation in system package.
 var isAllowedAPIURL = system.IsAllowedAPIURL
 
+// clientVersion is set by the CLI at startup via SetClientVersion.
+var clientVersion = "dev"
+
+// SetClientVersion sets the version string sent in X-OpenBoot-Version headers.
+func SetClientVersion(v string) { clientVersion = v }
+
+// versionTransport wraps http.DefaultTransport to inject the version header.
+type versionTransport struct{ base http.RoundTripper }
+
+func (t *versionTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	req.Header.Set("X-OpenBoot-Version", clientVersion)
+	return t.base.RoundTrip(req)
+}
+
 var remoteHTTPClient = &http.Client{
-	Timeout: 15 * time.Second,
+	Timeout:   15 * time.Second,
+	Transport: &versionTransport{base: http.DefaultTransport},
 }
 
 //go:embed data/presets.yaml
@@ -425,6 +457,7 @@ func fetchConfigBySlug(apiBase, username, slug, token string) (*http.Response, e
 
 func parseConfigResponse(resp *http.Response, username, slug, token string) (*RemoteConfig, error) {
 	defer resp.Body.Close()
+	checkUpgradeHint(resp)
 
 	if resp.StatusCode == 403 {
 		if token == "" {

internal/config/packages_remote.go

@@ -64,9 +64,17 @@ func loadRemotePackages() ([]remotePackage, error) {
 
 func fetchRemotePackages() ([]remotePackage, error) {
 	apiURL := getAPIBase() + "/api/packages"
-	client := &http.Client{Timeout: 8 * time.Second}
 
-	resp, err := client.Get(apiURL)
+	req, err := http.NewRequest("GET", apiURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("fetch packages: %w", err)
+	}
+
+	client := &http.Client{
+		Timeout:   8 * time.Second,
+		Transport: &versionTransport{base: http.DefaultTransport},
+	}
+	resp, err := client.Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("fetch packages: %w", err)
 	}