Merge pull request #10 from tidbcloud/feat-updater-update

feat: make tdc updates user-owned and password-free

Author: Icemap

AGENTS.md

@@ -335,13 +335,19 @@ Follow these rules unless `docs/priciples.md` is updated:
 - `tdc update` may replace only tdc-owned archive/script installs. It must
   refuse local, unknown, Homebrew, Scoop, Winget, or other package-manager
   installs with actionable guidance.
-- Installer scripts prefer upgrading the active `tdc`/`tdc.exe` found on
-  `PATH` unless `--install-dir` or `TDC_INSTALL_DIR` overrides it. On
-  macOS/Linux, no active binary means defaulting to `/usr/local/bin` and using
-  `sudo` for directory creation or binary replacement when needed.
+- `tdc update` is itself explicit update intent and must not require `--yes`.
+  It downloads, extracts, verifies, stages, and replaces artifacts as the
+  current user and must never invoke sudo or another privilege escalation
+  mechanism.
+- Installer scripts default to the stable user-owned `~/.tdc/bin` directory on
+  macOS, Linux, and Windows unless `--install-dir`/`-InstallDir` or
+  `TDC_INSTALL_DIR` overrides it. They must not prefer or overwrite an active
+  system-level tdc found on PATH, invoke sudo, create system-directory
+  symlinks, or modify shell profile files automatically.
 - Installer scripts must detect PATH shadowing, bootstrap `~/.tdc/config` only
-  when missing, print DB and tdc fs region lists, and show clear next steps.
-  They must never write `~/.tdc/credentials`.
+  when missing, print the exact command that prepends `~/.tdc/bin` to PATH,
+  print DB and tdc fs region lists, and show clear next steps. They must never
+  write `~/.tdc/credentials`.
 
 ## Commands
 
@@ -358,8 +364,8 @@ Implemented command behavior:
 - `tdc update --check`
 - `tdc update --check --fail-if-update-available`
 - `tdc update --dry-run`
-- `tdc update --yes`
-- `tdc update --target-version v0.1.0 --yes`
+- `tdc update`
+- `tdc update --target-version v0.1.1`
 - `tdc organization list-projects`
 - `tdc organization list-projects --query 'projects[0].id'`
 - `tdc organization list-projects --output text`

README.md

@@ -11,14 +11,20 @@ macOS and Linux users:
 
 ```bash
 curl -fsSL https://github.com/tidbcloud/tdc/releases/latest/download/install.sh | sh -s -- --yes
+export PATH="$HOME/.tdc/bin:$PATH"
+tdc --version
 ```
 
+The installer writes `tdc` and `tdc-drive9` to `~/.tdc/bin` without sudo. Add the `export PATH=...` line to your shell profile to make it persistent.
+
 Windows users:
 
 ```powershell
 $script = "$env:TEMP\install-tdc.ps1"
 iwr https://github.com/tidbcloud/tdc/releases/latest/download/install.ps1 -OutFile $script
-powershell -ExecutionPolicy Bypass -File $script -InstallDir "$HOME\bin" -Yes
+powershell -ExecutionPolicy Bypass -File $script -Yes
+$env:Path = "$HOME\.tdc\bin;$env:Path"
+tdc --version
 ```
 
 ## Quick Start Guide
@@ -109,10 +115,12 @@ Each project includes a `type`: `tidbx` identifies a regular project and `tidbx_
 ```bash
 tdc update --check
 tdc update --dry-run
-tdc update --yes
-tdc update --target-version v0.1.0 --yes
+tdc update
+tdc update --target-version v0.1.1
 ```
 
+`tdc update` downloads and verifies both `tdc` and its `tdc-drive9` companion before replacing either binary in the user-writable install directory. It never requests sudo. Legacy installations under `/usr/local/bin` must run the installer once to migrate to `~/.tdc/bin`.
+
 ## Build from source
 
 Requirements:

docs/priciples.md

@@ -162,9 +162,13 @@ CLI v2 for TiDB Cloud \| Init Date: 2026\-05\-18 \|@Todd Bao
 
     - Update checks are explicit, for example `tdc update --check`\.
 
-    - Self\-update is explicit, for example `tdc update --yes`, and must
+    - Self\-update is explicit, for example `tdc update`, and must
       refuse package\-manager installs with actionable instructions\.
 
+    - Direct installers place binaries in the user\-owned `~/.tdc/bin`
+      directory\. Installation and update must not require sudo; users add
+      `export PATH="$HOME/.tdc/bin:$PATH"` to their shell environment\.
+
 5. `--output`
 
 6. `--query` / JMESPath** ** — Even with JSON, there is no way to extract a single field \(e\.g\., cluster ID from a create response\)\. The dev/agent must parse the entire response\. Provide `--query`  to remove noisy output and save tokens\. For `db` command, if SQL executions are designed in the future, it will use `--sql`, no conflicts here\.

docs/release-notes/v0.1.1.md

@@ -1,6 +1,6 @@
 # tdc v0.1.1
 
-This release adds configuration-free tdc fs access for ephemeral agent sandboxes. An existing file system can now be used without running `tdc configure` or providing TiDB Cloud API keys: supply `TDC_FS_TOKEN`, `TDC_REGION_CODE`, and `TDC_FS_FILE_SYSTEM_NAME`, then use the normal `tdc fs`, `tdc fs-git`, `tdc fs-journal`, and `tdc fs-vault` commands.
+This release adds configuration-free tdc fs access for ephemeral agent sandboxes and makes tdc installation and updates fully user-owned. An existing file system can be used without running `tdc configure` or providing TiDB Cloud API keys: supply `TDC_FS_TOKEN`, `TDC_REGION_CODE`, and `TDC_FS_FILE_SYSTEM_NAME`, then use the normal `tdc fs`, `tdc fs-git`, `tdc fs-journal`, and `tdc fs-vault` commands.
 
 ```bash
 export TDC_FS_TOKEN="drive9_..."
@@ -13,10 +13,17 @@ tdc fs mount-file-system --file-system-name workspace --mount-path ./workspace
 
 The release keeps environment-provided credentials in memory, preserves configured profile workflows, isolates companion runtime state per file system, and allows drain and unmount operations to locate a configuration-free mount without storing its FS token.
 
-Upgrade an existing archive or installer-managed `v0.1.0` installation with:
+On macOS and Linux, the installer now places `tdc` and `tdc-drive9` in `~/.tdc/bin`; Windows uses `%USERPROFILE%\.tdc\bin`. It does not use `sudo`, write to `/usr/local/bin`, or create system-level links. Add the user-owned directory to `PATH` after installation:
 
 ```bash
-tdc update --check
-tdc update --yes
+curl -fsSL https://github.com/tidbcloud/tdc/releases/latest/download/install.sh | sh -s -- --yes
+export PATH="$HOME/.tdc/bin:$PATH"
 tdc --version
 ```
+
+Once installed in the user-owned directory, `tdc update` verifies and replaces both bundled binaries without `--yes` or elevated privileges:
+
+```bash
+tdc update --check
+tdc update
+```

docs/spec/0020-homebrew-and-scoop-distribution.md

@@ -26,7 +26,7 @@ Existing `tdc` commands keep the same behavior:
 ```bash
 tdc update --check
 tdc update --dry-run
-tdc update --yes
+tdc update
 ```
 
 For Homebrew and Scoop installs, `tdc update` must not replace the binary. It returns `update.managed_install` with the correct package-manager command.
@@ -59,13 +59,13 @@ No user `~/.tdc/` config or credentials are required for package-manager install
 
 ## Output And Errors
 
-`tdc update --yes` from a Homebrew install:
+`tdc update` from a Homebrew install:
 
 ```text
 tdc [ERROR]: tdc is managed by homebrew; update it with `brew upgrade tidbcloud/tap/tdc`
 ```
 
-`tdc update --yes` from a Scoop install:
+`tdc update` from a Scoop install:
 
 ```text
 tdc [ERROR]: tdc is managed by scoop; update it with `scoop update tdc`
@@ -78,15 +78,17 @@ The structured error code remains `update.managed_install`.
 Users can choose between direct GitHub Releases installers and package-manager installs:
 
 ```bash
-curl -fsSL https://github.com/tidbcloud/tdc/releases/latest/download/install.sh | sh -s -- --install-dir "$HOME/.local/bin" --yes
+curl -fsSL https://github.com/tidbcloud/tdc/releases/latest/download/install.sh | sh -s -- --yes
+export PATH="$HOME/.tdc/bin:$PATH"
 brew install tidbcloud/tap/tdc
 ```
 
 Windows users can choose between the PowerShell installer and Scoop:
 
 ```powershell
 iwr https://github.com/tidbcloud/tdc/releases/latest/download/install.ps1 -OutFile $env:TEMP\install-tdc.ps1
-powershell -ExecutionPolicy Bypass -File $env:TEMP\install-tdc.ps1 -InstallDir "$HOME\bin" -Yes
+powershell -ExecutionPolicy Bypass -File $env:TEMP\install-tdc.ps1 -Yes
+$env:Path = "$HOME\.tdc\bin;$env:Path"
 scoop bucket add icemap https://github.com/tidbcloud/scoop-bucket
 scoop install tdc
 ```
@@ -153,7 +155,7 @@ Runtime update call chain from package-managed installs:
 - `scoop bucket add icemap https://github.com/tidbcloud/scoop-bucket` and `scoop install tdc` install `tdc.exe` on Windows.
 - `scoop update tdc` upgrades to a newer release.
 - `tdc update --check` works from Homebrew and Scoop installs.
-- `tdc update --yes` refuses Homebrew and Scoop installs with `update.managed_install`.
+- `tdc update` refuses Homebrew and Scoop installs with `update.managed_install`.
 - README documents Homebrew and Scoop as optional package-manager channels.
 
 ## Out Of Scope