feat: add manual update commands

[flamerged]

Summary

• add manual sshshot update-check and sshshot update commands backed by npm version lookup
• add SwiftBar menu actions for manual update check/update with update logging
• clarify README/SECURITY wording that update checks are manual, not automatic

Verification

• yarn typecheck
• yarn test
• yarn lint
• yarn format:check
• yarn build
• node dist/index.js update-check

Summary by CodeRabbit

• New Features

  • Manual update-check command to query available updates
  • Update command to install the latest version globally
  • macOS menu-bar shows installed version, adds manual check/install actions, open update log, and notifies results
  • Update log created to track installation output

• Documentation

  • README and SECURITY clarified: no automatic checking/telemetry; npm registry contacted only when explicit update commands run

• Tests

  • Added unit and plugin tests for update behaviors and handlers

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 506df369-62bf-42c3-81b7-ca3b3b3e2eb6

📥 Commits

Reviewing files that changed from the base of the PR and between 2de2034 and 6603112.

📒 Files selected for processing (2)

• src/menubar.ts
• test/menubar.test.ts

---

📝 Walkthrough

Walkthrough

Adds npm update detection and installation: new src/update.ts with version comparison and npm calls, CLI commands update-check/update, SwiftBar plugin actions and notifications, tests for update logic and menubar behavior, and updated README/SECURITY text clarifying update-related network activity.

Changes

Package Update Check and Installation

Layer / File(s)	Summary
Update module: version comparison and npm integration src/update.ts, test/update.test.ts	Exports PACKAGE_NAME, UpdateStatus and types; compareVersions parses/compares semver (ignoring leading v and semantic-release placeholder), fetchLatestVersion runs npm view via injectable CommandRunner, checkForUpdate classifies status, formatUpdateCheck builds messages, and updateToLatest runs npm install -g ...@latest. Tests cover parsing, fetch, status, formatting, and install behavior.
CLI command wiring: update-check and update src/index.ts	Imports update helpers and wires update-check (prints formatted status; sets exit code when unavailable) and update (runs global install, propagates non-zero exit codes and prints follow-up instructions). Help text updated.
SwiftBar plugin: update menu items and notifications src/menubar.ts, test/menubar.test.ts	Plugin template adds UPDATE_LOG, notify() helper, and click-action handlers open-update-log, update-check, update that run sshshot subcommands, capture/redirect output, notify users, and refresh plugin after successful update. Utility menu shows installed version and exposes update actions. Tests verify wiring and the update handler's logging/notification flow.
Documentation: commands and security policy README.md, SECURITY.md	README documents sshshot update-check and sshshot update, menu items, and update-log access. SECURITY clarifies that contacting the public npm registry occurs only when those update commands are explicitly run.

Sequence Diagram

sequenceDiagram
  participant User
  participant CLI as sshshot CLI
  participant UpdateModule as update module
  participant NPM as npm registry

  User->>CLI: sshshot update-check
  CLI->>UpdateModule: checkForUpdate(currentVersion)
  UpdateModule->>NPM: npm view `@flamerged/sshshot` version --silent
  NPM-->>UpdateModule: latest version / error
  UpdateModule-->>CLI: UpdateCheckResult
  CLI-->>User: formatted status

  User->>CLI: sshshot update
  CLI->>UpdateModule: updateToLatest()
  UpdateModule->>NPM: npm install -g `@flamerged/sshshot`@latest
  NPM-->>UpdateModule: exit code
  UpdateModule-->>CLI: exit code
  CLI-->>User: follow-up instructions / exit code

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 I nibbled the changelog, found a clue,
A fresh release hop-steps into view,
From CLI to menu the update sings,
Logs and notifications, tidy things,
No secret pings—just npm when you cue.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 9.09% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat: add manual update commands' clearly and concisely summarizes the main change: introducing new update functionality via CLI commands. It is specific, directly related to the core changes across all modified files, and follows conventional commit conventions.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/manual-update-commands

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/menubar.ts`:
- Around line 169-186: The block that runs the update commands (currently using
{ ... } redirected to "$UPDATE_LOG") must be run in a subshell so its internal
exit does not terminate the surrounding script: change the brace block to a
subshell (use ( ... ) with the same redirection) so the internal exit only
affects the subshell, then capture its exit status into RC (RC=$? after the
subshell) and keep the subsequent notify calls (notify "Updated sshshot..." /
notify "Update failed...") and final exit "$RC" in the outer script; reference
the same symbols SSHSHOT, UPDATE_LOG, notify and RC when making this change.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 87140d49-b16c-4bcd-a090-081a801bc038

📥 Commits

Reviewing files that changed from the base of the PR and between f38130b and 2de2034.

📒 Files selected for processing (7)

• README.md
• SECURITY.md
• src/index.ts
• src/menubar.ts
• src/update.ts
• test/menubar.test.ts
• test/update.test.ts

[github-actions]

🎉 This PR is included in version 0.10.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀