feat(cli): ocx update — self-update to the latest published version

Add `ocx update` (src/update.ts): detects whether opencodex was installed via bun or npm
(from the running module path) and runs `bun add -g opencodex@latest` / `npm install -g
opencodex@latest`; a source checkout is told to `git pull` instead, and it's a no-op when
already current. The Release CI publishes the versions it fetches. Documented in the README
CLI list + docs CLI reference. Verified: tsc clean, source-checkout detection works, listed
in `ocx help`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: lidge-jun

README.md

@@ -111,6 +111,7 @@ ocx login <xai|anthropic|kimi> # OAuth login
 ocx logout <provider>          # remove a stored login
 ocx gui                        # open the web dashboard
 ocx service <install|start|stop|status|uninstall>   # run as a background service
+ocx update                     # update opencodex to the latest published version
 ```
 
 ## Configuration

docs-site/src/content/docs/reference/cli.md

@@ -88,6 +88,22 @@ ocx service status
 ocx service uninstall
 ```
 
+## Updating
+
+### `ocx update`
+
+Self-update opencodex to the latest version published on npm, using the package manager it was
+installed with (`bun add -g opencodex@latest` or `npm install -g opencodex@latest`). It detects a
+source checkout and tells you to `git pull && bun install` instead, and is a no-op if you're already
+on the newest version. Restart the proxy afterward (`ocx stop && ocx start`) to run the new build.
+
+```bash
+ocx update
+```
+
+New versions become available the moment the [Release workflow](https://github.com/lidge-jun/opencodex/actions/workflows/release.yml)
+publishes them to npm.
+
 ## Help
 
 `ocx help`, `ocx --help`, `ocx -h` — print usage and examples.

src/cli.ts

@@ -21,6 +21,7 @@ Usage:
   ocx status                  Check proxy server status
   ocx login <provider>        OAuth login (xai) — opens browser, stores token in ~/.opencodex/auth.json
   ocx logout <provider>       Remove a stored OAuth login
+  ocx update                  Update opencodex to the latest published version
   ocx help                    Show this help message
 
 Examples:
@@ -164,6 +165,11 @@ switch (command) {
   case "service":
     serviceCommand(args[1]);
     break;
+  case "update": {
+    const { runUpdate } = await import("./update");
+    runUpdate();
+    break;
+  }
   case "help":
   case "--help":
   case "-h":

src/update.ts

@@ -0,0 +1,64 @@
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+
+const PKG = "opencodex";
+const HERE = dirname(fileURLToPath(import.meta.url)); // .../opencodex/src
+
+type Installer = "bun" | "npm" | "source";
+
+/** Infer how opencodex is installed from the running module's path. */
+function detectInstall(): Installer {
+  if (!HERE.includes("node_modules")) return "source"; // a git checkout, not a global install
+  return HERE.includes(".bun") ? "bun" : "npm";
+}
+
+function currentVersion(): string {
+  try {
+    return (JSON.parse(readFileSync(join(HERE, "..", "package.json"), "utf8")).version as string) ?? "?";
+  } catch {
+    return "?";
+  }
+}
+
+/** Latest published version from the registry (best-effort; null if npm isn't available). */
+function latestVersion(): string | null {
+  const r = spawnSync("npm", ["view", PKG, "version"], { encoding: "utf8", timeout: 12000, windowsHide: true });
+  return r.status === 0 ? r.stdout.trim() : null;
+}
+
+/**
+ * `ocx update` — self-update opencodex to the latest published version, using the same package
+ * manager it was installed with (bun or npm global). A source checkout is told to `git pull` instead.
+ */
+export function runUpdate(): void {
+  const installer = detectInstall();
+  const current = currentVersion();
+  console.log(`opencodex v${current} (installed via ${installer})`);
+
+  if (installer === "source") {
+    console.log("Running from a source checkout — update with:  git pull && bun install");
+    return;
+  }
+
+  const latest = latestVersion();
+  if (latest && latest === current) {
+    console.log(`Already on the latest version (v${latest}).`);
+    return;
+  }
+
+  const bin = installer === "bun" ? "bun" : "npm";
+  const cmdArgs = installer === "bun"
+    ? ["add", "-g", `${PKG}@latest`]
+    : ["install", "-g", `${PKG}@latest`];
+  console.log(`Updating${latest ? ` to v${latest}` : ""}…\n$ ${bin} ${cmdArgs.join(" ")}`);
+
+  const r = spawnSync(bin, cmdArgs, { stdio: "inherit", timeout: 180000, windowsHide: true });
+  if (r.status === 0) {
+    console.log(`\n✅ Updated${latest ? ` to v${latest}` : ""}. Restart the proxy:  ocx stop && ocx start`);
+  } else {
+    console.error(`\n⚠️  Update failed (${bin} exit ${r.status ?? "?"}). Try manually:  ${bin} ${cmdArgs.join(" ")}`);
+    process.exit(1);
+  }
+}