feat(version): zcli upgrade self-updater + version checks

.github/workflows/main.yml

@@ -39,7 +39,7 @@ jobs:
           go-version-file: "go.mod"
 
       - name: test-integration
-        run: go test -v -tags devel ./src/cmd/...
+        run: go test -v ./src/cmd/...
 
   lint:
     name: lint

.golangci.yaml

@@ -95,6 +95,11 @@ linters:
       - linters: [staticcheck]
         path: src/cmdRunner/run.go
         text: "ST1005:"
+      # Integration tests marshal internal persisted structs (e.g.
+      # cliStorage.Data) to seed on-disk state. Those types intentionally rely
+      # on Go's default field-name JSON keys, so don't require explicit tags.
+      - linters: [musttag]
+        path: _test\.go$
 
 issues:
   max-same-issues: 0

.goreleaser.yaml

@@ -2,8 +2,16 @@ version: 2
 
 project_name: zcli
 
+# The channel ldflag stamps version.InstallMethod so `zcli upgrade` knows how
+# the running binary was installed. raw (GitHub release / install.sh) is the
+# only self-updatable channel; npm and deb refuse self-update and point at
+# their package manager. Path detection in src/version is only a fallback.
+#
+# raw and npm ship the same code but with different channel stamps, so they
+# need separate build entries even though they target the same platforms.
 builds:
-  - id: linux-amd64
+  # --- raw: direct download / install.sh, self-updatable (channel=manual) ---
+  - id: raw-linux-amd64
     main: ./cmd/zcli/main.go
     binary: zcli-linux-amd64
     goos: [linux]
@@ -12,9 +20,9 @@ builds:
       - CGO_ENABLED=0
     flags: [-trimpath]
     ldflags:
-      - -s -w -X github.com/zeropsio/zcli/src/version.version={{ .Tag }}
+      - -s -w -X github.com/zeropsio/zcli/src/version.version={{ .Tag }} -X github.com/zeropsio/zcli/src/version.channel=manual
 
-  - id: linux-386
+  - id: raw-linux-386
     main: ./cmd/zcli/main.go
     binary: zcli-linux-i386
     goos: [linux]
@@ -23,9 +31,9 @@ builds:
       - CGO_ENABLED=0
     flags: [-trimpath]
     ldflags:
-      - -s -w -X github.com/zeropsio/zcli/src/version.version={{ .Tag }}
+      - -s -w -X github.com/zeropsio/zcli/src/version.version={{ .Tag }} -X github.com/zeropsio/zcli/src/version.channel=manual
 
-  - id: darwin-amd64
+  - id: raw-darwin-amd64
     main: ./cmd/zcli/main.go
     binary: zcli-darwin-amd64
     goos: [darwin]
@@ -34,9 +42,9 @@ builds:
       - CGO_ENABLED=0
     flags: [-trimpath]
     ldflags:
-      - -s -w -X github.com/zeropsio/zcli/src/version.version={{ .Tag }}
+      - -s -w -X github.com/zeropsio/zcli/src/version.version={{ .Tag }} -X github.com/zeropsio/zcli/src/version.channel=manual
 
-  - id: darwin-arm64
+  - id: raw-darwin-arm64
     main: ./cmd/zcli/main.go
     binary: zcli-darwin-arm64
     goos: [darwin]
@@ -45,9 +53,9 @@ builds:
       - CGO_ENABLED=0
     flags: [-trimpath]
     ldflags:
-      - -s -w -X github.com/zeropsio/zcli/src/version.version={{ .Tag }}
+      - -s -w -X github.com/zeropsio/zcli/src/version.version={{ .Tag }} -X github.com/zeropsio/zcli/src/version.channel=manual
 
-  - id: windows-amd64
+  - id: raw-windows-amd64
     main: ./cmd/zcli/main.go
     binary: zcli-win-x64
     goos: [windows]
@@ -56,11 +64,68 @@ builds:
       - CGO_ENABLED=0
     flags: [-trimpath]
     ldflags:
-      - -s -w -X github.com/zeropsio/zcli/src/version.version={{ .Tag }}
+      - -s -w -X github.com/zeropsio/zcli/src/version.version={{ .Tag }} -X github.com/zeropsio/zcli/src/version.channel=manual
 
-  # Deb-only builds: binary is named "zcli" so the package installs
-  # /usr/local/bin/zcli rather than the arch-suffixed name the archives
-  # and npm wrapper rely on.
+  # --- npm: published as @zerops/zcli, refuses self-update (channel=npm) ---
+  - id: npm-linux-amd64
+    main: ./cmd/zcli/main.go
+    binary: zcli-linux-amd64
+    goos: [linux]
+    goarch: [amd64]
+    env:
+      - CGO_ENABLED=0
+    flags: [-trimpath]
+    ldflags:
+      - -s -w -X github.com/zeropsio/zcli/src/version.version={{ .Tag }} -X github.com/zeropsio/zcli/src/version.channel=npm
+
+  - id: npm-linux-386
+    main: ./cmd/zcli/main.go
+    binary: zcli-linux-i386
+    goos: [linux]
+    goarch: ["386"]
+    env:
+      - CGO_ENABLED=0
+    flags: [-trimpath]
+    ldflags:
+      - -s -w -X github.com/zeropsio/zcli/src/version.version={{ .Tag }} -X github.com/zeropsio/zcli/src/version.channel=npm
+
+  - id: npm-darwin-amd64
+    main: ./cmd/zcli/main.go
+    binary: zcli-darwin-amd64
+    goos: [darwin]
+    goarch: [amd64]
+    env:
+      - CGO_ENABLED=0
+    flags: [-trimpath]
+    ldflags:
+      - -s -w -X github.com/zeropsio/zcli/src/version.version={{ .Tag }} -X github.com/zeropsio/zcli/src/version.channel=npm
+
+  - id: npm-darwin-arm64
+    main: ./cmd/zcli/main.go
+    binary: zcli-darwin-arm64
+    goos: [darwin]
+    goarch: [arm64]
+    env:
+      - CGO_ENABLED=0
+    flags: [-trimpath]
+    ldflags:
+      - -s -w -X github.com/zeropsio/zcli/src/version.version={{ .Tag }} -X github.com/zeropsio/zcli/src/version.channel=npm
+
+  - id: npm-windows-amd64
+    main: ./cmd/zcli/main.go
+    binary: zcli-win-x64
+    goos: [windows]
+    goarch: [amd64]
+    env:
+      - CGO_ENABLED=0
+    flags: [-trimpath]
+    ldflags:
+      - -s -w -X github.com/zeropsio/zcli/src/version.version={{ .Tag }} -X github.com/zeropsio/zcli/src/version.channel=npm
+
+  # --- deb: dpkg-installed to /usr/local/bin/zcli, refuses self-update.
+  # binary is named "zcli" (not arch-suffixed) so the package installs a plain
+  # /usr/local/bin/zcli. channel=deb because that path is otherwise
+  # indistinguishable from a manual install.
   - id: deb-amd64
     main: ./cmd/zcli/main.go
     binary: zcli
@@ -70,7 +135,7 @@ builds:
       - CGO_ENABLED=0
     flags: [-trimpath]
     ldflags:
-      - -s -w -X github.com/zeropsio/zcli/src/version.version={{ .Tag }}
+      - -s -w -X github.com/zeropsio/zcli/src/version.version={{ .Tag }} -X github.com/zeropsio/zcli/src/version.channel=deb
 
   - id: deb-386
     main: ./cmd/zcli/main.go
@@ -81,11 +146,11 @@ builds:
       - CGO_ENABLED=0
     flags: [-trimpath]
     ldflags:
-      - -s -w -X github.com/zeropsio/zcli/src/version.version={{ .Tag }}
+      - -s -w -X github.com/zeropsio/zcli/src/version.version={{ .Tag }} -X github.com/zeropsio/zcli/src/version.channel=deb
 
 archives:
   - id: raw
-    ids: [linux-amd64, linux-386, darwin-amd64, darwin-arm64, windows-amd64]
+    ids: [raw-linux-amd64, raw-linux-386, raw-darwin-amd64, raw-darwin-arm64, raw-windows-amd64]
     formats: [binary]
     name_template: >-
       {{- if eq .Os "windows" -}}zcli-win-x64
@@ -94,7 +159,7 @@ archives:
       {{- end -}}
 
   - id: npm
-    ids: [linux-amd64, linux-386, darwin-amd64, darwin-arm64, windows-amd64]
+    ids: [npm-linux-amd64, npm-linux-386, npm-darwin-amd64, npm-darwin-arm64, npm-windows-amd64]
     formats: [tar.gz]
     wrap_in_directory: builds
     files:
@@ -117,6 +182,9 @@ nfpms:
     file_name_template: >-
       zcli_{{ .Tag }}_{{ if eq .Arch "386" }}i386{{ else }}{{ .Arch }}{{ end }}
 
+checksum:
+  name_template: "checksums.txt"
+
 release:
   mode: append
   prerelease: auto

CLAUDE.md

@@ -10,8 +10,8 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 - `make test` — runs `go test -v ./cmd/... ./src/...`. Run a single test with `go test -v -run TestName ./src/<pkg>/...`.
 - `make lint` — runs the pinned `./bin/golangci-lint` for darwin/arm64, linux/amd64, and windows/amd64. Config: `.golangci.yaml`.
-- `make build-dev` — build a dev binary for the host into `./bin/zcli` (build tag `devel`, debug-friendly via `-gcflags='all=-l -N'`, version injected from git).
-- `make all` — cross-builds dev binaries for windows-amd, linux-amd, darwin-amd, darwin-arm. Single-target builds: `make linux-amd` etc. All build targets share the `DEV_BUILD` recipe in the Makefile (version metadata, devel tag, gcflags).
+- `make build-dev` — build a dev binary for the host into `./bin/zcli` (debug-friendly via `-gcflags='all=-l -N'`, version injected from git).
+- `make all` — cross-builds dev binaries for windows-amd, linux-amd, darwin-amd, darwin-arm. Single-target builds: `make linux-amd` etc. All build targets share the `DEV_BUILD` recipe in the Makefile (version metadata, gcflags).
 - `make install` — production install into `~/.local/bin/zcli` (same path as the public `install.sh` script). Stripped/optimized, version from `git describe`, same flag set as `.goreleaser.yaml`.
 - `make install-dev` — installs to `$GOBIN` (or `$GOPATH/bin`) as `zcli-dev` so it sits with other Go dev tools and coexists on PATH with a production `zcli`.
 - `make goreleaser-check` / `make goreleaser-snapshot` — validate `.goreleaser.yaml` and dry-run a release build to `./dist`.

Makefile

@@ -22,7 +22,7 @@ DEV_INSTALL_DIR  := $(or $(shell go env GOBIN),$(shell go env GOPATH)/bin)
 # Dev-build version metadata (matches what tools/build.sh used to compose).
 DEV_VERSION := $(shell git rev-parse --abbrev-ref HEAD):$(shell git describe --tags 2>/dev/null)-($(shell git config --get user.name):<$(shell git config --get user.email)>)
 # -gcflags disables inlining and optimizations so the binary is dlv-friendly.
-DEV_BUILD := go build -tags devel \
+DEV_BUILD := go build \
 	-gcflags='all=-l -N' \
 	-ldflags='-X "github.com/zeropsio/zcli/src/version.version=$(DEV_VERSION)"'
 
@@ -44,8 +44,8 @@ help: ## Show this help.
 test: ## Run the full Go test suite.
 	go test -v ./cmd/... ./src/...
 
-test-integration: ## Run the integration test suite (devel build tag).
-	go test -v -tags devel ./src/cmd/...
+test-integration: ## Run just the in-process integration tests (src/cmd).
+	go test -v ./src/cmd/...
 
 # Lint each target GOOS in turn so platform-specific build tags get covered.
 lint: $(BIN)/.golangci-lint-$(GOLANGCI_LINT_VERSION) ## Run golangci-lint for darwin/arm64, linux/amd64, windows/amd64.
@@ -55,7 +55,7 @@ lint: $(BIN)/.golangci-lint-$(GOLANGCI_LINT_VERSION) ## Run golangci-lint for da
 
 ##@ Build
 
-build-dev: ## Build a dev binary for the host into ./bin/zcli (devel tag, no optimizations).
+build-dev: ## Build a dev binary for the host into ./bin/zcli (no optimizations, dlv-friendly).
 	$(DEV_BUILD) -o $(BIN)/zcli ./cmd/zcli
 
 all: windows-amd linux-amd darwin-amd darwin-arm ## Cross-build all dev targets.
@@ -79,7 +79,7 @@ install: ## Build a production zcli (stripped, optimized) and install it into ~/
 	$(PROD_BUILD) -o $(PROD_INSTALL_DIR)/zcli ./cmd/zcli
 	@echo "installed $(PROD_INSTALL_DIR)/zcli ($(PROD_VERSION))"
 
-install-dev: ## Build a dev zcli-dev (devel tag, debug-friendly) and install it into $GOBIN.
+install-dev: ## Build a dev zcli-dev (debug-friendly) and install it into $GOBIN.
 	$(DEV_BUILD) -o $(DEV_INSTALL_DIR)/zcli-dev ./cmd/zcli
 	@echo "installed $(DEV_INSTALL_DIR)/zcli-dev"
 

README.md

@@ -144,7 +144,7 @@ Common targets (run `make help` for the full list):
 
 | Target | What it does |
 |---|---|
-| `make build-dev` | Build `./bin/zcli` with the `devel` tag, no optimizations (dlv-friendly). |
+| `make build-dev` | Build `./bin/zcli` with no optimizations (dlv-friendly). |
 | `make install` | Build a production `zcli` and install to `~/.local/bin` (same path as `install.sh`). |
 | `make install-dev` | Install a `zcli-dev` binary into `$GOBIN` (or `$GOPATH/bin`). |
 | `make test` | Run the full Go test suite. |

go.mod

@@ -8,10 +8,12 @@ require (
 	github.com/charmbracelet/bubbles v0.20.0
 	github.com/charmbracelet/bubbletea v1.3.5
 	github.com/charmbracelet/lipgloss v1.1.0
+	github.com/charmbracelet/x/exp/teatest v0.0.0-20260511125431-fe5d686e0c99
 	github.com/golang/mock v1.6.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.3
 	github.com/mattn/go-isatty v0.0.20
+	github.com/minio/selfupdate v0.6.0
 	github.com/pkg/errors v0.9.1
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06
 	github.com/sirupsen/logrus v1.9.3
@@ -20,21 +22,22 @@ require (
 	github.com/spf13/viper v1.20.0
 	github.com/stretchr/testify v1.10.0
 	golang.org/x/exp v0.0.0-20240613232115-7f521ea00fb8
+	golang.org/x/mod v0.26.0
 	golang.org/x/term v0.28.0
 	golang.org/x/text v0.28.0
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
+	aead.dev/minisign v0.2.0 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/aymanbagabas/go-udiff v0.3.1 // indirect
 	github.com/charmbracelet/colorprofile v0.3.2 // indirect
 	github.com/charmbracelet/x/ansi v0.10.1 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
 	github.com/charmbracelet/x/exp/golden v0.0.0-20240815200342-61de596daa2b // indirect
-	github.com/charmbracelet/x/exp/teatest v0.0.0-20260511125431-fe5d686e0c99 // indirect
 	github.com/charmbracelet/x/term v0.2.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect