@patchgg/cli 0.1.0 → 0.1.1

package/README.md

@@ -5,10 +5,14 @@ The command-line tool for [Patch](https://patch.gg): make, validate and publish
 ## Install
 
 ```sh
-npm i -g @patchgg/cli
+npm i -g @patchgg/cli                           # with Node 20 or newer
+curl -fsSL https://patch.gg/install.sh | sh     # macOS and Linux, no Node needed
+irm https://patch.gg/install.ps1 | iex          # Windows PowerShell, no Node needed
 ```
 
-Every way of installing pch, and what each one takes, is on [docs.patch.gg/cli](https://docs.patch.gg/cli#install). They all get the same build of a version.
+Every way of installing pch, and what each one takes, is on [docs.patch.gg/cli](https://docs.patch.gg/cli#install). They all get the same build of a version. The one-line installers put pch's executable in `~/.pch/bin` (`%USERPROFILE%\.pch\bin` on Windows) and add that to your PATH.
+
+`pch update` brings the installers' pch up to the newest version. Installed with npm or pnpm, it says the command that updates it instead, and Patch Desktop's own pch moves with Patch Desktop. Once a day at most, pch says when a newer version is out, after a command in a terminal; never with `--json`, in CI, or when what it prints goes to another program.
 
 ## Use
 
@@ -468,6 +472,7 @@ This is on the `repos` branch, and Patch has it behind a flag, until it launches
 |             | `PCH_API_URL` | Point at another server, e.g. `http://localhost:3000`        |
 |             | `PCH_GIT_URL` | Where that server's repos live, e.g. `http://localhost:8787` |
 |             | `PCH_CONFIG`  | Config file (default `~/.pch/config.json`, mode 600)         |
+|             | `PCH_CDN_URL` | Where pch looks for its own releases, for `pch update`       |
 
 ## Your agent
 
@@ -508,12 +513,35 @@ PCH_BIN=dist/cli.js pnpm test   # the tests that run pch as a command, against t
 
 CI runs both, the first on Windows, macOS and Linux.
 
+### What the installers put in place
+
+The one-line installers download an executable: pch's `dist/` and Node 26 in one file, through Node's single executable support, so it needs nothing installed. `scripts/build-binary.mjs` makes it from a `dist/` folder, on Node 26, for the machine it runs on, with the licence texts and the notices (Node's own licence added) inside it. On macOS it signs it ad hoc, which Apple Silicon needs.
+
+```sh
+node scripts/build-binary.mjs dist out             # on Node 26: out/pch-<os>-<arch>[.exe]
+node scripts/smoke.mjs --executable out/pch-...    # the smoke test, and pch update, against it
+```
+
+CI runs both on Windows, macOS and Linux. pch knows it's the executable through `node:sea` (`src/install.ts`): it reads its licence texts from inside itself, and git's sign-in helper and the MCP server line `pch agent install` writes run it by its own path.
+
 ### Releasing
 
-`package.json` stays `"private": true`, so npm and pnpm refuse to publish pch from a checkout, and a test keeps it that way. [`publish.yml`](.github/workflows/publish.yml) is the only way out. It runs on a `v<version>` tag on `main`, and stops unless production has repos and this repo has an `NPM_TOKEN` secret. One build per version: its `pack` job runs every check, builds once, takes `private` out of its own copy, packs, tries the tarball installed, and keeps it as the run's artifact `npm-package`. Its `publish` job sends that same tarball to npm, with provenance once this repo is public. Every other way of installing pch is made from that tarball's `dist/`, never rebuilt from source.
-1. `pnpm sync <a patch checkout at main>`, then `pnpm generate`, so what's released checks what the API checks.
-2. Move the version on in `package.json`, the only place it lives (the build writes it into the bundle), and merge that to `main`.
-3. `git tag v<version> <that commit>`, then `git push origin v<version>`.
+**Release with the button:** [Actions, Release pch](https://github.com/patch-gg/pch/actions/workflows/release.yml), **Run workflow** on `main`, then pick `patch` (fixes), `minor` (new things) or `major` (breaking). It tags `main` with the next version and releases it to npm and the one-line installers together. Patch-gg/patch's `product/design/cli.md`, Releasing pch, says what each step does and what to do when one fails.
+
+`package.json` stays `"private": true`, so npm and pnpm refuse to publish pch from a checkout, and a test keeps it that way. [`publish.yml`](.github/workflows/publish.yml) is the only way out. It runs on a `v<version>` tag on `main`, which is the version, and stops unless production has repos. It publishes with npm's trusted publishing, so no npm key is kept anywhere: npm takes `@patchgg/cli` only from this repo's `publish.yml`, as the package's settings on npmjs.com say. One build per version: its `pack` job runs every check, builds once, takes `private` out of its own copy, packs, tries the tarball installed, and keeps it as the run's artifact `npm-package`. Every other way of installing pch is made from that tarball's `dist/`, never rebuilt from source. Then, in order:
+- `executable` makes the six executables, each on its own runner (Linux, macOS and Windows, x64 and arm64), and runs the smoke test against each, and on Linux the tests too.
+- `sign-windows` signs both Windows executables with Patch's Artifact Signing certificate profile and checks each signature, in the `production` environment. It signs in to Azure with GitHub's OIDC token, which the app registration `patch-pch-signing-production` trusts for that environment alone, so there's no secret. A Windows executable is never shipped unsigned: missing settings stop the release.
+- `staging` gzips them, writes `SHA256SUMS`, and puts the version on cdn-staging.patch.gg under `cli/<version>/`, then moves `cli/latest.json` to it ([`scripts/put-release.sh`](scripts/put-release.sh)).
+- `try-installers` installs it from staging.patch.gg on a clean Debian container, Linux on Arm, both kinds of Mac and both kinds of Windows, and checks it runs, says its version, and on Windows, its signature.
+- `publish` sends the tarball to npm, with provenance once this repo is public.
+- `production` puts the same files on cdn.patch.gg and moves production's `latest.json`.
+
+Nothing reaches npm or production unless every platform got through. A version's files never change: a version that's on the CDN already with other files stops the release. `latest.json` only moves forward, and it's the one version check: the installers read it, and so do `pch update` and the notice. The `staging` and `production` environments take `v*` tags only, and hold R2 keys for their own public bucket alone (`infra/scripts/create-pch-release-keys.mjs` in patch-gg/patch makes them).
+To release what's on `main`:
+1. `pnpm sync <a patch checkout at main>`, then `pnpm generate`, so what's released checks what the API checks, and merge that to `main` if it changed anything.
+2. Press the button: Actions, **Release pch**, Run workflow on `main`, and pick how big a change it is: `patch` for fixes, `minor` for new things, `major` for a breaking change. Or `gh workflow run release.yml -f bump=minor`.
+
+The button ([`release.yml`](.github/workflows/release.yml)) takes the newest `v<version>` tag, moves it on by that much, tags `main`'s newest commit with it and starts `publish.yml` on the tag. It refuses a commit that's released already. A person can still push a tag by hand, which runs the same release. Nobody edits a version: the tag is the version, `publish.yml` writes it into its own copy of `package.json`, and the build writes that into the bundle. `version` in `package.json` on `main` is only what a copy run from source says.
 
 ### End to end
 

package/dist/cli.js

@@ -49,14 +49,14 @@ var require_picocolors = __commonJS({
     var argv = p.argv || [];
     var env = p.env || {};
     var isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env.TERM !== "dumb" || !!env.CI);
-    var formatter = (open3, close, replace = open3) => (input2) => {
+    var formatter = (open3, close, replace2 = open3) => (input2) => {
       let string4 = "" + input2, index = string4.indexOf(close, open3.length);
-      return ~index ? open3 + replaceClose(string4, close, replace, index) + close : open3 + string4 + close;
+      return ~index ? open3 + replaceClose(string4, close, replace2, index) + close : open3 + string4 + close;
     };
-    var replaceClose = (string4, close, replace, index) => {
+    var replaceClose = (string4, close, replace2, index) => {
       let result = "", cursor = 0;
       do {
-        result += string4.substring(cursor, index) + replace;
+        result += string4.substring(cursor, index) + replace2;
         cursor = index + close.length;
         index = string4.indexOf(close, cursor);
       } while (~index);
@@ -172,7 +172,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = true ? "0.1.0" : JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+    VERSION = true ? "0.1.1" : JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
   }
 });
 
@@ -39734,6 +39734,62 @@ init_errors();
 import { spawn } from "node:child_process";
 import { resolve } from "node:path";
 init_errors();
+
+// src/install.ts
+import { existsSync, realpathSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname as dirname2, join as join2, sep } from "node:path";
+var require2 = createRequire(import.meta.url);
+function seaApi() {
+  try {
+    return require2("node:sea");
+  } catch {
+    return null;
+  }
+}
+var sea = seaApi();
+var isExecutable = sea?.isSea() ?? false;
+function embeddedText(key) {
+  if (!sea || !isExecutable) throw new Error(`pch isn't an executable, so ${key} isn't in it.`);
+  return sea.getAsset(key, "utf8");
+}
+function installKind(script = process.argv[1], versions = process.versions, executable = isExecutable) {
+  if (executable) return "executable";
+  if (versions.electron) return "desktop";
+  let path2 = script ?? "";
+  try {
+    path2 = realpathSync(path2);
+  } catch {
+  }
+  const parts = path2.split(/[\\/]/);
+  const at = parts.lastIndexOf("node_modules");
+  if (at < 0 || parts[at + 1] !== "@patchgg" || parts[at + 2] !== "cli") return "other";
+  if (/[\\/]pnpm[\\/]global[\\/]/.test(path2)) return "pnpm";
+  const owner = parts.slice(0, at).join(sep);
+  return existsSync(join2(owner || sep, "package.json")) ? "other" : "npm";
+}
+function updateCommand(kind) {
+  if (kind === "executable") return "pch update";
+  if (kind === "npm") return "npm install -g @patchgg/cli";
+  if (kind === "pnpm") return "pnpm add -g @patchgg/cli";
+  return null;
+}
+function executableName(platform = process.platform, arch = process.arch) {
+  const os = { linux: "linux", darwin: "macos", win32: "windows" }[platform];
+  if (!os || arch !== "x64" && arch !== "arm64") return null;
+  return `pch-${os}-${arch}${os === "windows" ? ".exe" : ""}`;
+}
+var CDNS = {
+  production: "https://cdn.patch.gg",
+  staging: "https://cdn-staging.patch.gg",
+  local: null
+};
+function releasesUrl(env, vars = process.env) {
+  const base = vars.PCH_CDN_URL ?? CDNS[env];
+  return base ? `${base.replace(/\/+$/, "")}/cli` : null;
+}
+
+// src/git.ts
 function runGit(args2, options = {}) {
   return new Promise((done, fail) => {
     const child = spawn("git", args2, {
@@ -39813,7 +39869,7 @@ function gitFailed(args2, result, advice = "") {
   );
 }
 var helperKey = (url2) => `credential.${url2}.helper`;
-var PCH_GONE = "pch isn't where it was, so git can't sign in to Patch. Install it again with npm i -g @patchgg/cli, then run pch login.";
+var PCH_GONE = `pch isn't where it was, so git can't sign in to Patch. Install it again with ${isExecutable ? "the installer at https://docs.patch.gg/cli" : "npm i -g @patchgg/cli"}, then run pch login.`;
 function helperCommand({ config: config2, target }) {
   const usesToken = Boolean(process.env.PCH_TOKEN);
   const vars = {
@@ -39827,10 +39883,11 @@ function helperCommand({ config: config2, target }) {
     ELECTRON_RUN_AS_NODE: process.env.ELECTRON_RUN_AS_NODE
   };
   const settings = Object.entries(vars).filter(([, value]) => value).map(([name, value]) => `export ${name}=${shellQuote(value)}; `).join("");
-  const node2 = shellQuote(process.execPath);
-  const script = shellQuote(process.argv[1]);
-  const here = [node2, ...nodeFlags().map(shellQuote), script].join(" ");
-  return `!f() { ${settings}if [ -x ${node2} ] && [ -e ${script} ]; then ${here} git-credential "$1"; elif command -v pch >/dev/null; then pch git-credential "$1"; else echo "${PCH_GONE}" >&2; fi; }; f`;
+  const program3 = shellQuote(process.execPath);
+  const script = isExecutable ? null : shellQuote(process.argv[1]);
+  const here = script ? [program3, ...nodeFlags().map(shellQuote), script].join(" ") : program3;
+  const there = script ? `[ -x ${program3} ] && [ -e ${script} ]` : `[ -x ${program3} ]`;
+  return `!f() { ${settings}if ${there}; then ${here} git-credential "$1"; elif command -v pch >/dev/null; then pch git-credential "$1"; else echo "${PCH_GONE}" >&2; fi; }; f`;
 }
 function nodeFlags() {
   return process.execArgv.map(
@@ -40308,7 +40365,7 @@ async function tokenRevoke(ctx, id) {
 var import_picocolors5 = __toESM(require_picocolors(), 1);
 import { constants } from "node:fs";
 import { access as access2, copyFile, lstat, mkdir as mkdir2, readdir as readdir2, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
-import { basename, dirname as dirname2, extname, join as join4, resolve as resolve4 } from "node:path";
+import { basename, dirname as dirname3, extname, join as join5, resolve as resolve4 } from "node:path";
 import { createInterface } from "node:readline";
 
 // src/project-files.ts
@@ -40316,7 +40373,7 @@ var import_semver = __toESM(require_semver2(), 1);
 import { createHash } from "node:crypto";
 import { createReadStream } from "node:fs";
 import { readdir, readFile as readFile2, stat } from "node:fs/promises";
-import { join as join2, relative, resolve as resolve2, sep } from "node:path";
+import { join as join3, relative, resolve as resolve2, sep as sep2 } from "node:path";
 
 // node_modules/.pnpm/zod@4.6.7/node_modules/zod/index.js
 init_external();
@@ -42085,7 +42142,7 @@ var projectFileSchema = external_exports.object({
 var usage = (code, message, details) => new CliError(EXIT.usage, code, message, details);
 async function loadProject(dir) {
   const root = resolve2(dir);
-  const path2 = join2(root, "patch.json");
+  const path2 = join3(root, "patch.json");
   let text;
   try {
     text = await readFile2(path2, "utf8");
@@ -42129,11 +42186,11 @@ async function loadProject(dir) {
     );
   }
   const paths = (await listFiles(filesRoot)).filter(
-    (name) => join2(filesRoot, name) !== path2 && !(filesRoot === root && (name === BRIEF_FILE || name.startsWith(`${BRIEF_FOLDER}/`)))
+    (name) => join3(filesRoot, name) !== path2 && !(filesRoot === root && (name === BRIEF_FILE || name.startsWith(`${BRIEF_FOLDER}/`)))
   );
   const files = [];
   for (const name of paths) {
-    const absolute = join2(filesRoot, ...name.split("/"));
+    const absolute = join3(filesRoot, ...name.split("/"));
     files.push({ path: name, absolute, ...await hashFile(absolute) });
   }
   return {
@@ -42179,11 +42236,11 @@ async function listFiles(root) {
   const found = [];
   async function walk(dir) {
     for (const entry of await readdir(dir, { withFileTypes: true })) {
-      const absolute = join2(dir, entry.name);
+      const absolute = join3(dir, entry.name);
       if (entry.isDirectory()) {
         if (!SKIPPED_DIRS.has(entry.name)) await walk(absolute);
       } else if (entry.isFile() && !SKIPPED_FILES.has(entry.name)) {
-        found.push(relative(root, absolute).split(sep).join("/"));
+        found.push(relative(root, absolute).split(sep2).join("/"));
       }
     }
   }
@@ -42204,7 +42261,7 @@ function hashFile(path2) {
 // src/commands/agent-guide.ts
 var import_picocolors4 = __toESM(require_picocolors(), 1);
 import { access, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join3, resolve as resolve3 } from "node:path";
+import { join as join4, resolve as resolve3 } from "node:path";
 
 // src/starter.ts
 var AGENT_GUIDE = `# Working on this project
@@ -42332,11 +42389,11 @@ Thumbs.db
 
 // src/commands/agent-guide.ts
 var AGENT_GUIDE_FILE = "AGENTS.md";
-var GUIDES = [AGENT_GUIDE_FILE, "CLAUDE.md", join3(".claude", "CLAUDE.md")];
+var GUIDES = [AGENT_GUIDE_FILE, "CLAUDE.md", join4(".claude", "CLAUDE.md")];
 async function agentGuidesIn(root) {
   const found = [];
   for (const name of GUIDES) {
-    const there = await access(join3(root, name)).then(
+    const there = await access(join4(root, name)).then(
       () => true,
       () => false
     );
@@ -42349,18 +42406,18 @@ async function agentGuideIn(root) {
 }
 async function writeAgentGuide(root) {
   const own2 = await agentGuideIn(root);
-  if (!own2) await writeFile2(join3(root, AGENT_GUIDE_FILE), AGENT_GUIDE);
+  if (!own2) await writeFile2(join4(root, AGENT_GUIDE_FILE), AGENT_GUIDE);
   return { name: own2 ?? AGENT_GUIDE_FILE, written: !own2 };
 }
 async function agentGuide(ctx, dir) {
   const root = resolve3(dir);
   const { name, written } = await writeAgentGuide(root);
-  ctx.out.result({ path: join3(root, name), written }, () => {
+  ctx.out.result({ path: join4(root, name), written }, () => {
     if (written) {
-      ctx.out.line(`Wrote ${import_picocolors4.default.bold(join3(root, name))}, for coding agents working in this folder.`);
+      ctx.out.line(`Wrote ${import_picocolors4.default.bold(join4(root, name))}, for coding agents working in this folder.`);
       ctx.out.line(import_picocolors4.default.dim("Commit it: in a clone, pch publish refuses files that aren't."));
     } else {
-      ctx.out.line(`${join3(root, name)} is this folder's guide for agents, so it's left as it is.`);
+      ctx.out.line(`${join4(root, name)} is this folder's guide for agents, so it's left as it is.`);
       ctx.out.line(
         import_picocolors4.default.dim("pch guide has how to run, check and publish, to add to it if it helps.")
       );
@@ -42413,7 +42470,7 @@ ${shown.join("\n")}
 ${said2.join("\n")}` : null;
 }
 async function gatherPictures(root, named, say) {
-  const folder = join4(root, BRIEF_FOLDER);
+  const folder = join5(root, BRIEF_FOLDER);
   for (const path2 of named) {
     const from = resolve4(path2.trim().replace(/^["']|["']$/g, ""));
     const found = await lstat(from).catch(() => null);
@@ -42421,7 +42478,7 @@ async function gatherPictures(root, named, say) {
       say(`Left out ${path2}: pch takes a PNG, JPEG, GIF or WebP file it can read.`);
       continue;
     }
-    if (dirname2(from) === folder) continue;
+    if (dirname3(from) === folder) continue;
     await mkdir2(folder, { recursive: true });
     await copyAside(from, folder);
   }
@@ -42433,7 +42490,7 @@ async function copyAside(from, folder) {
   const stem = basename(from, extension);
   for (let number4 = 1; ; number4++) {
     const name = number4 === 1 ? `${stem}${extension}` : `${stem}-${number4}${extension}`;
-    const copied = await copyFile(from, join4(folder, name), constants.COPYFILE_EXCL).then(
+    const copied = await copyFile(from, join5(folder, name), constants.COPYFILE_EXCL).then(
       () => true,
       (error62) => {
         if (error62.code === "EEXIST") return false;
@@ -42457,7 +42514,7 @@ async function fromTerminal(ctx) {
 }
 async function agentBrief(ctx, dir) {
   const root = resolve4(dir);
-  const path2 = join4(root, BRIEF_FILE);
+  const path2 = join5(root, BRIEF_FILE);
   const there = await access2(path2).then(
     () => true,
     () => false
@@ -42507,7 +42564,7 @@ async function agentBrief(ctx, dir) {
 async function guidesNotNaming(root) {
   const silent = [];
   for (const name of await agentGuidesIn(root)) {
-    const text = await readFile3(join4(root, name), "utf8").catch(() => "");
+    const text = await readFile3(join5(root, name), "utf8").catch(() => "");
     if (!text.includes(BRIEF_FILE)) silent.push(name);
   }
   return silent;
@@ -42517,10 +42574,10 @@ async function guidesNotNaming(root) {
 var import_picocolors6 = __toESM(require_picocolors(), 1);
 init_errors();
 import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync as existsSync2 } from "node:fs";
 import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile4 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import { delimiter, dirname as dirname3, join as join5, resolve as resolve5 } from "node:path";
+import { delimiter, dirname as dirname4, join as join6, resolve as resolve5 } from "node:path";
 var AGENT_IDS = ["claude", "codex", "cursor"];
 var AGENT_NAMES = {
   claude: "Claude Code",
@@ -42617,7 +42674,7 @@ async function installCursor(server) {
     ...settings.mcpServers,
     [server.name]: { command: server.command, args: server.args }
   };
-  await mkdir3(dirname3(path2), { recursive: true });
+  await mkdir3(dirname4(path2), { recursive: true });
   await writeFile4(path2, `${JSON.stringify(settings, null, 2)}
 `);
   return { agent: "cursor", state: had ? "updated" : "added", where: path2 };
@@ -42636,7 +42693,7 @@ function mcpServer({ target }, options = {}, found = {}) {
   return {
     name,
     command: process.execPath,
-    args: [...process.execArgv, resolve5(process.argv[1]), ...flags]
+    args: isExecutable ? flags : [...process.execArgv, resolve5(process.argv[1]), ...flags]
   };
 }
 function commandLine(server) {
@@ -42657,7 +42714,7 @@ function pchLogin({ target }) {
 }
 function isHere(agent2) {
   if (onPath(agent2)) return true;
-  if (agent2 === "cursor") return existsSync(join5(homedir2(), ".cursor"));
+  if (agent2 === "cursor") return existsSync2(join6(homedir2(), ".cursor"));
   return false;
 }
 function codexHas(server) {
@@ -42666,7 +42723,7 @@ function codexHas(server) {
 }
 function onPath(bin) {
   const names = process.platform === "win32" ? [`${bin}.cmd`, `${bin}.exe`, `${bin}.bat`, bin] : [bin];
-  return (process.env.PATH ?? "").split(delimiter).some((folder) => folder && names.some((name) => existsSync(join5(folder, name))));
+  return (process.env.PATH ?? "").split(delimiter).some((folder) => folder && names.some((name) => existsSync2(join6(folder, name))));
 }
 function run(bin, args2) {
   const shell = process.platform === "win32";
@@ -42678,7 +42735,7 @@ function run(bin, args2) {
 var import_picocolors7 = __toESM(require_picocolors(), 1);
 import { createHash as createHash2 } from "node:crypto";
 import { mkdir as mkdir4, readFile as readFile5, stat as stat2, writeFile as writeFile5 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname4, extname as extname2, isAbsolute, join as join6, relative as relative2, resolve as resolve6, sep as sep2 } from "node:path";
+import { basename as basename2, dirname as dirname5, extname as extname2, isAbsolute, join as join7, relative as relative2, resolve as resolve6, sep as sep3 } from "node:path";
 import { setTimeout as sleep2 } from "node:timers/promises";
 init_errors();
 var DEFAULT_WAIT_SECONDS = 300;
@@ -42784,7 +42841,7 @@ async function assetsAdd(ctx, ids, options) {
       saved.push(path2);
     }
     if (!saved.length) continue;
-    const holds = saved.length === 1 ? saved[0] : dirname4(saved[0]);
+    const holds = saved.length === 1 ? saved[0] : dirname5(saved[0]);
     credits.push({
       files: creditedFiles(holds, saved.length > 1, project2?.filesRoot ?? process.cwd()),
       license: item.license.spdx,
@@ -42871,7 +42928,7 @@ function placeInFolder(item, file2, taken) {
   taken.add(path2);
   return path2;
 }
-var forwardSlashes = (path2) => path2.split(sep2).join("/");
+var forwardSlashes = (path2) => path2.split(sep3).join("/");
 var fromHere = (path2) => forwardSlashes(relative2(process.cwd(), path2));
 function creditedFiles(path2, folder, filesRoot) {
   const inRelease = relative2(filesRoot, path2);
@@ -42881,15 +42938,15 @@ function creditedFiles(path2, folder, filesRoot) {
 }
 async function projectFileFor(root) {
   const here = process.cwd();
-  for (let dir = root; ; dir = dirname4(dir)) {
-    const path2 = join6(dir, "patch.json");
+  for (let dir = root; ; dir = dirname5(dir)) {
+    const path2 = join7(dir, "patch.json");
     if (await stat2(path2).catch(() => null)) {
       const contents = await readJson(path2);
       if (!contents) return null;
       const files = typeof contents.files === "string" ? contents.files : ".";
       return { path: path2, filesRoot: resolve6(dir, files), contents };
     }
-    if (dir === here || relative2(here, dir).startsWith("..") || dir === dirname4(dir)) return null;
+    if (dir === here || relative2(here, dir).startsWith("..") || dir === dirname5(dir)) return null;
   }
 }
 async function readJson(path2) {
@@ -42909,7 +42966,7 @@ async function addToCreditsFile(path2, lines) {
 async function addToRecipe(project2, credits) {
   const { recipe } = project2.contents;
   const inFile = typeof recipe === "string";
-  const path2 = inFile ? resolve6(dirname4(project2.path), recipe) : project2.path;
+  const path2 = inFile ? resolve6(dirname5(project2.path), recipe) : project2.path;
   const held = inFile ? await readJson(path2) : recipe ?? {};
   if (!held || held.credits !== void 0 && !Array.isArray(held.credits)) return null;
   const before = held.credits ?? [];
@@ -42922,14 +42979,14 @@ async function addToRecipe(project2, credits) {
 }
 function inside(root, relative3) {
   const path2 = resolve6(root, relative3);
-  if (!path2.startsWith(root + sep2)) {
+  if (!path2.startsWith(root + sep3)) {
     throw new CliError(EXIT.error, "asset_path_invalid", `${relative3} isn't inside ${root}.`);
   }
   return path2;
 }
 async function writeInside(root, relative3, contents) {
   const path2 = inside(root, relative3);
-  await mkdir4(dirname4(path2), { recursive: true });
+  await mkdir4(dirname5(path2), { recursive: true });
   await writeFile5(path2, contents);
 }
 async function download(url2) {
@@ -42951,7 +43008,7 @@ async function saveChecked(url2, path2, sha256) {
       `${url2} didn't download as Patch says it should: try again.`
     );
   }
-  await mkdir4(dirname4(path2), { recursive: true });
+  await mkdir4(dirname5(path2), { recursive: true });
   await writeFile5(path2, bytes);
 }
 
@@ -43454,8 +43511,8 @@ async function diffOf(ctx, project2, request) {
 }
 async function standing(ctx, project2, request) {
   const { diff, upToDate } = await diffOf(ctx, project2, request);
-  const update = upToDate === false ? await updateSteps(ctx, project2, request).catch(() => null) : null;
-  return { diff, fields: { up_to_date: upToDate, update } };
+  const update2 = upToDate === false ? await updateSteps(ctx, project2, request).catch(() => null) : null;
+  return { diff, fields: { up_to_date: upToDate, update: update2 } };
 }
 async function updateSteps(ctx, project2, request) {
   const repo = await unwrap(
@@ -43803,17 +43860,17 @@ async function changeRequestWithdraw(ctx, ref) {
 
 // src/commands/check.ts
 var import_picocolors10 = __toESM(require_picocolors(), 1);
-import { existsSync as existsSync3 } from "node:fs";
+import { existsSync as existsSync4 } from "node:fs";
 import { mkdir as mkdir6, mkdtemp as mkdtemp2 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { basename as basename3, join as join11, resolve as resolve8 } from "node:path";
+import { basename as basename3, join as join12, resolve as resolve8 } from "node:path";
 
 // src/check/browser.ts
 import { spawn as spawn3 } from "node:child_process";
-import { existsSync as existsSync2 } from "node:fs";
+import { existsSync as existsSync3 } from "node:fs";
 import { chmod as chmod2, mkdir as mkdir5, mkdtemp, rename, rm, writeFile as writeFile6 } from "node:fs/promises";
 import { tmpdir, userInfo } from "node:os";
-import { delimiter as delimiter2, dirname as dirname5, join as join7, resolve as resolve7, sep as sep3 } from "node:path";
+import { delimiter as delimiter2, dirname as dirname6, join as join8, resolve as resolve7, sep as sep4 } from "node:path";
 import { inflateRawSync } from "node:zlib";
 init_errors();
 var VERSIONS = "https://googlechromelabs.github.io/chrome-for-testing/last-known-good-versions-with-downloads.json";
@@ -43822,9 +43879,9 @@ function installedBrowsers(vars) {
   if (process.platform === "win32") {
     const places = [vars.ProgramFiles, vars["ProgramFiles(x86)"], vars.LOCALAPPDATA];
     return places.filter((place) => Boolean(place)).flatMap((place) => [
-      join7(place, "Google", "Chrome", "Application", "chrome.exe"),
-      join7(place, "Microsoft", "Edge", "Application", "msedge.exe"),
-      join7(place, "Chromium", "Application", "chrome.exe")
+      join8(place, "Google", "Chrome", "Application", "chrome.exe"),
+      join8(place, "Microsoft", "Edge", "Application", "msedge.exe"),
+      join8(place, "Chromium", "Application", "chrome.exe")
     ]);
   }
   if (process.platform === "darwin") {
@@ -43835,7 +43892,7 @@ function installedBrowsers(vars) {
     ];
   }
   const names = ["google-chrome", "google-chrome-stable", "chromium", "chromium-browser", "msedge"];
-  return (vars.PATH ?? "").split(delimiter2).filter(Boolean).flatMap((place) => names.map((name) => join7(place, name)));
+  return (vars.PATH ?? "").split(delimiter2).filter(Boolean).flatMap((place) => names.map((name) => join8(place, name)));
 }
 function downloadPlatform() {
   const { platform, arch } = process;
@@ -43844,8 +43901,8 @@ function downloadPlatform() {
   if (platform === "linux") return arch === "x64" ? "linux64" : null;
   return null;
 }
-var browsersFolder = () => join7(dirname5(configPath()), "browser");
-var shellFile = (platform) => join7(
+var browsersFolder = () => join8(dirname6(configPath()), "browser");
+var shellFile = (platform) => join8(
   browsersFolder(),
   platform,
   `chrome-headless-shell-${platform}`,
@@ -43853,16 +43910,16 @@ var shellFile = (platform) => join7(
 );
 function findBrowser(named, vars = process.env) {
   if (named) {
-    if (!existsSync2(named)) {
+    if (!existsSync3(named)) {
       throw new CliError(EXIT.usage, "browser_missing", `There's no browser at ${named}.`);
     }
     return { path: resolve7(named), headlessShell: /headless[-_]shell/i.test(named), from: "named" };
   }
-  const installed = installedBrowsers(vars).find((path2) => existsSync2(path2));
+  const installed = installedBrowsers(vars).find((path2) => existsSync3(path2));
   if (installed) return { path: installed, headlessShell: false, from: "this PC" };
   const platform = downloadPlatform();
   const shell = platform && shellFile(platform);
-  return shell && existsSync2(shell) ? { path: shell, headlessShell: true, from: "downloaded" } : null;
+  return shell && existsSync3(shell) ? { path: shell, headlessShell: true, from: "downloaded" } : null;
 }
 async function downloadBrowser(out) {
   const platform = downloadPlatform();
@@ -43873,7 +43930,7 @@ async function downloadBrowser(out) {
       `There's no browser on this PC, and none to download for ${process.platform} ${process.arch}. Install Chrome or Chromium, or name one with --browser.`
     );
   }
-  const folder = join7(browsersFolder(), platform);
+  const folder = join8(browsersFolder(), platform);
   const failed3 = (why) => new CliError(
     EXIT.error,
     "browser_download_failed",
@@ -43921,7 +43978,7 @@ async function downloadBrowser(out) {
   await rm(folder, { recursive: true, force: true });
   await rename(unpacking, folder);
   const shell = shellFile(platform);
-  if (!existsSync2(shell)) throw failed3("the download didn't hold what it should");
+  if (!existsSync3(shell)) throw failed3("the download didn't hold what it should");
   return { path: shell, headlessShell: true, from: "downloaded" };
 }
 async function unzip(zip, into) {
@@ -43943,14 +44000,14 @@ async function unzip(zip, into) {
     const name = zip.toString("utf8", at + 46, at + 46 + nameLength);
     at += 46 + nameLength + extraLength + commentLength;
     const target = resolve7(root, name);
-    if (!target.startsWith(root + sep3)) throw new Error(`a path leaves the zip: ${name}`);
+    if (!target.startsWith(root + sep4)) throw new Error(`a path leaves the zip: ${name}`);
     if (name.endsWith("/")) {
       await mkdir5(target, { recursive: true });
       continue;
     }
     const start = local + 30 + zip.readUInt16LE(local + 26) + zip.readUInt16LE(local + 28);
     const body = zip.subarray(start, start + packed);
-    await mkdir5(dirname5(target), { recursive: true });
+    await mkdir5(dirname6(target), { recursive: true });
     await writeFile6(target, method === 0 ? body : inflateRawSync(body));
     if (mode & 73) await chmod2(target, 493);
   }
@@ -44003,7 +44060,7 @@ var Browser = class _Browser {
     );
   }
   static async launch(found, sandboxOff) {
-    const profile = await mkdtemp(join7(tmpdir(), "pch-check-profile-"));
+    const profile = await mkdtemp(join8(tmpdir(), "pch-check-profile-"));
     const child = spawn3(
       found.path,
       [
@@ -44196,7 +44253,7 @@ async function checkModel(file2) {
 
 // src/check/play.ts
 import { writeFile as writeFile7 } from "node:fs/promises";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 import { setTimeout as wait } from "node:timers/promises";
 
 // src/check/pixels.ts
@@ -44284,7 +44341,7 @@ function changed(a, b) {
 import { createReadStream as createReadStream2 } from "node:fs";
 import { stat as stat3 } from "node:fs/promises";
 import { createServer } from "node:http";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 var GAME_HOST_HEADERS = {
   "Content-Security-Policy": [
     "default-src 'self'",
@@ -44393,7 +44450,7 @@ async function serveGame(root, files) {
       notFound();
       return;
     }
-    const absolute = join8(root, ...path2.split("/"));
+    const absolute = join9(root, ...path2.split("/"));
     const { type, encoding } = typeOf(path2);
     const html = type.startsWith("text/html");
     const headers = {
@@ -44700,7 +44757,7 @@ async function play(browser, options) {
     if (!shot) return null;
     const bytes = Buffer.from(shot.data, "base64");
     if (keep) {
-      const file2 = join9(options.out, name);
+      const file2 = join10(options.out, name);
       await writeFile7(file2, bytes);
       observed.screenshots.push(file2);
     }
@@ -44824,7 +44881,7 @@ async function readRendering(browser, origin) {
 
 // src/check/report.ts
 import { readFile as readFile8 } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 var NEEDS_GPU = /web ?gpu|web ?gl|graphics adapter|gpu adapter|no adapter/i;
 var seconds = (ms) => ms < 1e3 ? `${ms} ms` : `${(ms / 1e3).toFixed(ms < 1e4 ? 1 : 0)} s`;
 var limit = (ms) => `${ms / 1e3} s`;
@@ -44836,7 +44893,7 @@ async function pathsInText(root, files) {
   const byLowerCase = new Map(files.map((file2) => [file2.toLowerCase(), file2]));
   const found = [];
   for (const file2 of files.filter((name) => TEXT_FILES.test(name))) {
-    const text = await readFile8(join10(root, ...file2.split("/")), "utf8").catch(() => "");
+    const text = await readFile8(join11(root, ...file2.split("/")), "utf8").catch(() => "");
     if (!text || text.length > TEXT_LIMIT) continue;
     const folder = file2.includes("/") ? file2.slice(0, file2.lastIndexOf("/") + 1) : "";
     for (const [, written] of text.matchAll(PATH_IN_TEXT)) {
@@ -45027,7 +45084,7 @@ var LABELS = {
 var ADVICE = "This is advice: nothing here stops you publishing, and it doesn't judge what kind of game this is. Patch's own test runs in Patch Desktop: pch test start.";
 async function findGame(dir) {
   const root = resolve8(dir);
-  if (existsSync3(join11(root, "patch.json"))) {
+  if (existsSync4(join12(root, "patch.json"))) {
     const project2 = await loadProject(root);
     if (project2.recipe.mode !== "browser") {
       throw usage2(
@@ -45044,8 +45101,8 @@ async function findGame(dir) {
     };
   }
   for (const folder of ["", "dist", "build", "public", "out"]) {
-    if (existsSync3(join11(root, folder, "index.html"))) {
-      const here = join11(root, folder);
+    if (existsSync4(join12(root, folder, "index.html"))) {
+      const here = join12(root, folder);
       return { root: here, files: await listFiles(here), entry: "index.html", selfChecks: [] };
     }
   }
@@ -45072,9 +45129,9 @@ async function check2(ctx, dir, options) {
     );
   }
   const models = options.models === true ? await Promise.all(
-    game.files.filter((file2) => file2.toLowerCase().endsWith(".glb")).map((file2) => modelAt(join11(game.root, ...file2.split("/"))))
+    game.files.filter((file2) => file2.toLowerCase().endsWith(".glb")).map((file2) => modelAt(join12(game.root, ...file2.split("/"))))
   ) : [];
-  const folder = options.out ? resolve8(options.out) : await mkdtemp2(join11(tmpdir2(), `pch-check-${basename3(resolve8(dir))}-`));
+  const folder = options.out ? resolve8(options.out) : await mkdtemp2(join12(tmpdir2(), `pch-check-${basename3(resolve8(dir))}-`));
   await mkdir6(folder, { recursive: true });
   const found = findBrowser(options.browser) ?? await downloadBrowser(out);
   out.step(`Opening ${game.entry} from ${game.root}, muted, for ${seconds2} s or so`);
@@ -45217,7 +45274,7 @@ function printModels(ctx, models) {
 // src/commands/connect.ts
 var import_picocolors14 = __toESM(require_picocolors(), 1);
 import { readFile as readFile12, writeFile as writeFile10 } from "node:fs/promises";
-import { join as join14, resolve as resolve11 } from "node:path";
+import { join as join15, resolve as resolve11 } from "node:path";
 import { setTimeout as sleep5 } from "node:timers/promises";
 init_errors();
 
@@ -45265,7 +45322,7 @@ function sameName(a, b) {
 var import_picocolors13 = __toESM(require_picocolors(), 1);
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { mkdir as mkdir7, readdir as readdir3, readFile as readFile11, rm as rm2, writeFile as writeFile9 } from "node:fs/promises";
-import { join as join13, resolve as resolve10 } from "node:path";
+import { join as join14, resolve as resolve10 } from "node:path";
 import { setTimeout as sleep4 } from "node:timers/promises";
 init_errors();
 init_guide_words();
@@ -45307,7 +45364,7 @@ function unknownLicence(name) {
   );
 }
 async function licenceText(id, fill, texts = LICENCE_TEXTS) {
-  const text = await readFile9(new URL(`${id}.txt`, texts), "utf8");
+  const text = isExecutable && texts === LICENCE_TEXTS ? embeddedText(`licences/${id}.txt`) : await readFile9(new URL(`${id}.txt`, texts), "utf8");
   return text.replace(
     /^Copyright \(c\) <year> <(?:copyright holders|owner)>/m,
     `Copyright (c) ${fill.year} ${fill.holder}`
@@ -45442,7 +45499,7 @@ async function versionTaken(ctx, ref, failure2) {
 // src/commands/init.ts
 var import_picocolors11 = __toESM(require_picocolors(), 1);
 import { readFile as readFile10, stat as stat4, writeFile as writeFile8 } from "node:fs/promises";
-import { basename as basename4, join as join12, resolve as resolve9 } from "node:path";
+import { basename as basename4, join as join13, resolve as resolve9 } from "node:path";
 init_errors();
 init_guide_words();
 var FIRST_VERSION = "0.1.0";
@@ -45452,7 +45509,7 @@ function startingProjectFile(project2, version2 = FIRST_VERSION) {
 }
 async function init(ctx, dir, options) {
   const root = resolve9(dir);
-  const path2 = join12(root, "patch.json");
+  const path2 = join13(root, "patch.json");
   if (!options.force && await readFile10(path2, "utf8").catch(() => null) !== null) {
     throw new CliError(
       EXIT.conflict,
@@ -45462,7 +45519,7 @@ async function init(ctx, dir, options) {
   }
   const name = await projectFor(ctx, root, options.project);
   const files = options.files ?? await builtFolder(root);
-  const hasRecipe = await stat4(join12(root, "recipe.json")).then(
+  const hasRecipe = await stat4(join13(root, "recipe.json")).then(
     () => true,
     () => false
   );
@@ -45485,7 +45542,7 @@ async function init(ctx, dir, options) {
     "pch validate",
     "pch publish"
   ];
-  const agentGuide2 = { path: join12(root, guide2.name), written: guide2.written };
+  const agentGuide2 = { path: join13(root, guide2.name), written: guide2.written };
   const result = { path: path2, ...contents, on_patch: onPatch2, agent_guide: agentGuide2 };
   ctx.out.result({ ...result, next, look_first: LOOK_FIRST }, () => {
     ctx.out.line(`Wrote ${import_picocolors11.default.bold(path2)} for ${import_picocolors11.default.bold(name)}.`);
@@ -45527,9 +45584,9 @@ async function builtFolder(root) {
     (found) => found.isFile(),
     () => false
   );
-  if (await isFile(join12(root, "index.html"))) return void 0;
+  if (await isFile(join13(root, "index.html"))) return void 0;
   for (const folder of ["dist", "build", "public", "out"]) {
-    if (await isFile(join12(root, folder, "index.html"))) return folder;
+    if (await isFile(join13(root, folder, "index.html"))) return folder;
   }
   return void 0;
 }
@@ -45775,7 +45832,7 @@ async function newRepo(ctx, ref, dir, options) {
       lfs,
       url: url2,
       look_first: LOOK_FIRST,
-      agent_guide: { path: join13(folder, AGENT_GUIDE_FILE), written: true },
+      agent_guide: { path: join14(folder, AGENT_GUIDE_FILE), written: true },
       commits_as: commitsAs,
       ...options.visibility === "private" ? { who_can_see: PRIVATE_REPO } : {}
     },
@@ -45815,14 +45872,14 @@ async function clearFolder(folder, keepIt) {
   if (!keepIt) return rm2(folder, { recursive: true, force: true });
   const entries = await readdir3(folder).catch(() => []);
   await Promise.all(
-    entries.map((entry) => rm2(join13(folder, entry), { recursive: true, force: true }))
+    entries.map((entry) => rm2(join14(folder, entry), { recursive: true, force: true }))
   );
 }
 async function firstCommit(ctx, folder, name, files) {
   await mkdir7(folder, { recursive: true });
   await mustGit(["init", "-q", "-b", FIRST_BRANCH], { cwd: folder });
   const commitsAs = await commitAsYourHandle(ctx, folder);
-  for (const [path2, text] of Object.entries(files)) await writeFile9(join13(folder, path2), text);
+  for (const [path2, text] of Object.entries(files)) await writeFile9(join14(folder, path2), text);
   const lfs = await hasLfs();
   if (!lfs) ctx.out.step(NO_LFS);
   else if (!await lfsSetUp()) await setUpLfsHere(ctx, folder);
@@ -46200,7 +46257,7 @@ async function originOnGithub(ctx, dir) {
   );
 }
 async function readManifest(dir) {
-  const path2 = join14(dir, "patch.json");
+  const path2 = join15(dir, "patch.json");
   let text;
   try {
     text = await readFile12(path2, "utf8");
@@ -46596,7 +46653,7 @@ async function nameInManifest(manifest, project2) {
 // src/commands/covers.ts
 var import_picocolors15 = __toESM(require_picocolors(), 1);
 import { mkdir as mkdir8, readFile as readFile13, writeFile as writeFile11 } from "node:fs/promises";
-import { basename as basename5, extname as extname3, join as join15, resolve as resolve12 } from "node:path";
+import { basename as basename5, extname as extname3, join as join16, resolve as resolve12 } from "node:path";
 import { setTimeout as sleep7 } from "node:timers/promises";
 init_errors();
 
@@ -46817,13 +46874,13 @@ async function follow2(ctx, project2, job, wait2) {
 async function save(ctx, job, folder) {
   const ready = job.takes.filter((take) => take.state === "ready" && take.url);
   if (!ready.length || folder === void 0) return [];
-  const dir = resolve12(folder || join15("covers", job.id));
+  const dir = resolve12(folder || join16("covers", job.id));
   await mkdir8(dir, { recursive: true });
   ctx.out.step(`Saving ${ready.length} take${ready.length === 1 ? "" : "s"} to ${dir}`);
   const saved = [];
   for (const take of ready) {
-    const file2 = join15(dir, `${take.shape}-${take.id}.jpg`);
-    const preview = join15(dir, `${take.shape}-${take.id}-card.jpg`);
+    const file2 = join16(dir, `${take.shape}-${take.id}.jpg`);
+    const preview = join16(dir, `${take.shape}-${take.id}-card.jpg`);
     for (const [url2, path2] of [
       [take.url, file2],
       [take.preview_url, preview]
@@ -46941,7 +46998,7 @@ function outFolder(out, byDefault) {
 // src/commands/git.ts
 var import_picocolors16 = __toESM(require_picocolors(), 1);
 import { stat as stat5 } from "node:fs/promises";
-import { basename as basename6, join as join16, resolve as resolve13 } from "node:path";
+import { basename as basename6, join as join17, resolve as resolve13 } from "node:path";
 
 // src/direct-push.ts
 init_errors();
@@ -47706,7 +47763,7 @@ async function clone2(ctx, ref, dir) {
   if (lfsForThisOne) await setUpLfsHere(ctx, into);
   const commitsAs = target.token ? await commitAsYourHandle(ctx, into) : null;
   const guide2 = await agentGuideIn(into);
-  const brief = await stat5(join16(into, BRIEF_FILE)).then(
+  const brief = await stat5(join17(into, BRIEF_FILE)).then(
     (found) => found.isFile(),
     () => false
   );
@@ -48286,7 +48343,7 @@ var import_picocolors19 = __toESM(require_picocolors(), 1);
 import { createHash as createHash3 } from "node:crypto";
 import { mkdir as mkdir9, mkdtemp as mkdtemp3, writeFile as writeFile12 } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join17, resolve as resolve15 } from "node:path";
+import { join as join18, resolve as resolve15 } from "node:path";
 import { setTimeout as sleep9 } from "node:timers/promises";
 init_errors();
 var HOLD_SECONDS = 50;
@@ -48467,7 +48524,7 @@ async function testFootage(ctx, ref, options) {
   );
   const sheets = data.length ? await saveSheets(
     data,
-    options.out ? resolve15(options.out) : await mkdtemp3(join17(tmpdir3(), "pch-footage-"))
+    options.out ? resolve15(options.out) : await mkdtemp3(join18(tmpdir3(), "pch-footage-"))
   ) : [];
   const next = data.length ? reviewCommand(name) : nextStep(name, "testing", test2).command;
   out.result({ test: test2.id, state: test2.state, data: sheets, next }, () => {
@@ -48500,7 +48557,7 @@ async function saveSheets(sheets, folder) {
         `Run ${sheet.run}'s sheet ${sheet.index} didn't download intact. Try again.`
       );
     }
-    const path2 = join17(folder, `run-${sheet.run}-sheet-${sheet.index}.jpg`);
+    const path2 = join18(folder, `run-${sheet.run}-sheet-${sheet.index}.jpg`);
     await writeFile12(path2, bytes);
     const { url: _url2, ...kept } = sheet;
     saved.push({ ...kept, path: path2 });
@@ -48652,8 +48709,204 @@ async function categories(ctx, options) {
   });
 }
 
-// src/commands/validate.ts
+// src/commands/update.ts
 var import_picocolors21 = __toESM(require_picocolors(), 1);
+var import_semver3 = __toESM(require_semver2(), 1);
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { createHash as createHash4 } from "node:crypto";
+import { mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { chmod as chmod3, rename as rename2, rm as rm3, writeFile as writeFile13 } from "node:fs/promises";
+import { basename as basename8, dirname as dirname7, join as join19 } from "node:path";
+import { gunzipSync } from "node:zlib";
+init_errors();
+init_version();
+var DAY = 24 * 60 * 60 * 1e3;
+var QUIET = /* @__PURE__ */ new Set(["mcp", "git-credential", "update"]);
+async function latestVersion2(releases, signal) {
+  const response = await fetch(`${releases}/latest.json`, { signal });
+  if (!response.ok) throw new Error(`${releases}/latest.json answered ${response.status}`);
+  const { version: version2 } = await response.json();
+  if (typeof version2 !== "string" || !import_semver3.default.valid(version2)) {
+    throw new Error(`${releases}/latest.json names no version`);
+  }
+  return version2;
+}
+function parseSums(text) {
+  const sums = /* @__PURE__ */ new Map();
+  for (const line of text.split(/\r?\n/)) {
+    const match = /^([0-9a-f]{64}) [ *](.+)$/i.exec(line.trim());
+    if (match) sums.set(match[2], match[1].toLowerCase());
+  }
+  return sums;
+}
+function notReplaceable(kind) {
+  const command = updateCommand(kind);
+  if (kind === "desktop")
+    return { command, message: "This pch came with Patch Desktop, and updates with it." };
+  if (command)
+    return {
+      command,
+      message: `This pch was installed with ${kind}. To update it, run: ${command}`
+    };
+  return {
+    command,
+    message: `This pch runs from ${process.argv[1]}, which pch update doesn't manage. Update it the way you installed it.`
+  };
+}
+async function download2(url2) {
+  const response = await fetch(url2, { signal: AbortSignal.timeout(10 * 6e4) }).catch(
+    (error62) => {
+      throw new CliError(
+        EXIT.error,
+        "download_failed",
+        `Couldn't download ${url2}: ${error62.message}`
+      );
+    }
+  );
+  if (!response.ok) {
+    throw new CliError(EXIT.error, "download_failed", `${url2} answered ${response.status}.`);
+  }
+  return Buffer.from(await response.arrayBuffer());
+}
+async function update(ctx) {
+  const kind = installKind();
+  if (kind !== "executable") {
+    const { command, message } = notReplaceable(kind);
+    ctx.out.result(
+      { version: VERSION, install: kind, updated: false, command },
+      () => ctx.out.line(message)
+    );
+    return EXIT.ok;
+  }
+  const releases = releasesUrl(ctx.target.env);
+  const name = executableName();
+  if (!releases || !name) {
+    throw new CliError(
+      EXIT.usage,
+      "no_releases",
+      releases ? `There's no pch executable for ${process.platform} ${process.arch}.` : `${ctx.target.env} has no releases of pch to update from.`
+    );
+  }
+  ctx.out.step("Looking for a newer pch");
+  const latest2 = await latestVersion2(releases, AbortSignal.timeout(15e3)).catch(
+    (error62) => {
+      throw new CliError(
+        EXIT.error,
+        "download_failed",
+        `Couldn't check for a newer pch: ${error62.message}`
+      );
+    }
+  );
+  if (!import_semver3.default.gt(latest2, VERSION)) {
+    ctx.out.result(
+      { version: VERSION, latest: latest2, install: kind, updated: false },
+      () => ctx.out.line(`pch ${VERSION} is the newest.`)
+    );
+    return EXIT.ok;
+  }
+  const file2 = `${name}.gz`;
+  ctx.out.step(`Downloading pch ${latest2}`);
+  const [sums, packed] = await Promise.all([
+    download2(`${releases}/${latest2}/SHA256SUMS`),
+    download2(`${releases}/${latest2}/${file2}`)
+  ]);
+  const expected = parseSums(sums.toString("utf8")).get(file2);
+  const actual = createHash4("sha256").update(packed).digest("hex");
+  if (!expected || expected !== actual) {
+    throw new CliError(
+      EXIT.error,
+      "checksum_mismatch",
+      `pch ${latest2} for this machine doesn't match its SHA-256, so it wasn't installed.`,
+      { file: file2, expected: expected ?? null, actual }
+    );
+  }
+  const target = process.execPath;
+  const fresh = `${target}.new`;
+  await writeFile13(fresh, gunzipSync(packed), { mode: 493 });
+  await chmod3(fresh, 493);
+  const said2 = spawnSync2(fresh, ["--version"], { encoding: "utf8", timeout: 6e4 });
+  if (said2.status !== 0 || said2.stdout.trim() !== latest2) {
+    await rm3(fresh, { force: true });
+    throw new CliError(
+      EXIT.error,
+      "update_failed",
+      `pch ${latest2} didn't start on this machine, so pch ${VERSION} stays.`,
+      { stderr: (said2.stderr ?? said2.error?.message ?? "").trim().slice(-2e3) }
+    );
+  }
+  await replace(target, fresh);
+  ctx.out.result(
+    { version: latest2, previous: VERSION, install: kind, updated: true },
+    () => ctx.out.line(`Updated pch from ${VERSION} to ${latest2}.`)
+  );
+  return EXIT.ok;
+}
+async function replace(target, fresh) {
+  if (process.platform !== "win32") return rename2(fresh, target);
+  const old = `${target}.${process.pid}.old`;
+  await rename2(target, old);
+  try {
+    await rename2(fresh, target);
+  } catch (error62) {
+    await rename2(old, target);
+    throw error62;
+  }
+}
+function removeOldExecutables(target = process.execPath) {
+  if (!isExecutable || process.platform !== "win32") return;
+  const folder = dirname7(target);
+  const old = new RegExp(`^${basename8(target).replace(/\./g, "\\.")}\\.\\d+\\.old$`, "i");
+  try {
+    for (const name of readdirSync(folder)) {
+      if (old.test(name)) rmSync(join19(folder, name), { force: true });
+    }
+  } catch {
+  }
+}
+function startUpdateNotice(ctx, command, now = Date.now()) {
+  const how = updateCommand(installKind());
+  const releases = releasesUrl(ctx.target.env);
+  if (!how || !releases || ctx.out.json || QUIET.has(command)) return null;
+  if (!process.stderr.isTTY || process.env.CI) return null;
+  const stamp = join19(dirname7(configPath()), "update-check.json");
+  try {
+    const { checked_at } = JSON.parse(readFileSync(stamp, "utf8"));
+    if (checked_at && now - Date.parse(checked_at) < DAY) return null;
+  } catch {
+  }
+  try {
+    mkdirSync(dirname7(stamp), { recursive: true, mode: 448 });
+    writeFileSync(stamp, `${JSON.stringify({ checked_at: new Date(now).toISOString() })}
+`);
+  } catch {
+    return null;
+  }
+  const stop = new AbortController();
+  const giveUp = setTimeout(() => stop.abort(), 2e3);
+  giveUp.unref();
+  const latest2 = latestVersion2(releases, stop.signal).catch(() => null).finally(() => clearTimeout(giveUp));
+  return {
+    async show() {
+      let timer;
+      const late = new Promise((done) => {
+        timer = setTimeout(() => done(null), 500);
+      });
+      const version2 = await Promise.race([latest2, late]);
+      clearTimeout(timer);
+      stop.abort();
+      if (version2 && import_semver3.default.gt(version2, VERSION)) {
+        process.stderr.write(
+          `
+${import_picocolors21.default.dim("\u203A")} pch ${version2} is out (you have ${VERSION}). To update, run: ${how}
+`
+        );
+      }
+    }
+  };
+}
+
+// src/commands/validate.ts
+var import_picocolors22 = __toESM(require_picocolors(), 1);
 init_errors();
 async function validate2(ctx, dir) {
   const project2 = await loadProject(dir);
@@ -48712,12 +48965,12 @@ async function validate2(ctx, dir) {
     notes
   };
   ctx.out.result(result, () => {
-    const mark = result.ok ? import_picocolors21.default.green("\u2713") : import_picocolors21.default.red("\u2717");
+    const mark = result.ok ? import_picocolors22.default.green("\u2713") : import_picocolors22.default.red("\u2717");
     ctx.out.line(
       `${mark} ${file2.project}@${file2.version} \xB7 ${project2.kind} \xB7 ${result.trust_tier} \xB7 ${project2.files.length} files, ${formatSize(total)}`
     );
-    for (const issue2 of issues) ctx.out.line(`  ${import_picocolors21.default.red(issue2.path || "\xB7")} ${issue2.message}`);
-    for (const note2 of notes) ctx.out.line(`  ${import_picocolors21.default.dim(note2)}`);
+    for (const issue2 of issues) ctx.out.line(`  ${import_picocolors22.default.red(issue2.path || "\xB7")} ${issue2.message}`);
+    for (const note2 of notes) ctx.out.line(`  ${import_picocolors22.default.dim(note2)}`);
   });
   return result.ok ? EXIT.ok : EXIT.usage;
 }
@@ -48768,21 +49021,32 @@ function action(run3) {
   return async (...args2) => {
     const command = args2.at(-1);
     const globals = command.optsWithGlobals();
+    let notice = null;
     try {
       const ctx = await createContext(globals);
+      notice = startUpdateNotice(ctx, topLevel(command).name());
       const code = await run3(ctx, ...args2.slice(0, -1));
       process.exitCode = typeof code === "number" ? code : EXIT.ok;
     } catch (error62) {
       process.exitCode = new Output(Boolean(globals.json)).error(error62);
     }
+    await notice?.show();
   };
 }
+function topLevel(command) {
+  let top = command;
+  while (top.parent?.parent) top = top.parent;
+  return top;
+}
 var collect = (value, previous = []) => [...previous, value];
 program2.command("login").description(
   "Sign in through the browser (device code), and sign git in with it. It waits for a person, which can take a few minutes, so don't run it under a short timeout"
 ).option("--scope <scope>", "API key scope: read, publish, admin (repeatable)", collect).option("--no-browser", "print the link instead of opening a browser").action(action((ctx, options) => login(ctx, options)));
 program2.command("logout").description("Revoke and forget the active login, and sign git out").action(action((ctx) => logout(ctx)));
 program2.command("whoami").description("Who you're signed in as, and where").action(action((ctx) => whoami(ctx)));
+program2.command("update").description(
+  "Update pch to the newest version, when the installer put it here; installed another way, it says how to update"
+).action(action((ctx) => update(ctx)));
 program2.command("guide").description("How to make, test and publish on Patch, for you or your agent").action(action(async (ctx) => (await Promise.resolve().then(() => (init_mcp(), mcp_exports))).guide(ctx)));
 program2.command("mcp").description(
   "Patch's MCP server for your agent, signed in as pch is: add `pch mcp` to its servers"
@@ -49219,6 +49483,7 @@ var words = process.argv.slice(2);
 if (!program2.commands.some((one) => [one.name(), ...one.aliases()].some((n) => words.includes(n)))) {
   program2.version(VERSION);
 }
+removeOldExecutables();
 try {
   await program2.parseAsync(process.argv);
 } catch (error62) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patchgg/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "pch: the Patch command-line tool for creators and their agents",
   "license": "MIT",
   "homepage": "https://patch.gg",