fix: auto-updates

cmd/server/server.go

@@ -232,6 +232,7 @@ func runServer() {
 	meta.Register(api, mods)
 	meta.RegisterHealth(api, sessions)
 	meta.RegisterWhoami(api, sessions, roles, mods)
+	meta.RegisterUpdate(api)
 
 	auth.RegisterLogin(api, sessions, auditStore, cfg.SecureCookie())
 	auth.RegisterLogout(api, sessions, cfg.SecureCookie())

cmd/server/service.go

@@ -425,7 +425,8 @@ Usage:
   nadir token add <name>            Mint a machine credential (Bearer token), shown once
   nadir token rm <name>             Revoke a token (effective immediately, no restart)
   nadir token ls                    List token names and when they were created
-  nadir update                      Fetch the latest release from server.release_repo and restart
+  nadir update [--check|--force]    Fetch the latest release from server.release_repo and restart
+                                    (--check: report only; --force: re-download when already current)
   nadir help                        Show this help
 
 Most commands need root. Config path is specified via -f/--config or CONFIG_PATH (default ~/.config/config.yaml).

cmd/server/update.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"encoding/json"
+	"flag"
 	"fmt"
 	"io"
 	"net/http"
@@ -12,6 +13,7 @@ import (
 	"strings"
 	"time"
 
+	"nadir"
 	"nadir/internal/config"
 )
 
@@ -19,7 +21,12 @@ import (
 // releases/latest, pick the asset for the host's GOARCH, atomically replace
 // /usr/local/bin/nadir (or wherever the running binary lives), and restart
 // the systemd unit so the new code takes effect.
-func updateCmd(_ []string) error {
+func updateCmd(args []string) error {
+	fs := flag.NewFlagSet("update", flag.ExitOnError)
+	check := fs.Bool("check", false, "report the latest version without downloading")
+	force := fs.Bool("force", false, "re-download even when already at the latest version")
+	fs.Parse(args)
+
 	configPath, err := resolveConfigPath()
 	if err != nil {
 		return err
@@ -44,6 +51,21 @@ func updateCmd(_ []string) error {
 		return err
 	}
 
+	fmt.Printf("current: %s\nlatest:  %s\n", nadir.Version, rel.TagName)
+	upToDate := nadir.Version == rel.TagName
+	switch {
+	case *check:
+		if upToDate {
+			fmt.Println("already up to date.")
+		} else {
+			fmt.Println("update available; run `nadir update` to install.")
+		}
+		return nil
+	case upToDate && !*force:
+		fmt.Println("already up to date; pass --force to re-download.")
+		return nil
+	}
+
 	var assetURL, assetName string
 	for _, a := range rel.Assets {
 		if strings.HasSuffix(a.Name, suffix) {