@pippit-dev/cli 0.0.1

package/cmd/short_drama_test.go

@@ -0,0 +1,587 @@
+package cmd
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/Pippit-dev/pippit-cli/internal/auth"
+	"github.com/Pippit-dev/pippit-cli/internal/common"
+	"github.com/Pippit-dev/pippit-cli/internal/config"
+	"github.com/bytedance/sonic"
+	"github.com/spf13/cobra"
+)
+
+func TestShortDramaSubmitRun(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			t.Fatalf("method = %s, want POST", r.Method)
+		}
+		if r.URL.Path != "/api/biz/v1/skill/submit_run" {
+			t.Fatalf("path = %s, want submit_run path", r.URL.Path)
+		}
+		if r.Header.Get("Authorization") != "Bearer test-token" {
+			t.Fatalf("Authorization = %q, want test bearer token", r.Header.Get("Authorization"))
+		}
+		data, err := io.ReadAll(r.Body)
+		if err != nil {
+			t.Fatalf("read body: %v", err)
+		}
+		var body map[string]any
+		if err := sonic.Unmarshal(data, &body); err != nil {
+			t.Fatalf("decode body: %v", err)
+		}
+		if body["message"] != "write a cyberpunk opening" {
+			t.Fatalf("message = %v, want submitted message", body["message"])
+		}
+		if body["thread_id"] != "thread_123" {
+			t.Fatalf("thread_id = %v, want thread_123", body["thread_id"])
+		}
+		if body["agent_name"] != "pippit_nest_novel_agent" {
+			t.Fatalf("agent_name = %v, want pippit_nest_novel_agent", body["agent_name"])
+		}
+		assetIDs, ok := body["asset_ids"].([]any)
+		if !ok || len(assetIDs) != 2 || assetIDs[0] != "asset_1" || assetIDs[1] != "asset_2" {
+			t.Fatalf("asset_ids = %#v, want two asset ids", body["asset_ids"])
+		}
+		_, _ = w.Write([]byte(`{"ret":"0","errmsg":"","data":{"run":{"thread_id":"thread_123","run_id":"run_456"},"web_thread_link":"https://xyq.example/thread_123"}}`))
+	}))
+	defer server.Close()
+
+	var stdout, stderr bytes.Buffer
+	root := newTestRootCommand(t, &stdout, &stderr, server.URL)
+	root.SetArgs([]string{
+		"short-drama", "+submit-run",
+		"--message", "write a cyberpunk opening",
+		"--thread-id", "thread_123",
+		"--asset-ids", "asset_1",
+		"--asset-ids", "asset_2",
+	})
+
+	if err := root.Execute(); err != nil {
+		t.Fatalf("Execute() error = %v, stderr = %s", err, stderr.String())
+	}
+
+	got := decodeJSON(t, stdout.Bytes())
+	if got["thread_id"] != "thread_123" {
+		t.Fatalf("thread_id = %v, want thread_123", got["thread_id"])
+	}
+	if got["run_id"] != "run_456" {
+		t.Fatalf("run_id = %v, want run_456", got["run_id"])
+	}
+	if got["web_thread_link"] != "https://xyq.example/thread_123" {
+		t.Fatalf("web_thread_link = %v, want returned link", got["web_thread_link"])
+	}
+}
+
+func TestRootIncludesUpdateCommand(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	root := NewRootCommand(&stdout, &stderr)
+	cmd, _, err := root.Find([]string{"update"})
+	if err != nil {
+		t.Fatalf("Find(update) error = %v", err)
+	}
+	if cmd == nil || cmd.Name() != "update" {
+		t.Fatalf("Find(update) = %#v, want update command", cmd)
+	}
+}
+
+func TestShortDramaSubmitRunRequiresMessage(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	root := NewRootCommand(&stdout, &stderr)
+	root.SetArgs([]string{"short-drama", "+submit-run"})
+
+	err := root.Execute()
+	if err == nil {
+		t.Fatal("Execute() error = nil, want validation error")
+	}
+	if !strings.Contains(err.Error(), "--message is required") {
+		t.Fatalf("error = %q, want message validation", err)
+	}
+}
+
+func TestShortDramaSubmitRunRequiresAccessKey(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Fatal("server should not receive request without access key")
+	}))
+	defer server.Close()
+
+	var stdout, stderr bytes.Buffer
+	root := newTestRootCommandWithAccessKey(t, &stdout, &stderr, server.URL, "")
+	root.SetArgs([]string{
+		"short-drama", "+submit-run",
+		"--message", "write a cyberpunk opening",
+	})
+
+	err := root.Execute()
+	if err == nil {
+		t.Fatal("Execute() error = nil, want access key error")
+	}
+	if !strings.Contains(err.Error(), "XYQ_ACCESS_KEY is required") {
+		t.Fatalf("error = %q, want access key guidance", err)
+	}
+}
+
+func TestShortDramaUploadFile(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	root := NewRootCommand(&stdout, &stderr)
+	root.SetArgs([]string{"short-drama", "+upload-file", "--path", "/tmp/story.md"})
+
+	if err := root.Execute(); err != nil {
+		t.Fatalf("Execute() error = %v, stderr = %s", err, stderr.String())
+	}
+
+	got := decodeJSON(t, stdout.Bytes())
+	if got["scene"] != "short-drama" {
+		t.Fatalf("scene = %v, want short-drama", got["scene"])
+	}
+	if got["status"] != "uploaded" {
+		t.Fatalf("status = %v, want uploaded", got["status"])
+	}
+	if !strings.HasPrefix(got["file_id"].(string), "file_mock_") {
+		t.Fatalf("file_id = %v, want mock file id", got["file_id"])
+	}
+}
+
+func TestShortDramaUploadFileRequiresPath(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	root := NewRootCommand(&stdout, &stderr)
+	root.SetArgs([]string{"short-drama", "+upload-file"})
+
+	err := root.Execute()
+	if err == nil {
+		t.Fatal("Execute() error = nil, want validation error")
+	}
+	if !strings.Contains(err.Error(), "--path is required") {
+		t.Fatalf("error = %q, want path validation", err)
+	}
+}
+
+func TestShortDramaDownloadResult(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("User-Agent") != "Pippit-CLI/1.0" {
+			t.Fatalf("User-Agent = %q, want Pippit-CLI/1.0", r.Header.Get("User-Agent"))
+		}
+		switch r.URL.Path {
+		case "/image":
+			_, _ = w.Write([]byte("image-data"))
+		default:
+			t.Fatalf("unexpected path %s", r.URL.Path)
+		}
+	}))
+	defer server.Close()
+
+	chdirTemp(t)
+	var stdout, stderr bytes.Buffer
+	root := NewRootCommand(&stdout, &stderr)
+	outputPath := filepath.Join("results", "cover.jpeg")
+	root.SetArgs([]string{
+		"short-drama", "+download-result",
+		"--output-dir", outputPath,
+		"--workers", "2",
+		"--url", server.URL + "/image?filename=ignored.jpeg",
+	})
+
+	if err := root.Execute(); err != nil {
+		t.Fatalf("Execute() error = %v, stderr = %s", err, stderr.String())
+	}
+
+	got := decodeJSON(t, stdout.Bytes())
+	if got["output_dir"] != outputPath {
+		t.Fatalf("output_dir = %v, want %s", got["output_dir"], outputPath)
+	}
+	if got["total"] != float64(1) {
+		t.Fatalf("total = %v, want 1", got["total"])
+	}
+	downloaded, ok := got["downloaded"].([]any)
+	if !ok || len(downloaded) != 1 {
+		t.Fatalf("downloaded = %#v, want one file", got["downloaded"])
+	}
+	wantFiles := []string{
+		outputPath,
+	}
+	for i, want := range wantFiles {
+		if downloaded[i] != want {
+			t.Fatalf("downloaded[%d] = %v, want %s", i, downloaded[i], want)
+		}
+	}
+	assertFileContent(t, wantFiles[0], "image-data")
+}
+
+func TestShortDramaDownloadResultSkipsExistingFile(t *testing.T) {
+	serverCalled := false
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		serverCalled = true
+		t.Fatal("server should not receive request when target file already exists")
+	}))
+	defer server.Close()
+
+	chdirTemp(t)
+	outputPath := filepath.Join("results", "cover.jpeg")
+	if err := os.MkdirAll(filepath.Dir(outputPath), 0o755); err != nil {
+		t.Fatalf("MkdirAll(): %v", err)
+	}
+	if err := os.WriteFile(outputPath, []byte("existing-data"), 0o644); err != nil {
+		t.Fatalf("WriteFile(): %v", err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	root := NewRootCommand(&stdout, &stderr)
+	root.SetArgs([]string{
+		"short-drama", "+download-result",
+		"--output-dir", outputPath,
+		"--url", server.URL + "/image",
+	})
+
+	if err := root.Execute(); err != nil {
+		t.Fatalf("Execute() error = %v, stderr = %s", err, stderr.String())
+	}
+	if serverCalled {
+		t.Fatal("server was called, want existing file to skip download")
+	}
+
+	got := decodeJSON(t, stdout.Bytes())
+	if got["output_dir"] != outputPath {
+		t.Fatalf("output_dir = %v, want %s", got["output_dir"], outputPath)
+	}
+	if got["total"] != float64(0) {
+		t.Fatalf("total = %v, want 0", got["total"])
+	}
+	alreadyExist, ok := got["already_exist"].([]any)
+	if !ok || len(alreadyExist) != 1 || alreadyExist[0] != outputPath {
+		t.Fatalf("already_exist = %#v, want existing output path", got["already_exist"])
+	}
+	assertFileContent(t, outputPath, "existing-data")
+}
+
+func TestShortDramaDownloadResultRequiresOutputDir(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	root := NewRootCommand(&stdout, &stderr)
+	root.SetArgs([]string{"short-drama", "+download-result", "--url", "https://example.com/image.png"})
+
+	err := root.Execute()
+	if err == nil {
+		t.Fatal("Execute() error = nil, want validation error")
+	}
+	if !strings.Contains(err.Error(), "--output-dir is required") {
+		t.Fatalf("error = %q, want output-dir validation", err)
+	}
+}
+
+func TestShortDramaDownloadResultRequiresURL(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	root := NewRootCommand(&stdout, &stderr)
+	root.SetArgs([]string{"short-drama", "+download-result", "--output-dir", filepath.Join("results", "image.png")})
+
+	err := root.Execute()
+	if err == nil {
+		t.Fatal("Execute() error = nil, want validation error")
+	}
+	if !strings.Contains(err.Error(), "--url is required") {
+		t.Fatalf("error = %q, want url validation", err)
+	}
+}
+
+func TestShortDramaDownloadResultRejectsInvalidScheme(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	root := NewRootCommand(&stdout, &stderr)
+	root.SetArgs([]string{"short-drama", "+download-result", "--output-dir", filepath.Join("results", "image.png"), "--url", "file:///etc/passwd"})
+
+	err := root.Execute()
+	if err == nil {
+		t.Fatal("Execute() error = nil, want scheme validation error")
+	}
+	if !strings.Contains(err.Error(), "only http and https are allowed") {
+		t.Fatalf("error = %q, want scheme validation", err)
+	}
+}
+
+func TestShortDramaDownloadResultAllFailed(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer server.Close()
+
+	chdirTemp(t)
+	var stdout, stderr bytes.Buffer
+	root := NewRootCommand(&stdout, &stderr)
+	root.SetArgs([]string{
+		"short-drama", "+download-result",
+		"--output-dir", filepath.Join("results", "missing.png"),
+		"--url", server.URL + "/notfound",
+	})
+
+	err := root.Execute()
+	if err == nil {
+		t.Fatal("Execute() error = nil, want all-failed error")
+	}
+	if !strings.Contains(err.Error(), "all 1 download(s) failed") {
+		t.Fatalf("error = %q, want all-failed message", err)
+	}
+}
+
+func TestShortDramaDownloadResultOutputPath(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte("image-data"))
+	}))
+	defer server.Close()
+
+	chdirTemp(t)
+
+	var stdout, stderr bytes.Buffer
+	root := NewRootCommand(&stdout, &stderr)
+	outputPath := filepath.Join("custom", "nested", "cover.png")
+	root.SetArgs([]string{
+		"short-drama", "+download-result",
+		"--output-dir", outputPath,
+		"--url", server.URL + "/image.png",
+	})
+
+	if err := root.Execute(); err != nil {
+		t.Fatalf("Execute() error = %v, stderr = %s", err, stderr.String())
+	}
+
+	got := decodeJSON(t, stdout.Bytes())
+	if got["output_dir"] != outputPath {
+		t.Fatalf("output_dir = %v, want %s", got["output_dir"], outputPath)
+	}
+	assertFileContent(t, outputPath, "image-data")
+}
+
+func TestShortDramaGetThread(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			t.Fatalf("method = %s, want POST", r.Method)
+		}
+		if r.URL.Path != "/api/biz/v1/skill/get_thread" {
+			t.Fatalf("path = %s, want get_thread path", r.URL.Path)
+		}
+		if r.Header.Get("Authorization") != "Bearer test-token" {
+			t.Fatalf("Authorization = %q, want test bearer token", r.Header.Get("Authorization"))
+		}
+		data, err := io.ReadAll(r.Body)
+		if err != nil {
+			t.Fatalf("read body: %v", err)
+		}
+		var body map[string]any
+		if err := sonic.Unmarshal(data, &body); err != nil {
+			t.Fatalf("decode body: %v", err)
+		}
+		if body["thread_id"] != "thread_123" {
+			t.Fatalf("thread_id = %v, want thread_123", body["thread_id"])
+		}
+		if body["run_id"] != "run_456" {
+			t.Fatalf("run_id = %v, want run_456", body["run_id"])
+		}
+		if body["after_seq"] != float64(7) {
+			t.Fatalf("after_seq = %v, want 7", body["after_seq"])
+		}
+		_, _ = w.Write([]byte(`{"ret":"0","errmsg":"","data":{"thread":{"run_list":[{"state":3,"entry_list":[{"message":{"message_id":"msg_1","role":"assistant","content":[{"text":"hello"}],"client_tool_calls":[{"name":"tool_call"}]}},{"artifact":{"artifact_id":"artifact_1","role":"assistant","content":[{"type":"image"}]}}]}]}}}`))
+	}))
+	defer server.Close()
+
+	var stdout, stderr bytes.Buffer
+	root := newTestRootCommand(t, &stdout, &stderr, server.URL)
+	root.SetArgs([]string{
+		"short-drama", "+get-thread",
+		"--thread-id", "thread_123",
+		"--run-id", "run_456",
+		"--after-seq", "7",
+	})
+
+	if err := root.Execute(); err != nil {
+		t.Fatalf("Execute() error = %v, stderr = %s", err, stderr.String())
+	}
+
+	got := decodeJSON(t, stdout.Bytes())
+	messages, ok := got["messages"].([]any)
+	if !ok || len(messages) != 2 {
+		t.Fatalf("messages = %#v, want two entries", got["messages"])
+	}
+	first, ok := messages[0].(map[string]any)
+	if !ok {
+		t.Fatalf("first message = %#v, want object", messages[0])
+	}
+	if first["id"] != "msg_1" {
+		t.Fatalf("first id = %v, want msg_1", first["id"])
+	}
+	content, ok := first["content"].([]any)
+	if !ok || len(content) != 2 {
+		t.Fatalf("first content = %#v, want message content plus tool call", first["content"])
+	}
+}
+
+func TestShortDramaGetThreadRequiresThreadID(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	root := NewRootCommand(&stdout, &stderr)
+	root.SetArgs([]string{"short-drama", "+get-thread"})
+
+	err := root.Execute()
+	if err == nil {
+		t.Fatal("Execute() error = nil, want validation error")
+	}
+	if !strings.Contains(err.Error(), "--thread-id is required") {
+		t.Fatalf("error = %q, want thread-id validation", err)
+	}
+}
+
+func TestShortDramaGetThreadRequiresAccessKey(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Fatal("server should not receive request without access key")
+	}))
+	defer server.Close()
+
+	var stdout, stderr bytes.Buffer
+	root := newTestRootCommandWithAccessKey(t, &stdout, &stderr, server.URL, "")
+	root.SetArgs([]string{"short-drama", "+get-thread", "--thread-id", "thread_123"})
+
+	err := root.Execute()
+	if err == nil {
+		t.Fatal("Execute() error = nil, want access key error")
+	}
+	if !strings.Contains(err.Error(), "XYQ_ACCESS_KEY is required") {
+		t.Fatalf("error = %q, want access key guidance", err)
+	}
+}
+
+func TestShortDramaListThreadFile(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			t.Fatalf("method = %s, want POST", r.Method)
+		}
+		if r.URL.Path != "/api/biz/v1/skill/list_thread_file" {
+			t.Fatalf("path = %s, want list_thread_file path", r.URL.Path)
+		}
+		if r.Header.Get("Authorization") != "Bearer test-token" {
+			t.Fatalf("Authorization = %q, want test bearer token", r.Header.Get("Authorization"))
+		}
+		data, err := io.ReadAll(r.Body)
+		if err != nil {
+			t.Fatalf("read body: %v", err)
+		}
+		var body map[string]any
+		if err := sonic.Unmarshal(data, &body); err != nil {
+			t.Fatalf("decode body: %v", err)
+		}
+		if body["thread_id"] != "thread_123" {
+			t.Fatalf("thread_id = %v, want thread_123", body["thread_id"])
+		}
+		if body["page_num"] != float64(2) {
+			t.Fatalf("page_num = %v, want 2", body["page_num"])
+		}
+		if body["page_size"] != float64(10) {
+			t.Fatalf("page_size = %v, want 10", body["page_size"])
+		}
+		_, _ = w.Write([]byte(`{"ret":"0","errmsg":"","data":{"total":1,"files":[{"file_name":"ignored.png","file_path":"results/images/cover.png","download_url":"https://example.com/cover.png"}]}}`))
+	}))
+	defer server.Close()
+
+	var stdout, stderr bytes.Buffer
+	root := newTestRootCommand(t, &stdout, &stderr, server.URL)
+	root.SetArgs([]string{
+		"short-drama", "+list-thread-file",
+		"--thread-id", "thread_123",
+		"--page-num", "2",
+		"--page-size", "10",
+	})
+
+	if err := root.Execute(); err != nil {
+		t.Fatalf("Execute() error = %v, stderr = %s", err, stderr.String())
+	}
+
+	got := decodeJSON(t, stdout.Bytes())
+	if got["total"] != float64(1) {
+		t.Fatalf("total = %v, want 1", got["total"])
+	}
+	files, ok := got["files"].([]any)
+	if !ok || len(files) != 1 {
+		t.Fatalf("files = %#v, want one file", got["files"])
+	}
+	file, ok := files[0].(map[string]any)
+	if !ok {
+		t.Fatalf("file = %#v, want object", files[0])
+	}
+	if _, ok := file["file_name"]; ok {
+		t.Fatalf("file_name should not be returned: %#v", file)
+	}
+	wantPath := "." + string(os.PathSeparator) + filepath.Join("thread_123", "results/images/cover.png")
+	if file["file_path"] != wantPath {
+		t.Fatalf("file_path = %v, want %s", file["file_path"], wantPath)
+	}
+	if file["download_url"] != "https://example.com/cover.png" {
+		t.Fatalf("download_url = %v, want returned url", file["download_url"])
+	}
+}
+
+func TestShortDramaListThreadFileRequiresThreadID(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	root := NewRootCommand(&stdout, &stderr)
+	root.SetArgs([]string{"short-drama", "+list-thread-file"})
+
+	err := root.Execute()
+	if err == nil {
+		t.Fatal("Execute() error = nil, want validation error")
+	}
+	if !strings.Contains(err.Error(), "--thread-id is required") {
+		t.Fatalf("error = %q, want thread-id validation", err)
+	}
+}
+
+func newTestRootCommand(t *testing.T, stdout, stderr io.Writer, baseURL string) *cobra.Command {
+	t.Helper()
+	return newTestRootCommandWithAccessKey(t, stdout, stderr, baseURL, "test-token")
+}
+
+func newTestRootCommandWithAccessKey(t *testing.T, stdout, stderr io.Writer, baseURL string, accessKey string) *cobra.Command {
+	t.Helper()
+	cfg := config.Load()
+	cfg.BaseURL = baseURL
+	cfg.AccessKey = accessKey
+	authAuthorizer := auth.NewManager(cfg)
+	client := common.NewHTTPClient(cfg.BaseURL, cfg.HTTPTimeout, common.NewAccessKeyAuthorizer(cfg.AccessKey))
+	runner := common.NewRunner(cfg, client, authAuthorizer)
+	return newRootCommand(stdout, stderr, runner)
+}
+
+func decodeJSON(t *testing.T, data []byte) map[string]any {
+	t.Helper()
+	var got map[string]any
+	if err := sonic.Unmarshal(data, &got); err != nil {
+		t.Fatalf("stdout is not JSON: %v\n%s", err, string(data))
+	}
+	return got
+}
+
+func chdirTemp(t *testing.T) string {
+	t.Helper()
+	cwd := t.TempDir()
+	oldWD, err := os.Getwd()
+	if err != nil {
+		t.Fatalf("Getwd(): %v", err)
+	}
+	if err := os.Chdir(cwd); err != nil {
+		t.Fatalf("Chdir(%s): %v", cwd, err)
+	}
+	t.Cleanup(func() {
+		if err := os.Chdir(oldWD); err != nil {
+			t.Fatalf("restore working dir: %v", err)
+		}
+	})
+	return cwd
+}
+
+func assertFileContent(t *testing.T, path string, want string) {
+	t.Helper()
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("ReadFile(%s): %v", path, err)
+	}
+	if string(data) != want {
+		t.Fatalf("ReadFile(%s) = %q, want %q", path, string(data), want)
+	}
+}

package/cmd/update/update.go

@@ -0,0 +1,124 @@
+package updatecmd
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+
+	"github.com/spf13/cobra"
+)
+
+const defaultPackage = "@pippit-dev/cli"
+
+// NewCommand builds the update command.
+func NewCommand(stdout, stderr io.Writer) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "update",
+		Short: "Update pippit-cli and bundled skills",
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			return runUpdate(stdout, stderr)
+		},
+	}
+	return cmd
+}
+
+func runUpdate(stdout, stderr io.Writer) error {
+	pkg := os.Getenv("PIPPIT_CLI_INSTALL_PACKAGE")
+	if pkg == "" {
+		pkg = defaultPackage + "@latest"
+	}
+
+	fmt.Fprintf(stderr, "Updating pippit-cli via npm: %s\n", pkg)
+	restore, err := prepareSelfReplace()
+	if err != nil {
+		return fmt.Errorf("prepare self replace: %w", err)
+	}
+	if err := runInheritEnv(stderr, []string{"PIPPIT_CLI_SKIP_SKILLS=1"}, "npm", "install", "-g", pkg); err != nil {
+		restore()
+		return fmt.Errorf("update pippit-cli: %w", err)
+	}
+
+	root, err := globalPackageRoot(defaultPackage)
+	if err != nil {
+		return fmt.Errorf("locate global package: %w", err)
+	}
+
+	fmt.Fprintln(stderr, "Updating pippit-cli skills...")
+	if err := installSkills(root, stderr); err != nil {
+		return fmt.Errorf("update pippit-cli skills: %w", err)
+	}
+
+	fmt.Fprintln(stdout, "pippit-cli and skills updated")
+	return nil
+}
+
+func globalPackageRoot(pkg string) (string, error) {
+	out, err := command("npm", "root", "-g").Output()
+	if err != nil {
+		return "", err
+	}
+	npmRoot := strings.TrimSpace(string(out))
+	if npmRoot == "" {
+		return "", fmt.Errorf("npm root -g returned empty output")
+	}
+	return filepath.Join(append([]string{npmRoot}, strings.Split(pkg, "/")...)...), nil
+}
+
+func installSkills(root string, stderr io.Writer) error {
+	if info, err := os.Stat(filepath.Join(root, "skills")); err != nil {
+		return err
+	} else if !info.IsDir() {
+		return fmt.Errorf("%s is not a directory", filepath.Join(root, "skills"))
+	}
+	return runInherit(stderr, "npx", "-y", "skills", "add", root, "-g", "-y")
+}
+
+func runInherit(stderr io.Writer, name string, args ...string) error {
+	return runInheritEnv(stderr, nil, name, args...)
+}
+
+func runInheritEnv(stderr io.Writer, env []string, name string, args ...string) error {
+	cmd := command(name, args...)
+	if len(env) > 0 {
+		cmd.Env = append(os.Environ(), env...)
+	}
+	cmd.Stdout = stderr
+	cmd.Stderr = stderr
+	return cmd.Run()
+}
+
+func command(name string, args ...string) *exec.Cmd {
+	if runtime.GOOS == "windows" {
+		cmdArgs := append([]string{"/c", name}, args...)
+		return exec.Command("cmd.exe", cmdArgs...)
+	}
+	return exec.Command(name, args...)
+}
+
+func prepareSelfReplace() (func(), error) {
+	if runtime.GOOS != "windows" {
+		return func() {}, nil
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		return nil, err
+	}
+	if filepath.Base(exe) != "pippit-cli.exe" || !strings.Contains(exe, "node_modules") {
+		return func() {}, nil
+	}
+	old := exe + ".old"
+	_ = os.Remove(old)
+	if err := os.Rename(exe, old); err != nil {
+		return nil, err
+	}
+	return func() {
+		if _, err := os.Stat(exe); err == nil {
+			return
+		}
+		_ = os.Rename(old, exe)
+	}, nil
+}