fix(cli): update the active standalone binary

[kjgbot]

Summary

• Detect the active Bun-compiled installation by resolving process.execPath through standalone launcher paths.
• Download and validate the matching release asset before atomically replacing the resolved target.
• Verify standalone and npm-installed CLI versions before reporting success, using shell-free argv execution for version probes.
• Keep installer failures credential-safe and provide install-method-specific remediation.

The previous update command always ran npm install globally, even when PATH resolved to a standalone binary, and trusted the installer exit code without checking the active CLI version. Standalone users now update the binary their launcher actually executes; mismatched downloaded or installed versions fail instead of reporting false success.

Fixes #1336

Test Plan

• Tests added/updated: core and bootstrap suites pass (70 tests).
• Manual testing completed: full monorepo typecheck, CLI typecheck, ESLint, Prettier, and diff checks pass; v10.6.4 standalone release asset names were verified.

Screenshots

Not applicable; CLI maintenance behavior only.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d220a6af-9864-41d4-bf1c-008eb388ea1d

📥 Commits

Reviewing files that changed from the base of the PR and between b2e604e and 6a02016.

📒 Files selected for processing (3)

• packages/cli/src/cli/commands/core.test.ts
• packages/cli/src/cli/commands/core.ts
• packages/cli/src/cli/lib/core-maintenance.ts

🚧 Files skipped from review as they are similar to previous changes (3)

• packages/cli/src/cli/commands/core.ts
• packages/cli/src/cli/commands/core.test.ts
• packages/cli/src/cli/lib/core-maintenance.ts

---

📝 Walkthrough

Walkthrough

agent-relay update now detects standalone installations, replaces the active binary atomically, verifies the resulting CLI version, and falls back to verified npm updates when appropriate. Tests cover successful and failed updates, version mismatches, path resolution, and secret-safe error output.

Changes

Verified CLI updates

Layer / File(s)	Summary
Executable resolution and version verification packages/cli/src/cli/commands/core.ts, packages/cli/src/cli/lib/core-maintenance.ts	Filesystem and command abstractions now support real-path resolution and argv-safe version checks; update helpers detect standalone binaries and compare CLI versions.
Standalone and npm update mechanisms packages/cli/src/cli/lib/core-maintenance.ts	Standalone assets are downloaded, verified, and atomically swapped; npm updates install the latest package and verify the installed CLI version.
Command routing, failure handling, and validation packages/cli/src/cli/lib/core-maintenance.ts, packages/cli/src/cli/commands/core.test.ts, CHANGELOG.md	The command selects the active installation method, reports remediation after failures, suppresses sensitive output, and documents the corrected behavior with expanded tests.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant runUpdateCommand
  participant UpdateTarget
  participant CLI
  User->>runUpdateCommand: request update
  runUpdateCommand->>UpdateTarget: detect standalone or npm installation
  UpdateTarget->>CLI: install or replace target
  runUpdateCommand->>CLI: request --version
  CLI-->>runUpdateCommand: return installed version
  runUpdateCommand-->>User: report success or remediation

Loading

Suggested labels: size:L

Suggested reviewers: khaliqgant, willwashburn

Poem

A rabbit watched the binary hop,
No silent npm copy could make it stop.
It swapped the file and checked the tune,
Then verified the version under the moon.
“Success,” it twitched, “the right one grew!”

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main standalone-binary update fix.
Description check	✅ Passed	The description follows the template with summary, test plan, and screenshots sections filled in.
Linked Issues check	✅ Passed	The changes address #1336 by detecting standalone installs, updating the active binary, and verifying the post-update version.
Out of Scope Changes check	✅ Passed	The changelog, tests, and dependency updates all support the update fix and no unrelated work is evident.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/standalone-cli-update

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/cli/src/cli/lib/core-maintenance.ts`:
- Around line 302-307: Update the installer output handling around the
stdout/stderr logging branches and the corresponding lines near the later output
replay so raw captured output is not emitted before version verification
completes. Suppress or sanitize both streams while preserving credential-safe
failure behavior, and ensure no installer output is replayed if verification
fails.
- Around line 292-293: Update npmCliVersionCommand and its caller to use
argv-based execution via spawn or execFile instead of constructing a
shell-quoted command string, preserving the existing version verification
behavior on all platforms. Remove the POSIX quoting dependency from this path
and add a test covering Windows executable/script paths.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 42ade2d4-9be9-45d3-aae3-eef911fda62f

📥 Commits

Reviewing files that changed from the base of the PR and between d4f0822 and 3a7333e.

📒 Files selected for processing (4)

• CHANGELOG.md
• packages/cli/src/cli/commands/core.test.ts
• packages/cli/src/cli/commands/core.ts
• packages/cli/src/cli/lib/core-maintenance.ts

[kjgbot]

ar-relay-review adversarial review — APPROVED ✅

Full diff read line-by-line. All checklist items pass.

Key verifications:

• Install method detection: npm path (node execPath, no Bun marker) → null → npm update. Bun standalone (hasBunMarker or execName=agent-relay in known path) → binary replacement. ✅
• Launcher resolution: safeRealpath via realpathSync mock tested with launcher→target mapping. ✅
• Same-filesystem atomic replace: temp file in path.dirname(targetPath), mv -f is rename(2). ✅
• Pre-mv version check: download→chmod→readCliVersion(tmp)→assertUpdatedVersion before mv. Test asserts mv not called on version mismatch. ✅
• Post-mv version from installed binary: readCliVersion(shellQuote(targetPath) + ' --version') — runs the replaced binary. Regression test: tmp=2.0.0, target=1.2.3 after mv → exit 1. ✅
• npm false-success bug fixed: updateNpmInstall also calls readCliVersion after install. ✅
• No credential reflection: raw error suppressed, test asserts 'registry token' and '/tmp/private' absent from all output. ✅
• shellQuote: correct POSIX quoting. ✅
• Temp cleanup in finally: existsSync guard handles both 'mv succeeded' and 'pre-mv failure' paths. ✅
• 5 new/updated tests cover all critical paths. ✅
• CHANGELOG: [Unreleased - Patch] / Fixed. ✅
• Branch fix/standalone-cli-update off main. ✅

Minor non-blocking findings:

1. standaloneAssetName() uses process.platform/arch directly — correct, guarded by it.runIf
2. looksLikeStandaloneExecutable may trigger for a custom binary named agent-relay in a known path without Bun marker — low real-world risk
3. safeRealpath catch fallback not directly tested — defensive, works correctly

Ready for merge.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/cli/src/cli/commands/core.ts`:
- Around line 225-231: Update execFileCommand to enforce a finite timeout when
invoking execFileAsync, so readCliVersion cannot block indefinitely during
agent-relay update. Preserve the existing stdout and stderr normalization while
configuring the timeout through the child-process execution options.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5bf31268-6e58-465d-aaea-945acb228ad6

📥 Commits

Reviewing files that changed from the base of the PR and between 3a7333e and b2e604e.

📒 Files selected for processing (3)

• packages/cli/src/cli/commands/core.test.ts
• packages/cli/src/cli/commands/core.ts
• packages/cli/src/cli/lib/core-maintenance.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• packages/cli/src/cli/lib/core-maintenance.ts