fix(cli): make logicsrc update actually check for updates

[ralyodio]

The bug

$ logicsrc update
Current version: 0.1.0
Latest version: 0.1.0
LogicSRC CLI is already up to date.

That was the only output the command could produce. It was three hardcoded console.log lines in packages/cli/src/index.ts — no check, no install, no network call. program.version("0.1.0") was hardcoded the same way.

Why a version check alone wouldn't fix it

install.sh installs a tarball of the master branch, not a tagged release. packages/cli/package.json has been 0.1.0 since the repo began (0 tags, 0 releases) while master gets commits continuously. Comparing versions would report "up to date" forever, no matter how far master had moved. The commit is the real signal.

Changes

• install.sh writes $LOGICSRC_HOME/install.json (ref, commit, version, installed_at). Without a record of what was installed, the CLI can only guess it is current. The sha comes from GitHub's Accept: application/vnd.github.sha media type, which returns bare text — no jq dependency. Resolved before the download deliberately: if master moves mid-install we under-report (a spurious update offer, self-correcting) rather than falsely claim currency.
• packages/cli/src/update.ts (new) — commit/version resolution with the decision logic kept pure and network I/O in thin wrappers, so it's testable without hitting GitHub.
• update compares installed commit vs remote ref head, falls back to version comparison for pre-manifest installs, and reports why it reached its verdict. --check reports without installing; otherwise it re-runs the installer.
• --version reads the real package version.

Verification

Live against GitHub, all three states:

state	output
manifest at current master	already up to date — installed from the current commit
manifest at stale sha	Update available — the tracked branch has moved on (0000000 → cf475f0)
no manifest (every install today)	Update available — this install predates update tracking…

30 tests pass in packages/cli (10 new), npm run build:cli clean, sh -n clean on the installer, written manifest round-trips as valid JSON.

Found but not fixed here

• remove / uninstall is the same kind of stub, and worse — it prints Removed LogicSRC CLI. while deleting nothing, so anyone running it believes their install is gone. install.sh already has a working do_uninstall to wire it to.
• scripts/install.sh prints Installed: commandboard (latest) — looks like a stale copy from another product. The installer actually served at logicsrc.com is apps/logicsrc-web/public/install.sh, the one changed here.

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.