feat(cli): auto-update — nudge + tracebloc upgrade (F1)

[LukasWodka]

Fixes the stale-CLI problem (backlog F1): install once → never updated.

• Update-check nudge — after any command, a quiet once/day line when a newer release exists (cache in ~/.tracebloc, 2s network cap, best-effort). Silent on dev builds, off a terminal, in CI, or via TRACEBLOC_NO_UPDATE_CHECK.
• tracebloc upgrade — re-runs the verified installer (reuses cosign; upgrades CLI + environment together, no skew).
• 426 "too old" now points at tracebloc upgrade.

Not a silent auto-replace (surprise/latency/security/skew) — nudge + one-command apply, the gh/kubectl pattern. Tests: semver compare, cache, fetch (httptest), fresh/stale, skip gates. Catalog: 11-upgrade.golden.

🤖 Generated with Claude Code

---

Note

Medium Risk
upgrade shells out to curl|bash on Unix (trusted installer path, but still elevated user impact); update checks add outbound GitHub traffic on interactive release builds only.

Overview
Adds F1 stale-CLI handling: a best-effort update nudge after commands plus an explicit tracebloc upgrade path, without silent auto-replace.

main switches to ExecuteContextC so it knows which command ran, then calls MaybeNotifyUpdate on stderr (skipped after upgrade). The nudge checks GitHub’s latest release at most once per day (cached under ~/.tracebloc), with a 2s timeout; it stays quiet on dev builds, non-TTY, CI, or TRACEBLOC_NO_UPDATE_CHECK.

tracebloc upgrade on Linux/macOS re-runs the signed official installer via bash -o pipefail (CLI + secure environment stay aligned); on Windows it only prints the PowerShell install command because the running binary can’t replace itself.

HTTP 426 upgrade-required copy now points at tracebloc upgrade instead of generic release URLs. Copy catalog gains 11-upgrade.golden and home help lists upgrade.

^{Reviewed by Cursor Bugbot for commit ab10dc7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[shujaatTracebloc]

Pushed fixes for the 3 Bugbot findings (commit 63d43d4), plus merged latest develop:

1. Offline throttle broken — on a failed fetch, latestReleaseVersion fell back to the stale cache but never re-stamped CheckedAt, so every command re-hit the network and ate the 2s timeout while offline. Now re-stamps CheckedAt so the once-per-interval throttle holds.
2. Nudge after successful upgrade — the nudge used the running process's compile-time version (stale by design once upgrade swaps the binary). main now captures the executed command via ExecuteContextC and skips the nudge for upgrade.
3. upgrade broken on Windows — hardcoded bash i.sh, but Windows is a shipped platform (install.ps1, windows/* matrix) with no bash. Now branches on GOOS to run install.ps1 via PowerShell, matching the README's documented Windows install.

Added regression tests: offline-fetch throttle refresh, per-OS upgrade command, upgrade nudge-skip detector. Full internal/cli suite + go vet green locally.

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 63d43d4. Configure here.}

[shujaatTracebloc]

Round-2 fixes pushed (commit ab10dc7) — all 3 HIGH findings verified against scripts/install.ps1 and resolved:

1. Upgrade hid curl failures — Unix now runs bash -o pipefail -c …, so a failed curl fails the whole pipeline instead of the trailing bash exiting 0 on empty stdin.
   2 & 3. Windows self-upgrade can't work — confirmed install.ps1 is CLI-only and does Move-Item -Force onto the binary (Windows locks a running .exe). Proper Windows self-update is a separate feature, so rather than pretend, upgrade on Windows now prints the documented manual command to run in a fresh shell. Help/home/copy no longer promise CLI+environment parity on Windows.

Refactored the per-OS branch into upgradePlanFor(goos) (exec on Unix, guide on Windows) — testable on any host. Regenerated copy-catalog goldens. Full go test ./... + go vet + gofmt green locally.

Windows automatic self-upgrade (running-exe swap + Windows environment story) is worth its own ticket — happy to file it.