onepatch 0.4.0 → 0.5.1

package/README.md

@@ -2,13 +2,16 @@
 
 The [OnePatch](https://onepatch.dev) CLI. Query your telemetry, read and reply to agent chats, and inspect incidents from a terminal or from a coding agent. It speaks to the same MCP endpoint the product serves at `/mcp`, so it has exact functional parity with connecting an MCP client.
 
-Requires [Bun](https://bun.sh).
-
 ```sh
-bun install -g onepatch   # or: npm install -g onepatch
+npm install -g onepatch      # needs Node
+# or, without Node:
+curl -fsSL https://releases.onepatch.dev/install.sh | sh
+
 onepatch login
 ```
 
+The CLI is a single self-contained binary (compiled with Bun, so Bun is not needed). `npm install -g onepatch` installs a small Node launcher that fetches the binary for your platform from `https://releases.onepatch.dev/v<version>/` and verifies its SHA-256 against the checksum shipped inside the package; the installer script does the same without Node. Releases carry binaries for macOS (arm64, x64), Linux (x64, arm64), and Windows (x64).
+
 `login` uses a device flow: it prints a URL, you approve in the browser, and credentials land in `~/.config/onepatch/credentials.json` (0600). Tokens refresh automatically.
 
 ## Commands
@@ -39,7 +42,7 @@ Pass `-` to read SQL or message text from stdin. `--json` prints raw MCP content
 
 ## Updates
 
-The CLI keeps itself current. Once a day, in a detached background process, it asks the npm registry for the latest version; when one exists it reinstalls itself through whichever package manager owns the copy (bun or npm) and prints a one-line notice to stderr. The command you typed is never delayed and never fails because of update machinery. Set `ONEPATCH_NO_UPDATE=1` to disable it, or run `onepatch update` to update on demand. Running from a source checkout never auto-updates.
+The CLI keeps itself current. Once a day, in a detached background process, it asks the npm registry for the latest version; when one exists it either reinstalls itself through the package manager that owns the copy (npm or bun) or, for a standalone binary, downloads the new release, verifies it, and swaps it in place. It prints a one-line notice to stderr. The command you typed is never delayed and never fails because of update machinery. Set `ONEPATCH_NO_UPDATE=1` to disable it, or run `onepatch update` to update on demand. Running from a source checkout never auto-updates. Self-update of a standalone binary isn't available on Windows yet; re-run the installer there.
 
 ## Programmatic use
 
@@ -53,4 +56,4 @@ const digest = await op.chats.start("investigate the p95 spike on /checkout");
 await op.close();
 ```
 
-All methods return the same plain-text digests the MCP tools produce. `op.call(name, args)` reaches any tool directly.
+All methods return the same plain-text digests the MCP tools produce. `op.call(name, args)` reaches any tool directly. The programmatic API runs under Bun (it imports the TypeScript sources shipped in the package) and needs `@modelcontextprotocol/sdk` installed alongside; the CLI itself has no dependencies.

package/bin/onepatch.cjs

@@ -0,0 +1,203 @@
+#!/usr/bin/env node
+// The npm package's entry point. It is a launcher, not the CLI: it finds (or
+// fetches) the prebuilt onepatch binary for this machine and hands over to
+// it. Plain Node, no dependencies, so `npm install -g onepatch` needs nothing
+// but Node. The binary is downloaded from the release host
+// (https://releases.onepatch.dev/v<version>/) that matches this package's
+// version and verified against the SHA-256 recorded in checksums.json at
+// publish time, so npm's integrity check on this package extends to the
+// binary it fetches.
+"use strict";
+
+const { spawnSync, spawn } = require("node:child_process");
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+const root = path.join(__dirname, "..");
+const pkg = require(path.join(root, "package.json"));
+const RELEASE_BASE = process.env.ONEPATCH_RELEASE_BASE || "https://releases.onepatch.dev";
+
+function releaseTarget(platform = process.platform, arch = process.arch) {
+	const osName =
+		platform === "darwin"
+			? "darwin"
+			: platform === "linux"
+				? "linux"
+				: platform === "win32"
+					? "windows"
+					: null;
+	if (osName === null || (arch !== "x64" && arch !== "arm64")) return null;
+	if (osName === "windows" && arch !== "x64") return null;
+	return `${osName}-${arch}`;
+}
+
+function assetName(target) {
+	return `onepatch-${target}.tar.gz`;
+}
+
+function assetUrl(version, target, base = RELEASE_BASE) {
+	return `${base}/v${version}/${assetName(target)}`;
+}
+
+function binaryName(target) {
+	return target.startsWith("windows") ? "onepatch.exe" : "onepatch";
+}
+
+function sha256(buffer) {
+	return crypto.createHash("sha256").update(buffer).digest("hex");
+}
+
+function readChecksums() {
+	try {
+		return JSON.parse(fs.readFileSync(path.join(root, "checksums.json"), "utf8"));
+	} catch {
+		return null;
+	}
+}
+
+// Where the binary lives once fetched. The package's own vendor/ directory is
+// preferred (postinstall fills it, uninstall removes it); a per-user cache is
+// the fallback when the package directory isn't writable at run time.
+function vendorDir() {
+	return path.join(root, "vendor");
+}
+function cacheDir() {
+	const base = process.env.XDG_CACHE_HOME || path.join(os.homedir(), ".cache");
+	return path.join(base, "onepatch", "bin", pkg.version);
+}
+
+function findBinary(target) {
+	if (process.env.ONEPATCH_BIN) return process.env.ONEPATCH_BIN;
+	for (const dir of [vendorDir(), cacheDir()]) {
+		const candidate = path.join(dir, binaryName(target));
+		if (fs.existsSync(candidate)) return candidate;
+	}
+	return null;
+}
+
+async function download(url) {
+	const res = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(120_000) });
+	if (!res.ok) throw new Error(`${url} answered ${res.status}`);
+	return Buffer.from(await res.arrayBuffer());
+}
+
+// Fetch, verify, and unpack the binary into `dir`. Staged in a sibling
+// directory and renamed in, so a concurrent launcher never sees a half-written
+// file.
+async function fetchBinary(target, dir, { quiet } = {}) {
+	const checksums = readChecksums();
+	const expected = checksums?.[target];
+	if (!expected) {
+		throw new Error(
+			`this onepatch package carries no checksum for ${target}; refusing to download`,
+		);
+	}
+	if (!quiet) process.stderr.write(`Downloading onepatch ${pkg.version} for ${target}…\n`);
+	const tarball = await download(assetUrl(pkg.version, target));
+	const actual = sha256(tarball);
+	if (actual !== expected) {
+		throw new Error(
+			`checksum mismatch for ${assetName(target)}: expected ${expected}, got ${actual}`,
+		);
+	}
+	fs.mkdirSync(dir, { recursive: true });
+	const stage = fs.mkdtempSync(path.join(dir, ".stage-"));
+	try {
+		const archive = path.join(stage, assetName(target));
+		fs.writeFileSync(archive, tarball);
+		const tar = spawnSync("tar", ["-xzf", archive, "-C", stage], { stdio: "ignore" });
+		if (tar.status !== 0) throw new Error("tar failed to extract the onepatch archive");
+		const bin = path.join(stage, binaryName(target));
+		fs.chmodSync(bin, 0o755);
+		fs.renameSync(bin, path.join(dir, binaryName(target)));
+	} finally {
+		fs.rmSync(stage, { recursive: true, force: true });
+	}
+	return path.join(dir, binaryName(target));
+}
+
+async function ensureBinary(target, opts) {
+	const found = findBinary(target);
+	if (found) return found;
+	try {
+		return await fetchBinary(target, vendorDir(), opts);
+	} catch (err) {
+		if (err && err.code !== "EACCES" && err.code !== "EPERM" && err.code !== "EROFS") throw err;
+		return await fetchBinary(target, cacheDir(), opts);
+	}
+}
+
+function isSourceCheckout() {
+	return (
+		fs.existsSync(path.join(root, "src", "cli.ts")) &&
+		!fs.existsSync(path.join(root, "checksums.json"))
+	);
+}
+
+async function main(argv) {
+	const args = argv.slice(2);
+
+	// npm's postinstall: prefetch so the first real invocation is instant.
+	// Never fail the install over it — the launcher fetches on demand anyway.
+	if (args[0] === "--postinstall") {
+		if (isSourceCheckout()) return 0;
+		const target = releaseTarget();
+		if (target === null) return 0;
+		try {
+			await ensureBinary(target, { quiet: true });
+		} catch (err) {
+			process.stderr.write(
+				`onepatch: could not prefetch the binary (${err.message}); it will download on first use.\n`,
+			);
+		}
+		return 0;
+	}
+
+	// A developer's checkout: run the sources under Bun, like before.
+	if (isSourceCheckout()) {
+		const run = spawnSync("bun", [path.join(root, "src", "cli.ts"), ...args], { stdio: "inherit" });
+		return run.status === null ? 1 : run.status;
+	}
+
+	const target = releaseTarget();
+	if (target === null) {
+		process.stderr.write(`onepatch: no prebuilt binary for ${process.platform}/${process.arch}.\n`);
+		return 1;
+	}
+
+	let bin = findBinary(target);
+	if (bin === null) {
+		// Hooks run on every agent prompt and must never wait on a download:
+		// fetch in the background and inject nothing this time.
+		if (args[0] === "hook") {
+			spawn(process.execPath, [__filename, "--postinstall"], {
+				detached: true,
+				stdio: "ignore",
+			}).unref();
+			return 0;
+		}
+		bin = await ensureBinary(target);
+	}
+
+	const run = spawnSync(bin, args, { stdio: "inherit" });
+	if (run.error) throw run.error;
+	if (run.signal) {
+		process.kill(process.pid, run.signal);
+		return 1;
+	}
+	return run.status === null ? 1 : run.status;
+}
+
+module.exports = { releaseTarget, assetName, assetUrl, binaryName, sha256 };
+
+if (require.main === module) {
+	main(process.argv).then(
+		(code) => process.exit(code),
+		(err) => {
+			process.stderr.write(`onepatch: ${err?.message ?? err}\n`);
+			process.exit(1);
+		},
+	);
+}

package/checksums.json

@@ -0,0 +1,7 @@
+{
+  "darwin-arm64": "f53d824326e0e26746d65e63ebaf300c730841da8b7ebedc3b487af8160d9ae7",
+  "darwin-x64": "1779984fb3a998cd5de26b2ffd6c0cac0c9733f7670e1dc488059f53f5a95ecc",
+  "linux-arm64": "51e22bb3b290e47482efdbdc0ad3aabd79218c6858dc552c49d3e67ea787114c",
+  "linux-x64": "4c963f164f1929fe5e475c4d59614179faa43566d42088875554025b32ce58cf",
+  "windows-x64": "e6d62ea9e99ef951fedacd75987605486a8ff04fa76d7b176c7df45d700b76ec"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "onepatch",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "OnePatch CLI: query your telemetry, chats, and incidents from a terminal or a coding agent",
   "license": "MIT",
   "homepage": "https://onepatch.dev",
@@ -11,34 +11,58 @@
   "bugs": {
     "url": "https://github.com/1patch/cli/issues"
   },
-  "keywords": ["onepatch", "observability", "sre", "cli", "mcp", "opentelemetry"],
+  "keywords": [
+    "onepatch",
+    "observability",
+    "sre",
+    "cli",
+    "mcp",
+    "opentelemetry"
+  ],
   "type": "module",
   "bin": {
-    "onepatch": "./src/cli.ts"
+    "onepatch": "./bin/onepatch.cjs"
   },
   "exports": {
     ".": "./src/index.ts"
   },
-  "files": ["src", "README.md", "LICENSE"],
+  "files": [
+    "bin",
+    "src",
+    "!src/*.test.ts",
+    "checksums.json",
+    "README.md",
+    "LICENSE"
+  ],
   "engines": {
-    "bun": ">=1.1.0"
+    "node": ">=18"
   },
   "publishConfig": {
     "access": "public"
   },
   "scripts": {
+    "postinstall": "node bin/onepatch.cjs --postinstall",
+    "build": "scripts/build-binaries.sh",
+    "mirror": "scripts/mirror-plugins.sh",
     "typecheck": "tsgo --noEmit -p tsconfig.json",
     "test": "bun test",
     "fmt": "biome check --write .",
-    "check": "biome ci . && bun run typecheck && bun test"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0"
+    "check": "biome ci . && bun run typecheck && bun test",
+    "mirror": "scripts/mirror-plugins.sh"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.5.8",
     "@types/bun": "^1.3.14",
     "@typescript/native-preview": "^7.0.0-dev.20260506.1",
-    "typescript": "^5.5.0"
+    "typescript": "^5.5.0",
+    "@modelcontextprotocol/sdk": "^1.29.0"
+  },
+  "peerDependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0"
+  },
+  "peerDependenciesMeta": {
+    "@modelcontextprotocol/sdk": {
+      "optional": true
+    }
   }
 }

package/src/hook.ts

@@ -8,6 +8,7 @@ import { readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { OnepatchClient } from "./client";
 import { configDir, ensureConfigDir, loadCredentials } from "./credentials";
+import { selfCommand } from "./runtime";
 
 export const HOOK_CACHE_TTL_MS = 5 * 60 * 1000;
 // A refresh normally lands in seconds; this only bounds how long a failed one
@@ -97,7 +98,7 @@ export async function runHook(api: string, event: string | undefined, refresh: b
 	if (action.refresh) {
 		writeHookCache({ ...readHookCache(), refreshStartedAt: Date.now() });
 		Bun.spawn({
-			cmd: [process.execPath, join(import.meta.dir, "cli.ts"), "hook", "--refresh", "--api", api],
+			cmd: selfCommand(["hook", "--refresh", "--api", api]),
 			stdin: "ignore",
 			stdout: "ignore",
 			stderr: "ignore",

package/src/runtime.ts

@@ -0,0 +1,35 @@
+// Where this process's code lives and how to re-invoke it. The CLI ships two
+// ways: as a compiled Bun executable (the binary users actually run) and as
+// TypeScript sources under Bun (development, and the programmatic API). Every
+// place that needs "this program again" or "this program's version" asks here
+// instead of assuming a file layout.
+import { realpathSync } from "node:fs";
+import { join } from "node:path";
+import pkg from "../package.json" with { type: "json" };
+
+export const VERSION: string = pkg.version;
+
+// Bun compiled executables mount their bundled sources on a virtual filesystem
+// (`/$bunfs/` on POSIX, `B:\~BUN\` on Windows); nothing else ever lives there.
+export function isCompiled(dir: string = import.meta.dir): boolean {
+	return dir.startsWith("/$bunfs/") || dir.includes("~BUN");
+}
+
+// The argv that re-runs this program with `args`, detached or not.
+export function selfCommand(args: string[], compiled: boolean = isCompiled()): string[] {
+	return compiled
+		? [process.execPath, ...args]
+		: [process.execPath, join(import.meta.dir, "cli.ts"), ...args];
+}
+
+// The path that decides who owns this install: the binary itself when
+// compiled, otherwise the package directory the sources live in. Symlinks
+// (bin shims, ~/.local/bin links) are resolved so the answer is physical.
+export function installRoot(): string {
+	const raw = isCompiled() ? process.execPath : join(import.meta.dir, "..");
+	try {
+		return realpathSync(raw);
+	} catch {
+		return raw;
+	}
+}

package/src/update.ts

@@ -2,35 +2,34 @@
 // actually typed never waits on update machinery. Each invocation reads one
 // small cached JSON file; a stale cache spawns a detached background process
 // to refresh it from the npm registry, and a cache that already names a newer
-// version spawns a detached reinstall via whichever package manager owns this
-// copy. Either way the foreground command proceeds immediately, and the next
-// invocation runs the new code.
-import { readFileSync, realpathSync, writeFileSync } from "node:fs";
+// version spawns a detached update. Either way the foreground command proceeds
+// immediately, and the next invocation runs the new code.
+//
+// How the update lands depends on who owns this copy: a package manager (bun
+// or npm) reinstalls the package, which fetches the matching binary; a
+// standalone binary (curl installer, or a copied file) replaces itself in
+// place from the release host, after checking the tarball's SHA-256.
+//
+// The release host (https://releases.onepatch.dev) is the one source of
+// truth for "what is released": `latest` is written last by the publish job,
+// after both the binaries and the npm package exist, so a version it names
+// is always fully installable by every kind.
+import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join, sep } from "node:path";
+import { dirname, join, sep } from "node:path";
 import { configDir, ensureConfigDir } from "./credentials";
+import { installRoot, isCompiled, selfCommand, VERSION } from "./runtime";
 
 export const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
 // A spawned install normally lands in seconds; this only bounds how long a
 // *failed* install suppresses retries (and dogpiles from parallel invocations).
 export const INSTALL_RETRY_MS = 15 * 60 * 1000;
 
-const packageRoot = (() => {
-	// The bin shim is a symlink into the installed package; resolve it so the
-	// path we inspect is where the package physically lives.
-	const raw = join(import.meta.dir, "..");
-	try {
-		return realpathSync(raw);
-	} catch {
-		return raw;
-	}
-})();
+// Overridable so a release can be rehearsed end-to-end against a local server.
+export const RELEASE_BASE = process.env.ONEPATCH_RELEASE_BASE ?? "https://releases.onepatch.dev";
 
 export function currentVersion(): string {
-	const pkg = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8")) as {
-		version?: unknown;
-	};
-	return typeof pkg.version === "string" ? pkg.version : "0.0.0";
+	return VERSION;
 }
 
 // Plain x.y.z compare; a prerelease suffix sorts below its release.
@@ -53,24 +52,65 @@ export function compareVersions(a: string, b: string): number {
 	return pa.pre < pb.pre ? -1 : 1;
 }
 
-export type InstallKind = "bun" | "npm";
+export type InstallKind = "bun" | "npm" | "binary";
 
-// Which package manager owns this copy — decided from where the package
-// physically lives, because that's also the only place the answer is honest.
-// null means a source checkout (dev), where auto-update must stay away.
-export function detectInstallKind(root: string = packageRoot): InstallKind | null {
+// Who owns this copy — decided from where it physically lives, because that's
+// also the only place the answer is honest. A package-manager path wins even
+// for a compiled binary (the launcher's vendored copy), so the manager stays
+// in charge of it. null means a source checkout (dev), where auto-update must
+// stay away.
+export function detectInstallKind(
+	root: string = installRoot(),
+	compiled: boolean = isCompiled(),
+): InstallKind | null {
 	const bunInstall = process.env.BUN_INSTALL ?? join(homedir(), ".bun");
 	if (root.startsWith(bunInstall + sep) || root.split(sep).includes(".bun")) return "bun";
 	if (root.split(sep).includes("node_modules")) return "npm";
-	return null;
+	return compiled ? "binary" : null;
 }
 
-export function installCommand(kind: InstallKind, version: string): string[] {
+export function installCommand(kind: "bun" | "npm", version: string): string[] {
 	return kind === "bun"
 		? ["bun", "add", "-g", `onepatch@${version}`]
 		: ["npm", "install", "-g", `onepatch@${version}`];
 }
 
+// The `<os>-<arch>` suffix of the release asset built for this machine; null
+// when no prebuilt binary exists for it.
+export function releaseTarget(
+	platform: string = process.platform,
+	arch: string = process.arch,
+): string | null {
+	const os =
+		platform === "darwin"
+			? "darwin"
+			: platform === "linux"
+				? "linux"
+				: platform === "win32"
+					? "windows"
+					: null;
+	if (os === null || (arch !== "x64" && arch !== "arm64")) return null;
+	if (os === "windows" && arch !== "x64") return null;
+	return `${os}-${arch}`;
+}
+
+export function assetName(target: string): string {
+	return `onepatch-${target}.tar.gz`;
+}
+
+export function assetUrl(version: string, target: string, base: string = RELEASE_BASE): string {
+	return `${base}/v${version}/${assetName(target)}`;
+}
+
+// The hex digest recorded for `filename` in a `sha256sum`-style listing.
+export function parseSha256Sums(listing: string, filename: string): string | null {
+	for (const line of listing.split("\n")) {
+		const m = /^([0-9a-f]{64})\s+\*?(.+)$/.exec(line.trim());
+		if (m && m[2] === filename) return m[1] ?? null;
+	}
+	return null;
+}
+
 export type UpdateState = {
 	checkedAt?: number;
 	latest?: string;
@@ -113,18 +153,62 @@ export function decideUpdateAction(state: UpdateState, current: string, now: num
 }
 
 export async function fetchLatestVersion(fetchImpl: typeof fetch = fetch): Promise<string> {
-	const res = await fetchImpl("https://registry.npmjs.org/onepatch/latest", {
+	const res = await fetchImpl(`${RELEASE_BASE}/latest`, {
 		headers: { accept: "application/json" },
 		signal: AbortSignal.timeout(10_000),
 	});
-	if (!res.ok) throw new Error(`npm registry answered ${res.status} for onepatch@latest`);
+	if (!res.ok) throw new Error(`release host answered ${res.status} for latest`);
 	const doc = (await res.json()) as { version?: unknown };
 	if (typeof doc.version !== "string") {
-		throw new Error("npm registry returned a manifest without a version");
+		throw new Error("release host returned a latest document without a version");
 	}
 	return doc.version;
 }
 
+async function fetchOk(url: string): Promise<Response> {
+	const res = await fetch(url, { signal: AbortSignal.timeout(120_000) });
+	if (!res.ok) throw new Error(`${url} answered ${res.status}`);
+	return res;
+}
+
+// Replace the running standalone binary with the released `version`. The
+// tarball is checked against the release's SHA256SUMS before anything on disk
+// changes, staged next to the binary (same filesystem, so the final rename is
+// atomic), and swapped in with one rename. A process already running keeps
+// its old inode; the next invocation gets the new file.
+export async function replaceBinary(version: string): Promise<void> {
+	const target = releaseTarget();
+	if (target === null) {
+		throw new Error(`no prebuilt onepatch binary for ${process.platform}/${process.arch}`);
+	}
+	if (target.startsWith("windows")) {
+		throw new Error("self-update isn't available on Windows yet; re-run the installer instead");
+	}
+	const sums = await (await fetchOk(`${RELEASE_BASE}/v${version}/SHA256SUMS`)).text();
+	const expected = parseSha256Sums(sums, assetName(target));
+	if (expected === null) throw new Error(`release v${version} has no checksum for ${target}`);
+	const tarball = new Uint8Array(await (await fetchOk(assetUrl(version, target))).arrayBuffer());
+	const actual = new Bun.CryptoHasher("sha256").update(tarball).digest("hex");
+	if (actual !== expected) {
+		throw new Error(
+			`checksum mismatch for ${assetName(target)}: expected ${expected}, got ${actual}`,
+		);
+	}
+	const real = installRoot();
+	const stage = join(dirname(real), `.onepatch-update-${process.pid}`);
+	mkdirSync(stage, { recursive: true });
+	try {
+		const archive = join(stage, assetName(target));
+		writeFileSync(archive, tarball);
+		const tar = Bun.spawn({ cmd: ["tar", "-xzf", archive, "-C", stage], stdout: "ignore" });
+		if ((await tar.exited) !== 0) throw new Error("tar failed to extract the release archive");
+		chmodSync(join(stage, "onepatch"), 0o755);
+		renameSync(join(stage, "onepatch"), real);
+	} finally {
+		rmSync(stage, { recursive: true, force: true });
+	}
+}
+
 function spawnDetached(cmd: string[]): void {
 	Bun.spawn({ cmd, stdin: "ignore", stdout: "ignore", stderr: "ignore" }).unref();
 }
@@ -141,7 +225,9 @@ export function maybeAutoUpdate(): void {
 		if (action.kind === "install") {
 			// Stamp before spawning so parallel invocations don't dogpile.
 			writeUpdateState({ ...state, installStartedAt: Date.now() });
-			spawnDetached(installCommand(kind, action.latest));
+			spawnDetached(
+				kind === "binary" ? selfCommand(["update"]) : installCommand(kind, action.latest),
+			);
 			console.error(
 				`onepatch ${currentVersion()} → ${action.latest} is installing in the background ` +
 					"(ONEPATCH_NO_UPDATE=1 disables this).",
@@ -149,7 +235,7 @@ export function maybeAutoUpdate(): void {
 		} else if (action.kind === "check") {
 			// Refresh the cache off-process: `onepatch update --check` fetches the
 			// registry and writes the state file, costing this invocation nothing.
-			spawnDetached([process.execPath, join(packageRoot, "src", "cli.ts"), "update", "--check"]);
+			spawnDetached(selfCommand(["update", "--check"]));
 		}
 	} catch {
 		// Auto-update is strictly best-effort; the user's command always wins.
@@ -177,11 +263,16 @@ export async function runUpdate(opts: { checkOnly: boolean }): Promise<void> {
 		);
 		return;
 	}
-	const cmd = installCommand(kind, latest);
-	console.log(`Updating onepatch ${current} → ${latest} (${cmd.join(" ")})…`);
-	const proc = Bun.spawn({ cmd, stdin: "ignore", stdout: "inherit", stderr: "inherit" });
-	const code = await proc.exited;
-	if (code !== 0) throw new Error(`${cmd[0]} exited with code ${code}`);
+	if (kind === "binary") {
+		console.log(`Updating onepatch ${current} → ${latest} (${installRoot()})…`);
+		await replaceBinary(latest);
+	} else {
+		const cmd = installCommand(kind, latest);
+		console.log(`Updating onepatch ${current} → ${latest} (${cmd.join(" ")})…`);
+		const proc = Bun.spawn({ cmd, stdin: "ignore", stdout: "inherit", stderr: "inherit" });
+		const code = await proc.exited;
+		if (code !== 0) throw new Error(`${cmd[0]} exited with code ${code}`);
+	}
 	writeUpdateState({ checkedAt: Date.now(), latest });
 	console.log(`onepatch ${latest} installed.`);
 }

package/src/credentials.test.ts

@@ -1,49 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { mkdtempSync, rmSync, statSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import {
-	credentialsPath,
-	deleteCredentials,
-	loadCredentials,
-	saveCredentials,
-} from "./credentials";
-
-const CREDS = {
-	clientId: "client_01TEST",
-	accessToken: "at",
-	refreshToken: "rt",
-	email: "dev@example.com",
-};
-
-let dir: string;
-
-beforeEach(() => {
-	dir = mkdtempSync(join(tmpdir(), "onepatch-cli-test-"));
-	process.env.ONEPATCH_CONFIG_DIR = dir;
-});
-
-afterEach(() => {
-	delete process.env.ONEPATCH_CONFIG_DIR;
-	rmSync(dir, { recursive: true, force: true });
-});
-
-describe("credential store", () => {
-	test("round-trips per API base and deletes cleanly", () => {
-		expect(loadCredentials("https://a.example")).toBeNull();
-		saveCredentials("https://a.example", CREDS);
-		saveCredentials("https://b.example", { ...CREDS, email: "other@example.com" });
-		expect(loadCredentials("https://a.example")?.email).toBe("dev@example.com");
-		expect(loadCredentials("https://b.example")?.email).toBe("other@example.com");
-		expect(deleteCredentials("https://a.example")).toBe(true);
-		expect(loadCredentials("https://a.example")).toBeNull();
-		expect(loadCredentials("https://b.example")?.email).toBe("other@example.com");
-		expect(deleteCredentials("https://a.example")).toBe(false);
-	});
-
-	test("credential file is written 0600", () => {
-		saveCredentials("https://a.example", CREDS);
-		const mode = statSync(credentialsPath()).mode & 0o777;
-		expect(mode).toBe(0o600);
-	});
-});

package/src/hook.test.ts

@@ -1,67 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { buildContextLine, decideHookAction, HOOK_CACHE_TTL_MS } from "./hook";
-
-// Verbatim shape of the CLI's list_incidents digest.
-const DIGEST = `86 open incidents · newest activity first
-115 closed/folded incidents hidden — scope: "all" lists them
-showing the newest 5 — raise limit for older
-
-INC-193 · unjudged · waiting on time · false alarm · A stale staging deploy failure is still flagged · updated 2026-09-01T15:04Z
-INC-183 · unjudged · waiting on human · Search intermittently degraded · updated 2026-09-01T14:58Z
-INC-192 · P3 · waiting on human · false alarm · Stale boot-time probe · updated 2026-09-01T12:51Z
-incident-3de5a4e4 · no incident document yet (read_chat incident-3de5a4e4) · updated 2026-08-30T05:26Z`;
-
-describe("buildContextLine", () => {
-	test("keeps the count and the two newest INC rows, drops timestamps", () => {
-		const line = buildContextLine(DIGEST);
-		expect(line).toContain("86 open incidents");
-		expect(line).toContain(
-			"INC-193 · unjudged · waiting on time · false alarm · A stale staging deploy failure is still flagged",
-		);
-		expect(line).toContain("INC-183");
-		expect(line).not.toContain("INC-192");
-		expect(line).not.toContain("updated 2026");
-		expect(line).not.toContain("incident-3de5a4e4");
-		expect(line.split("\n")).toHaveLength(1);
-	});
-
-	test("injects nothing when no incidents are open", () => {
-		expect(buildContextLine("0 open incidents · newest activity first\n")).toBe("");
-		expect(buildContextLine("")).toBe("");
-	});
-
-	test("singularizes a lone incident", () => {
-		const line = buildContextLine(
-			"1 open incident · newest\n\nINC-7 · P1 · waiting on agent · x · updated now",
-		);
-		expect(line).toContain("1 open incident —");
-	});
-});
-
-describe("decideHookAction", () => {
-	const now = 1_000_000_000_000;
-
-	test("fresh cache: emit, no refresh", () => {
-		const a = decideHookAction({ fetchedAt: now - 1000, line: "[onepatch] hi" }, now);
-		expect(a).toEqual({ emit: "[onepatch] hi", refresh: false });
-	});
-
-	test("stale cache: emit the stale line AND refresh", () => {
-		const a = decideHookAction({ fetchedAt: now - HOOK_CACHE_TTL_MS - 1, line: "old" }, now);
-		expect(a).toEqual({ emit: "old", refresh: true });
-	});
-
-	test("empty cache: emit nothing, refresh", () => {
-		expect(decideHookAction({}, now)).toEqual({ emit: "", refresh: true });
-	});
-
-	test("refresh already in flight is not re-spawned", () => {
-		const a = decideHookAction({ refreshStartedAt: now - 1000 }, now);
-		expect(a.refresh).toBe(false);
-	});
-
-	test("a stuck refresh stops suppressing after the retry window", () => {
-		const a = decideHookAction({ refreshStartedAt: now - 10 * 60 * 1000 }, now);
-		expect(a.refresh).toBe(true);
-	});
-});

package/src/install.test.ts

@@ -1,67 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { ensureCodexMcpServer, ensureCursorMcpServer } from "./install";
-
-const URL = "https://app.onepatch.dev/mcp";
-
-describe("ensureCodexMcpServer", () => {
-	test("appends a block to an empty config", () => {
-		const r = ensureCodexMcpServer("", URL);
-		expect(r.changed).toBe(true);
-		expect(r.text).toBe(`[mcp_servers.onepatch]\nurl = "${URL}"\n`);
-	});
-
-	test("separates the block from existing content with a blank line", () => {
-		const r = ensureCodexMcpServer('model = "gpt-5"\n', URL);
-		expect(r.changed).toBe(true);
-		expect(r.text).toBe(`model = "gpt-5"\n\n[mcp_servers.onepatch]\nurl = "${URL}"\n`);
-	});
-
-	test("adds a newline when the file lacks a trailing one", () => {
-		const r = ensureCodexMcpServer('model = "gpt-5"', URL);
-		expect(r.text.startsWith('model = "gpt-5"\n\n[')).toBe(true);
-	});
-
-	test("is idempotent", () => {
-		const once = ensureCodexMcpServer("", URL);
-		const twice = ensureCodexMcpServer(once.text, URL);
-		expect(twice.changed).toBe(false);
-		expect(twice.text).toBe(once.text);
-	});
-
-	test("respects an existing block even with different settings", () => {
-		const existing = '[mcp_servers.onepatch]\nurl = "https://elsewhere.example/mcp"\n';
-		expect(ensureCodexMcpServer(existing, URL).changed).toBe(false);
-	});
-
-	test("does not match other servers or commented blocks", () => {
-		const other = '[mcp_servers.other]\nurl = "x"\n# [mcp_servers.onepatch] disabled\n';
-		expect(ensureCodexMcpServer(other, URL).changed).toBe(true);
-	});
-});
-
-describe("ensureCursorMcpServer", () => {
-	test("creates the document when the file is missing", () => {
-		const r = ensureCursorMcpServer(null, URL);
-		expect(r.changed).toBe(true);
-		expect(JSON.parse(r.text)).toEqual({ mcpServers: { onepatch: { url: URL } } });
-	});
-
-	test("preserves existing servers and unknown top-level keys", () => {
-		const existing = JSON.stringify({ mcpServers: { foo: { command: "foo" } }, other: 1 });
-		const r = ensureCursorMcpServer(existing, URL);
-		expect(r.changed).toBe(true);
-		expect(JSON.parse(r.text)).toEqual({
-			mcpServers: { foo: { command: "foo" }, onepatch: { url: URL } },
-			other: 1,
-		});
-	});
-
-	test("is idempotent, even against a user-customized entry", () => {
-		const existing = JSON.stringify({ mcpServers: { onepatch: { url: "https://custom/mcp" } } });
-		expect(ensureCursorMcpServer(existing, URL).changed).toBe(false);
-	});
-
-	test("refuses to clobber an unparseable file", () => {
-		expect(() => ensureCursorMcpServer("{not json", URL)).toThrow(/not valid JSON/);
-	});
-});

package/src/update.test.ts

@@ -1,128 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import {
-	CHECK_INTERVAL_MS,
-	compareVersions,
-	decideUpdateAction,
-	detectInstallKind,
-	fetchLatestVersion,
-	INSTALL_RETRY_MS,
-	installCommand,
-} from "./update";
-
-describe("compareVersions", () => {
-	test("orders plain versions", () => {
-		expect(compareVersions("0.2.0", "0.3.0")).toBeLessThan(0);
-		expect(compareVersions("0.3.0", "0.2.9")).toBeGreaterThan(0);
-		expect(compareVersions("1.0.0", "0.99.99")).toBeGreaterThan(0);
-		expect(compareVersions("0.2.0", "0.2.0")).toBe(0);
-	});
-
-	test("compares numerically, not lexically", () => {
-		expect(compareVersions("0.10.0", "0.9.0")).toBeGreaterThan(0);
-	});
-
-	test("prerelease sorts below its release", () => {
-		expect(compareVersions("1.0.0-beta.1", "1.0.0")).toBeLessThan(0);
-		expect(compareVersions("1.0.0", "1.0.0-rc.2")).toBeGreaterThan(0);
-	});
-
-	test("tolerates short versions", () => {
-		expect(compareVersions("1.0", "1.0.0")).toBe(0);
-		expect(compareVersions("1", "1.0.1")).toBeLessThan(0);
-	});
-});
-
-describe("decideUpdateAction", () => {
-	const now = 1_700_000_000_000;
-
-	test("empty state asks for a background check", () => {
-		expect(decideUpdateAction({}, "0.2.0", now)).toEqual({ kind: "check" });
-	});
-
-	test("fresh state with no newer version does nothing", () => {
-		expect(decideUpdateAction({ checkedAt: now - 1000, latest: "0.2.0" }, "0.2.0", now)).toEqual({
-			kind: "none",
-		});
-	});
-
-	test("stale state asks for a background check", () => {
-		expect(
-			decideUpdateAction({ checkedAt: now - CHECK_INTERVAL_MS - 1, latest: "0.2.0" }, "0.2.0", now),
-		).toEqual({ kind: "check" });
-	});
-
-	test("known newer version installs", () => {
-		expect(decideUpdateAction({ checkedAt: now, latest: "0.3.0" }, "0.2.0", now)).toEqual({
-			kind: "install",
-			latest: "0.3.0",
-		});
-	});
-
-	test("an in-flight install suppresses re-spawning", () => {
-		expect(
-			decideUpdateAction(
-				{ checkedAt: now, latest: "0.3.0", installStartedAt: now - 1000 },
-				"0.2.0",
-				now,
-			),
-		).toEqual({ kind: "none" });
-	});
-
-	test("a failed install retries after the guard window", () => {
-		expect(
-			decideUpdateAction(
-				{ checkedAt: now, latest: "0.3.0", installStartedAt: now - INSTALL_RETRY_MS - 1 },
-				"0.2.0",
-				now,
-			),
-		).toEqual({ kind: "install", latest: "0.3.0" });
-	});
-
-	test("a cached latest older than current never installs", () => {
-		expect(decideUpdateAction({ checkedAt: now, latest: "0.1.0" }, "0.2.0", now)).toEqual({
-			kind: "none",
-		});
-	});
-});
-
-describe("detectInstallKind", () => {
-	test("bun global install", () => {
-		expect(
-			detectInstallKind(join(homedir(), ".bun", "install", "global", "node_modules", "onepatch")),
-		).toBe("bun");
-	});
-
-	test("npm global install", () => {
-		expect(detectInstallKind("/usr/local/lib/node_modules/onepatch")).toBe("npm");
-	});
-
-	test("source checkout is not updatable", () => {
-		expect(detectInstallKind("/Users/someone/dev/onepatch-cli")).toBeNull();
-	});
-});
-
-describe("installCommand", () => {
-	test("pins the discovered version, not the latest tag", () => {
-		expect(installCommand("bun", "0.3.0")).toEqual(["bun", "add", "-g", "onepatch@0.3.0"]);
-		expect(installCommand("npm", "0.3.0")).toEqual(["npm", "install", "-g", "onepatch@0.3.0"]);
-	});
-});
-
-describe("fetchLatestVersion", () => {
-	test("reads the version from the registry manifest", async () => {
-		const fake = (async () => Response.json({ version: "0.4.2" })) as unknown as typeof fetch;
-		expect(await fetchLatestVersion(fake)).toBe("0.4.2");
-	});
-
-	test("rejects a manifest without a version", async () => {
-		const fake = (async () => Response.json({})) as unknown as typeof fetch;
-		await expect(fetchLatestVersion(fake)).rejects.toThrow("without a version");
-	});
-
-	test("rejects a non-2xx answer", async () => {
-		const fake = (async () => new Response("nope", { status: 503 })) as unknown as typeof fetch;
-		await expect(fetchLatestVersion(fake)).rejects.toThrow("503");
-	});
-});

package/src/workos.test.ts

@@ -1,87 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { type DeviceAuthorization, pollForDeviceToken, refreshTokens } from "./workos";
-
-const DEVICE: DeviceAuthorization = {
-	device_code: "dev_123",
-	user_code: "ABCD-1234",
-	verification_uri: "https://auth.example/device",
-	verification_uri_complete: "https://auth.example/device?code=ABCD-1234",
-	expires_in: 300,
-	interval: 5,
-};
-
-// A fetch stub that answers the authenticate endpoint from a scripted queue.
-function scriptedFetch(responses: Array<{ status: number; body: unknown }>): {
-	fetchImpl: typeof fetch;
-	requests: URLSearchParams[];
-} {
-	const requests: URLSearchParams[] = [];
-	const fetchImpl = (async (_url: string | URL | Request, init?: RequestInit) => {
-		requests.push(new URLSearchParams(String(init?.body ?? "")));
-		const next = responses.shift();
-		if (!next) throw new Error("scripted fetch exhausted");
-		return Response.json(next.body, { status: next.status });
-	}) as typeof fetch;
-	return { fetchImpl, requests };
-}
-
-const TOKENS = {
-	access_token: "at_new",
-	refresh_token: "rt_new",
-	user: { id: "user_1", email: "dev@example.com" },
-	organization_id: "org_1",
-};
-
-describe("pollForDeviceToken", () => {
-	test("keeps polling through authorization_pending, widens on slow_down, then succeeds", async () => {
-		const sleeps: number[] = [];
-		const { fetchImpl, requests } = scriptedFetch([
-			{ status: 400, body: { error: "authorization_pending" } },
-			{ status: 400, body: { error: "slow_down" } },
-			{ status: 200, body: TOKENS },
-		]);
-		const result = await pollForDeviceToken("client_01TEST", DEVICE, {
-			fetchImpl,
-			sleep: async (ms) => {
-				sleeps.push(ms);
-			},
-		});
-		expect(result.accessToken).toBe("at_new");
-		expect(result.refreshToken).toBe("rt_new");
-		expect(result.user?.email).toBe("dev@example.com");
-		expect(result.organizationId).toBe("org_1");
-		// 5s while pending, then 5+5=10s after slow_down.
-		expect(sleeps).toEqual([5000, 10000]);
-		expect(requests[0]?.get("grant_type")).toBe("urn:ietf:params:oauth:grant-type:device_code");
-		expect(requests[0]?.get("device_code")).toBe("dev_123");
-	});
-
-	test("access_denied stops with a clear error", async () => {
-		const { fetchImpl } = scriptedFetch([{ status: 400, body: { error: "access_denied" } }]);
-		await expect(
-			pollForDeviceToken("client_01TEST", DEVICE, { fetchImpl, sleep: async () => {} }),
-		).rejects.toThrow(/denied/);
-	});
-
-	test("expired_token tells the user to log in again", async () => {
-		const { fetchImpl } = scriptedFetch([{ status: 400, body: { error: "expired_token" } }]);
-		await expect(
-			pollForDeviceToken("client_01TEST", DEVICE, { fetchImpl, sleep: async () => {} }),
-		).rejects.toThrow(/login/);
-	});
-});
-
-describe("refreshTokens", () => {
-	test("sends the refresh grant and parses rotated tokens", async () => {
-		const { fetchImpl, requests } = scriptedFetch([{ status: 200, body: TOKENS }]);
-		const result = await refreshTokens("client_01TEST", "rt_old", fetchImpl);
-		expect(result.refreshToken).toBe("rt_new");
-		expect(requests[0]?.get("grant_type")).toBe("refresh_token");
-		expect(requests[0]?.get("refresh_token")).toBe("rt_old");
-	});
-
-	test("a rejected refresh surfaces as a re-login prompt", async () => {
-		const { fetchImpl } = scriptedFetch([{ status: 400, body: { error: "invalid_grant" } }]);
-		await expect(refreshTokens("client_01TEST", "rt_old", fetchImpl)).rejects.toThrow(/login/);
-	});
-});