pingcode-cli-unofficial 1.8.3 → 1.9.0

package/dist/bin/pingcode.js

@@ -978,7 +978,7 @@ var require_command = __commonJS({
     "use strict";
     var EventEmitter = __require("events").EventEmitter;
     var childProcess = __require("child_process");
-    var path8 = __require("path");
+    var path9 = __require("path");
     var fs = __require("fs");
     var process2 = __require("process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
@@ -1911,9 +1911,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path8.resolve(baseDir, baseName);
+          const localBin = path9.resolve(baseDir, baseName);
           if (fs.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path8.extname(baseName))) return void 0;
+          if (sourceExt.includes(path9.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
             (ext) => fs.existsSync(`${localBin}${ext}`)
           );
@@ -1931,17 +1931,17 @@ Expecting one of '${allowedValues.join("', '")}'`);
           } catch (err) {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path8.resolve(
-            path8.dirname(resolvedScriptPath),
+          executableDir = path9.resolve(
+            path9.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path8.basename(
+            const legacyName = path9.basename(
               this._scriptPath,
-              path8.extname(this._scriptPath)
+              path9.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -1952,7 +1952,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path8.extname(executableFile));
+        launchWithNode = sourceExt.includes(path9.extname(executableFile));
         let proc;
         if (process2.platform !== "win32") {
           if (launchWithNode) {
@@ -2792,7 +2792,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path8.basename(filename, path8.extname(filename));
+        this._name = path9.basename(filename, path9.extname(filename));
         return this;
       }
       /**
@@ -2806,9 +2806,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path9) {
-        if (path9 === void 0) return this._executableDir;
-        this._executableDir = path9;
+      executableDir(path10) {
+        if (path10 === void 0) return this._executableDir;
+        this._executableDir = path10;
         return this;
       }
       /**
@@ -3425,7 +3425,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "1.8.3";
+    VERSION = "1.9.0";
   }
 });
 
@@ -4475,9 +4475,9 @@ var init_catalog = __esm({
 function isMutating(method) {
   return MUTATING.has(method.toUpperCase());
 }
-function buildUrl(apiBase, path8, query) {
+function buildUrl(apiBase, path9, query) {
   const base = apiBase.replace(/\/+$/, "");
-  const relative = path8.startsWith("/") ? path8 : `/${path8}`;
+  const relative = path9.startsWith("/") ? path9 : `/${path9}`;
   const url = new URL(`${base}${relative}`);
   if (query !== void 0) {
     for (const [key, value] of Object.entries(query)) {
@@ -5301,12 +5301,12 @@ function normalizeEnvelope(raw, requested) {
     values
   };
 }
-async function fetchPage(ctx, path8, query = {}, page = {}) {
+async function fetchPage(ctx, path9, query = {}, page = {}) {
   const pageIndex = validatePageIndex(page.pageIndex ?? 0);
   const pageSize = validatePageSize(page.pageSize ?? DEFAULT_PAGE_SIZE);
   const raw = await request(ctx, {
     method: "GET",
-    path: path8,
+    path: path9,
     query: { ...query, page_index: pageIndex, page_size: pageSize }
   });
   return normalizeEnvelope(raw, { pageIndex, pageSize });
@@ -5339,8 +5339,8 @@ async function* walkPages(ctx, fetchOne, options, label) {
     pageIndex += 1;
   }
 }
-async function* paginate(ctx, path8, query = {}, options = {}) {
-  yield* walkPages(ctx, (page) => fetchPage(ctx, path8, query, page), options, "GET-list");
+async function* paginate(ctx, path9, query = {}, options = {}) {
+  yield* walkPages(ctx, (page) => fetchPage(ctx, path9, query, page), options, "GET-list");
 }
 function asReadContext(ctx) {
   return ctx.dryRun ? { ...ctx, dryRun: false } : ctx;
@@ -5356,20 +5356,20 @@ function buildSearchBody(payload, page) {
   body.page_size = page.pageSize;
   return { mode: "query", payload: body };
 }
-async function fetchSearchPage(ctx, path8, payload = {}, page = {}) {
+async function fetchSearchPage(ctx, path9, payload = {}, page = {}) {
   const pageIndex = validatePageIndex(page.pageIndex ?? 0);
   const pageSize = validatePageSize(page.pageSize ?? DEFAULT_PAGE_SIZE);
   const raw = await request(asReadContext(ctx), {
     method: "POST",
-    path: path8,
+    path: path9,
     body: buildSearchBody(payload, { pageIndex, pageSize })
   });
   return normalizeEnvelope(raw, { pageIndex, pageSize });
 }
-async function* searchPaginate(ctx, path8, payload = {}, options = {}) {
+async function* searchPaginate(ctx, path9, payload = {}, options = {}) {
   yield* walkPages(
     ctx,
-    (page) => fetchSearchPage(ctx, path8, payload, page),
+    (page) => fetchSearchPage(ctx, path9, payload, page),
     options,
     "search"
   );
@@ -7087,9 +7087,9 @@ async function loadSuiteTree(ctx, path_, query) {
   }
   const candidates = [];
   for (const [id, node] of nodes) {
-    const path8 = suitePath(nodes, id);
-    const candidate = { id, name: node.name, path: path8 };
-    if (path8 !== void 0 && path8 !== node.name) candidate.aliases = [path8];
+    const path9 = suitePath(nodes, id);
+    const candidate = { id, name: node.name, path: path9 };
+    if (path9 !== void 0 && path9 !== node.name) candidate.aliases = [path9];
     candidates.push(candidate);
   }
   return candidates;
@@ -7861,29 +7861,29 @@ endpoints; a wiki page and a code branch are the two with no recovery path at al
   }
 }
 async function runVerb(method, pathArgument, flags, self) {
-  const { candidates, path: path8 } = resolveEntry2(method, pathArgument);
+  const { candidates, path: path9 } = resolveEntry2(method, pathArgument);
   const { ctx } = contextFor(self);
   refuseUserTokenEndpoint(ctx, candidates);
   const query = parseQueryFlags(flags.query);
-  refuseUnconfirmedDelete(method, path8, query, flags);
+  refuseUnconfirmedDelete(method, path9, query, flags);
   const body = await readBodyFlags(flags);
   const entry = chooseEntry(candidates, query, body);
   const paging = readPagingFor(entry, flags);
   try {
-    await send(ctx, entry, path8, query, body, paging);
+    await send(ctx, entry, path9, query, body, paging);
   } catch (error) {
     if (error instanceof PermissionError) errLine(paint.dim(declaredScopeLine(entry)));
     throw error;
   }
 }
-async function send(ctx, entry, path8, query, body, paging) {
+async function send(ctx, entry, path9, query, body, paging) {
   if (entry.paged === "search") {
-    await sendSearch(ctx, path8, body, paging);
+    await sendSearch(ctx, path9, body, paging);
     return;
   }
   if (entry.paged === "query" && paging.all) {
     const values = await collect(
-      paginate(ctx, path8, query, {
+      paginate(ctx, path9, query, {
         pageSize: paging.pageSize,
         startPage: paging.pageIndex,
         limit: paging.limit
@@ -7894,17 +7894,17 @@ async function send(ctx, entry, path8, query, body, paging) {
   }
   const raw = await request(ctx, {
     method: entry.method,
-    path: path8,
+    path: path9,
     query: paging.requested ? { ...query, page_index: paging.pageIndex, page_size: paging.pageSize } : query,
     ...body === void 0 ? {} : { body }
   });
   printResponse(raw);
 }
-async function sendSearch(ctx, path8, body, paging) {
+async function sendSearch(ctx, path9, body, paging) {
   const payload = searchPayloadOf(body);
   if (paging.all) {
     const values = await collect(
-      searchPaginate(ctx, path8, payload, {
+      searchPaginate(ctx, path9, payload, {
         pageSize: paging.pageSize,
         startPage: paging.pageIndex,
         limit: paging.limit
@@ -7913,7 +7913,7 @@ async function sendSearch(ctx, path8, body, paging) {
     printJson({ values, count: values.length, all: true });
     return;
   }
-  const page = await fetchSearchPage(ctx, path8, payload, {
+  const page = await fetchSearchPage(ctx, path9, payload, {
     pageIndex: paging.pageIndex,
     pageSize: paging.pageSize
   });
@@ -7947,8 +7947,8 @@ function resolveEntry2(method, pathArgument) {
       hint: `drop everything from "?" and pass the parameters as --query key=value (repeatable), so they are serialised the same way every other command does it`
     });
   }
-  const path8 = normalizePath(raw);
-  const unfilled = unfilledPathParams(path8);
+  const path9 = normalizePath(raw);
+  const unfilled = unfilledPathParams(path9);
   if (unfilled.length > 0) {
     throw new UsageError(
       `the path still contains the placeholder${unfilled.length > 1 ? "s" : ""} ${unfilled.map((name) => `{${name}}`).join(", ")}`,
@@ -7957,32 +7957,32 @@ function resolveEntry2(method, pathArgument) {
       }
     );
   }
-  const onPath = matchPath(path8);
-  if (onPath.length === 0) throw unknownPath(path8);
+  const onPath = matchPath(path9);
+  if (onPath.length === 0) throw unknownPath(path9);
   const candidates = onPath.filter((candidate) => candidate.method === method);
   if (candidates.length === 0) {
-    const supported = methodsFor(path8);
-    throw new UsageError(`${method} ${path8} is not a documented endpoint`, {
+    const supported = methodsFor(path9);
+    throw new UsageError(`${method} ${path9} is not a documented endpoint`, {
       hint: `that path supports ${supported.join(", ")} \u2014 this API is missing several symmetric operations on purpose (there is no project delete, no sprint delete, and nothing in \u4EA7\u54C1\u7BA1\u7406 can be deleted at all)`
     });
   }
-  return { candidates, path: path8 };
+  return { candidates, path: path9 };
 }
-function unknownPath(path8) {
-  if (segmentsOf2(path8).includes("authorize")) {
+function unknownPath(path9) {
+  if (segmentsOf2(path9).includes("authorize")) {
     return new UsageError(
-      `${path8} is the browser authorization page of the OAuth2 authorization-code flow, not a REST endpoint: it renders HTML for a human to click and redirects, it returns no JSON, and it is not under /v1`,
+      `${path9} is the browser authorization page of the OAuth2 authorization-code flow, not a REST endpoint: it renders HTML for a human to click and redirects, it returns no JSON, and it is not under /v1`,
       { hint: AUTHORIZE_HINT }
     );
   }
-  const suggestions = nearestPaths(path8);
-  const hint = suggestions.length === 0 ? `no documented path has ${segmentsOf2(path8).length} segments like this one \u2014 search the catalog with \`pingcode api list --search <text>\`` : `did you mean ${suggestions.join(" , ")} ? \u2014 or search with \`pingcode api list --search <text>\``;
-  return new UsageError(`${path8} is not in the endpoint catalog (459 documented v1 endpoints)`, {
+  const suggestions = nearestPaths(path9);
+  const hint = suggestions.length === 0 ? `no documented path has ${segmentsOf2(path9).length} segments like this one \u2014 search the catalog with \`pingcode api list --search <text>\`` : `did you mean ${suggestions.join(" , ")} ? \u2014 or search with \`pingcode api list --search <text>\``;
+  return new UsageError(`${path9} is not in the endpoint catalog (459 documented v1 endpoints)`, {
     hint
   });
 }
-function nearestPaths(path8) {
-  const actual = segmentsOf2(path8);
+function nearestPaths(path9) {
+  const actual = segmentsOf2(path9);
   const scored = /* @__PURE__ */ new Map();
   for (const entry of CATALOG2) {
     const template = segmentsOf2(entry.path);
@@ -8011,8 +8011,8 @@ function editDistance(a, b) {
   }
   return previous[b.length] ?? Math.max(a.length, b.length);
 }
-function segmentsOf2(path8) {
-  return path8.split("/").filter((segment) => segment !== "");
+function segmentsOf2(path9) {
+  return path9.split("/").filter((segment) => segment !== "");
 }
 function isPlaceholder2(segment) {
   return segment.startsWith("{") && segment.endsWith("}");
@@ -8029,9 +8029,9 @@ function refuseUserTokenEndpoint(ctx, candidates) {
     }
   );
 }
-function refuseUnconfirmedDelete(method, path8, query, flags) {
+function refuseUnconfirmedDelete(method, path9, query, flags) {
   if (method !== "DELETE" || flags.yes === true) return;
-  throw new UsageError(`refusing to send DELETE ${path8}${displayQuery(query)} without --yes`, {
+  throw new UsageError(`refusing to send DELETE ${path9}${displayQuery(query)} without --yes`, {
     hint: "re-run with --yes to send it, or with --yes --dry-run to print the full request plan without sending anything"
   });
 }
@@ -8193,22 +8193,22 @@ function registerDescribe(api) {
     "\nAn id is exact; a method + path is matched through the same wildcard rules the\nexecutor uses. GET /v1/auth/token is the one path three entries share (the three\ngrants), so address those by id.\n--json prints the catalog entry verbatim.\n"
   );
   addGlobalOptions(command, { hidden: true }).action(
-    (idOrMethod, path8, _flags, self) => {
+    (idOrMethod, path9, _flags, self) => {
       const { ctx } = contextFor(self);
-      const entry = lookupForDescribe(idOrMethod, path8);
+      const entry = lookupForDescribe(idOrMethod, path9);
       printEntry(entry, modeOf(ctx));
     }
   );
 }
-function lookupForDescribe(idOrMethod, path8) {
-  if (path8 !== void 0) {
+function lookupForDescribe(idOrMethod, path9) {
+  if (path9 !== void 0) {
     const method = idOrMethod.trim().toUpperCase();
     if (!METHODS.includes(method)) {
       throw new UsageError(`"${idOrMethod}" is not an HTTP method`, {
         hint: `the methods are ${METHODS.join(", ")} \u2014 or pass a single catalog id instead`
       });
     }
-    const normalized = normalizePath(path8.trim());
+    const normalized = normalizePath(path9.trim());
     const matches = matchPath(normalized).filter((entry2) => entry2.method === method);
     const entry = matches[0];
     if (entry === void 0) {
@@ -8385,26 +8385,26 @@ function parseRefList(raw) {
 function parseProperties(raw) {
   return typeof raw === "object" && raw !== null && !Array.isArray(raw) ? raw : void 0;
 }
-async function fetchPageOf(ctx, path8, query, page, parse) {
-  const raw = await fetchPage(ctx, path8, query, page);
+async function fetchPageOf(ctx, path9, query, page, parse) {
+  const raw = await fetchPage(ctx, path9, query, page);
   return { ...raw, values: raw.values.map(parse) };
 }
-async function* iterateOf(ctx, path8, query, options, parse) {
-  for await (const raw of paginate(ctx, path8, query, options)) {
+async function* iterateOf(ctx, path9, query, options, parse) {
+  for await (const raw of paginate(ctx, path9, query, options)) {
     yield parse(raw);
   }
 }
-async function listAllOf(ctx, path8, query, parse, options = {}) {
+async function listAllOf(ctx, path9, query, parse, options = {}) {
   return await collect(
-    iterateOf(ctx, path8, query, { pageSize: 100, limit: 1e3, ...options }, parse)
+    iterateOf(ctx, path9, query, { pageSize: 100, limit: 1e3, ...options }, parse)
   );
 }
-async function fetchSearchPageOf(ctx, path8, payload, page, parse) {
-  const raw = await fetchSearchPage(ctx, path8, payload, page);
+async function fetchSearchPageOf(ctx, path9, payload, page, parse) {
+  const raw = await fetchSearchPage(ctx, path9, payload, page);
   return { ...raw, values: raw.values.map(parse) };
 }
-async function* iterateSearchOf(ctx, path8, payload, options, parse) {
-  for await (const raw of searchPaginate(ctx, path8, payload, options)) {
+async function* iterateSearchOf(ctx, path9, payload, options, parse) {
+  for await (const raw of searchPaginate(ctx, path9, payload, options)) {
     yield parse(raw);
   }
 }
@@ -12936,13 +12936,13 @@ var init_projectMember = __esm({
 
 // src/cli/commands/_shared/bulkEntries.ts
 async function readBulkEntries(source, options) {
-  const path8 = source.file?.trim() ?? "";
-  if (path8 === "") {
+  const path9 = source.file?.trim() ?? "";
+  if (path9 === "") {
     throw new UsageError("--file <path|-> is required", {
       hint: "pass a JSON array of entries, or - to read it from stdin. Each entry needs name, start and end; project and assignee may be shared with --project / --assignee"
     });
   }
-  const document = path8 === "-" ? await readJsonStdin() : parseJsonDocument(await readTextFile(path8, "--file"), `--file ${path8}`);
+  const document = path9 === "-" ? await readJsonStdin() : parseJsonDocument(await readTextFile(path9, "--file"), `--file ${path9}`);
   const list = unwrap(document, options.wrapperKey);
   if (list.length === 0) {
     throw new UsageError("--file contained no entries", {
@@ -17614,21 +17614,9 @@ function skillTargets(env = process.env) {
     }
   ];
 }
-function installDir(env = process.env) {
-  if (process.platform === "win32") {
-    const base = env["LOCALAPPDATA"];
-    const root3 = base !== void 0 && base !== "" ? base : path4.join(os2.homedir(), "AppData", "Local");
-    return path4.join(root3, APP_NAME);
-  }
-  const xdg = env["XDG_DATA_HOME"];
-  const root2 = xdg !== void 0 && xdg !== "" ? xdg : path4.join(os2.homedir(), ".local", "share");
-  return path4.join(root2, APP_NAME);
-}
-var APP_NAME;
 var init_paths = __esm({
   "src/core/paths.ts"() {
     "use strict";
-    APP_NAME = "pingcode-cli";
   }
 });
 
@@ -17639,18 +17627,21 @@ import {
   mkdirSync as mkdirSync3,
   readFileSync as readFileSync3,
   readdirSync,
-  renameSync as renameSync2,
   rmSync as rmSync3,
   statSync as statSync2,
   utimesSync,
   writeFileSync as writeFileSync3
 } from "fs";
 import { execFileSync } from "child_process";
-import os3 from "os";
 import path5 from "path";
-import { gunzipSync } from "zlib";
+import { fileURLToPath } from "url";
 function defaultExec(file, args) {
-  return execFileSync(file, args, { encoding: "utf8" });
+  const isWindowsBatch = /\.(cmd|bat)$/i.test(file);
+  return execFileSync(file, args, {
+    encoding: "utf8",
+    stdio: ["inherit", "pipe", "pipe"],
+    ...isWindowsBatch ? { shell: true } : {}
+  });
 }
 function defaultFetch(input, init) {
   return init === void 0 ? globalThis.fetch(input) : globalThis.fetch(input, init);
@@ -17711,180 +17702,82 @@ async function fetchLatestInfo(fetchFn = defaultFetch) {
   }
   return { version: latest, tarballUrl };
 }
-async function downloadTarball(url, fetchFn = defaultFetch) {
-  let response;
-  try {
-    response = await fetchFn(url, { signal: AbortSignal.timeout(NETWORK_TIMEOUT_MS) });
-  } catch (error) {
-    throw new TransportError(`failed to download tarball: ${errorMessage2(error)}`, {
-      cause: error
-    });
-  }
-  if (!response.ok) {
+function resolveNpm() {
+  const binDir = path5.dirname(process.execPath);
+  const candidates = process.platform === "win32" ? [path5.join(binDir, "npm.cmd"), path5.join(binDir, "npm")] : [path5.join(binDir, "npm")];
+  return candidates.find(existsSync2);
+}
+async function installViaNpm(exec, version) {
+  const npm = resolveNpm();
+  if (npm === void 0) {
     throw new TransportError(
-      `tarball download returned HTTP ${response.status}`,
-      { status: response.status }
+      `cannot update: no npm binary found next to the node running this command (tried ${path5.join(path5.dirname(process.execPath), "npm")})`,
+      { hint: `install Node.js, then re-run this command` }
     );
   }
-  if (response.body === null) {
-    throw new TransportError("tarball download returned empty body");
-  }
-  const chunks = [];
-  const reader = response.body.getReader();
-  const MAX_SIZE = 50 * 1024 * 1024;
-  let total = 0;
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    total += value.length;
-    if (total > MAX_SIZE) {
-      throw new TransportError(`tarball exceeds maximum size of ${MAX_SIZE} bytes`);
-    }
-    chunks.push(value);
-  }
-  return Buffer.concat(chunks);
-}
-function extractTarball(buffer, destDir) {
-  const gzipped = gunzipSync(buffer);
-  return extractTar(gzipped, destDir);
-}
-function extractTar(tarBuffer, destDir) {
-  const resolvedDest = path5.resolve(destDir);
-  mkdirSync3(resolvedDest, { recursive: true });
-  const extracted = [];
-  let offset = 0;
-  while (offset < tarBuffer.length) {
-    if (offset + 512 > tarBuffer.length) break;
-    const headerBlock = tarBuffer.subarray(offset, offset + 512);
-    if (headerBlock.every((b) => b === 0)) {
-      break;
-    }
-    const name = readTarString(headerBlock, 0, 100);
-    const typeflag = tarBuffer[offset + 156];
-    const size = readTarNumber(headerBlock, 124, 12);
-    offset += 512;
-    const dataBlocks = Math.ceil(size / 512);
-    const dataOffset = offset;
-    if (typeflag === "5".charCodeAt(0)) {
-      const cleanName = stripPackagePrefix(name);
-      if (cleanName) {
-        const dest = path5.resolve(resolvedDest, cleanName);
-        if (dest.startsWith(resolvedDest + path5.sep) || dest === resolvedDest) {
-          mkdirSync3(dest, { recursive: true });
-        }
-      }
-    } else if (typeflag === "0".charCodeAt(0) || typeflag === 0) {
-      const cleanName = stripPackagePrefix(name);
-      if (cleanName) {
-        const data = tarBuffer.subarray(dataOffset, dataOffset + size);
-        const dest = path5.resolve(resolvedDest, cleanName);
-        if (dest.startsWith(resolvedDest + path5.sep)) {
-          mkdirSync3(path5.dirname(dest), { recursive: true });
-          writeFileSync3(dest, data);
-          extracted.push(cleanName);
-        }
-      }
-    }
-    offset += dataBlocks * 512;
-  }
-  return extracted;
-}
-function stripPackagePrefix(name) {
-  if (name.startsWith("package/")) {
-    return name.slice("package/".length);
-  }
-  return name;
-}
-function readTarString(buf, start, maxLen) {
-  const end = buf.indexOf(0, start);
-  const actualEnd = end < 0 ? start + maxLen : end;
-  return buf.subarray(start, actualEnd).toString("utf8").trim();
-}
-function readTarNumber(buf, start, maxLen) {
-  const str2 = readTarString(buf, start, maxLen);
-  if (str2.charCodeAt(0) === 128) {
-    return 0;
-  }
-  return parseInt(str2, 8) || 0;
-}
-async function atomicReplace(current, staging) {
-  const backup = `${current}.backup`;
-  if (existsSync2(backup)) {
-    rmSync3(backup, { recursive: true, force: true });
-  }
-  const isNested = staging.startsWith(`${current}${path5.sep}`);
-  const incoming = isNested ? `${current}.incoming` : staging;
-  if (isNested) {
-    if (existsSync2(incoming)) rmSync3(incoming, { recursive: true, force: true });
-    try {
-      renameSync2(staging, incoming);
-    } catch (error) {
-      throw new TransportError(
-        `failed to move staging aside: ${errorMessage2(error)}`,
-        { cause: error }
-      );
-    }
-  }
-  if (existsSync2(current)) {
-    try {
-      renameSync2(current, backup);
-    } catch (error) {
-      if (isNested && existsSync2(incoming)) {
-        try {
-          renameSync2(incoming, staging);
-        } catch {
-        }
-      }
-      throw new TransportError(
-        `failed to back up current install: ${errorMessage2(error)}`,
-        { cause: error }
-      );
-    }
-  }
+  const spec = `${PACKAGE_NAME2}@${version}`;
+  let output;
   try {
-    renameSync2(incoming, current);
+    output = exec(npm, ["install", "--global", spec]);
   } catch (error) {
-    try {
-      if (existsSync2(backup)) renameSync2(backup, current);
-    } catch (restoreError) {
-      throw new TransportError(
-        `CRITICAL: update failed AND backup restore failed. Restore manually: mv "${backup}" "${current}". Original error: ${errorMessage2(error)}. Restore error: ${errorMessage2(restoreError)}`,
-        { cause: error }
-      );
-    }
+    const detail = npmOutputOf(error);
     throw new TransportError(
-      `failed to install update (backup restored): ${errorMessage2(error)}`,
+      `npm install --global ${spec} failed (exit ${exitStatusOf(error)}): ${errorMessage2(error)}`,
       {
-        hint: `if needed, restore manually: mv "${backup}" "${current}"`,
+        hint: detail === "" ? `npm printed nothing; try running manually: ${npm} install --global ${spec}` : detail,
         cause: error
       }
     );
   }
-}
-function cleanStaging(stagingDir) {
-  if (existsSync2(stagingDir)) {
-    rmSync3(stagingDir, { recursive: true, force: true });
+  const trimmed = output.trim();
+  if (trimmed !== "") {
+    process.stderr.write(`${output.endsWith("\n") ? output : `${output}
+`}`);
+  }
+  const installed = readInstalledVersion();
+  if (installed !== version) {
+    throw new TransportError(
+      `npm install --global ${spec} exited 0 but the installed version is ${installed ?? "unreadable"}, expected ${version}`,
+      { hint: `verify with: ${npm} list --global --depth=0 ${PACKAGE_NAME2}` }
+    );
   }
 }
-function validateStaging(stagingDir) {
-  const bin = path5.join(stagingDir, "dist", "bin", "pingcode.js");
-  return existsSync2(bin);
+function readInstalledVersion() {
+  try {
+    const raw = readFileSync3(fileURLToPath(new URL("../../package.json", import.meta.url)), "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null) return void 0;
+    const version = parsed.version;
+    return typeof version === "string" ? version : void 0;
+  } catch {
+    return void 0;
+  }
 }
-function writeBufferToFile(destPath, buffer) {
-  writeFileSync3(destPath, buffer);
+function exitStatusOf(error) {
+  if (typeof error === "object" && error !== null && "status" in error) {
+    const status = error.status;
+    if (typeof status === "number") return String(status);
+    if (typeof status === "string" && status !== "") return status;
+  }
+  return "unknown";
 }
-function ensureDir(dirPath) {
-  mkdirSync3(dirPath, { recursive: true });
+function npmOutputOf(error) {
+  if (typeof error !== "object" || error === null) return "";
+  const e = error;
+  return [e.stderr, e.stdout].filter((part) => part !== void 0 && part !== null).map((part) => String(part).trim()).filter((part) => part !== "").join("\n");
 }
 function removeFile(filePath) {
   try {
-    rmSync3(filePath, { recursive: true, force: true });
+    rmSync3(filePath, { force: true });
   } catch {
   }
 }
 function dirExists(dirPath) {
   return existsSync2(dirPath);
 }
+function packageSkillDir() {
+  return fileURLToPath(new URL("../../skills/pingcode", import.meta.url));
+}
 async function syncSkills(sourceDir, targets) {
   const written = [];
   const payload = [];
@@ -17913,43 +17806,6 @@ async function syncSkills(sourceDir, targets) {
   }
   return written;
 }
-function verifyBundle(dir, exec, expectedVersion) {
-  const bin = path5.join(dir, "dist", "bin", "pingcode.js");
-  let reported;
-  try {
-    reported = exec("node", [bin, "--version"]).trim();
-  } catch (error) {
-    throw new TransportError(
-      `failed to verify new installation: ${errorMessage2(error)}`,
-      {
-        hint: `try running manually: node "${bin}" --version`,
-        cause: error
-      }
-    );
-  }
-  if (reported !== expectedVersion) {
-    throw new TransportError(
-      `installed bundle reports version ${reported}, expected ${expectedVersion}`,
-      { hint: `try running manually: node "${bin}" --version` }
-    );
-  }
-  return reported;
-}
-function restoreBackup(current) {
-  const backup = `${current}.backup`;
-  rmSync3(current, { recursive: true, force: true });
-  try {
-    renameSync2(backup, current);
-  } catch (error) {
-    throw new TransportError(
-      `failed to restore the previous install: ${errorMessage2(error)}`,
-      {
-        hint: `restore manually: mv "${backup}" "${current}"`,
-        cause: error
-      }
-    );
-  }
-}
 function acquireLock(dir) {
   const lockPath = path5.join(dir, LOCK_FILENAME);
   try {
@@ -18023,7 +17879,6 @@ function removeHint(dir) {
   removeFile(path5.join(dir, HINT_FILENAME));
 }
 async function runAutoUpdate(env = process.env, fetchFn = defaultFetch, exec = defaultExec) {
-  const dir = installDir(env);
   const stateDir = configDir(env);
   try {
     touchCooldown(stateDir);
@@ -18049,44 +17904,16 @@ async function runAutoUpdate(env = process.env, fetchFn = defaultFetch, exec = d
       return { status: "up-to-date" };
     }
     const newVersion = info.version;
-    const tarballBuffer = await downloadTarball(info.tarballUrl, fetchFn);
-    const stagingDir = path5.join(dir, ".staging");
-    const tmpTarball = path5.join(os3.tmpdir(), `pingcode-cli-${newVersion}.tgz`);
+    await installViaNpm(exec, newVersion);
+    const skillSource = packageSkillDir();
+    if (dirExists(skillSource)) {
+      await syncSkills(skillSource, skillTargets(env));
+    }
     try {
-      writeFileSync3(tmpTarball, tarballBuffer);
-      cleanStaging(stagingDir);
-      mkdirSync3(stagingDir, { recursive: true });
-      extractTarball(tarballBuffer, stagingDir);
-      if (!validateStaging(stagingDir)) {
-        cleanStaging(stagingDir);
-        throw new TransportError("invalid tarball: dist/bin/pingcode.js not found");
-      }
-      try {
-        verifyBundle(stagingDir, exec, newVersion);
-      } catch (error) {
-        cleanStaging(stagingDir);
-        throw error;
-      }
-      await atomicReplace(dir, stagingDir);
-      const skillSource = path5.join(dir, "skills", "pingcode");
-      if (dirExists(skillSource)) {
-        await syncSkills(skillSource, skillTargets(env));
-      }
-      try {
-        verifyBundle(dir, exec, newVersion);
-      } catch (error) {
-        restoreBackup(dir);
-        throw error;
-      }
-      removeFile(`${dir}.backup`);
-      try {
-        removeHint(stateDir);
-      } catch {
-      }
-      return { status: "updated", version: newVersion };
-    } finally {
-      removeFile(tmpTarball);
+      removeHint(stateDir);
+    } catch {
     }
+    return { status: "updated", version: newVersion };
   } catch (error) {
     if (info !== void 0) {
       try {
@@ -18121,10 +17948,9 @@ var init_update = __esm({
 
 // src/cli/commands/selfUpdate.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import os4 from "os";
 import path6 from "path";
 function registerSelfUpdateCommands(program2) {
-  const cmd = program2.command("self-update").description("update the CLI to the latest npm-published version").option("--check-only", "check for updates without downloading").option("--force", "force update even if already up to date");
+  const cmd = program2.command("self-update").description("update the CLI to the latest npm-published version").option("--check-only", "check for updates without installing").option("--force", "force update even if already up to date");
   addGlobalOptions(cmd).action(async (flags, command) => {
     await runSelfUpdate(flags, command);
   });
@@ -18173,73 +17999,45 @@ async function runSelfUpdate(flags, command) {
   }
   const oldVersion = VERSION;
   const newVersion = info.version;
-  const tarballBuffer = await downloadTarball(info.tarballUrl);
-  const tarballName = path6.basename(new URL(info.tarballUrl).pathname);
-  const install = installDir();
-  const stagingDir = path6.join(install, ".staging");
   if (ctx.dryRun) {
     printDryRunPlan({
       oldVersion,
       newVersion,
-      assetName: tarballName,
+      assetName: path6.basename(new URL(info.tarballUrl).pathname),
       downloadUrl: info.tarballUrl,
-      install,
-      stagingDir,
       json: mode.json
     });
     return;
   }
-  errLine(paint.dim(`Downloading ${tarballName}...`));
-  errLine(paint.dim("Extracting to staging..."));
-  const tmpTarball = path6.join(os4.tmpdir(), `pingcode-cli-${newVersion}.tgz`);
+  errLine(paint.dim(`Installing v${newVersion}...`));
   try {
-    writeBufferToFile(tmpTarball, tarballBuffer);
-    cleanStaging(stagingDir);
-    ensureDir(stagingDir);
-    extractTarball(tarballBuffer, stagingDir);
-    if (!validateStaging(stagingDir)) {
-      cleanStaging(stagingDir);
-      throw new TransportError(
-        "invalid tarball: dist/bin/pingcode.js not found"
-      );
-    }
-    errLine(paint.dim("Verifying..."));
-    const exec = (file, args) => String(execFileSync2(file, args, { encoding: "utf8" }));
-    verifyBundle(stagingDir, exec, newVersion);
-    errLine(paint.dim(`Installing v${newVersion}...`));
-    await atomicReplace(install, stagingDir);
-    const skillSource = path6.join(install, "skills", "pingcode");
-    if (dirExists(skillSource)) {
-      errLine(paint.dim("Syncing skills..."));
-      await syncSkills(skillSource, skillTargets());
-    }
-    let verified;
-    try {
-      verified = verifyBundle(install, exec, newVersion);
-    } catch (error) {
-      restoreBackup(install);
-      throw new TransportError(
-        `installed bundle failed verification: ${error instanceof Error ? error.message : String(error)}`,
-        {
-          hint: `restore manually: mv "${install}.backup" "${install}"`,
-          cause: error
-        }
-      );
-    }
-    removeFile(`${install}.backup`);
-    if (mode.json) {
-      printJson({
-        status: "updated",
-        previous_version: oldVersion,
-        new_version: verified
-      });
-    } else {
-      errLine(paint.green(`updated v${oldVersion} \u2192 v${verified}`));
+    await installViaNpm(cliExec, newVersion);
+  } catch (error) {
+    if (!mode.json) {
+      errLine(paint.red(`update failed: ${errorMessageOf(error)}`));
+      const hint = error instanceof TransportError ? error.hint : void 0;
+      if (hint !== void 0 && hint !== "") errLine(paint.dim(`  ${hint}`));
     }
-  } finally {
-    removeFile(tmpTarball);
+    throw error;
+  }
+  const skillSource = packageSkillDir();
+  if (dirExists(skillSource)) {
+    errLine(paint.dim("Syncing skills..."));
+    await syncSkills(skillSource, skillTargets());
+  }
+  if (mode.json) {
+    printJson({
+      status: "updated",
+      previous_version: oldVersion,
+      new_version: newVersion
+    });
+  } else {
+    errLine(paint.green(`updated v${oldVersion} \u2192 v${newVersion}`));
   }
 }
+function errorMessageOf(error) {
+  return error instanceof Error ? error.message : String(error);
+}
 function printCheckResult(check, json) {
   if (json) {
     printJson({
@@ -18272,8 +18070,6 @@ function printDryRunPlan(plan) {
       target_version: plan.newVersion,
       asset: plan.assetName,
       download_url: plan.downloadUrl,
-      install_dir: plan.install,
-      staging_dir: plan.stagingDir,
       skill_targets: skillTargets().map((t) => t.dir)
     });
     return;
@@ -18282,10 +18078,9 @@ function printDryRunPlan(plan) {
   errLine(`  current:  v${plan.oldVersion}`);
   errLine(`  target:   v${plan.newVersion}`);
   errLine(`  asset:    ${plan.assetName}`);
-  errLine(`  install:  ${plan.install}`);
-  errLine(`  staging:  ${plan.stagingDir}`);
   errLine(`  skills:   ${skillTargets().map((t) => t.dir).join(", ")}`);
 }
+var cliExec;
 var init_selfUpdate = __esm({
   "src/cli/commands/selfUpdate.ts"() {
     "use strict";
@@ -18293,11 +18088,11 @@ var init_selfUpdate = __esm({
     init_update_check();
     init_update();
     init_errors();
-    init_update();
     init_common();
     init_output();
     init_globals();
     init_paths();
+    cliExec = (file, args) => execFileSync2(file, args, { encoding: "utf8" });
   }
 });
 
@@ -18466,6 +18261,10 @@ var init_skill_ops = __esm({
 });
 
 // src/cli/commands/skill.ts
+import path8 from "path";
+function packageSkillRoot() {
+  return path8.dirname(path8.dirname(packageSkillDir()));
+}
 function registerSkillCommands(program2) {
   const skill = program2.command("skill").description("manage the pingcode skill across agent targets");
   skill.command("list").description("show where the skill is installed").action(async (flags) => {
@@ -18528,7 +18327,7 @@ async function runInstall(flags) {
   const { ctx } = contextFor(command);
   const mode = modeOf(ctx);
   const targets = resolveTargets(flags);
-  const sourceRoot = installDir();
+  const sourceRoot = packageSkillRoot();
   const results = installSkill(sourceRoot, targets, flags.force ?? false);
   renderResults(results, mode);
 }
@@ -18545,7 +18344,7 @@ async function runUpdate16(flags) {
   const { ctx } = contextFor(command);
   const mode = modeOf(ctx);
   const targets = resolveTargets(flags);
-  const sourceRoot = installDir();
+  const sourceRoot = packageSkillRoot();
   const results = installSkill(sourceRoot, targets, true);
   renderResults(results, mode);
 }
@@ -18604,6 +18403,7 @@ var init_skill = __esm({
   "src/cli/commands/skill.ts"() {
     "use strict";
     init_paths();
+    init_update();
     init_skill_ops();
     init_globals();
     init_output();
@@ -19081,11 +18881,11 @@ var init_libraries = __esm({
 
 // src/cli/commands/testhub/entries.ts
 async function readEntryFile(source, schema, hint) {
-  const path8 = source.file?.trim() ?? "";
-  if (path8 === "") {
+  const path9 = source.file?.trim() ?? "";
+  if (path9 === "") {
     throw new UsageError("--file <path|-> is required", { hint });
   }
-  const document = path8 === "-" ? await readJsonStdin() : parseJsonDocument(await readTextFile(path8, "--file"), `--file ${path8}`);
+  const document = path9 === "-" ? await readJsonStdin() : parseJsonDocument(await readTextFile(path9, "--file"), `--file ${path9}`);
   const list = unwrap2(document, schema.wrapperKey);
   if (list.length === 0) {
     throw new UsageError("--file contained no entries", {