cb943c66c4
Definitions and the application were two separate acts with two different mechanisms, and only one of them had a command. `hound update` now does both: sudo hound update definitions, then offer the app sudo hound update -y both, unattended hound update --check what is available, install nothing sudo hound update --definitions-only Definitions run first and independently: a release check that fails — laptop offline, host down — is a warning, not a failed command. The definitions half is what matters between releases and it either worked or it did not, regardless of what the manifest server did. The app half prompts unless given --yes, because definitions are verified before they are parsed while replacing the running binary is a larger step. Non-interactive callers never block on a read: they are told to pass --yes and exit cleanly. `release.check` is classified read-only, so any member of the `hound` group can ask whether they are current — it changes nothing and reveals nothing the website does not. Installing still requires root and says so. Verified end to end on a real machine: a 0.1.1 install discovered 0.1.2, verified the signed manifest, checked the SHA-256, staged it root-owned and installed it through apt, unattended. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| src | ||
| Cargo.toml | ||